#include 'date.au3'
$QueryDate = "12.11.2012"
$dtmStartDate=StringRegExpReplace($QueryDate, _
'(\d{2}).(\d{2}).(\d{4})', '\3\2\1')&'000000.000000+180'
$dtmEndDate=StringReplace(_DateAdd('D', 1, StringRegExpReplace($QueryDate, _
'(\d{2}).(\d{2}).(\d{4})', '\3/\2/\1')), '/', '')&'000000.000000+180'
$strResult =''
$objService = ObjGet("WinMgmts:\\.\Root\CIMV2")
$colEvents = $objService.ExecQuery _
("SELECT * FROM Win32_NTLogEvent WHERE logfile='security' and TimeWritten >= '" _
& $dtmStartDate & "' and TimeWritten < '" & $dtmEndDate & "'")
For $objEvent In $colEvents
$strResult &=$objEvent.Type&','&StringRegExpReplace($objEvent.TimeWritten, _
'(\d{4})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2}).*','\3.\2.\1,\4:\5:\6')&','&','&$objEvent.SourceName& _
','& $objEvent.Category&','&$objEvent.Message&','&$objEvent.EventCode &','& $objEvent.User & _
','& $objEvent.ComputerName & @CRLF
Next
FileWrite(@ScriptDir&'\123.csv',$strResult)