我參考對岸的code

void __fastcall TForm1::Button7Click(TObject *Sender)
{
HANDLE hdle;
EVENTLOGRECORD *ptr;
BYTE buff[40960];
DWORD read_len, next_len;
ptr=(EVENTLOGRECORD *)&buff;
hdle=OpenEventLog("", "Security");// System
if (hdle==NULL)
{
// MessageBox("??????");
}
else
{
long mRet;
char lpszSourceName[255]={0};
char lpszComputerName[255]={0};
unsigned uStepOfString;
char* pStrings;
char szExpandedString[1024]={0};

int i = 0;
while(ReadEventLog(hdle,EVENTLOG_FORWARDS_READ|EVENTLOG_SEQUENTIAL_READ,
0,ptr,sizeof(buff),&read_len,&next_len))
{
while (read_len > 0) {
i ;
mRet=ptr->EventID;//事件id
mRet=ptr->EventType;//事件?型

mRet=ptr->TimeWritten;//
mRet=ptr->NumStrings;//
mRet=ptr->Length;//
mRet=sizeof(EVENTLOGRECORD);
strcpy(lpszSourceName, (LPTSTR)((LPBYTE)ptr mRet));//事件源
//////////////////////////////////////////////////////////////////////////
if (strcmp(lpszSourceName, "Automatic Updates") == 0) {
HANDLE handle = LoadLibrary("wuaueng.dll");
char szBuffers[256] = {0};
FormatMessage(FORMAT_MESSAGE_FROM_HMODULE, handle,
ptr->EventCategory, 0, szBuffers, 4096, NULL);
}
//////////////////////////////////////////////////////////////////////////

mRet = strlen(lpszSourceName) 1;
strcpy(lpszComputerName, (LPTSTR)((LPBYTE)ptr mRet));//机器名
mRet = strlen(lpszComputerName) 1;
if(ptr->UserSidLength>0){;}//

/////////////////////////////////////////////////////
PSID psid = ptr->UserSidOffset (LPBYTE)ptr;
CHAR szAccName[256] = "\0";
DWORD dwLen = 256;
CHAR szDomainName[256] = "\0";
DWORD dwDoLen = 256;
SID_NAME_USE nameuse;
LookupAccountSid(lpszComputerName, psid, szAccName, &dwLen,
szDomainName, &dwDoLen, &nameuse);
/////////////////////////////////////////////////////

mRet=ptr->DataOffset-ptr->StringOffset;
if (mRet>0)//事件描述
{
pStrings=new char[mRet];
memcpy(pStrings,(LPBYTE)ptr ptr->StringOffset,mRet);
uStepOfString=0;
for(int x=0;xNumStrings;x )
{
if(x==0)
{
strcpy(szExpandedString, (TCHAR *)pStrings uStepOfString);
if(x<(UINT)ptr->NumStrings - 1)strcat(szExpandedString, ",");
}
else strcat(szExpandedString, pStrings uStepOfString);
uStepOfString = strlen(pStrings uStepOfString) 1;
}

delete [] pStrings;
}
// MessageBox(lpszSourceName,szExpandedString);
Memo1->Lines->Add(lpszSourceName);
Memo1->Lines->Add(szExpandedString);
read_len -= ptr->Length;
ptr = (EVENTLOGRECORD *)((LPBYTE)ptr ptr->Length);
}
ptr=(EVENTLOGRECORD *)&buff;
}
CloseEventLog(hdle);
}
//return 0;

}
//---------------------------------------------------------------------------

但是沒辦法讀到詳細資料，我希望看到像

http://marsblue.twbbs.org/~liming/tmp/event.JPG

紅色區域那一塊資料，不知道有沒有有這方面經驗可幫忙