@@ -48,30 +48,35 @@ function New-FileMonitor {
48
48
param (
49
49
[Parameter (Mandatory )]
50
50
[string ]$Name ,
51
+
51
52
[Parameter (Mandatory )]
52
53
[string ]$MonitorInterval ,
54
+
53
55
[Parameter (Mandatory )]
54
56
[string ]$FolderPath ,
57
+
58
+ [Parameter (Mandatory )]
59
+ [ValidateNotNullOrEmpty ()]
60
+ [ValidateSet (' Modification' , ' Creation' )]
61
+ [string ]$EventType ,
62
+
55
63
[Parameter (Mandatory )]
56
64
[ValidateScript ({ Test-Path - Path $_ - PathType ' Leaf' })]
57
65
[ValidatePattern (' .*\.ps1' )]
58
66
[string ]$ScriptFilePath ,
67
+
59
68
[ValidatePattern (' .*\.vbs' )]
60
69
[string ]$VbsScriptFilePath = " $ ( $env: TEMP ) \FileMonitor.vbs"
61
70
)
62
71
process {
63
72
try {
64
- # # Break apart the drive and path to meet WMI specs
65
- $Drive = $FolderPath | Split-Path - Qualifier
66
- $FolderPath = " $ ( $FolderPath | Split-Path - NoQualifier) \" .Replace(' \' , ' \\' )
67
-
68
73
# # Create the event query to monitor only the folder we want. Also, set the monitor interval
69
74
# # to something like 10 seconds to check the folder every 10 seconds.
70
- $WmiEventFilterQuery = "
71
- SELECT * FROM __InstanceCreationEvent WITHIN $MonitorInterval
72
- WHERE targetInstance ISA 'CIM_DataFile'
73
- AND targetInstance.Drive = `" $Drive `"
74
- AND targetInstance.Path = `" $ FolderPath`" "
75
+ $WmiEventFilterQuery = @'
76
+ SELECT * FROM __Instance{0}Event WITHIN {1}
77
+ WHERE targetInstance ISA 'CIM_DirectoryContainsFile'
78
+ and TargetInstance.GroupComponent = 'Win32_Directory.Name="{2}"'
79
+ '@ -f $EventType , $MonitorInterval , ( $ FolderPath -replace ' \\+$ ' ).Replace( ' \ ' , ' \\ ' )
75
80
76
81
# # Subscribe to the WMI event using the WMI filter query created above
77
82
$WmiFilterParams = @ {
@@ -86,15 +91,15 @@ function New-FileMonitor {
86
91
# # WMI events cannot auto-trigger another PowerShell script.
87
92
$VbsScript = "
88
93
Set objShell = CreateObject(`" Wscript.shell`" )`r`n
89
- objShell.run(`" powershell.exe -NoProfile -WindowStyle Hidden -executionpolicy bypass -file `"`" $ScriptFilePath `"`"`" )
94
+ objShell.run(`" powershell.exe -NonInteractive - NoProfile -WindowStyle Hidden -executionpolicy bypass -file `"`" $ScriptFilePath `"`"`" )
90
95
"
91
96
Set-Content - Path $VbsScriptFilePath - Value $VbsScript
92
97
93
98
# # Create the WMI event consumer which will actually consume the event
94
99
$WmiConsumerParams = @ {
95
100
' Class' = ' ActiveScriptEventConsumer'
96
101
' Namespace' = ' root\subscription'
97
- ' Arguments' = @ { Name = $Name ; ScriptFileName = $VbsScriptFilePath ; ScriptingEngine = ' VBscript ' }
102
+ ' Arguments' = @ { Name = $Name ; ScriptFileName = $VbsScriptFilePath ; ScriptingEngine = ' VBScript ' }
98
103
}
99
104
Write-Verbose - Message " Creating WMI consumer using script file name $VbsScriptFilePath "
100
105
$WmiConsumer = Set-WmiInstance @WmiConsumerParams
@@ -138,7 +143,7 @@ function Get-FileMonitor {
138
143
$Monitor.Binding = Get-WmiObject @BindingParams
139
144
$Monitor.Filter = Get-WmiObject @FilterParams
140
145
$Monitor.Consumer = Get-WmiObject @ConsumerParams
141
- if (@ ( $Monitor.Values | where { $_ }).Count -eq $Monitor.Keys.Count ) {
146
+ if ($Monitor.Consumer -and $Monitor.Filter ) {
142
147
[pscustomobject ]$Monitor
143
148
} elseif (-not $Monitor.Consumer -and -not $Monitor.Filter ) {
144
149
$null
0 commit comments