WMI Event Basics

The principle behind WMI Event Notification is extremely simple. It relies on the observation that whenever components of a computer system represented by instances of WMI classes change in some meaningful way, this change will be reflected in the Repository. Whenever an application is launched, for example, a new Win32_Process object is created to represent it. Whenever a file is modified, the LastModified property of the CIM_DataFile representing it changes too. Whenever a file is deleted or a process dies, the object representing it is deleted. WMI can detect all of these changes to its world and model them as events.

Just as a program or script can ask WMI for a collection of objects that fulfil certain criteria merely by ...

Get Windows Management Instrumentation (WMI) now with O’Reilly online learning.

O’Reilly members experience live online training, plus books, videos, and digital content from 200+ publishers.