WQL WMI Query to watch for newly created files

StackOverflow https://stackoverflow.com//questions/11688592

  •  12-12-2019
  •  | 
  •  

Question

The following query should return a set of files that were created to the G drive in the folder test.

I am having trouble getting the following WMI query to work:

SELECT * FROM __InstanceCreationEvent WITHIN 1 WHERE 
TargetInstance ISA 'CIM_DataFile' AND TargetInstance.Drive = 'G:' AND 
TargetInstance.Path = '\\test\\'

The wbemtest utility gives me the following error:

Number: 0x80041017
Facility: WMI
Description: Invalid query

Thanks!

Was it helpful?

Solution

There is a space in the event class name, ie. __ InstanceCreationEvent should be __InstanceCreationEvent. Other than that you shouldn't use the LIKE operator in the query because it will force WMI to search your machine for all files that have 'test' as one of their parent directories. Better to use the exact path.

OTHER TIPS

This is giving you Invalid query error as you are runnign this as a query, but _instancecreationEvent or all subClass of "_InstanceOperationEvent" must be called as NotificationQuery.

Thanks.

Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow
scroll top