__InstanceModificationEvent class

Article
11/09/2023

The __InstanceModificationEvent system class reports an instance modification event, which is a type of intrinsic event generated when an instance changes in the namespace.

The following syntax is simplified from Managed Object Format (MOF) code and includes all inherited properties. Properties are listed in alphabetic order, not MOF order.

Syntax

class __InstanceModificationEvent : __InstanceOperationEvent
{
  object PreviousInstance;
  uint8  SECURITY_DESCRIPTOR[];
  object TargetInstance;
  uint64 TIME_CREATED;
};

Members

The __InstanceModificationEvent class has these types of members:

Properties

Properties

The __InstanceModificationEvent class has these properties.

PreviousInstance

Data type: object
Access type: Read-only

Copy of the instance prior to modification.

SECURITY_DESCRIPTOR

Data type: uint8 array
Access type: Read-only

Descriptor used by the event provider to determine which users can receive the event. This property is inherited from __Event.

TargetInstance

Data type: object
Access type: Read-only

New version of the changed instance. This property is inherited from __InstanceOperationEvent.

TIME_CREATED

Data type: uint64
Access type: Read-only

Unique value that indicates the time at which the event was generated. This is a 64-bit value that represents the number of 100-nanosecond intervals after January 1, 1601. The information is in the Coordinated Universal Times (UTC) format. This property is inherited from __Event.

For more information about using uint64 values in scripts, see Scripting in WMI.

Remarks

The __InstanceModificationEvent class is derived from __InstanceOperationEvent.

Modification of a resource: __InstanceModificationEvent

Suppose you suspect that a management application you are using is erroneously changing the startup type of a service on one of your servers. You want to write a WMI script to monitor any modifications made to the configuration of the service. As soon as a modification is made to a service, its corresponding TargetInstance reflects the modification.

If you register your interest in this event, a modification to the configuration of the service results in the creation of an instance of the __InstanceModificationEvent class.

Notification queries that request notification of the modification of a resource and use intrinsic events all use syntax similar to the following:

SELECT * FROM __InstanceModificationEvent WITHIN PollingInterval WHERE TargetInstance ISA 'Win32_Service' and TargetInstance.Name = 'alerter'

Requirements

Requirement	Value
Minimum supported client	Windows Vista
Minimum supported server	Windows Server 2008
Namespace	All WMI namespaces