SELECT * FROM __InstanceOperationEvent WITHIN 1 WHERE TargetInstance ISA "CIM_DataFile" AND TargetInstance.Drive="C:" AND TargetInstance.Path="\Data"
像这样的东西:
' Full path to the folder to monitor
sPath = "\\localhost\c$\Scripts"
sComputer = split(sPath,"\")(2)
sDrive = split(sPath,"\")(3)
sDrive = REPLACE(sDrive, "$", ":")
sFolders = split(sPath,"$")(1)
sFolders = REPLACE(sFolders, "\", "\\") & "\\"
' Create our WMI instance
Set objWMIService = GetObject("winmgmts:\\" & sComputer & "\root\cimv2")
' Begin monitoring
Set colMonitoredEvents = objWMIService.ExecNotificationQuery _
("SELECT * FROM __InstanceOperationEvent WITHIN 1 WHERE " _
& "TargetInstance ISA 'CIM_DataFile' AND " _
& "TargetInstance.Drive='" & sDrive & "' AND " _
& "TargetInstance.Path='" & sFolders & "'")
Wscript.Echo vbCrlf & Now & vbTab & _
"Begin Monitoring for a Folder Change Event..." & vbCrlf
Do
Set objLatestEvent = colMonitoredEvents.NextEvent
Select Case objLatestEvent.Path_.Class
Case "__InstanceCreationEvent"
WScript.Echo Now & vbTab & objLatestEvent.TargetInstance.FileName _
& " was created" & vbCrlf
Case "__InstanceDeletionEvent"
WScript.Echo Now & vbTab & objLatestEvent.TargetInstance.FileName _
& " was deleted" & vbCrlf
Case "__InstanceOperationEvent"
If objLatestEvent.TargetInstance.LastModified <> _
objLatestEvent.PreviousInstance.LastModified then
WScript.Echo Now & vbTab & objLatestEvent.TargetInstance.FileName _
& " was modified" & vbCrlf
End If
IF objLatestEvent.TargetInstance.LastAccessed <> _
objLatestEvent.PreviousInstance.LastAccessed then
WScript.Echo Now & vbTab & objLatestEvent.TargetInstance.FileName _
& " was accessed" & vbCrlf
End If
End Select
Loop
Set objWMIService = nothing
Set colMonitoredEvents = nothing
Set objLatestEvent = nothing
关于监视文件夹的活动:
您可以使用 WMI (CIM_DataFile) 来监视文件夹是否有任何修改,使用类似于以下内容的查询:
SELECT * FROM __InstanceOperationEvent WITHIN 1 WHERE TargetInstance ISA "CIM_DataFile" AND TargetInstance.Drive="C:" AND TargetInstance.Path="\Data"
像这样的东西: