Powershell 创建使用特定事件日志项作为触发器的计划任务

我正在尝试使用PowerShell创建一个使用Windows事件日志作为触发器的计划任务。将事件放入事件日志时，此任务将启动。我要监视的事件是事件ID 8001，屏幕截图如下

我在脚本中使用的是.Net方法，因为我找不到一种方法在PowerShell本机上实现这一点

此屏幕截图是一个示例计划任务的快照，该任务以我要监视的同一事件为目标

这是我迄今为止的尝试

$taskName = "MyRepetitiveTask"

$Service = new-object -ComObject ("Schedule.Service")
$Service.Connect()
$RootFolder = $Service.GetFolder("\")
$TaskDefinition = $Service.NewTask(0)
$TaskDefinition.RegistrationInfo.Description = ''
$TaskDefinition.Settings.Enabled = $true
$TaskDefinition.Settings.AllowDemandStart = $true
$Triggers = $TaskDefinition.Triggers
$Trigger = $Triggers.Create(0) ## 0 is an event trigger
$Trigger.Enabled = $true
$TaskEndTime = [datetime]::Now.AddMinutes(30);$Trigger.EndBoundary = $TaskEndTime.ToString("yyyy-MM-dd'T'HH:mm:ss")
$Trigger.Id = '8001'
$Action = $TaskDefinition.Actions.Create(0)
$Action.Path = 'PowerShell.exe'
$action.Arguments = "$dropboxPath\request\Scripts\Hire\NetworkConnections\StartLTE-WiFi.ps1"
$RootFolder.RegisterTaskDefinition($taskName, $TaskDefinition, 6, "System", $null, 5) | Out-Null

---

好的，做了一些其他的小修改，但是主要的修改是在最后一行添加订阅行

### Variables
$dropboxDBfile = Get-ChildItem -Path $env:USERPROFILE\AppData\Local -Recurse -ErrorAction SilentlyContinue | ? {$_.Name -eq 'host.db'}
$base64path = gc $dropboxDBfile.FullName | select -index 1
$dropboxPath = [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String($base64path)) # convert from base64 to ascii

$taskName = "Keep_WiFi_Connected"
$Path = 'PowerShell.exe'
$Arguments = "$dropboxPath\request\Scripts\Hire\NetworkConnections\StartLTE-WiFi.ps1"

$Service = new-object -ComObject ("Schedule.Service")
$Service.Connect()
$RootFolder = $Service.GetFolder("\")
$TaskDefinition = $Service.NewTask(0) # TaskDefinition object https://msdn.microsoft.com/en-us/library/windows/desktop/aa382542(v=vs.85).aspx
$TaskDefinition.RegistrationInfo.Description = ''
$TaskDefinition.Settings.Enabled = $True
$TaskDefinition.Settings.AllowDemandStart = $True
$TaskDefinition.Settings.DisallowStartIfOnBatteries = $False
$Triggers = $TaskDefinition.Triggers
$Trigger = $Triggers.Create(0) ## 0 is an event trigger https://msdn.microsoft.com/en-us/library/windows/desktop/aa383898(v=vs.85).aspx
$Trigger.Enabled = $true
$TaskEndTime = [datetime]::Now.AddMinutes(30);$Trigger.EndBoundary = $TaskEndTime.ToString("yyyy-MM-dd'T'HH:mm:ss")
$Trigger.Id = '8003' # 8003 is for disconnections and 8001 is for connections
$Trigger.Subscription = "<QueryList><Query Id='0' Path='Microsoft-Windows-WLAN-AutoConfig/Operational'><Select Path='Microsoft-Windows-WLAN-AutoConfig/Operational'>*[System[Provider[@Name='Microsoft-Windows-WLAN-AutoConfig'] and EventID=8003]]</Select></Query></QueryList>"
$Action = $TaskDefinition.Actions.Create(0)
$Action.Path = $Path
$action.Arguments = $Arguments
$RootFolder.RegisterTaskDefinition($taskName, $TaskDefinition, 6, "System", $null, 5) | Out-Null

---

工作正常-请记住在运行此PowerShell脚本时以管理员身份运行

我在谷歌上搜索了一下，找到了一个很好的方法：

$Action = New-ScheduledTaskAction  -Execute 'Powershell.exe' -Argument "-ExecutionPolicy RemoteSigned -Command $Command"

$CIMTriggerClass = Get-CimClass -ClassName MSFT_TaskEventTrigger -Namespace Root/Microsoft/Windows/TaskScheduler:MSFT_TaskEventTrigger
$Trigger = New-CimInstance -CimClass $CIMTriggerClass -ClientOnly
$Trigger.Subscription = 
@"
<QueryList><Query Id="0" Path="System"><Select Path="System">*[System[Provider[@Name='Microsoft-Windows-Eventlog'] and EventID=6005]]</Select></Query></QueryList>
"@
$Trigger.Enabled = $True 

Register-ScheduledTask -Action $Action -Trigger $Trigger -TaskName "  Startup"  -Description 'test' -User 'System' -Force 

---

您计划使用哪个版本的PowerShell$PSVersionTable.PSVersion这确实取决于此，以帮助以最佳方式回答问题。@ZachOlinske:这种方法不需要任何版本检查。它是一种COM对象方法，适用于所有版本。马尔基恩：你有什么错误吗？@Marc：我有一个脚本也是这样的。您可以在@RanadipDutta处引用它，我将使用以下PowerShell脚本获取事件日志。获取事件日志。我将为答案编写一些代码。这是我得到的错误：8,8:Subscription:在第18行char:1+$RootFolder.RegisterAskDefinition$taskName，$TaskDefinition，6，Sy…+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~CategoryInfo:OperationsStopped:：[]，COMException+FullyQualifiedErrorId:System.Runtime.InteropServices.COMException我可以确认这对USB拔出事件2102有效，但我需要补充一点，我花了一个小时尝试启动notepad.exe来测试这一点，任务启动失败，消息为操作员或管理员已拒绝请求0x800710E0。一旦我用参数将操作更改为powershell，它就起作用了。这是红石5号。我不明白为什么，我真的没想到记事本会在powershell工作时无法运行！