by snt.kamikaze

@ECHO Off & COLOR 1F & TITLE [Event Log Backup Script] >NUL

( SETLOCAL EnableExtensions EnableDelayedExpansion
	FOR /f "skip=1 tokens=1-3" %%D IN ('WMIC Path Win32_LocalTime Get Day^,Month^,Year /Format:table') DO SET /a "nD=%%D" 2>NUL & IF !nD! EQU %%D (
		SET /a "nYear=%%F" & SET /a "nMonth=%%E" & SET /a "nDay=%%D-1"
		SET "sYear=!nYear!" & SET "sMonth=0!nMonth!" & SET "sDay=0!nDay!"
		SET "sDate=!sYear:~-4!-!sMonth:~-2!-!sDay:~-2!"
	)

	FOR %%T IN ("Application" "Security" "System") DO WEVTUTIL qe %%T /q:"*[System[TimeCreated[@SystemTime>='!sDate!T00:00:00' and @SystemTime<='!sDate!T23:59:59']]]" /f:text>Backup_%%T_!sDate!.txt
)

( ENDLOCAL
	EXIT
)