I'm trying to run a script the pulls event viewer ".evt" files from remote computers.

Here's the code:

Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate,(Backup)}!\\" & _
strComputer & "\root\cimv2")
Set colLogFiles = objWMIService.ExecQuery _
("Select * from Win32_NTEventLogFile " _
& "Where LogFileName='Application'")
For Each objLogfile in colLogFiles
errBackupLog = objLogFile.BackupEventLog( _
dest & "el-app-" & node & ".evt")
Next

When I run this for a group of computers, it only gets the .evt files for the local computer that the script is run on. I need to be able to pull .evt files from all the computers.

From reading similar posts, I'm thinking that this is because all these computers are on the default "Workgroup", and not on a domain.

Can't impersonation work on "Workgroup"? If not, what are my options for getting remote Event Viewer .evt files, because I have no control over the setup - these computers will only ever be on Workgroup.

Thanks,

David