New Blog post - Permanent WMI Event Handling #51

doctordns · 2021-04-28T16:54:43Z

PR Summary

PR Checklist

Do you want this post to be published on a specific date?: Y/N [Specify date]:
I have read the contributors guide and followed the style and process guidelines
PR has a meaningful title
Includes content related an open issue
- see Closing issues using keywords.
This PR is ready to merge and is not Work in Progress

…nto WMIEvent1

sdwheeler

See my comments and suggestions. Call me in Teams if you have questions.

sdwheeler · 2021-05-06T15:12:29Z

Posts/2021/04/tfl-WMIEventHandler.md

+## WMI
+Windows Management Instrumentation (WMI) is an important component of the Windows operating system.


Suggested change

## WMI

Windows Management Instrumentation (WMI) is an important component of the Windows operating system.

## WMI

Windows Management Instrumentation (WMI) is an important component of the Windows operating system.

sdwheeler · 2021-05-06T15:15:40Z

Posts/2021/04/tfl-WMIEventHandler.md

+And for some more details on using WMI and Powershell, look at using PowerShell 7 and WMI, look at [my recently published PowerShell 7 book](https://www.wiley.com/en-gb/PowerShell+7+for+IT+Professionals-p-9781119644705).
+In chapter 9, I devote a chapter to WMI and using the CIM cmdlets.
+To see just the scripts for that chapter, see my [GitHub repository](https://github.com/doctordns/Wiley20/tree/master/09%20-%20WMI).
+The scripts show you the basics of WMI and PowerShell 7.


One of the tenets of this blog is that we don't allow marketing. I am OK with linking to your book, in the right context. See my suggestion at the bottom of the article. I think it reads better there and comes off like a pitch for your book.

Suggested change

And for some more details on using WMI and Powershell, look at using PowerShell 7 and WMI, look at [my recently published PowerShell 7 book](https://www.wiley.com/en-gb/PowerShell+7+for+IT+Professionals-p-9781119644705).

In chapter 9, I devote a chapter to WMI and using the CIM cmdlets.

To see just the scripts for that chapter, see my [GitHub repository](https://github.com/doctordns/Wiley20/tree/master/09%20-%20WMI).

The scripts show you the basics of WMI and PowerShell 7.

sdwheeler · 2021-05-06T15:16:31Z

Posts/2021/04/tfl-WMIEventHandler.md

+
+In writing this article, I assume you have an understanding of WMI.
+In specific, I assume you understand WMI namespaces, classes, properties, and methods.
+If not, you might like to look at the [WMI Documentation](https://docs.microsoft.com/windows/win32/wmisdk/wmi-start-page)


Suggested change

If not, you might like to look at the [WMI Documentation](https://docs.microsoft.com/windows/win32/wmisdk/wmi-start-page)

If not, you might like to look at the [WMI Documentation](https://docs.microsoft.com/windows/win32/wmisdk/wmi-start-page).

will add the full stop.

sdwheeler · 2021-05-06T15:19:10Z

Posts/2021/04/tfl-WMIEventHandler.md

+This script displays a list of the current members of the Enterprise Admins group to a log file and reports whether the membership now contains unauthorised users.
+If the script finds that an unauthorised user is now a group member, it writes details to a text file for you to review later.


Suggested change

This script displays a list of the current members of the Enterprise Admins group to a log file and reports whether the membership now contains unauthorised users.

If the script finds that an unauthorised user is now a group member, it writes details to a text file for you to review later.

This script displays a list of the current members of the **Enterprise Admins** group to a log file and reports whether the membership now contains unauthorized users.

If the script finds that an unauthorized user is now a group member, it writes details to a text file for you to review later.

will revise for American English

sdwheeler · 2021-05-06T15:20:10Z

Posts/2021/04/tfl-WMIEventHandler.md

+In this post, you want to detect whether an unauthorised user is a member of the Enterprise Admins group.
+You must first create a file of authorised users.


Suggested change

In this post, you want to detect whether an unauthorised user is a member of the Enterprise Admins group.

You must first create a file of authorised users.

In this post, you want to detect whether an unauthorized user is a member of the **Enterprise Admins** group.

You must first create a file of authorized users.

will update for US english

sdwheeler · 2021-05-06T15:27:53Z

Posts/2021/04/tfl-WMIEventHandler.md

+
+# 11. Tidying up


Suggested change

# 11. Tidying up

# 11. Tidying up

removed blank line.

sdwheeler · 2021-05-06T15:28:06Z

Posts/2021/04/tfl-WMIEventHandler.md

+Remove-ADGroupMember @RGMHT
+


Suggested change

Remove-ADGroupMember @RGMHT

Remove-ADGroupMember @RGMHT

removed blank line

sdwheeler · 2021-05-06T15:29:03Z

Posts/2021/04/tfl-WMIEventHandler.md

+Then it looks to see if the Enterprise Admins group contains unauthorised users - and if so, the script reports that fact to the log file.
+This script is fairly simple, and you can embellish. as needed.
+You could, for example, remove all unauthorised users.


Suggested change

Then it looks to see if the Enterprise Admins group contains unauthorised users - and if so, the script reports that fact to the log file.

This script is fairly simple, and you can embellish. as needed.

You could, for example, remove all unauthorised users.

Then it looks to see if the Enterprise Admins group contains unauthorized users - and if so, the script reports that fact to the log file.

This script is fairly simple, and you can embellish. as needed.

You could, for example, remove all unauthorized users.

changed to US ENglish

sdwheeler · 2021-05-06T15:29:37Z

Posts/2021/04/tfl-WMIEventHandler.md

+
+WMI eventing is very powerful and straightforward to implement.
+There are thousands of WMI events you could subscribe to and which may help troubleshooting activities.
+In this case, you are examining unauthorised changers to an AD group.


Suggested change

In this case, you are examining unauthorised changers to an AD group.

In this case, you are examining unauthorized changers to an AD group.

Posts/2021/04/tfl-WMIEventHandler.md

doctordns · 2021-05-07T09:08:40Z

This post is being moved into a new folder since it'll be posted in MAY!

doctordns added 4 commits April 26, 2021 12:01

1st draft of WMI Permanent Event Handler post

337da23

update console prompt in examples

54037e2

Merge branch 'main' of https://github.com/PowerShell/Community-Blog i…

286ac7e

…nto WMIEvent1

2nd draft of this post

ad51a35

doctordns mentioned this pull request Apr 28, 2021

Post idea - How Can I Be Notified Any Time a Service Goes Down? #52

Open

Merge branch 'main' into WMIEvent1

9595830

doctordns requested a review from sdwheeler May 2, 2021 15:58

sdwheeler requested changes May 6, 2021

View reviewed changes

doctordns closed this May 7, 2021

doctordns deleted the WMIEvent1 branch May 7, 2021 09:07

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

New Blog post - Permanent WMI Event Handling #51

New Blog post - Permanent WMI Event Handling #51

doctordns commented Apr 28, 2021 •

edited

Loading

sdwheeler left a comment

sdwheeler May 6, 2021

sdwheeler May 6, 2021

sdwheeler May 6, 2021

doctordns May 6, 2021

sdwheeler May 6, 2021

doctordns May 6, 2021

sdwheeler May 6, 2021

doctordns May 6, 2021

sdwheeler May 6, 2021

doctordns May 7, 2021

sdwheeler May 6, 2021

doctordns May 7, 2021

sdwheeler May 6, 2021

doctordns May 7, 2021

sdwheeler May 6, 2021

doctordns May 7, 2021

doctordns commented May 7, 2021

		## WMI
		Windows Management Instrumentation (WMI) is an important component of the Windows operating system.

	If not, you might like to look at the [WMI Documentation](https://docs.microsoft.com/windows/win32/wmisdk/wmi-start-page)
	If not, you might like to look at the [WMI Documentation](https://docs.microsoft.com/windows/win32/wmisdk/wmi-start-page).

		This script displays a list of the current members of the Enterprise Admins group to a log file and reports whether the membership now contains unauthorised users.
		If the script finds that an unauthorised user is now a group member, it writes details to a text file for you to review later.

		In this post, you want to detect whether an unauthorised user is a member of the Enterprise Admins group.
		You must first create a file of authorised users.

	In this case, you are examining unauthorised changers to an AD group.
	In this case, you are examining unauthorized changers to an AD group.

New Blog post - Permanent WMI Event Handling #51

New Blog post - Permanent WMI Event Handling #51

Conversation

doctordns commented Apr 28, 2021 • edited Loading

PR Summary

PR Checklist

sdwheeler left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

doctordns commented May 7, 2021

doctordns commented Apr 28, 2021 •

edited

Loading