Search code examples
filewmiwql

WQL WMI Query to watch for newly created files

The following query should return a set of files that were created to the G drive in the folder test.

I am having trouble getting the following WMI query to work:

SELECT * FROM __InstanceCreationEvent WITHIN 1 WHERE 
TargetInstance ISA 'CIM_DataFile' AND TargetInstance.Drive = 'G:' AND 
TargetInstance.Path = '\\test\\'

The wbemtest utility gives me the following error:

Number: 0x80041017
Facility: WMI
Description: Invalid query

Thanks!

Solution

  • There is a space in the event class name, ie. __ InstanceCreationEvent should be __InstanceCreationEvent. Other than that you shouldn't use the LIKE operator in the query because it will force WMI to search your machine for all files that have 'test' as one of their parent directories. Better to use the exact path.