Use PowerShell to Create a Permanent WMI Event to Launch a VBScript

re: Use PowerShell to Create a Permanent WMI Event to Launch a VBScript

Pär Björklund — Sun, 29 Jul 2012 08:00:49 GMT

@IamMred I had totally missed that aspect, thanks for the great answer.

re: Use PowerShell to Create a Permanent WMI Event to Launch a VBScript

Ed Wilson — Wed, 25 Jul 2012 20:20:05 GMT

@K_Schulte It is complicated, but also VERY powerful. And I think that following my articles from this week one should be able to begin to set them up. It opens a very powerful solution for net admins -- AND it is a great place for exploration for Windows Developers seeking to instrument their applications.

re: Use PowerShell to Create a Permanent WMI Event to Launch a VBScript

Ed Wilson — Wed, 25 Jul 2012 20:18:25 GMT

@JRV yes the troubleshooting logging is definitely something to only turn on when you need it. In Windows Vista and above, DO NOT use this old log. Use the NEW diagnostic and analytic log I talk about here blogs.technet.com/.../use-powershell-to-troubleshoot-windows.aspx

re: Use PowerShell to Create a Permanent WMI Event to Launch a VBScript

K_Schulte — Wed, 25 Jul 2012 19:55:12 GMT

Hi Ed,

this is a very interesting technique!

It allows for potentially anythiing and is surely something to consider if you want permanent events.

But it is rather complicated and requires a sound knowledge of the WMI classes and their methods

and properties. This is good to know but hard to figure out unless you are a WMI expert.

Good stuff. Interesting, powerful and something to remember if you have to!

Klaus.

re: Use PowerShell to Create a Permanent WMI Event to Launch a VBScript

jrv — Fri, 20 Jul 2012 21:37:55 GMT

@Ed - I had to look it up too. I knew it could be done in the registry but I scanned and was reminded that the WMI manager has a tab for logging. I seldom use it although once in a while it comes in handy. Never leave it set to detailed. It really loads the system. It is not so bad on Windows 7 but XP sure bogs down.

re: Use PowerShell to Create a Permanent WMI Event to Launch a VBScript

IamMred — Fri, 20 Jul 2012 21:15:43 GMT

@JRV thanks for the additions. Yes, working with trace logs requires an extra step to make them visible, but it is worthwhile. I completely forgot about how to enable them on WIndows XP ... been a very long time since I used that OS on a regular basis. Thanks.

re: Use PowerShell to Create a Permanent WMI Event to Launch a VBScript

jrv — Fri, 20 Jul 2012 20:01:09 GMT

@Ed - to get the details of each event in the WMI log you will need to enable the trace log. The Operational log only records global events. The Trace and Debug logs equate to higher levels of logging detail.

To make trace and debug logs available in EventVwr just check the menu item "View\Show Analytic and Debug Logs"

For operational logging it is actually better to generate you own log to avoid WMI overhead but the trace log is what you will need to verify operation.

Pre-Vista use WMI control under WIndows Management.

re: Use PowerShell to Create a Permanent WMI Event to Launch a VBScript

IamMred — Fri, 20 Jul 2012 19:07:30 GMT

@Par Bjorklund if you are talking about using the .NET Framework filesystemwatcher class, you may want to write a service that does this. The thing here, is that this is a perment wmi event registration. It survives reboots, does not require anyone to be logged on, and for that matter, you will not even see an additional process listed ... because it runs inside of WMI. Most scripts, require the script to be running, or they launch a process that stops once the computer reboots ... this does not. It is in fact, the same technology that is used by Systems Center and even Windows to perform certain things. This technology is completely flexible, and with a few changes, this script can monitor for literally anything ... a new USB key inserted, a new event arriving in the event log, a service that stops, a user that types an incorrect password ... literally anything. AND then what we do when the event arrives ... is also nearly limitless. You are right, this about learning, but the script and the technology is dramatic.

re: Use PowerShell to Create a Permanent WMI Event to Launch a VBScript

Pär Björklund — Fri, 20 Jul 2012 16:34:13 GMT

What would the use case for something like this be compared to say Filesystemwatcher? I understand that the post is about learning wmi but if we ignore that.