Managing WMI events

A key feature of WMI is its event handling. There are thousands of events that can occur within a Windows system that might be of interest. For example, you might want to know if someone adds a new member to a high-privilege AD group such as Enterprise Admins. You can tell WMI to notify you when such an event occurs, and then take whatever action is appropriate. For example, you might just print out an updated list of group members when group membership changes occur. You could also check a list of users who should be members of the group and take some action if the user added is not authorized.

Events are handled both by WMI itself and by WMI providers. WMI itself can signal an event should a change be detected in a CIM class – that is, any new, updated, or deleted class instance. You can detect changes, too, to entire classes or namespaces. WMI calls these events intrinsic events. One common intrinsic event would occur when you (or Windows) start...