2016-10-09 76 views
1

我想通過powershell註冊WMI中的事件,但是下面的查詢不斷返回'unparsable query',我正在努力弄清楚。該文件夾已被創建。註冊WMI事件時出現不可解析的查詢

$Action = { New-Event "PowerShell.ProcessCreated" -Sender $Sender -EventArguments $EventArgs.NewEvent.TargetInstance } 
Register-WmiEvent -Query "SELECT * FROM __InstanceCreationEvent WITHIN 10 WHERE targetInstance ISA 'CIM_DataFile' AND targetInstance.Path = 'E:\MyTestFolder'" -SourceIdentifier "ProcessStarted" -Action $Action 

事件是監視一個文件夾,事件的動作是發送一個通知給窗口中的事件查看器。

回答

2

也許你可以試試下面的語法(我用的雙\路徑和雙打引號):

$Action = { New-Event "PowerShell.ProcessCreated" -Sender $Sender -EventArguments $EventArgs.NewEvent.TargetInstance } 
Register-WmiEvent -Query "SELECT * FROM __InstanceCreationEvent WITHIN 10 WHERE TargetInstance ISA `"CIM_DataFile`" AND TargetInstance.Path=`"E:\\MyTestFolder`"" -SourceIdentifier "ProcessStarted" -Action $Action