Hi, when notepad.exe opens, the event will trigger and run START.bat but .bat file did not run at all. What is wrong with this script ?
$filter = ([wmiclass]"\\.\root\subscription:__EventFilter").CreateInstance()
$filter.QueryLanguage = "WQL"
$filter.Query = "Select * from win32_ProcessStartTrace where processname = 'notepad.exe'"
$filter.Name = "NotepadFilter"
$filter.EventNamespace = 'root\cimv2'
$result = $filter.Put()
$filterPath = $result.Path
$consumer = ([wmiclass]"\\.\root\subscription:CommandLineEventConsumer").CreateInstance()
$consumer.Name = 'NotepadConsumer'
$consumer.CommandLineTemplate = "cmd.exe /c C:\script\START.bat"
$consumer.ExecutablePath = "C:\Windows\System32\cmd.exe"
$consumer.WorkingDirectory = "C:\script"
$result = $consumer.Put()
$consumerPath = $result.Path
$bind = ([wmiclass]"\\.\root\subscription:__FilterToConsumerBinding").CreateInstance()
$bind.Filter = $filterPath
$bind.Consumer = $consumerPath
$result = $bind.Put()
$bindPath = $result.Path