how MONITOR SUB DI

[aubaby]

$strComputer = "."
$objWMIService = ObjGet("winmgmts:\\" & $strComputer & "\root\cimv2")

$colMonitoredEvents = $objWMIService.ExecNotificationQuery _
("SELECT * FROM __InstanceDeletionEvent WITHIN 1 WHERE " _
& "Targetinstance ISA 'CIM_DirectoryContainsFile' and " _
& "TargetInstance.GroupComponent= " _
& "'Win32_Directory.Name=""c:\\\\1""'")

While 1
$objEventObject = $colMonitoredEvents.NextEvent()

Select 
Case $objEventObject.Path_.Class()="__InstanceDeletionEvent"
ConsoleWrite ("A file was just deleted: " & $objEventObject.TargetInstance.PartComponent() & @CR)
EndSelect
WEnd

This script can only monitor the current directory

How do you modify you can have your scripts can monitor a subdirectory under the specified directory

For example,

C:\1\1

C:\1\2

C:\1\3

C:\1\4

C:\1\5

C:\1\AABB

C:\1\WW

C:\1\1A

C:\1\1D

C:\1\1ASDFSDF

C:\1\1AAAAFFF

....

[PsaltyDS]

This was interesting to me, so I tried a few things (and failed). You don't want to recursively list all the subdirectories and monitor the deletion events in each because it would suck up tremendous resources. I had an idea of using an "ASSOCIATORS OF" class because one type is something like:

..."ASSOCIATORS OF {Win32_Directory.Name='"C:\\\\1"'} " & _
    "WHERE AssocClass = Win32_Subdirectory"

So you would be monitoring __InstanceDeletionEvent where TargetInstance is a Win32_Subdirectory associator of the Win32_Directory parent to be monitored.

I couldn't make it work. Smarter people may prevail.