如何修复 thix 批处理脚本

Question

您好，我的脚本有问题，我想从该脚本中获得以下内容。首先，我想创建一个文件夹，其中包含特定于我的计算机的月份，并在该文件夹中记录事件日志，但即使脚本以管理员权限运行也没有任何安全性，但仅保存应用程序事件和系统事件。下面是我的脚本

@echo off
rem Script starts here
rem Timestamp Generator
for /f "delims=" %%a in ('wmic OS Get localdatetime  ^| find "."') do set "dt=%%a"
:: Format the WMIC command output in YY_MM_DD_hr_mn format
set "YY=%dt:~0,4%"
set "MM=%dt:~4,2%"
set "DD=%dt:~6,2%"
set "hr=%dt:~8,2%"
set "mn=%dt:~10,2%"
:: Format the MM (month-number) to display the month-name
if %MM%==01 set MM=Ianuarie
if %MM%==02 set MM=Februarie
if %MM%==03 set MM=Martie
if %MM%==04 set MM=Aprilie
if %MM%==05 set MM=Mai
if %MM%==06 set MM=Iunie
if %MM%==07 set MM=Iulie
if %MM%==08 set MM=August
if %MM%==09 set MM=Septembrie
if %MM%==10 set MM=Octombrie
if %MM%==11 set MM=Noiembrie
if %MM%==12 set MM=Decembrie
set "today_date_time=%MM%_%YY%"
echo %today_date_time%
mkdir .\%today_date_time%
rem Set the timestamp format
wevtutil epl System %MM%_%YY%\system.evtx
wevtutil epl Application %MM%_%YY%\application.evtx
wevtutil epl Security %MM%_%YY%\security.evtx
wmic nteventlog where filename='system' cleareventlog
wmic nteventlog where filename='application' cleareventlog
wmic nteventlog where filename='security' cleareventlog
rem End of Script

Answer 1

根据您的评论请求，这是一个没有所有 WMIC.exe 内容的重写示例：

@Rem Start of script.
@Echo Off
SetLocal EnableExtensions
Rem End script if end user is not running with the required permissions.
%SystemRoot%\System32\reg.exe Query "HKU\S-1-5-19" 1>NUL 2>&1 || GoTo :EOF
Rem Add the current directory to the stack and make this scripts location the current directory.
PushD "%~dp0."
Rem Generate a datestamp variable with a string formatted as yy_MMMM.
Set "DateStamp="
For /F %%G In ('%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile "Get-Date -F 'yy_MMMM'" 2^>NUL') Do Set "DateStamp=%%G"
Rem End script if datestamp variable was not defined.
If Not Defined DateStamp GoTo :EOF
Rem Backup and clear event logs.
If Not Exist "%DateStamp%\" MD "%DateStamp%"
For %%G In (Application Security System) Do %SystemRoot%\System32\wevtutil.exe cl %%G /bu:"%DateStamp%\%%G.evtx"
Rem Make the previous directory in the stack the current directory.
PopD
Rem End of Script.

如果最终用户没有以管理员身份运行，则该脚本被设计为关闭。备份文件也将保存到与正在运行的批处理文件相同的位置。