Shutdown flyout options

options.ps1

# https://learn.microsoft.com/en-us/windows/win32/wmisdk/monitoring-and-responding-to-events-with-standard-consumers
# https://www.google.com/search?q=%22from+RegistryValueChangeEvent%22+%22powershell%22+%22__FilterToConsumerBinding%22
# https://techcommunity.microsoft.com/blog/askperf/wmi-repository-corruption-or-not/375484

$Namespace = 'root/subscription'
# https://youtu.be/cz-M6cWlrdo?si=jGeD8M-aAtbR_IRv
$Path = 'HKLM:\SOFTWARE\Microsoft\WindowsUpdate\Orchestrator'
$ValueName = 'ShutdownFlyoutOptions'

# Create an instance of the event filter
# The filter queries for instance creation event
# for instances of the RegistryValueChangeEvent class
#
# https://learn.microsoft.com/en-us/windows/win32/wmisdk/creating-an-event-filter
$prop = @{
    "Name"           = 'Shutdown flyout options Filter'
    "QueryLanguage"  = 'WQL'
    # https://learn.microsoft.com/en-us/windows/win32/wmisdk/determining-the-type-of-event-to-receive#extrinsic-events
    # https://learn.microsoft.com/en-us/previous-versions/windows/desktop/regprov/registryvaluechangeevent
    "Query"          = "SELECT * FROM RegistryValueChangeEvent WHERE Hive='HKEY_LOCAL_MACHINE' AND KeyPath='SOFTWARE\\Microsoft\\WindowsUpdate\\Orchestrator' AND ValueName='ShutdownFlyoutOptions'"
    # RegistryValueChangeEvent only fire in root\default namespace
    "EventNamespace" = 'root/default'
}
# https://learn.microsoft.com/en-us/windows/win32/wmisdk/--eventfilter
$Filter = New-CimInstance -ClassName '__EventFilter' -Namespace $Namespace -Property $prop

# https://learn.microsoft.com/en-us/windows/win32/wmisdk/creating-a-logical-consumer
$prop = @{
    "Name"                = 'Shutdown flyout options Consumer'
    "CommandLineTemplate" = "powershell.exe -ep unrestricted -nop -c `"if (`$(gpv '$Path' -Name '$ValueName') -eq 10) {sp '$Path' -Name '$ValueName' -Value 15}`""
}
# https://learn.microsoft.com/en-us/windows/win32/wmisdk/standard-consumer-classes
# https://learn.microsoft.com/en-us/windows/win32/wmisdk/commandlineeventconsumer
$Consumer = New-CimInstance -ClassName 'CommandLineEventConsumer' -Namespace $Namespace -Property $prop

# Create an instance of the binding
# between filter and consumer instances.
#
# https://learn.microsoft.com/en-us/windows/win32/wmisdk/binding-an-event-filter-with-a-logical-consumer
$prop = @{
    "Filter"      = [ref]$Filter
    "Consumer"    = [ref]$Consumer
    "DeliveryQoS" = [uint32]0 # WMIMSG_FLAG_QOS_SYNCHRONOUS
}
# https://learn.microsoft.com/en-us/windows/win32/wmisdk/--filtertoconsumerbinding
New-CimInstance -ClassName '__FilterToConsumerBinding' -Namespace $Namespace -Property $prop

# https://github.com/doctordns/PacktPS72/blob/019a044af769d355fb3ea7f86089e5a6123db110/Scripts/Ch%2013%20-%20WMI/13.7%20-%20Implementing%20Permanent%20WMI%20Event%20Handling.ps1#L33-L47
# or %WINDIR%\System32\wbem\wbemtest.exe