Scheduling a task using powershell to restart a windows service on basis of Event ID 20227

Question

Scheduling a task using powershell to restart a windows service on basis of Event ID 20227.

This is to restart the IKE and AuthIP IPsec Keying Modules service when the machine gets connected to the LAN and this will disconnect the VPN connection.

Please help. Thanks.

Answer 1

Hi,

You can copy the event filter XML of the trigger from the Task Scheduler.

To create a trigger you can refer to Cathersal's reply from the below link
https://social.microsoft.com/Forums/Azure/en-US/3882c805-be26-416c-b636-8502d3fb877f/eventtriggered-task-via-powershell?forum=Offtopic

$CIMTriggerClass = Get-CimClass -ClassName MSFT_TaskEventTrigger -Namespace Root/Microsoft/Windows/TaskScheduler:MSFT_TaskEventTrigger  
$Trigger = New-CimInstance -CimClass $CIMTriggerClass -ClientOnly  
$Trigger.Subscription =@"  
<QueryList>  
  <Query Id="0" Path="Application">  
    <Select Path="Application">*[System[Provider[@Name='RasClient'] and (Level=1  or Level=2) and (EventID=20227)]]</Select>  
  </Query>  
</QueryList>  
"@  
$Trigger.Enabled = $True   
$Action = New-ScheduledTaskAction  -Execute 'Powershell.exe' -Argument "-ExecutionPolicy RemoteSigned -Command $Command"  
Register-ScheduledTask -Action $Action -Trigger $Trigger -TaskName "  Startup"  -Description 'test' -User 'System' -Force   

Best Regards,
Ian Xue

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.