$computer = \"localhost\"\n$dte = get-date\n$ServiceName = \"'AdobeActiveFileMonitor6.0'\"\n<\/pre>\nNext we create our WMI event query. Today we are looking for an __instanceModificationEvent<\/b>. This is an event that will be triggered when something is modified. Yesterday we used an __instanceDeletionEvent<\/b> to monitor when a process went away, and on Monday we used an __instanceCreationEvent<\/b> to monitor when a process was created. The difference here is that a service that is defined always exists. The thing that is changing is its state (in other words, is it running or is it stopped?). This means the service is being modified, not created and deleted as in the case of a process. It is a subtle distinction, but one that is vital if the script is going to work. <\/p>\n
The other thing that is new about our WMI event query is that we are using a compound query. We are, of course, looking for changes in a service state, but we are also interested in only one specific instance of the service. The one whose name we have identified in the $ServiceName<\/b> variable. TargetInstance<\/b> gets created when the event is triggered. It holds a copy of the object in question. This means we can use any property from the class we are monitoring.<\/p>\n
The WMI event query is seen here:<\/p>\n
$Query = \"select * from __instanceModificationEvent within 5 where\n targetInstance isa 'win32_Service' AND targetInstance.name = $ServiceName\"\n<\/pre>\nWhen we have defined our WMI event query, we now want to print a message to the screen to let the user know that the script is doing something. To do this, we use the Write-Host<\/b> cmdlet as illustrated here: <\/p>\nWrite-Host \"Waiting for $ServiceName to be terminated ...\nYou will be notified within 5 seconds of service termination\n start time was $dte\"\n<\/pre>\nThen we do a plain old everyday WMI query. The reason to do this is we want to see if the service we are getting ready to stop will accept a stop<\/b> command. This is one way of reducing errors. We use the Get-WmiObject<\/b> cmdlet and specify the class we are querying is the Win32_Service<\/b> WMI class. We also select the computer whose name is stored in the $computer<\/b> variable. We use the filter<\/b> parameter to limit the results to only services specified in the $ServiceName<\/b> variable. This query is shown here:<\/p>\n$WMI=Get-WmiObject -Class Win32_Service -computername $computer `\n -filter \"name=$Servicename\"\n<\/pre>\nWe now want to stop the service if it will accept a stop<\/b> command. For this example script, we are using a service that does not have any dependencies. If we were to choose a service with dependencies, and if the service accepted a stop<\/b> command, we would receive error 3 in return, which means that dependent services are running. In our case we are not worrying about that because we know that our service has no dependencies. If it will accept a stop<\/b> command, we enter the rest of the script. This statement is seen here:<\/p>\nif($WMI.acceptstop)<\/pre>\nWhen we make it past the if<\/b> statement, we first create an instance of the ManagementEventWatcher<\/b> .NET Framework class. This class resides in the System.Management<\/b> .NET Framework namespace. To create the ManagementEventWatcher<\/b> class, we give it the WMI event query that we stored in the $query<\/b> variable. We store the resulting ManagementEventWatcher<\/b> in the $EventWatcher<\/b> variable as shown here: <\/p>\n{\n $Eventwatcher = New-Object management.managementEventWatcher $Query\n<\/pre>\nAfter we have created the ManagementEventWatcher<\/b>, we stop the service. To do this, we use the stopService<\/b> method from the managementObject<\/b> we stored as a result of our previous WMI query. When the stopService<\/b> method is called, it returns a value, and we capture the return code in the $rtn<\/b> variable. This is seen here: <\/p>\n$rtn=$WMI.stopservice()<\/pre>\nNext we display the return code from the method<\/b> call. To do this, we need to use a subexpression, and we use the dollar sign and a set of parentheses to constrain the unraveling effect of the variable inside expanding quotation marks. This is shown here:<\/p>\n\"Stopping $ServiceName returned $($rtn.ReturnValue)\"<\/pre>\nNow we use the ManagementEventWatcher<\/b> we stored in the $EventWatcher<\/b> variable, and we wait for the next event. To do this, we use the waitForNextEvent<\/b> method. When the ManagementEventWatcher<\/b> detects that the service has changed, the __instanceModificationEvent<\/b> is fired, and we store the returned managementObject<\/b> in the $event<\/b> variable. <\/p>\n
One thing to keep in mind: As written, this script works for services that take a bit of time to start and to stop. If you use this script on a fast service or on a fast computer, you will miss the event. But it is after all only a demo. In a real script with a real service, you would only be using this technique on a slow service anyway, so it is a moot point (which has nothing to do with cows by the way):<\/p>\n
$Event = $Eventwatcher.waitForNextEvent()<\/pre>\nWe can at this point in your script do whatever we need to do. We could start the service back up, or we could copy files that were locked by the service. In this demo script, we decide to simply print out all the properties of the modified instance of the service. To do this, we retrieve the targetInstance<\/b> property from the managementObject<\/b> and pipeline it to the Format-List<\/b> cmdlet. We select only the properties whose name begins with the letters a through z and are followed by any other characters. This allows us to filter out the system properties (as they all begin with a double underscore)<\/p>\n$Event.targetInstance |\n Format-List -property [a-z]*\n }\n<\/pre>\nWhen the script is run, you will see an output similar to this: <\/p>\n
![\"Image](\"http:\/\/img.microsoft.com\/library\/media\/1033\/technet\/images\/scriptcenter\/qanda\/hsg\/2009\/january\/hey0121\/Hsg_1_21_09-01.jpg\")
<\/p>\n
<\/p>\n
If the service was unable to accept a stop<\/b> command, we print out a message regarding that situation and exit the script as shown here:<\/p>\nELSE {\n \"$ServiceName unable to accept stop command\"\n exit\n }\n<\/pre>\nWell, CC, thank you for an interesting question. We hope you enjoyed our little excursion into compound WMI event queries and working with services. We will see you tomorrow, when we continue our discussions about WMI eventing. Until then, take care.<\/p>\n
<\/p>\n
Ed Wilson and Craig Liebendorfer, Scripting Guys<\/b><\/p>\n","protected":false},"excerpt":{"rendered":"
Hey, Scripting Guy! I have a problem. I am trying to script the backup of a data folder used by our database application. The problem is that as long as the database service is running, the files that are used are locked, and I am unable to copy them. I have found the service that […]<\/p>\n","protected":false},"author":595,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[146,42,3,4,45,6],"class_list":["post-54563","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting","tag-databases","tag-events-and-monitoring","tag-scripting-guy","tag-scripting-techniques","tag-windows-powershell","tag-wmi"],"acf":[],"blog_post_summary":"
Hey, Scripting Guy! I have a problem. I am trying to script the backup of a data folder used by our database application. The problem is that as long as the database service is running, the files that are used are locked, and I am unable to copy them. I have found the service that […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/54563","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/595"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=54563"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/54563\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=54563"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=54563"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=54563"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![\"Hey,](\"https:\/\/devblogs.microsoft.com\/wp-content\/uploads\/sites\/29\/2019\/02\/q-for-powertip.jpg\" "\\"Hey,")
<\/h2>\n![\"Spacer\"](\"https:\/\/devblogs.microsoft.com\/scripting\/wp-content\/uploads\/sites\/29\/2019\/05\/spacer.gif\")
![\"Hey,](\"https:\/\/devblogs.microsoft.com\/wp-content\/uploads\/sites\/29\/2019\/02\/a-for-powertip.jpg\" "\\"Hey,")
<\/p>\n