-
Notifications
You must be signed in to change notification settings - Fork 0
/
stepFifteen_wmi.ps1
18 lines (15 loc) · 880 Bytes
/
stepFifteen_wmi.ps1
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
function wmi {
$FilterArgs = @{name='WindowsParentalControlMigration';
EventNameSpace='root\CimV2';
QueryLanguage="WQL";
Query = "SELECT * FROM __InstanceCreationEvent WITHIN 10 WHERE TargetInstance ISA 'Win32_LoggedOnUser' AND TargetInstance.__RELPATH like '%$($env:UserName)%'";}
$Filter=New-CimInstance -Namespace root/subscription -ClassName __EventFilter -Property $FilterArgs
$ConsumerArgs = @{name='WindowsParentalControlMigration';
CommandLineTemplate="";}
$Consumer=New-CimInstance -Namespace root/subscription -ClassName CommandLineEventConsumer -Property $ConsumerArgs
$FilterToConsumerArgs = @{
Filter = [Ref] $Filter
Consumer = [Ref] $Consumer
}
$FilterToConsumerBinding = New-CimInstance -Namespace root/subscription -ClassName __FilterToConsumerBinding -Property $FilterToConsumerArgs
}