Automating the world one-liner at a time…
PowerShell V1 does not provide native support for WMI events. That doesn't mean that you can't use WMI events with PowerShell, it just means that you need to leverage the .NET classes to do so. This falls into the category of "to ship is to choose". Here is a function that you can use to work with WMI events. This function takes a WMI class name (and optionally a path to a namespace [it defaults to root\cimv2]) and gets the events until you enter ESCAPE or 'q' at the keyboard.
Function Get-WmiEvent ($class, $Path="root\cimv2"){$ESCkey = 27$Qkey = 81$query = New-Object System.Management.WQlEventQuery "Select * from $class"$scope = New-Object System.Management.ManagementScope $Path$watcher = New-Object System.Management.ManagementEventWatcher $scope,$query$options = New-Object System.Management.EventWatcherOptions $options.TimeOut = [timespan]"0.0:0:1"$watcher.Options = $Options$watcher.Start()while ($true) {trap [System.Management.ManagementException] {continue}$watcher.WaitForNextEvent()if ($host.ui.RawUi.KeyAvailable){ $key = $host.ui.RawUI.ReadKey("NoEcho,IncludeKeyUp")if (($key.VirtualKeyCode -eq $ESCkey) -OR ($key.VirtualKeyCode -eq $Qkey)) { $watcher.Stop()break}}}}Set-Alias gwe Get-WmiEvent
NOTE: This function is available as an attachement below.
From here you might ask yourself the question: OK but what are the WMI Events? You might think that Events follow the naming patter: WMI*EVENT. Sadly, you'd be wrong. Here is how you find all the WMI events in a particular namespace:
PS> Get-WmiObject -list -namespace root\cimv2 |>> where {$_.__Derivation -contains "__EVENT"}>>__NamespaceOperationEvent __NamespaceModificationEvent__NamespaceDeletionEvent __NamespaceCreationEvent__ClassOperationEvent __ClassDeletionEvent__ClassModificationEvent __ClassCreationEvent__InstanceOperationEvent __InstanceCreationEvent__MethodInvocationEvent __InstanceModificationEvent__InstanceDeletionEvent __TimerEvent__ExtrinsicEvent __SystemEvent__EventDroppedEvent __EventQueueOverflowEvent__QOSFailureEvent __ConsumerFailureEventMSFT_SCMEvent MSFT_SCMEventLogEventMSFT_NetSevereServiceFailed MSFT_NetTransactInvalidMSFT_NetServiceNotInteractive MSFT_NetTakeOwnershipMSFT_NetServiceConfigBackoutFailed MSFT_NetServiceShutdownFailedMSFT_NetServiceStartHung MSFT_NetServiceStopControlSuccessMSFT_NetServiceSlowStartup MSFT_NetCallToFunctionFailedMSFT_NetBadAccount MSFT_NetBadServiceStateMSFT_NetConnectionTimeout MSFT_NetCircularDependencyAutoMSFT_NetServiceStartTypeChanged MSFT_NetServiceLogonTypeNotGrantedMSFT_NetServiceStartFailedGroup MSFT_NetDependOnLaterServiceMSFT_NetFirstLogonFailedII MSFT_NetServiceDifferentPIDConnectedMSFT_NetServiceCrashNoAction MSFT_NetCircularDependencyDemandMSFT_NetServiceExitFailed MSFT_NetServiceStartFailedIIMSFT_NetServiceExitFailedSpecific MSFT_NetBootSystemDriversFailedMSFT_NetInvalidDriverDependency MSFT_NetServiceCrashMSFT_NetServiceRecoveryFailed MSFT_NetServiceStatusSuccessMSFT_NetTransactTimeout MSFT_NetFirstLogonFailedMSFT_NetServiceControlSuccess MSFT_NetServiceStartFailedMSFT_NetServiceStartFailedNone MSFT_NetReadfileTimeoutMSFT_NetRevertedToLastKnownGood MSFT_NetCallToFunctionFailedIIMSFT_NetDependOnLaterGroup MSFT_WmiSelfEventMSFT_WmiEssEvent MSFT_WmiThreadPoolEventMSFT_WmiThreadPoolThreadCreated MSFT_WmiThreadPoolThreadDeletedMSFT_WmiRegisterNotificationSink MSFT_WmiFilterEventMSFT_WmiFilterDeactivated MSFT_WmiFilterActivatedMSFT_WmiCancelNotificationSink MSFT_WmiProviderEventMSFT_WmiConsumerProviderEvent MSFT_WmiConsumerProviderSinkLoadedMSFT_WmiConsumerProviderSinkUnloaded MSFT_WmiConsumerProviderUnloadedMSFT_WmiConsumerProviderLoaded Msft_WmiProvider_OperationEventMsft_WmiProvider_ComServerLoadOper... Msft_WmiProvider_OperationEvent_PostMsft_WmiProvider_PutInstanceAsyncE... Msft_WmiProvider_CreateInstanceEnu...Msft_WmiProvider_DeleteInstanceAsy... Msft_WmiProvider_CancelQuery_PostMsft_WmiProvider_NewQuery_Post Msft_WmiProvider_ProvideEvents_PostMsft_WmiProvider_ExecQueryAsyncEve... Msft_WmiProvider_AccessCheck_PostMsft_WmiProvider_CreateClassEnumAs... Msft_WmiProvider_DeleteClassAsyncE...Msft_WmiProvider_ExecMethodAsyncEv... Msft_WmiProvider_GetObjectAsyncEve...Msft_WmiProvider_PutClassAsyncEven... Msft_WmiProvider_InitializationOpe...Msft_WmiProvider_InitializationOpe... Msft_WmiProvider_LoadOperationFail...Msft_WmiProvider_ComServerLoadOper... Msft_WmiProvider_UnLoadOperationEventMsft_WmiProvider_LoadOperationEvent Msft_WmiProvider_OperationEvent_PreMsft_WmiProvider_DeleteInstanceAsy... Msft_WmiProvider_AccessCheck_PreMsft_WmiProvider_ExecQueryAsyncEve... Msft_WmiProvider_DeleteClassAsyncE...Msft_WmiProvider_NewQuery_Pre Msft_WmiProvider_PutInstanceAsyncE...Msft_WmiProvider_CreateClassEnumAs... Msft_WmiProvider_ExecMethodAsyncEv...Msft_WmiProvider_ProvideEvents_Pre Msft_WmiProvider_CancelQuery_PreMsft_WmiProvider_PutClassAsyncEven... Msft_WmiProvider_GetObjectAsyncEve...Msft_WmiProvider_CreateInstanceEnu... MSFT_WMI_GenericNonCOMEventWin32_ComputerSystemEvent Win32_ComputerShutdownEventWin32_IP4RouteTableEvent MSFT_NCProvEventMSFT_NCProvCancelQuery MSFT_NCProvClientConnectedMSFT_NCProvNewQuery MSFT_NCProvAccessCheckRegistryEvent RegistryKeyChangeEventRegistryTreeChangeEvent RegistryValueChangeEventWin32_SystemTrace Win32_ProcessTraceWin32_ProcessStartTrace Win32_ProcessStopTraceWin32_ModuleTrace Win32_ModuleLoadTraceWin32_ThreadTrace Win32_ThreadStartTraceWin32_ThreadStopTrace Win32_PowerManagementEventWin32_DeviceChangeEvent Win32_SystemConfigurationChangeEventWin32_VolumeChangeEventPS>
Here is an example of it working (I run this for a while and then type ESC):
PS> gwe Win32_ProcessStopTrace |ft ProcessName,Processid -autoProcessName Processid----------- ---------HOSTNAME.EXE 4788ipconfig.exe 4664notepad.exe 3980calc.exe 3816
I hope you find this useful.
Cheers!
Jeffrey Snover [MSFT]Windows PowerShell/MMC ArchitectVisit the Windows PowerShell Team blog at: http://blogs.msdn.com/PowerShellVisit the Windows PowerShell ScriptCenter at: http://www.microsoft.com/technet/scriptcenter/hubs/msh.mspx
This is very interesting especially for WMI based scripts.
A while ago I wrote a Powershell script which at the end made use of the Windows Media Player ActiveX Control. One thing I wanted to do was to make the script sink the Media Player events. Is it possible to do so in Power Shell? I ask this because a lot of COM objects provided by Windows have this feature of event notifications and it would be nice to know if this is doable in Power shell.
Thanks.
hi. I haven't seen any documentation specifically answereing this question:
Is it necessary to install powershell on a remote system in order to use powershell scripts against from a remote workstation?
In other words if I install Powershell on my workstations will the scripts run against my servers if I haven't installed powershell on them?
Thanks
> it necessary to install powershell on a remote system in order to use powershell scripts against from a remote workstation?
Your scripts can run locally and access your remove workstation using the WMI commands.
Jeffrey Snover [MSFT]
Windows PowerShell/MMC Architect
Visit the Windows PowerShell Team blog at: http://blogs.msdn.com/PowerShell
Visit the Windows PowerShell ScriptCenter at: http://www.microsoft.com/technet/scriptcenter/hubs/msh.mspx
This post builds on Jeffrey's post on wmi events - http://blogs.msdn.com/powershell/archive/2007/01/28/working-with-wmi-events.aspx
This post builds on Jeffrey's post on wmi events - http://blogs.msdn.com/powershell/archive/2007
The WMI events don't appear to function under Windows Vista. Even when run as admin.