Search the Community
Showing results for tags 'file monitoring WSH objects'.
-
1st of all, I know there are other ways of doing this via dll calls, but I was just wondering why you can't do this like this? $Obj2 = ObjGet("winmgmts:{impersonationLevel=impersonate}!\\" & @ComputerName & "\root\cimv2") $S2 = ObjCreate("WbemScripting.SWbemSink") If Not IsObj($Obj2) And IsObj($S2) Then Exit MsgBox(0,"","Could not aquire object handle.") ObjEvent($S1,"SINK2_") $Obj2.ExecNotificationQueryAsync($S2, "Select * From __InstanceCreationEvent Within 5 Where " _ & "Targetinstance Isa 'CIM_DataFile' and " _ & "TargetInstance.Drive= 'Win32_Directory.Name=C:\\\\Documents and Settings\\\\TEST\\\\Desktop'") While 1 Sleep(500) Wend Func SINK2_OnObjectReady($OB) Switch $OB.Path_.Class Case "__InstanceCreationEvent" MsgBox(0,"","A new file was just created: " & $OB.TargetInstance.PartComponent,1) Case "__InstanceDeletionEvent" MsgBox(0,"","A file was just deleted: " & $OB. TargetInstance.PartComponent,1) EndSwitch EndFunc I get an error with $OB.TargetInstance.PartComponent but I don't If I use the VBS version, that doesn't quite operate through a notification like this autoit object version. I just learned what objects are so give me some slack. Although, I got these to work just fine- $Obj0 = ObjGet("winmgmts:{impersonationLevel=impersonate}!\\" & @ComputerName & "\root\cimv2") $S0 = ObjCreate("WbemScripting.SWbemSink") If Not IsObj($Obj0) And IsObj($S0) Then Exit MsgBox(0,"","Could not aquire object handle.") ObjEvent($S0,"SINK0_") $Obj0.ExecNotificationQueryAsync($S0, "SELECT * FROM __InstanceOperationEvent WITHIN 0.1 WHERE TargetInstance ISA 'Win32_Process'") $Obj1 = ObjGet("winmgmts:{impersonationLevel=impersonate}!\\" & @ComputerName & "\root\cimv2") $S1 = ObjCreate("WbemScripting.SWbemSink") If Not IsObj($Obj1) And IsObj($S1) Then Exit MsgBox(0,"","Could not aquire object handle.") ObjEvent($S1,"SINK1_") $Obj1.ExecNotificationQueryAsync($S1, "SELECT * FROM __InstanceOperationEvent WITHIN 0.1 WHERE TargetInstance ISA 'Win32_LogicalDisk'") While 1 Sleep(500) Wend Func SINK0_OnObjectReady($OB) Switch $OB.Path_.Class Case "__InstanceCreationEvent" ;$OB.TargetInstance.Terminate MsgBox(0,"Initiated",$OB.TargetInstance.Name,1) Case "__InstanceDeletionEvent" MsgBox(0,"Terminated",$OB.TargetInstance.Name,1) EndSwitch EndFunc Func SINK1_OnObjectReady($OB) If $OB.TargetInstance.DriveType = 2 Then Select Case $OB.Path_.Class()="__InstanceCreationEvent" MsgBox(0,"Inserted",$OB.TargetInstance.DeviceId&"\",1) Case $OB.Path_.Class()="__InstanceDeletionEvent" MsgBox(0,"Removed",$OB.TargetInstance.DeviceId&"\",1) EndSelect EndIf EndFunc Edit: What happened to the [AutoIt] tags?