{"id":16291,"date":"2010-12-07T00:01:00","date_gmt":"2010-12-07T00:01:00","guid":{"rendered":"https:\/\/blogs.technet.microsoft.com\/heyscriptingguy\/2010\/12\/07\/use-powershell-to-monitor-and-respond-to-events-on-your-server\/"},"modified":"2010-12-07T00:01:00","modified_gmt":"2010-12-07T00:01:00","slug":"use-powershell-to-monitor-and-respond-to-events-on-your-server","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/scripting\/use-powershell-to-monitor-and-respond-to-events-on-your-server\/","title":{"rendered":"Use PowerShell to Monitor and Respond to Events on Your Server"},"content":{"rendered":"

<\/span><\/p>\n

Summary: <\/strong>Learn how to use Windows PowerShell to monitor and to respond to events on your computer or server without the need to run a script.<\/span><\/p>\n

 <\/span><\/p>\n

\"Hey,<\/span><\/span><\/span><\/span><\/span>Hey, Scripting Guy! I am interested in learning how to use Windows PowerShell<\/span><\/a> to create a Windows Management Instrumentation (WMI<\/span><\/a>) permanent event consumer. Basically, what I need is a script that will monitor a particular service and if the status of that service changes I need the script to launch a script that will perform a specific action. Is this something I can do with Windows PowerShell, or do I need to compile a Managed Object Format (MOF) file? Everything I can find on the Internet says I need to use a MOF file, but I do not like MOF files and would rather use a Windows PowerShell script so I can create these permanent event consumers on a remote machine. <\/span><\/p>\n

— CD<\/span><\/p>\n

 <\/span><\/p>\n

\"Hey,<\/span><\/span><\/span><\/span><\/span>Hello CD, Microsoft Scripting Guy Ed Wilson here. You are absolutely correct. There are two cool things about creating permanent event consumers via script. The first thing is that it can easily be performed remotely. Therefore,, I can target a several machines with the script and create the event consumer on the remote machines. The second cool thing is the fact that permanent event consumers are cool. They monitor for and respond to events without the need for a script to be running. Talk about something cool! I run one script one time, and then my computer will always look for an event and respond to it. Dude<\/span><\/a> (or Dudette) that rocks! This means that almost every one of the event and monitoring scripts<\/span><\/a> that are discussed in the Hey, Scripting Guy! Blog<\/span><\/a> can be converted to a permanent event monitor. <\/span><\/p>\n

Portions of today’s post are adapted from my WMI book, Microsoft Windows Scripting with WMI: Self-Paced Learning Guide<\/span><\/i><\/a>,<\/i> that was published by Microsoft Press in 2006. <\/span><\/p>\n

In yesterday’s<\/span><\/a> Hey, Scripting Guy! Blog post, I talked about the concepts involved in creating a permanent event consumer. <\/span><\/p>\n

In yesterday’s post, the script that was created uses the ActiveScriptEventConsumer<\/b> WMI class to run a VBScript when the status of the Bits service changes. The ActiveScriptEventConsumer<\/b> WMI class provides the most flexibility because it enables you to run a script which means that in reality it is the only class that you would actually need. However, some other standard consumer classes might be more efficient. For example, if you have to write to an event log, then the NTEventLogEventConsumer<\/b> is more efficient than the ActiveScriptEventConsumer<\/b> (although your script could write to the event log, using a specially tailored consumer is generally better). Table 1 details the standard consumer classes. For more information about these classes, see the MSDN documentation<\/span><\/a>.<\/span><\/p>\n

Table 1<\/strong><\/span><\/p>\n\n\n\n\n\n\n\n\n\n
\n

Class name<\/strong><\/span><\/p>\n<\/td>\n

\n

Description<\/span><\/b><\/p>\n<\/td>\n<\/tr>\n

\n

ActiveScriptEventConsumer<\/span><\/b><\/p>\n<\/td>\n

\n

Executes a predefined script in an arbitrary scripting language when an event is delivered to it. This consumer is available on Windows 2000 and above. <\/span><\/p>\n<\/td>\n<\/tr>\n

\n

ScriptingStandardConsumerSetting<\/span><\/b><\/p>\n<\/td>\n

\n

Provides registration data common to all instances of the ActiveScriptEventConsumer<\/b> class. This consumer is available on Windows 2000 and above.<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

LogFileEventConsumer<\/span><\/b><\/p>\n<\/td>\n

\n

Writes customized strings to a text log file when events are delivered to it. This consumer is available on Windows XP and above.<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

NTEventLogEventConsumer<\/span><\/b><\/p>\n<\/td>\n

\n

Logs a specific message to the Windows NT event log when an event is delivered to it. This consumer is available on Windows XP and above.<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

SMTPEventConsumer<\/span><\/b><\/p>\n<\/td>\n

\n

Sends an email message using SMTP every time that an event is delivered to it. This consumer is available on Windows 2000 and above.<\/span><\/p>\n<\/td>\n<\/tr>\n

\n

CommandLineEventConsumer<\/span><\/b><\/p>\n<\/td>\n

\n

Launches an arbitrary process in the local system context when an event is delivered to it. This consumer is available on Windows XP and above.<\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

 <\/span><\/p>\n

The CreatePermenantEventConsumer.ps1<\/b> script creates a permanent event consumer that monitors the bits<\/i> service. If the status of the service changes, it fires an event that is received by the ActiveScriptEventConsumer<\/b>. When the event is received by the ActiveScriptEventConsumer<\/b>, it runs a simple VBScript that will toggle the status of the browser<\/i> service. Therefore, if the browser<\/i> service is running and an event is received, the browser<\/i> service will be stopped; if the browser<\/i> service is currently stopped and an event is received it will be started. <\/span><\/p>\n

CreatePermenantEventConsumer.ps1<\/strong><\/p>\n

$computer = “mred1”<\/span><\/span><\/p>\n

$filterNS = “root\\cimv2”<\/span><\/span><\/p>\n

$wmiNS = “root\\subscription”<\/span><\/span><\/p>\n

$query = “Select * from __InstanceModificationEvent within 10 where <\/span><\/span><\/p>\n

  <\/span>targetInstance isa ‘Win32_Service’ and targetInstance.Name = ‘Bits'”<\/span><\/span><\/p>\n

$filterName = “Win32ServiceModification”<\/span><\/span><\/p>\n

$scriptFileName = “C:\\fso\\ToggleBrowserService.vbs”<\/span><\/span><\/p>\n

$filterPath = Set-WmiInstance -Class __EventFilter `<\/span><\/span><\/p>\n

 <\/span>-ComputerName $computer -Namespace $filterNS -Arguments `<\/span><\/span><\/p>\n

  <\/span>@{name=$filterName; EventNameSpace=$filterNS; QueryLanguage=”WQL”;<\/span><\/span><\/p>\n

    <\/span>Query=$query}<\/span><\/span><\/p>\n

$consumerPath = Set-WmiInstance -Class ActiveScriptEventConsumer `<\/span><\/span><\/p>\n

 <\/span>-ComputerName $computer -Namespace $wmiNS `<\/span><\/span><\/p>\n

 <\/span>-Arguments @{name=”ToggleBits”; ScriptFileName=$scriptFileName;<\/span><\/span><\/p>\n

  <\/span>ScriptingEngine=”VBScript”}<\/span><\/span><\/p>\n

Set-WmiInstance -Class __FilterToConsumerBinding -ComputerName $computer `<\/span><\/span><\/p>\n

  <\/span>-Namespace $wmiNS -arguments @{Filter=$filterPath; Consumer=$consumerPath} |<\/span><\/span><\/p>\n

  <\/span>out-null<\/span><\/span><\/p>\n

<\/span><\/p>\n

The CreatePermenantEventConsumer.ps1<\/b> must be run with administrator rights, and before running the script, I right-click the Windows PowerShell ISE icon and select Run as administrator<\/b>. When the CreatePermenantEventConsumer.ps1<\/b> script runs no output is generated. This output of the script and the use of the Get-Service<\/b> cmdlet to check the status of the bits and the browser service is seen in the following figure.<\/span><\/p>\n

<\/p>\n

<\/span><\/p>\n

The command I used to check the status of both services is seen here.<\/span><\/p>\n

Get-Service -Name browser, bits<\/span><\/span><\/p>\n

 <\/span><\/p>\n

When checking the status of the services, as well as toggling the bits<\/i> service, I use the bottom execution pane. This is seen in following figure.<\/span><\/p>\n

<\/p>\n

<\/span><\/p>\n

To create an instance of the __EventFilter<\/b>, I use the Set-WmiInstance<\/b>. The VBScript code that was discussed yesterday is seen here.<\/span><\/p>\n

‘Create the event filter<\/span><\/span><\/p>\n

set objfilterclass=objActiveScriptConsumer.get(“__EventFilter”)<\/span><\/span><\/p>\n

set objfilter=objfilterclass.spawninstance_()<\/span><\/span><\/p>\n

objfilter.name=”win32ServiceModification”<\/span><\/span><\/p>\n

objFilter.EventNamespace=”\\root\\cimv2″ ‘NOTE:IS NOT IN THE BOOK! Write at BTM pg.110<\/span><\/span><\/p>\n

objfilter.querylanguage=”wql”<\/span><\/span><\/p>\n

objfilter.query=(qQuery)<\/span><\/span><\/p>\n

set filterpath = objfilter.put_<\/span><\/span><\/p>\n

 <\/span><\/p>\n

When you use the Set-WmiInstance<\/b> Windows PowerShell cmdlet, each of the __EventFilter<\/b> WMI class properties are assigned their values via a HashTable<\/b>. This means the Windows PowerShell command to create the new instance of the __EventFilter<\/b> WMI class can be done by using one logical line of code. The code is seen here.<\/span><\/p>\n

$filterPath = Set-WmiInstance -Class __EventFilter `<\/span><\/span><\/p>\n

 <\/span>-ComputerName $computer -Namespace $filterNS -Arguments `<\/span><\/span><\/p>\n

  <\/span>@{name=$filterName; EventNameSpace=$filterNS; QueryLanguage=”WQL”;<\/span><\/span><\/p>\n

    <\/span>Query=$query}<\/span><\/span><\/p>\n

 <\/span><\/p>\n

The new instance of the __EventFilter <\/b>class is stored in the $FilterPath<\/i> variable. The returned instance of the class is used in the command to bind the filter to the consumer. <\/span><\/p>\n

The next step is to create the consumer. The VBScript code from yesterday is seen here.<\/span><\/p>\n

‘Create the active script consumer<\/span><\/span><\/p>\n

set  <\/span>objConsumerClass=objActiveScriptConsumer.get(“ActiveScriptEventConsumer”)<\/span><\/span><\/p>\n

set objconsumer=objconsumerclass.spawninstance_()<\/span><\/span><\/p>\n

objconsumer.name=”ToggleBits”<\/span><\/span><\/p>\n

objconsumer.scriptfilename=”C:\\FSO\\ToggleBrowserService.vbs”<\/span><\/span><\/p>\n

objconsumer.scriptingengine=”vbscript”<\/span><\/span><\/p>\n

set consumerpath = objconsumer.put_<\/span><\/span><\/p>\n

 <\/span><\/p>\n

Again, the Set-WmiInstance <\/b>Windows PowerShell cmdlet is used to create a new instance of the ActiveScriptEventConsumer<\/b> WMI class. As before each property receives its value via the hash table. The Windows PowerShell command is seen here. (As before, this is one logical line of Windows PowerShell code. I had to break it down into four lines to display it correctly on the blog platform. If you want to convert it to a single line, copy the following code and back each line back up to the previous line while taking care to remove the backtick, grave, reverse quote, backward apostrophe, or whatever you want to call the ` symbol).<\/span><\/p>\n

$consumerPath = Set-WmiInstance -Class ActiveScriptEventConsumer `<\/span><\/span><\/p>\n

 <\/span>-ComputerName $computer -Namespace $wmiNS `<\/span><\/span><\/p>\n

 <\/span>-Arguments @{name=”ToggleBits”; ScriptFileName=$scriptFileName;<\/span><\/span><\/p>\n

  <\/span>ScriptingEngine=”VBScript”}<\/span><\/span><\/p>\n

 <\/span><\/p>\n

Finally, I have to bind the consumer to the event. To do this, I have to create an instance of the __FilterToConsumerBinding<\/b> WMI class. The VBScript code to do this (seen yesterday) is seen here.<\/span><\/p>\n

‘Do the binding<\/span><\/span><\/p>\n

FTCB = “__filterToConsumerBinding”<\/span><\/span><\/p>\n

set objbindingclass=objActiveScriptConsumer.get(FTCB)<\/span><\/span><\/p>\n

set objbinding=objbindingclass.spawninstance_()<\/span><\/span><\/p>\n

objbinding.filter=filterpath<\/span><\/span><\/p>\n

objbinding.consumer=consumerpath<\/span><\/span><\/p>\n

objbinding.put_<\/span><\/span><\/p>\n

 <\/span><\/p>\n

In Windows PowerShell, I use the Set-WmiInstance<\/b> cmdlet to create and to configure a new instance of the class. In this script, I do not have to save the object that is returned (like I did in each of the two previous commands) and therefore I pipeline<\/span><\/a> the results to the Out-Null<\/b> Windows PowerShell cmdlet. One thing that I did not mention yesterday is that if a suitable event filter (__EventFilter<\/b>) already exists, or if a suitable event consumer class already exists, you do not have to create a new instance. All that must occur is for the event and the consumer to be bound together via the __FilterToConsumerBinding<\/b> class. Although it is unlikely that both a suitable consumer and a suitable filter would already exist, it is definitely possible that one or the other might exist. Here is the Windows PowerShell code to do the binding.<\/span><\/p>\n

Set-WmiInstance -Class __FilterToConsumerBinding -ComputerName $computer `<\/span><\/span><\/p>\n

  <\/span>-Namespace $wmiNS -arguments @{Filter=$filterPath; Consumer=$consumerPath} |<\/span><\/span><\/p>\n

  <\/span>out-null<\/span><\/span><\/p>\n

 <\/span><\/p>\n

One thing I like to do when I am finished creating everything for the new permanent event consumer is to check whether everything looks like it is created correctly. To do this, I use Windows PowerShell’s Get-WmiObject<\/span><\/a><\/b> cmdlet. With the gwmi<\/b> alias, this is short work, although I have to create a simple script to do this. As this is a quick script, I incorporated the gwmi<\/b> alias instead of typing Get-WmiObject<\/b>. <\/span><\/p>\n

ReportPermenantEventConsumer.ps1<\/strong><\/p>\n

gwmi __EventFilter <\/span><\/span><\/p>\n

gwmi ActiveScriptEventConsumer -Namespace root\\subscription<\/span><\/span><\/p>\n

gwmi __FilterToConsumerBinding -Namespace root\\subscription<\/span><\/span><\/p>\n

 <\/span><\/p>\n

The report from these three commands is seen here.<\/span><\/p>\n

PS C:\\Windows\\system32> C:\\data\\ScriptingGuys\\2010\\HSG_12_6_10\\ReportPermenantEventConsumer.ps1<\/span><\/span><\/p>\n

 <\/span><\/span><\/p>\n

__GENUS          <\/span>: 2<\/span><\/span><\/p>\n

__CLASS          <\/span>: __EventFilter<\/span><\/span><\/p>\n

__SUPERCLASS     <\/span>: __IndicationRelated<\/span><\/span><\/p>\n

__DYNASTY        <\/span>: __SystemClass<\/span><\/span><\/p>\n

__RELPATH        <\/span>: __EventFilter.Name=”Win32ServiceModification”<\/span><\/span><\/p>\n

__PROPERTY_COUNT : 6<\/span><\/span><\/p>\n

__DERIVATION     <\/span>: {__IndicationRelated, __SystemClass}<\/span><\/span><\/p>\n

__SERVER         <\/span>: MRED1<\/span><\/span><\/p>\n

__NAMESPACE      <\/span>: ROOT\\cimv2<\/span><\/span><\/p>\n

__PATH           <\/span>: \\\\MRED1\\ROOT\\cimv2:__EventFilter.Name=”Win32ServiceModification”<\/span><\/span><\/p>\n

CreatorSID       <\/span>: {1, 5, 0, 0…}<\/span><\/span><\/p>\n

EventAccess      <\/span>: <\/span><\/span><\/p>\n

EventNamespace   <\/span>: root\\cimv2<\/span><\/span><\/p>\n

Name             <\/span>: Win32ServiceModification<\/span><\/span><\/p>\n

Query            <\/span>: Select * from __InstanceModificationEvent within 10 where <\/span><\/span><\/p>\n

                     <\/span>targetInstance isa ‘Win32_Service’ and targetInstance.Name = ‘Bits’<\/span><\/span><\/p>\n

QueryLanguage    <\/span>: WQL<\/span><\/span><\/p>\n

 <\/span><\/span><\/p>\n

__GENUS          <\/span>: 2<\/span><\/span><\/p>\n

__CLASS          <\/span>: ActiveScriptEventConsumer<\/span><\/span><\/p>\n

__SUPERCLASS     <\/span>: __EventConsumer<\/span><\/span><\/p>\n

__DYNASTY        <\/span>: __SystemClass<\/span><\/span><\/p>\n

__RELPATH        <\/span>: ActiveScriptEventConsumer.Name=”ToggleBits”<\/span><\/span><\/p>\n

__PROPERTY_COUNT : 8<\/span><\/span><\/p>\n

__DERIVATION     <\/span>: {__EventConsumer, __IndicationRelated, __SystemClass}<\/span><\/span><\/p>\n

__SERVER         <\/span>: MRED1<\/span><\/span><\/p>\n

__NAMESPACE      <\/span>: ROOT\\subscription<\/span><\/span><\/p>\n

__PATH           <\/span>: \\\\MRED1\\ROOT\\subscription:ActiveScriptEventConsumer.Name=”ToggleBits”<\/span><\/span><\/p>\n

CreatorSID       <\/span>: {1, 5, 0, 0…}<\/span><\/span><\/p>\n

KillTimeout      <\/span>: 0<\/span><\/span><\/p>\n

MachineName      <\/span>: <\/span><\/span><\/p>\n

MaximumQueueSize : <\/span><\/span><\/p>\n

Name             <\/span>: ToggleBits<\/span><\/span><\/p>\n

ScriptFilename   <\/span>: C:\\fso\\ToggleBrowserService.vbs<\/span><\/span><\/p>\n

ScriptingEngine  <\/span>: VBScript<\/span><\/span><\/p>\n

ScriptText       <\/span>: <\/span><\/span><\/p>\n

 <\/span><\/span><\/p>\n

__GENUS                 <\/span>: 2<\/span><\/span><\/p>\n

__CLASS                 <\/span>: __FilterToConsumerBinding<\/span><\/span><\/p>\n

__SUPERCLASS            <\/span>: __IndicationRelated<\/span><\/span><\/p>\n

__DYNASTY               <\/span>: __SystemClass<\/span><\/span><\/p>\n

__RELPATH               <\/span>: __FilterToConsumerBinding.Consumer=”ActiveScriptEventConsumer.Name=\\”ToggleBits\\””,Filter=”__EventFilter.Name=\\”Win32ServiceModification\\””<\/span><\/span><\/p>\n

__PROPERTY_COUNT        <\/span>: 7<\/span><\/span><\/p>\n

__DERIVATION            <\/span>: {__IndicationRelated, __SystemClass}<\/span><\/span><\/p>\n

__SERVER                <\/span>: MRED1<\/span><\/span><\/p>\n

__NAMESPACE             <\/span>: ROOT\\subscription<\/span><\/span><\/p>\n

__PATH                  <\/span>: \\\\MRED1\\ROOT\\subscription:__FilterToConsumerBinding.Consumer=”ActiveScriptEventConsumer.Name=\\”ToggleBits\\””,Filter=”__EventFilter.Name=\\”Win32ServiceModification\\””<\/span><\/span><\/p>\n

Consumer                <\/span>: ActiveScriptEventConsumer.Name=”ToggleBits”<\/span><\/span><\/p>\n

CreatorSID              <\/span>: {1, 5, 0, 0…}<\/span><\/span><\/p>\n

DeliverSynchronously    <\/span>: False<\/span><\/span><\/p>\n

DeliveryQoS             <\/span>: <\/span><\/span><\/p>\n

Filter                  <\/span>: __EventFilter.Name=”Win32ServiceModification”<\/span><\/span><\/p>\n

MaintainSecurityContext : False<\/span><\/span><\/p>\n

SlowDownProviders       <\/span>: False<\/span><\/span><\/p>\n

 <\/span><\/span><\/p>\n

Cleanup involves deleting each of the three new instances. In Windows PowerShell it is easy to delete these instances. I use the Remove-WMIObject<\/b> cmdlet. I have to be very careful doing this to make sure that I delete only the instances I previously created. It turns out that my machine already has an instance of one of the classes installed. I use the Where-Object to filter the one I created. Proper WMI methodology would be to connect to the specific instance of the __FilterToConsumer<\/b> binding class. But because this is an association class, it has two keys in its path to the instance. The Path to this class is seen here. <\/span><\/p>\n

__PATH                  <\/span>: \\\\MRED1\\ROOT\\subscription:__FilterToConsumerBinding.Consumer=”ActiveScriptEventConsumer.Name=\\”ToggleBits\\””,Filter=”__EventFilter.Name=\\”Win32ServiceModification\\””<\/span><\/span><\/p>\n

 <\/span><\/p>\n

Using Windows PowerShell and the where-object I filter the name of the __EventFilter<\/b>, and pipeline the object to the Remove-WmiObject<\/b> cmdlet and I am done; no fussing with embedded quotation marks, no worrying about line wrapping or any of the typical problems confronting composite keys in WMI. Here is my cleanup code.<\/span><\/p>\n

gwmi __EventFilter | Remove-WmiObject<\/span><\/span><\/p>\n

gwmi ActiveScriptEventConsumer -Namespace root\\subscription | Remove-WmiObject<\/span><\/span><\/p>\n

gwmi __FilterToConsumerBinding -Namespace root\\subscription | <\/span><\/span><\/p>\n

Where-Object { $_.filter -match ‘Win32ServiceModification’} | Remove-WmiObject<\/span><\/span><\/p>\n

 <\/span><\/span><\/p>\n

CD, that is all there is to working with permanent WMI event consumers. Permanent event consumer week will continue tomorrow when guest blogger Trevor Sullivanwill discuss a Windows PowerShell permanent event consumer module<\/span><\/a>. <\/span><\/p>\n

I invite you to follow me on Twitter<\/span><\/a> or Facebook<\/span><\/a>. If you have any questions, send email to me at scripter@microsoft.com<\/span><\/a> or post them on the Official Scripting Guys Forum.<\/span><\/a>. See you tomorrow. Until then, peace.<\/span><\/p>\n

 <\/span><\/p>\n

Ed Wilson, Microsoft Scripting Guy<\/span><\/b> <\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

Summary: Learn how to use Windows PowerShell to monitor and to respond to events on your computer or server without the need to run a script.   Hey, Scripting Guy! I am interested in learning how to use Windows PowerShell to create a Windows Management Instrumentation (WMI) permanent event consumer. Basically, what I need is […]<\/p>\n","protected":false},"author":595,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[42,3,4,45,6],"class_list":["post-16291","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting","tag-events-and-monitoring","tag-scripting-guy","tag-scripting-techniques","tag-windows-powershell","tag-wmi"],"acf":[],"blog_post_summary":"

Summary: Learn how to use Windows PowerShell to monitor and to respond to events on your computer or server without the need to run a script.   Hey, Scripting Guy! I am interested in learning how to use Windows PowerShell to create a Windows Management Instrumentation (WMI) permanent event consumer. Basically, what I need is […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/16291","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/595"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=16291"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/16291\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=16291"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=16291"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=16291"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}