Skip to content

Commit 2ddcca7

Browse files
pcgeek86pcgeek86
committed
Initial commit
Moving PowerEvents project from CodePlex to GitHub.
0 parents  commit 2ddcca7

File tree

98 files changed

+4083
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

98 files changed

+4083
-0
lines changed

‎Functions/Get-ToDoList.ps1

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
<#
2+
3+
Author: Trevor Sullivan
4+
Date: 2014-02-09
5+
Purpose: Retrieves a list of TODO items from the supporting scripts of this
6+
PowerShell module, and indicates the line number and file in which each
7+
item is located.
8+
#>
9+
10+
Clear-Host;
11+
$ScriptList = Get-ChildItem -Path $PSScriptRoot\* -Include *.ps1;
12+
13+
foreach ($Script in $ScriptList) {
14+
$Result = (Get-Content -Path $Script.FullName) -match '(?<=#.*)(?<!DONE.*)TODO(?!.*DONE)';
15+
$Result | Select-Object -Property PSChildName,ReadCount,@{ Name = 'String'; Expression = { $_.Trim(); } };
16+
}

‎Functions/Get-WmiEventBinding.ps1

+106
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
function Get-WmiEventBinding
2+
{
3+
[CmdletBinding(SupportsShouldProcess = $false)]
4+
<#
5+
.Synopsis
6+
Retrieves WMI event bindings
7+
8+
.Description
9+
The Get-WmiEventBinding function retrieves WMI event binding instances from the specified computer
10+
and WMI namespace. You can specify either the -Filter or -Consumer parameter, to identify which
11+
WMI event bindings you would like to retrieve, based on the bound filter or consumer. WMI event
12+
bindings are instances of the __FilterToConsumerBinding WMI class.
13+
14+
.Parameter Namespace
15+
The namespace in which to retrieve WMI event bindings from.
16+
17+
.Parameter Filter
18+
The name of the WMI event filter that you would like to retrieve
19+
20+
.Parameter ComputerName
21+
The computer on which to retrieve __FilterToConsumerBinding instances.
22+
#>
23+
Param(
24+
# The name of the WMI event filter to retrieve. The name property is the key on the __FilterToConsumerBinding system WMI class.
25+
[Parameter(
26+
Mandatory = $false
27+
, HelpMessage = "Please specify the name of the WMI event filter instance that you would like to retrieve bindings for."
28+
, ParameterSetName = 'filter'
29+
)]
30+
[string]
31+
${Filter}
32+
,
33+
[Parameter(ParameterSetName = 'consumer')]
34+
[string]
35+
${Consumer}
36+
,
37+
# The WMI namespace to retrieve event filters from.
38+
# TODO: Provide an option to retrieve ALL event filters from ALL namespaces?
39+
[Parameter(ValueFromPipelineByPropertyName = $true)]
40+
[Alias('ns')]
41+
[string]
42+
${Namespace}
43+
,
44+
[Parameter(ValueFromPipelineByPropertyName = $true)]
45+
[Alias('cn')]
46+
[ValidateScript({
47+
if (Test-Connection -ComputerName $_ -Count 1) { $true; }
48+
else { $false; }
49+
})]
50+
[string]
51+
${ComputerName} = '.'
52+
,
53+
# TODO: Implement parameter to allow searching of the query text
54+
[string]
55+
${QuerySearchString}
56+
,
57+
[Parameter(ParameterSetName = 'all')]
58+
[switch]
59+
${All}
60+
)
61+
62+
begin
63+
{
64+
# Get the cmdlet name for writing dynamic log messages
65+
${CmdletName} = $Pscmdlet.MyInvocation.MyCommand.Name
66+
${ParameterSetName} = $Pscmdlet.ParameterSetName;
67+
68+
Write-Verbose -Message "${CmdletName}: Start running BEGIN block";
69+
}
70+
71+
process {
72+
Write-Verbose -Message "${CmdletName}: Start running PROCESS block";
73+
74+
if (${ParameterSetName} = 'all') {
75+
$BindingList = Get-WmiObject -ComputerName ${ComputerName} -Namespace ${Namespace} -Class __FilterToConsumerBinding;
76+
}
77+
elseif (${ParameterSetName} = 'filter') {
78+
${WmiQuery} = "REFERENCES OF {__EventFilter='{0}'} WHERE ResultClass = __FilterToConsumerBinding" -f ${Filter};
79+
$BindingList = Get-WmiObject -ComputerName ${ComputerName} -Namespace ${Namespace} -Query ${WmiQuery} -ErrorAction Stop;
80+
}
81+
elseif (${ParameterSetName} = 'consumer') {
82+
${WmiQuery} = "REFERENCES OF {__EventConsumer='{0}'} WHERE ResultClass = __FilterToConsumerBinding" -f ${Consumer};
83+
$BindingList = Get-WmiObject -ComputerName ${ComputerName} -Namespace ${Namespace} -Query ${WmiQuery} -ErrorAction Stop;
84+
}
85+
# Get a list of WMI filter-to-consumer bindings
86+
87+
if ($BindingList) {
88+
Write-Output -InputObject $BindingList;
89+
}
90+
else {
91+
Write-Error -Message ('{0}: Could not find any matching WMI event bindings' -f ${CmdletName});
92+
}
93+
# Translate asterisks (wildcards) to percent signs (WMI wildcards)
94+
#${Name} = ${Name}.Replace("*", "%");
95+
}
96+
97+
end {
98+
}
99+
}
100+
101+
# Export the Get-WmiEventBinding function
102+
Export-ModuleMember -Function Get-WmiEventBinding;
103+
104+
# Export an alias for the function
105+
New-Alias -Name gwmib -Value Get-WmiEventBinding;
106+
Export-ModuleMember -Alias gwmib

‎Functions/Get-WmiEventConsumer.ps1

+134
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,134 @@
1+
function Get-WmiEventConsumer
2+
{
3+
<#
4+
.Synopsis
5+
Retrieves WMI event consumer objects.
6+
7+
.Description
8+
Retrieves WMI event consumers instances based on criteria passed to the function. The -Namespace All parameter value can be used to retrieve instances in all WMI namespaces on a given computer.
9+
10+
.Link
11+
http://trevorsullivan.net
12+
13+
.Link
14+
http://powershell.artofshell.com
15+
#>
16+
17+
[CmdletBinding(
18+
SupportsShouldProcess = $false
19+
, SupportsTransactions = $false
20+
, ConfirmImpact = 'Low'
21+
)]
22+
23+
#region PARAM block
24+
param (
25+
[parameter(
26+
Mandatory = $false
27+
, HelpMessage = "Please specify the name of event consumer you would like to retrieve."
28+
)]
29+
[string]
30+
${Name}
31+
,
32+
[Parameter(ValueFromPipelineByPropertyName = $true)]
33+
[string]
34+
${Namespace} = 'root\subscription'
35+
,
36+
# In the interest of think + type, I've adjusted these types from their actual WMI class names
37+
# EventLog = NTEventLogEventConsumer
38+
# LogFile = LogFileEventConsumer
39+
# Script = ActiveScriptEventConsumer
40+
# CommandLine = CommandLineEventConsumer
41+
# SMTP = SMTPEventConsumer
42+
[parameter(
43+
Mandatory = $false
44+
, HelpMessage = "Please specify the type of event consumer you would like to retrieve."
45+
)]
46+
[ValidateSet(
47+
'EventLog'
48+
, 'LogFile'
49+
, 'CommandLine'
50+
, 'Script'
51+
, 'SMTP'
52+
)]
53+
[alias('Type')]
54+
${ConsumerType}
55+
,
56+
[Parameter(ValueFromPipelineByPropertyName = $true)]
57+
[Alias('cn')]
58+
[ValidateScript({
59+
if (Test-Connection -ComputerName $_ -Count 1) { $true; }
60+
else { $false; }
61+
})]
62+
[string]
63+
${ComputerName} = '.'
64+
)
65+
#endregion PARAM block
66+
67+
Begin
68+
{
69+
# Get the cmdlet name for writing dynamic log messages
70+
${CmdletName} = $Pscmdlet.MyInvocation.MyCommand.Name;
71+
Write-Verbose -Message ('{0}: Start running BEGIN block' -f ${CmdletName});
72+
73+
$ConsumerClasses = @{
74+
Script = "ActiveScriptEventConsumer";
75+
SMTP = "SMTPEventConsumer";
76+
EventLog = "NTEventLogEventConsumer";
77+
LogFile = "LogFileEventConsumer";
78+
CommandLine = "CommandLineEventConsumer";
79+
}
80+
}
81+
82+
Process
83+
{
84+
Write-Verbose -Message ('{0}: Start running BEGIN block' -f ${CmdletName});
85+
86+
if (${Namespace} -ne 'All')
87+
{
88+
# Translate asterisks (wildcards) to percent signs (WMI wildcards)
89+
${Name} = ${Name}.Replace("*", "%")
90+
91+
# $ConsumerList is an array that holds a list of WMI event consumers returned from WMI.
92+
# If multiple namespaces are queries for consumers, this will consolidate the results into a single variable.
93+
$ConsumerList = @();
94+
95+
${ConsumerQuery} = "select * from __EventConsumer";
96+
if ($ConsumerType) {
97+
${ConsumerQuery} += " where __CLASS = '{0}'" -f ${ConsumerClasses}.${ConsumerType};
98+
}
99+
100+
Write-Verbose -Message ("${CmdletName}: Consumer query is: " + ${ConsumerQuery});
101+
${EventConsumerList} = Get-WmiObject -ComputerName ${ComputerName} -Query ${ConsumerQuery} -Namespace ${Namespace};
102+
103+
if (${EventConsumerList})
104+
{
105+
Write-Verbose -Message ("${CmdletName}: Retrieved " + $Filters.Count + " event consumers from the ${Namespace} namespace.");
106+
foreach ($EventConsumer in $EventConsumerList) {
107+
${ConsumerList} += ${EventConsumer};
108+
}
109+
}
110+
else
111+
{
112+
Write-Verbose -Message ("${CmdletName}: Could not find any consumers with the specified name and type.");
113+
}
114+
115+
116+
Write-Output -InputObject ${ConsumerList};
117+
}
118+
else
119+
{
120+
121+
}
122+
}
123+
124+
end {
125+
Write-Verbose -Message ('{0}: Start running END block' -f ${CmdletName});
126+
}
127+
}
128+
129+
# Export the Get-WmiEventConsumer function
130+
Export-ModuleMember -Function Get-WmiEventConsumer
131+
132+
# Create an alias for the function
133+
New-Alias -Name gwmic -Value Get-WmiEventConsumer;
134+
Export-ModuleMember -Alias gwmic;

‎Functions/Get-WmiEventFilter.ps1

+94
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
function Get-WmiEventFilter
2+
{
3+
[CmdletBinding(SupportsShouldProcess = $false)]
4+
<#
5+
.Synopsis
6+
Retrieves an existing WMI event filter.
7+
8+
.Description
9+
Retrieves an existing WMI event filter.
10+
11+
.Parameter Namespace
12+
The namespace in which to retrieve __EventFilter instances from.
13+
14+
.Parameter Name
15+
The name of the __EventFilter instance to retrieve.
16+
17+
.Parameter ComputerName
18+
The computer on which to retrieve __EventFilter instances.
19+
20+
.Parameter QuerySearchString
21+
String to search for inside the event filter's query text.
22+
23+
.Inputs
24+
25+
#>
26+
Param(
27+
# The name of the WMI event filter to retrieve. The name property is the key on the __EventFilter system WMI class.
28+
[Parameter(
29+
Mandatory = $false
30+
, HelpMessage = "Please specify the name of the __EventFilter instance you would like to retrieve. Wildcards are acceptable."
31+
, ValueFromPipelineByPropertyName = $true
32+
, ValueFromPipeline = $true
33+
)]
34+
[string]
35+
${Name}
36+
,
37+
# The WMI namespace to retrieve event filters from.
38+
# TODO: Provide an option to retrieve ALL event filters from ALL namespaces?
39+
[Parameter(ValueFromPipelineByPropertyName = $true)]
40+
[string]
41+
${Namespace} = 'root\subscription'
42+
,
43+
[Parameter(ValueFromPipelineByPropertyName = $true)]
44+
[ValidateScript({
45+
if (Test-Connection -ComputerName $_ -Count 1) { $true; }
46+
else { $false; }
47+
})]
48+
[string]
49+
${ComputerName} = '.'
50+
,
51+
# TODO: Implement parameter to allow searching of the query text
52+
[string]
53+
[ValidateNotNull()]
54+
${QuerySearchString}
55+
)
56+
57+
begin
58+
{
59+
${CmdletName} = $Pscmdlet.MyInvocation.MyCommand.Name;
60+
61+
Write-Debug -Message "${CmdletName}: `${Name} parameter's value is: ${Name}";
62+
Write-Debug -Message "${CmdletName}: `${Namespace} parameter's value is: ${Name}";
63+
Write-Debug -Message "${CmdletName}: `${QuerySearchString} parameter's value is: ${Name}";
64+
65+
if (${Name})
66+
{
67+
# Translate asterisks (wildcards) to percent signs (WMI wildcards)
68+
${Name} = ${Name}.Replace("*", "%");
69+
${EventFilters} = Get-WmiObject -Namespace ${Namespace} -Query "SELECT * FROM __EventFilter WHERE Name LIKE '${Name}'";
70+
}
71+
else
72+
{
73+
# Translate asterisks (wildcards) to percent signs (WMI wildcards)
74+
${QuerySearchString} = ${QuerySearchString}.Replace("*", "%");
75+
${EventFilters} = Get-WmiObject -Query "SELECT * FROM __EventFilter WHERE Query LIKE '${QuerySearchString}'";
76+
}
77+
78+
if (${EventFilters})
79+
{
80+
Write-Verbose -Message "${CmdletName}: Found $(${EventFilters}.psbase.Length) event filters";
81+
Write-Output -InputObject ${EventFilters};
82+
}
83+
else
84+
{
85+
Write-Warning -Message "${CmdletName}: No event filters were found with the specified criteria.";
86+
}
87+
}
88+
}
89+
90+
Export-ModuleMember -Function Get-WmiEventFilter;
91+
92+
# Create alias for the Get-WmiEventFilter function
93+
New-Alias -Name gwmif -Value Get-WmiEventFilter;
94+
Export-ModuleMember -Alias gwmif;

0 commit comments

Comments
 (0)