strComputer = "XXXXXX"

Const ForReading = 1, ForWriting = 2, ForAppending = 8
Set fso = CreateObject("Scripting.FileSystemObject")

sCurPath = fso.GetAbsolutePathName(".")

Set FLog = FSO.CreateTextFile(sCurPath&"\ip.txt")

Set objWMIService = GetObject("winmgmts:" _
 & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")

'Get time one hour ago
dtmCurrentDate = DateAdd("h", -1, now)

'Format time
dtmTargetDate = Year(dtmCurrentDate)
dtmMonth = Month(dtmCurrentDate)
If Len(dtmMonth) = 1 Then
 dtmMonth = "0" & dtmMonth
End If
dtmTargetDate = dtmTargetDate & dtmMonth
dtmDay = Day(dtmCurrentDate)
If Len(dtmDay) = 1 Then
 dtmDay = "0" & dtmDay
End If
dtmTargetDate = dtmTargetDate & dtmDay
dtmHour = Hour(dtmCurrentDate)
If Len(dtmHour) = 1 Then
 dtmHour = "0" & dtmHour
End If
dtmTargetDate = dtmTargetDate & dtmHour
dtmTargetDate = dtmTargetDate & "0000.000000"
dtmTargetDate = dtmTargetDate & chr(43) & Cstr(120)

'search all EventID 672 occuring one hour ago
Set colLoggedEvents = objWMIService.ExecQuery _
 ("SELECT * FROM Win32_NTLogEvent WHERE Logfile = 'Security' AND EventCode = '672' AND TimeWritten >='"&dtmTargetDate&"'")
For Each objEvent in colLoggedEvents
'parse the Message IP is between Client Adress and Certificate Issuer Name
   message = objEvent.Message
   message1 = split(message,"Client Address:")
   messagef = split(message1(1),"Certificate Issuer Name:")
   FLog.Writeline (messagef(0))
Next
msgbox "View all IPs in ip.txt, now lets count occurences"
FLog.close

Set df1 = fso.OpenTextFile(sCurPath&"\ip.txt",ForReading,True)
Set FLog2 = fso.CreateTextFile(sCurPath&"\result.csv")

Dim IPCOUNT(80000,2)

'Initialize counting table
for j=0 to 80000
IPCOUNT(j,0) = "0"
IPCOUNT(j,1) = 0
Next
'read lines of ip.txt and save result in table, if a new IP is discovered a new column is filled in with IP otherwise counter is increased by one
Do while Not df1.AtEndOfStream
IPTST = df1.readline()
marque = "non"
   if IPTST <> "" then
   i=0
      Do While IPCOUNT(i,0) <> "0"
           if IPCOUNT(i,0) = IPTST then
             IPCOUNT(i,1) = IPCOUNT(i,1) + 1
             marque = "oui"
         End if
      i = i + 1
      Loop

      if marque = "non" then
      IPCOUNT(i,0) = IPTST
      IPCOUNT(i,1) = 1
      End if

  End if
Loop

df1.close

'write table result in text file
for k=0 to 80000
FLog2.writeline(IPCOUNT(k,0)&";"&IPCOUNT(k,1))
Next

msgbox "Done, Check result.csv"