powershell - WMI Permanent Events -
i try set wmi permanent events base on specifics events coming network card on windows 7 sp1.
i use code:
#creating new event filter $instancefilter = ([wmiclass]"\\.\root\subscription:__eventfilter").createinstance() $instancefilter.querylanguage = "wql" $instancefilter.query = "select * __instancecreationevent targetinstance isa 'win32_ntlogevent' , targetinstance.logfile='system' , targetinstance.sourcename '%e1_express%' , (targetinstance.eventcode=27 or targetinstance.eventcode=32 or targetinstance.eventcode=33 or targetinstance.eventcode=36)" $instancefilter.name = "lan_watcher_filter" $instancefilter.eventnamespace = 'root\cimv2' $result = $instancefilter.put() $newfilter = $result.path #creating new event consumer $instanceconsumer = ([wmiclass]"\\.\root\subscription:commandlineeventconsumer").createinstance() $instanceconsumer.name ='lan_watcher_consumer' $instanceconsumer.executablepath="c:\windows\system32\windowspowershell\v1.0\powershell.exe" $instanceconsumer.commandlinetemplate="-file c:\windows\system32\switch_lan_test.ps1" $result = $instanceconsumer.put() $newconsumer = $result.path #bind filter , consumer $instancebinding = ([wmiclass]"\\.\root\subscription:__filtertoconsumerbinding").createinstance() $instancebinding.filter = $newfilter $instancebinding.consumer = $newconsumer $result = $instancebinding.put() $newbinding = $result.path ##removing wmi subscriptions using [wmi] , delete() method #([wmi]$newfilter).delete() #([wmi]$newconsumer).delete() #([wmi]$newbinding).delete() i can turn off powershell session, script launch if reboot computer, permanent event exist again script doesn't work.
any idea ? thanks.
Comments
Post a Comment