WMI Event -> Windows Event on File Create?


 


 


Here are 2 scripting options that demonstrate how to create a Windows Event from a WMI Event when a new file is created. Use the following sites for reference:


 


Details on the WMI Event Watcher Task: http://msdn.microsoft.com/en-us/library/ms141130.aspx


Details from a PowerShell v2 perspective: http://www.microsoft.com/technet/scriptcenter/topics/winpsh/events.mspx


 


PowerShell V2 example (note, PowerShell must be running for this to fire and this example doesn’t include the file name in the Event text, see the above site for creating that type of script).


 


register-wmievent -query “select * from __instancecreationevent within 1 where targetinstance isa ‘cim_directorycontainsfile’ and targetinstance.groupcomponent=`”win32_directory.name=’c:\\temp’`”” -sourceidentifier “New File” -action {eventcreate /id 1000 /t information /l application /d “A new file was created.”}


 


VBScript (note: the CMD session that launches this script must be left open for this to fire):


 


‘”.” represents localhost. If you want listen to another machine plese use the remote machine name


 


strComputer = “.”


 


Set objWMIService = GetObject(“winmgmts:\\” & strComputer & “\root\cimv2”)


Set objFSO = CreateObject(“Scripting.FileSystemObject”)


 


Const ForReading = 1


 


Set colMonitoredEvents = objWMIService.ExecNotificationQuery _


(“SELECT * FROM __InstanceOperationEvent WITHIN 1 WHERE ” _


& “Targetinstance ISA ‘CIM_DirectoryContainsFile’ and ” _


& “TargetInstance.GroupComponent= ” _


& “‘Win32_Directory.Name=””c:\\\\temp””‘”)


 


Do While TRUE


     Set objEventObject = colMonitoredEvents.NextEvent()


     Select Case objEventObject.Path_.Class


     Case “__InstanceCreationEvent”


 


     ‘once the WMI Event is detected, we create a Windows Event


 


     TriggerEvent(objEventObject.TargetInstance.PartComponent)


 


     End Select


Loop


 


Function TriggerEvent(ByVal filename)ActiveItemArray = split(filename, “=”)


     CurrentItemFileName = ActiveItemArray(1)


 


     CurrentItemFileNameClean = Replace(CurrentItemFileName, “\\”, “\”)


     CurrentItemFileNameCleanFinal = Replace(CurrentItemFileNameClean, “”””, “”)


 


     set WshShell = WScript.CreateObject(“WScript.Shell”)


    


     createEventText = “The following file was created: ” & CurrentItemFileNameCleanFinal


     createEventCommand = “eventcreate /id 1000 /t information /l application /d “”” & createEventText & “”””


 


     WshShell.Run(createEventCommand)


End Function


 


 


Otto Helweg [MSFT]


 http://blogs.technet.com/otto/default.aspx 


 

Comments (2)

  1. Jared says:

    If you specify $TargetInstance.PartComponent.Split('"')[1] within the scriptblock following the -action parameter you can access the file name