code:

---

$COMPUTER="server"

	$getobj=GetObject("winmgmts:{impersonationLevel=impersonate}!//$COMPUTER")
	$errmsg=$getobj.ExecQuery("Select * From Win32_NTLogEvent Where EventIdentifier='2140'")

	For each $event in $errmsg
		$message=$event.message
		$ec	=$event.EventIdentifier
		$time	=$event.TimeGenerated
		$year 	=substr("$time",1,4)	$hour=substr("$time",9,2)
		$month	=substr("$time",5,2)	$min =substr("$time",11,2)
		$day  	=substr("$time",7,2)	$sec =substr("$time",13,2)

		? "$ec	$month/$day/$year	$hour:$min:$sec"
		? $Message
		?
		next

---