__InstanceCreationEvent class

The __InstanceCreationEvent system class reports an instance creation event, which is a type of intrinsic event that is generated when a new instance is added to the namespace.

The following syntax is simplified from Managed Object Format (MOF) code and includes all inherited properties. Properties are listed in alphabetic order, not MOF order.


class __InstanceCreationEvent : __InstanceOperationEvent
  object TargetInstance;
  uint64 TIME_CREATED;


The __InstanceCreationEvent class has these types of members:


The __InstanceCreationEvent class has these properties.


Data type: uint8 array

Access type: Read-only

Descriptor used by the event provider to determine which users can receive the event. This property is inherited from __Event.


Data type: object

Access type: Read-only

Copy of the instance that was created. This property is inherited from __InstanceOperationEvent.


Data type: uint64

Access type: Read-only

Unique value that indicates the time at which the event was generated. This is a 64-bit value that represents the number of 100-nanosecond intervals after January 1, 1601. The information is in the Coordinated Universal Time (UTC) format. This property is inherited from __Event.

For more information about using uint64 values in scripts, see Scripting in WMI.


The __InstanceCreationEvent class is derived from __InstanceOperationEvent.

Creation of a resource: __InstanceCreationEvent

Suppose you are interested in receiving a notification if Notepad is run on a certain computer. When Notepad runs, a corresponding process is created. Processes can be managed by using WMI and are represented by the Win32_Process class. When Notepad starts running, a corresponding instance of the Win32_Process class becomes available through WMI. If you have registered your interest in this event (by issuing the appropriate event notification query), the availability of this instance results in the creation of an instance of the __InstanceCreationEvent class.

Notification queries that request notification of the creation of a resource and use intrinsic events all use syntax similar to the following:

SELECT * FROM __InstanceCreationEvent WITHIN PollingInterval WHERE TargetInstance ISA 'Win32_Process' and TargetInstance.Name = 'notepad.exe'

For a larger discussion of using __InstanceCreationEvent as a way to monitor file systems, see WMI and File System Monitoring on CodeProject.


The Create Permanent WMI Event registration to monitor files PowerShell example on TechNet Gallery uses __InstanceCreationEvent as part of a complex script to set up a permanent WMI event registration.

The PowerShell WMI Permanent Events PowerShell example on TechNet Gallery uses __InstanceCreationEvent as part of a demonstration script for setting up a permanent event registration.

The Monitor process creation event VBScript sample on TechNet uses __InstanceCreationEvent to monitors the first WMI instance creation event for Win32_Process.


Requirement Value
Minimum supported client
Windows Vista
Minimum supported server
Windows Server 2008
All WMI namespaces

See also


WMI System Classes