query on Win32_NTLogEvent WHERE Logfile = 'Security' works only on remote machine

Question

I've have a problem using the code below to retrieve data from the security log event of my local machine. I tested on various computers: the local machine is a windows xp sp3. The query has no error but it returns 0 record. For remote machines it works perfectly Anyone can give me a solution? This is the code:

using System;
using System.Management;
using System.Windows.Forms;

namespace WMISample
{
    public class MyWMIQuery
    {
        public static void Main()
        {
            try
            {
                string[] arrComputers = {".","clientN"};
                foreach (string strComputer in arrComputers)
                {
                    Console.WriteLine("==========================================");
                    Console.WriteLine("Computer: " + strComputer);
                    Console.WriteLine("==========================================");

                    ManagementObjectSearcher searcher = 
                        new ManagementObjectSearcher(
                        "\\\\" + strComputer + "\\root\\CIMV2", 
                        "SELECT * FROM Win32_NTLogEvent WHERE Logfile = 'Security'"); 

                    foreach (ManagementObject queryObj in searcher.Get())
                    {
                        Console.WriteLine("-----------------------------------");
                        Console.WriteLine("Win32_NTLogEvent instance");
                        Console.WriteLine("-----------------------------------");
                        Console.WriteLine("RecordNumber: {0}", queryObj["RecordNumber"]);
                        Console.WriteLine("SourceName: {0}", queryObj["SourceName"]);
                        Console.WriteLine("TimeGenerated: {0}", queryObj["TimeGenerated"]);
                    }
                }
            }
            catch(ManagementException err)
            {
                MessageBox.Show("An error occurred while querying for WMI data: " + err.Message);
            }
        }
    }
}

---

I understood that using the impersonation level for the wmi query in vbs it works.

    Set objWMI = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate,(Security)}!\\" _
& strComputer & "\root\cimv2")
Set colLoggedEvents = objWMI.ExecQuery _
("Select * from Win32_NTLogEvent Where Logfile = 'Security'" )

So I have to translate in c#.

Answer 1

Ok so I close this Question using my code. the code is:

     using System; 
        using System.Management; 
        namespace WMISample 
        {  
            public class MyWMIQuery 
            { 
                public static void Main() 
                { 
                    try 
                    { 
                        ConnectionOptions oConn = new ConnectionOptions();
                        oConn.Impersonation = ImpersonationLevel.Impersonate;
                        oConn.EnablePrivileges = true;

                        string[] arrComputers = {".","clientN"}; 
                        foreach (string strComputer in arrComputers) 
                        { 
                            Console.WriteLine("=========================================="); 
                            Console.WriteLine("Computer: " + strComputer); 
                            Console.WriteLine("=========================================="); 
                            ManagementObjectSearcher searcher = new ManagementObjectSearcher
                            (
                               new ManagementScope("\\\\" + strComputer + "\\root\\CIMV2",  oConn),
                               new ObjectQuery( @"SELECT * FROM Win32_NTLogEvent WHERE Logfile = 'Security'")
                            );


                            foreach (ManagementObject queryObj in searcher.Get()) 
                            { 
                                Console.WriteLine("-----------------------------------"); 
                                Console.WriteLine("Win32_NTLogEvent instance"); 
                                Console.WriteLine("-----------------------------------"); 
                                Console.WriteLine("RecordNumber: {0}", queryObj["RecordNumber"]); 
                                Console.WriteLine("SourceName: {0}", queryObj["SourceName"]); 
                                Console.WriteLine("TimeGenerated: {0}", queryObj["TimeGenerated"]); 
                            } 
                        } 
                    } 
                    catch(ManagementException err) 
                    { 
                        MessageBox.Show("An error occurred while querying for WMI data: " + err.Message); 
                    } 
                } 
            } 
        } 

---

Answer 2

try using the local computername instead of ".". so, instead of

string[] arrComputers = {".","clientN"};

you would have

string[] arrComputers = { Environment.GetEnvironmentVariable("computername"), "clientN" };