This VBS script will allow you to enter a remote workstation name from an input dialog box and return the machines System Restore information to an Excel spreadsheet. It will include all but the System Checkpoints which are created by the system. It will return the sequence number, the description, creation time date stamp and the event type.
VBS Script:
strComputer = InputBox ("Enter Machine Name")
Set objExcel = CreateObject("Excel.Application")
objExcel.Visible = True
objExcel.Workbooks.Add
intRow = 2
objExcel.Cells(1, 1).Value = "Sequence Number"
objExcel.Cells(1, 2).Value = "Description"
objExcel.Cells(1, 3).Value = "Creation Time"
objExcel.Cells(1, 4).Value = "Event Type"
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\Default")
Set colItems = objWMIService.ExecQuery("Select * from SystemRestore Where Description <> 'System Checkpoint'")
For Each objItem in colItems
objExcel.Cells(intRow, 1).Value = objItem.SequenceNumber
objExcel.Cells(intRow, 2).Value = objItem.Description
objExcel.Cells(intRow, 3).Value = ConvWbemTime(objItem.CreationTime)
If objItem.EventType = 100 Then
objExcel.Cells(intRow, 4).Value = "Begin System Change"
ElseIf objItem.EventType = 101 Then
objExcel.Cells(intRow, 4).Value = "End System Change"
ElseIf objItem.EventType = 102 Then
objExcel.Cells(intRow, 4).Value = "Begin Nested System Change"
ElseIf objItem.EventType = 103 Then
objExcel.Cells(intRow, 4).Value = "End Nested System Change"
End If
intRow = intRow + 1
Next
Function ConvWbemTime(IntervalFormat)
sMonth = mid(IntervalFormat,5,2)
sDay = mid(IntervalFormat,7,2)
sYear = mid(IntervalFormat,1,4)
ConvWbemTime = sMonth & "-" & sDay & "-" & sYear
End Function
objExcel.Range("A1:D1").Select
objExcel.Selection.Interior.ColorIndex = 19
objExcel.Selection.Font.ColorIndex = 11
objExcel.Selection.Font.Bold = True
objExcel.Cells.EntireColumn.AutoFit
MsgBox "Done"
Additional Information From Microsoft:
“System Restore monitors system changes and saves the system state as a restore point. If a system problem develops as a result of a system change, the user can return the system to a previous state using the data from a restore point....Applications and the system can create restore points when system changes occur....System Restore does not restore user data or documents, so it will not cause users to lose their files, e-mail, browsing history, or favorites. System Restore is also made available to users in safe mode, making it easier for them to restore their computers to a state before problems occurred.”
No Comments