Share This Post

Looking at WMI eventing from within Wbemtest – Part 1

I have spent quite a while looking through WMI in both SMS and ConfigMgr and my favorite tool to do exactly that is still good old Wbemtest. Wbemtest is probably the notepad of the WMI explorers, no fancy interface, no whistles or Bells, but it gets the job done, and is available on every Windows station.

In this post we will look at how to subscribe to Wmi events, in the ConfigMgr WMI namespace of course using wbemtest. I hope that this post will let you guys think about the enormous possibilities this opens to ConfigMgr admins.

Lets start by launching WbemTest.exe


This launches the wbemtest window like this, where you click the Connect button:


The connect window lets you define where to connect to:


1) The namespace obviously needs to reflect your environment so it should look like \\ConfigMgrServercomputername\sms\site_Sitecode

Where configmgrServerComputername and Sitecode are variables that need to represent your environment

You can specify an alternate user than the logged in user in domain\username format here with its password.

These credentials need to be in the distributed com users group on the ConfigMgr provider server computer and in the Sms Admins group when running wbemtest from a remote machine.

When executing locally specifying credentials is not possible.

Once connected you’ll have this window open


Now click the Notification query button as this is where you launch event subscription queries:


Now in your notification query box type the following text:

SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA “SMS_Advertisement” AND TargetInstance.comment != “MassDeployment”

And Click APPLY.


Let’s analyze what this notification query does:

  1. It will subscribe to an event class call __instancecreationevent (double underscore at the front), which means it will warn me when instances are created in the namespace that I am currently in
  2. the “Within 5” means that the wmi eventing system will check for new events every 5 seconds, so it will take a maximum of 5 seconds before I am told that a new instance has been created
  3. “Where targinstance ISA “SMS_Advertisement” is rather obvious and means that I am only intrested in advertisements being created
  4. TargetInstance.comment != “MassDeployment’” means that I am not intrested in advertisements being created that have the text MassDeployment in their comment field.

Their you have it, that’s how to subscribe to WMI events from wbemtest, in part 2 of this post (which should be online tomorrow, we’ll look at evaluating the results of our subscription).

And don’t forget schedules are boring, events are sexy!

Share This Post

Leave a Reply