Редактиране

Споделяне чрез

Implementing Cross-Namespace Permanent Event Subscriptions

  • Статия

It is recommended that all permanent subscriptions be compiled into the \root\subscription namespace. This prevents the need to compile the permanent consumer into each namespace being used, which means that there is only one namespace to look for permanent subscriptions. Use the EventNamespace property of __EventFilter to implement a cross-namespace subscription.

When using the CommandLineEventConsumer, it is important to secure the executable you are launching. If the executable is not in a secure location, or secured with a strong access control list (ACL), anyone can replace your executable with one of their own. For more information about ACLs, see Creating a Security Descriptor for a New Object in C++.

The following Managed Object Format (MOF) code example shows a cross-namespace subscription.

#pragma namespace("\\root\\subscription")

instance of __EventFilter as $FLT
{
  Name = "Filter";
  Query = "SELECT * FROM __InstanceModificationEvent "
          "WHERE TargetInstance ISA \"Win32_LocalTime\" "
          "AND TargetInstance.Hour = 8 "
          "AND TargetInstance.Minute = 0 "
          "AND TargetInstance.Second = 0 "
          "AND TargetInstance.DayOfWeek = 6";
  QueryLanguage = "WQL";
  EventNamespace = "root\\cimv2";
};

instance of CommandLineEventConsumer as $CONS
{
  ExecutablePath = "cmd.exe";
  ShowWindowCommand = 7;
  RunInteractively = true;
};

instance of __FilterToConsumerBinding
{
  Consumer = $CONS;
  Filter = $FLT;
};