Skip to content

Instantly share code, notes, and snippets.

Show Gist options
  • Select an option

  • Save developerprofiles/073bebd4c6e80346ef9fe1958b931a7f to your computer and use it in GitHub Desktop.

Select an option

Save developerprofiles/073bebd4c6e80346ef9fe1958b931a7f to your computer and use it in GitHub Desktop.
PowerShell code to watch for Active Directory Events
<#
This is old code that still works in Windows PowerShell
as a temporary event subscriber for Active Directory events.
#>
Function Get-WmiADEvent {
Param([string]$query)
$path="root\directory\ldap"
$EventQuery = New-Object System.Management.WQLEventQuery $query
$scope = New-Object System.Management.ManagementScope $path
$watcher = New-Object System.Management.ManagementEventWatcher $scope,$EventQuery
$options = New-Object System.Management.EventWatcherOptions
$options.TimeOut = [timespan]"0.0:0:1"
$watcher.Options = $options
cls
Write-Host ("Waiting for events in response to: {0}" -F $EventQuery.querystring) -backgroundcolor cyan -foregroundcolor black
$watcher.Start()
while ($true) {
trap [System.Management.ManagementException] {continue}
$evt=$watcher.WaitForNextEvent()
if ($evt) {
$evt.TargetInstance | select *
Clear-Variable evt
}
}
}
#Sample usage
# $query="Select * from __InstanceCreationEvent Within 10 where TargetInstance ISA 'DS_USER'"
# $query="Select * from __InstanceCreationEvent Within 10 where TargetInstance ISA 'DS_GROUP'"
# $query="Select * from __InstanceModificationEvent Within 10 where TargetInstance ISA 'DS_USER'"
# $query="Select * from __InstanceModificationEvent Within 10 where TargetInstance ISA 'DS_COMPUTER'"
#
# Get-WmiADEvent $query
@dorene12rock
Copy link

Hi. I sent a message as issue to you a few months ago (to developerprofile account, I guess it yours). I have a question about a repository that you have forked. I am going to delete my github account (not this account) but you (and other users) have forked my repository. If I ask, would you delete the repository? If you reply this comment can write what repository that would you delete. Looking forward to your reply because it's important for me. Also I have contacted with Github Support too and they said me that I should direct contact with you. Thx.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment