Search code examples
windowspowershelleventsevent-handlingwmi

PowerShell get detailed event information from WmiEvent (System.Management.ManagementEventWatcher)


I want to get event delails like the event type and drive letter from a Windows Powershell event.

Register-WmiEvent -Class win32_VolumeChangeEvent -SourceIdentifier volumeChange -Action {
param($event)
$eventType = $event.SourceEventArgs.NewEvent.EventType # don't work
write-host $eventType
}
while (1-eq1) {} # don't exit program

This is what i want to achieve. It works on a Windows computer, but because of performance problems it don't work on a Windows tablet:

Register-WmiEvent -Class win32_VolumeChangeEvent -SourceIdentifier volumeChange
do {
$newEvent = Wait-Event -SourceIdentifier volumeChange
$eventType = $newEvent.SourceEventArgs.NewEvent.EventType
$driveLetter = $newEvent.SourceEventArgs.NewEvent.DriveName
write-host $eventType
Remove-Event -SourceIdentifier volumeChange
} while (1-eq1) # Loop until next event
Unregister-Event -SourceIdentifier volumeChange

Solution

  • I found out that multiple params are submitted:

    Register-WmiEvent -Class win32_VolumeChangeEvent -SourceIdentifier volumeChange -Action {
    param($event, $sourceEventArgs)
    $eventType= $sourceEventArgs.NewEvent.EventType
    write-host $eventType
    }
    while (1-eq1) {} # don't exit program