Events Powershell事件转发
对不起,英语不好 我对powershell和其中的事件转发机制有一些问题。我正在尝试这样做:Events Powershell事件转发,events,powershell,forwarding,powershell-remoting,Events,Powershell,Forwarding,Powershell Remoting,对不起,英语不好 我对powershell和其中的事件转发机制有一些问题。我正在尝试这样做: $remoteComputer = "." $session = New-PsSession $remoteComputer Unregister-Event CatchEvent -ErrorAction SilentlyContinue Invoke-Command $session { ## The WMI query to detect a stopping service
$remoteComputer = "."
$session = New-PsSession $remoteComputer
Unregister-Event CatchEvent -ErrorAction SilentlyContinue
Invoke-Command $session {
## The WMI query to detect a stopping service
$query = @"
SELECT *
FROM __instancecreationevent
WHERE TargetInstance ISA 'Win32_NtLogEvent'
and targetinstance.eventcode = '7036'
"@
Register-WmiEvent -Query $query "CatchEvent" -Forward
}
$null = Register-EngineEvent CatchEvent -Action { $GLOBAL:MyEvent = $event}
$MyEvent变量最终不包含事件信息,而是包含system.string类数据。
这个脚本怎么了?瓦西里·古塞夫给了我一个答案
再说一遍。对不起,英语不好。如果有什么问题,请纠正我:)瓦西里·古塞夫给了我一个答案
再说一遍。对不起,英语不好。如果有什么问题,请纠正我:)
$query = "SELECT * FROM __instancecreationevent WHERE TargetInstance ISA 'Win32_NtLogEvent' AND TargetInstance.eventcode = '7036'"
Register-WmiEvent -Query $query -ComputerName client1 -Action {write-host "Service Stopped"}