PowerShell 2.0: One Cmdlet at a Time #98 Wait-Event

Continuing the series looking at new cmdlets available in PowerShell 2.0. This time we look at the Wait-Event cmdlet.

What can I do with it?

Pause a running script or session and wait for an event to occur before continuing.

Example:

The built-in PowerShell help has a great example for New-Event. It uses New-Event to create a custom event based on a reaction to another event. Use Wait-Event to make the current session pause until a new process has been opened. Open Windows Calculator to make the event trigger and return the prompt to the user.

function Enable-ProcessCreationEvent
{
   $query = New-Object System.Management.WqlEventQuery "__InstanceCreationEvent", (New-Object TimeSpan 0,0,1), "TargetInstance isa 'Win32_Process'"
   $processWatcher = New-Object System.Management.ManagementEventWatcher $query
   $identifier = "WMI.ProcessCreated"

   Register-ObjectEvent $processWatcher "EventArrived" -SupportEvent $identifier -Action {
       [void] (New-Event -sourceID "PowerShell.ProcessCreated" -Sender $args[0] -EventArguments $args[1].SourceEventArgs.NewEvent.TargetInstance)
   }
}
Wait-Event -SourceIdentifier PowerShell.ProcessCreated

Before opening Windows Calculator:

You will notice that after the opening of Windows Calculator the event is triggered and the prompt is returned to the user.

How could I have done this in PowerShell 1.0?

PowerShell engine events are a new feature in PowerShell 2.0.

1000 things 1% better

PowerShell 2.0: One Cmdlet at a Time #97 Get-Event

Continuing the series looking at new cmdlets available in PowerShell 2.0. This time we look at the Get-Event cmdlet.

What can I do with it?

Retrieve events from the event queue.

Example:

The built-in PowerShell help has a great example for New-Event. It uses New-Event to create a custom event based on a reaction to another event. Once the event has been created Get-Event can be used to examine details of that event and any others currently in the queue.

function Enable-ProcessCreationEvent
{
   $query = New-Object System.Management.WqlEventQuery "__InstanceCreationEvent", (New-Object TimeSpan 0,0,1), "TargetInstance isa 'Win32_Process'"
   $processWatcher = New-Object System.Management.ManagementEventWatcher $query
   $identifier = "WMI.ProcessCreated"

   Register-ObjectEvent $processWatcher "EventArrived" -SupportEvent $identifier -Action {
       [void] (New-Event -sourceID "PowerShell.ProcessCreated" -Sender $args[0] -EventArguments $args[1].SourceEventArgs.NewEvent.TargetInstance)
   }
}
Get-Event

You will notice that if you execute this function and then create a new process a new event is automatically generated. Get-Event retrieves details of this event.

How could I have done this in PowerShell 1.0?

PowerShell engine events are a new feature in PowerShell 2.0.

1000 things 1% better

PowerShell 2.0: One Cmdlet at a Time #96 New-Event

Continuing the series looking at new cmdlets available in PowerShell 2.0. This time we look at the New-Event cmdlet.

What can I do with it?

Create a custom event.

Example:

The built-in PowerShell help has a great example for New-Event. It uses New-Event to create a custom event based on a reaction to another event.

function Enable-ProcessCreationEvent
{
   $query = New-Object System.Management.WqlEventQuery "__InstanceCreationEvent", (New-Object TimeSpan 0,0,1), "TargetInstance isa 'Win32_Process'"
   $processWatcher = New-Object System.Management.ManagementEventWatcher $query
   $identifier = "WMI.ProcessCreated"

   Register-ObjectEvent $processWatcher "EventArrived" -SupportEvent $identifier -Action {
       [void] (New-Event -sourceID "PowerShell.ProcessCreated" -Sender $args[0] -EventArguments $args[1].SourceEventArgs.NewEvent.TargetInstance)
   }
}

You will notice that if you execute this function and then create a new process a new event is automatically generated.

How could I have done this in PowerShell 1.0?

PowerShell engine events are a new feature in PowerShell 2.0.

1000 things 1% better

PowerShell 2.0: One Cmdlet at a Time #95 Register-EngineEvent

Continuing the series looking at new cmdlets available in PowerShell 2.0. This time we look at the Register-EngineEvent cmdlet.

What can I do with it?

Subscribe to events generated by the PowerShell engine or the New-Event cmdlet.

Example:

Subscribe to an event when the PowerShell session exits, and save information including the date and time out to a log file.

Register-EngineEvent PowerShell.Exiting 
-Action {"PowerShell exited at " + (Get-Date) | Out-File c:\log.txt -Append}

After closing the PowerShell session (by typing Exit) the date and time it was closed is written to the log file.

How could I have done this in PowerShell 1.0?

PowerShell engine events are a new feature in PowerShell 2.0.

1000 things 1% better

PowerShell 2.0: One Cmdlet at a Time #94 Get-EventSubscriber

Continuing the series looking at new cmdlets available in PowerShell 2.0. This time we look at the Get-EventSubscriber cmdlet.

What can I do with it?

Retrieve event subscribers from the current session.

Example:

Use the Register-ObjectEvent cmdlet to register for an event to check for new processes, use the ManagementEventWatcher .NET object to form the basis of the object to monitor and save information including the date and time out to a log file.

Execution of Get-EventSubscriber will then show details of the event subscribed to.

$query = New-Object System.Management.WqlEventQuery "__InstanceCreationEvent", (New-Object TimeSpan 0,0,1), "TargetInstance isa 'Win32_Process'"
$processWatcher = New-Object System.Management.ManagementEventWatcher $query
Register-ObjectEvent -inputObject $processWatcher -eventName "EventArrived" -Action {"A new process started at " + (Get-Date) | Out-File c:\log.txt -Append}
Get-EventSubscriber

You will see below the details which are returned by default

How could I have done this in PowerShell 1.0?

Register-ObjectEvent and Register-WMIEvent contain examples of how to create events in .NET

1000 things 1% better

PowerShell 2.0: One Cmdlet at a Time #93 Register-ObjectEvent

Continuing the series looking at new cmdlets available in PowerShell 2.0. This time we look at the Register-ObjectEvent cmdlet.

What can I do with it?

Subscribe to an event on a local or remote computer generated by a .NET Framework object and carry out actions based on the event.

Example:

Register for an event to check for new processes, use the ManagementEventWatcher .NET object to form the basis of the object to monitor and save information including the date and time out to a log file.

$query = New-Object System.Management.WqlEventQuery "__InstanceCreationEvent", (New-Object TimeSpan 0,0,1), "TargetInstance isa 'Win32_Process'"
$processWatcher = New-Object System.Management.ManagementEventWatcher $query
Register-ObjectEvent -inputObject $processWatcher -eventName "EventArrived" -Action {"A new process started at " + (Get-Date) | Out-File c:\log.txt -Append}

After running the above commands and then starting a process the below is automatically written to c:\log.txt after a few seconds.

How could I have done this in PowerShell 1.0?

The Scripting Guys detail how to do this in PowerShell 1.0 in this article by using .NET. The code to achieve it is reproduced below:

$a = 0

$timespan = New-Object System.TimeSpan(0, 0, 1)
$scope = New-Object System.Management.ManagementScope("\\.\root\cimV2")
$query = New-Object System.Management.WQLEventQuery `
    ("__InstanceDeletionEvent",$timespan, "TargetInstance ISA 'Win32_Process'" )
$watcher = New-Object System.Management.ManagementEventWatcher($scope,$query)

do
    {
        $b = $watcher.WaitForNextEvent()
        $b.TargetInstance.Name
    }
while ($a -ne 1)

1000 things 1% better

PowerShell 2.0: One Cmdlet at a Time #92 Register-WmiEvent

Continuing the series looking at new cmdlets available in PowerShell 2.0. This time we look at the Register-WMIEvent cmdlet.

What can I do with it?

Subscribe to a WMI event on a local or remote computer and carry out actions based on the event.

Example:

Register for a WMI which checks every 10 seconds for any new processes which have started, call it Check for New Processes and save information including the date and time out to a log file.

Register-WmiEvent -Query "select * from __instancecreationevent within 10 where targetinstance isa 'win32_process'"
-SourceIdentifier "Check for New Processes" 
-Action {"A new process started at " + (Get-Date) | Out-File c:\log.txt -Append}

After running the above command and then starting a process the below is automatically written to c:\log.txt after a few seconds.

How could I have done this in PowerShell 1.0?

The Scripting Guys detail how to do this in PowerShell 1.0 in this article by using .NET. The code to achieve it is reproduced below:

$a = 0

$timespan = New-Object System.TimeSpan(0, 0, 1)
$scope = New-Object System.Management.ManagementScope("\\.\root\cimV2")
$query = New-Object System.Management.WQLEventQuery `
    ("__InstanceDeletionEvent",$timespan, "TargetInstance ISA 'Win32_Process'" )
$watcher = New-Object System.Management.ManagementEventWatcher($scope,$query)

do
    {
        $b = $watcher.WaitForNextEvent()
        $b.TargetInstance.Name
    }
while ($a -ne 1)

1000 things 1% better

PowerShell 2.0: One Cmdlet at a Time #91 Set-WmiInstance

Continuing the series looking at new cmdlets available in PowerShell 2.0. This time we look at the Set-WmiInstance cmdlet.

What can I do with it?

Set an instance of a WMI class.

Example:

Change the value of MaxLogFileSize within the Win32_WMISetting class from the default of 6556 to 13112.

Set-WmiInstance -Class Win32_WMISetting 
-Argument @{MaxLogFileSize=13112}

You will notice that the MaxLogFileSize value is updated:

How could I have done this in PowerShell 1.0?

In the above example you could have called the Put method on the object returned in the WMI query.

$wmisetting = Get-WmiObject Win32_WMISetting
$wmisetting.MaxLogFileSize = 13112
$wmisetting.Put()

1000 things 1% better

PowerShell 2.0: One Cmdlet at a Time #90 Remove-WMIObject

Continuing the series looking at new cmdlets available in PowerShell 2.0. This time we look at the Remove-WMIObject cmdlet.

What can I do with it?

Remove an instance of a WMI class.

Example:

Start Windows Calcultor. Retrieve the running process and terminate it.

calc
Get-WmiObject Win32_Process -Filter "name='calc.exe'" | Remove-WmiObject

How could I have done this in PowerShell 1.0?

In the above example you could have called the Terminate method on the object returned in the WMI query. One of the advantages though of Remove-WmiObject is the possibility to use the pipeline.

(Get-WmiObject Win32_Process -Filter "name='calc.exe'").Terminate()

1000 things 1% better

PowerShell 2.0: One Cmdlet at a Time #89 Invoke-WMIMethod

Continuing the series looking at new cmdlets available in PowerShell 2.0. This time we look at the Invoke-WMIMethod cmdlet.

What can I do with it?

Call WMI Methods.

Example:

Retrieve the WMI instances of the Print Spooler service. Pipe it through to Invoke-WMIMethod and call the StopService method.

Get-WmiObject Win32_Service -filter "name='spooler'"
| Invoke-WmiMethod -Name StopService

Notice the service State changes.

How could I have done this in PowerShell 1.0?

In the above example you could have called the StopService method on the object returned in the WMI query. One of the advantages though of Invoke-WMIMethod is the possibility to use the pipeline.

(Get-WmiObject Win32_Service -filter "name='spooler'").StopService()

1000 things 1% better!