• try this script instead;

    query = "Select * from __InstanceCreationEvent" _

    & " " & "where TargetInstance isa 'Win32_NTLogEvent'" _

    & " " & "and (TargetInstance.Logfile = 'Application' or TargetInstance.Logfile = 'System')" _

    & " " & "and (TargetInstance.EventType = 1 or TargetInstance.EventType = 2)"