How Can I Be Notified Any Time a Network Cable Gets Unplugged?

How Can I Be Notified Any Time a Network Cable Gets Unplugged?

  • Comments 1
  • Likes
Hey, Scripting Guy! Question

Hey, Scripting Guy! Is there a way I can be notified any time a network cable gets unplugged on a computer?

-- DD

SpacerHey, Scripting Guy! AnswerScript Center

Hey, DD. A lot of people, when growing up, had a grandmother or an aunt or someone somewhere who had a house with a big attic, an attic overflowing with stuff. Admittedly, most of the time you had no idea what you were looking at when you wandered through there, but every now and then you came across something really cool and really useful. Every visit to the attic was like a treasure hunt, and you never knew what you might find there.

The WMI equivalent of Grandma’s attic is the root\wmi namespace. There’s quite a lot of stuff in there - 374 classes on our Windows XP test machine - but a lot of the classes either are not implemented or don’t return any data. Every now and then, however, you stumble upon a class that does something really useful, something like, say, notifying you any time a network connection is lost. Just like a treasure hunt.

As it turns out, the MSNdis_StatusMediaDisconnect class - a WMI event class - can monitor a computer and notify you any time a network connection has been lost (whether that’s because of a network cable being pulled or some other reason). As we often do, let’s show you the script and then explain how it works:

strComputer = "."

Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\wmi")
Set colMonitoredEvents = objWMIService.ExecNotificationQuery _
    ("Select * from MSNdis_StatusMediaDisconnect") 

Do While True 
    Set strLatestEvent = colMonitoredEvents.NextEvent 
    Wscript.Echo "A network connection has been lost:"
    WScript.Echo strLatestEvent.InstanceName, Now
    Wscript.Echo 
Loop

If you have at least some experience with WMI event scripts, this one should look very familiar. (If you don’t have much experience with WMI event scripts, you might want to check out this Scripting Week 2 webcast.) We begin by connecting to the WMI service; note that we connect to root\wmi rather than root\cimv2. We then use ExecNotificationQuery to request notification any time a new instance of the MSNdis_StatusMediaDisconnect class is created. As you might have guessed, a new instance of this class is created any time a network connection is lost.

We then set up an infinite loop; by design this script will continually monitor the computer for new instances of the MSNdis_StatusMediaDisconnect class. (In fact, the only way to get it to stop monitoring is to terminate the script or the script process.) The script then pauses on this line of code, waiting for the next network disconnection event:

Set strLatestEvent = colMonitoredEvents.NextEvent

So what happens if we pull the cable and we disconnect the computer from the network? In that case a network disconnection event will occur, a new instance of the MSNdis_StatusMediaDisconnect class will be created, and the script will issue a notification that looks something like this:

A network connection has been lost:
Microsoft Wireless Notebook Adapter MN-720 3/172005 8:28:34 AM

Cool, huh? The script will then loop around and wait for the next network disconnection to occur. Should there be another such disconnection then another notification will be issued.

Note. Of course, you aren’t limited to echoing messages to the screen. You could have your script do pretty much anything in the event of a network disconnection; we just wanted to keep things simple.

Incidentally, there’s a similar class - MSNdis_StatusMediaConnect - that can notify you any time a network connection has been made. Here’s a sample script that does just that:

strComputer = "."

Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\wmi")
Set colMonitoredEvents = objWMIService.ExecNotificationQuery _
    ("Select * from MSNdis_StatusMediaConnect") 

Do While True 
    Set strLatestEvent = colMonitoredEvents.NextEvent 
    Wscript.Echo "A network connection has been made:"
    WScript.Echo strLatestEvent.InstanceName, Now
    Wscript.Echo 
Loop

Unfortunately we don’t know of an easy way to combine the two scripts into one (that is, a single script that could notify you of both network connections and network disconnections). There is at least one way this can be done, but there are some security concerns with that approach so we can’t recommend it. For the time being, then, you’ll need to run two separate scripts if you’d like to monitor for both kinds of events. But we’ll keep rummaging through the WMI attic; who knows what else we might find in there.

Your comment has been posted.   Close
Thank you, your comment requires moderation so it may take a while to appear.   Close
Leave a Comment
  • That's work fine, but, how can we do if we want this WMI query in a Permanent WMI subscription, via a .mof file?

    Nothing happened with a query like Select * From __InstanceCreationEvent with 10 where TargetInstance ISA 'MSNdis_StatusMediaDisConnect'

    The same with InstanceModificationEvent :/

    Any idea ??

    Ps , sorry for my english...