WQL WMI Query to watch for newly created files

Question

The following query should return a set of files that were created to the G drive in the folder test.

I am having trouble getting the following WMI query to work:

SELECT * FROM __InstanceCreationEvent WITHIN 1 WHERE 
TargetInstance ISA 'CIM_DataFile' AND TargetInstance.Drive = 'G:' AND 
TargetInstance.Path = '\\test\\'

The wbemtest utility gives me the following error:

Number: 0x80041017
Facility: WMI
Description: Invalid query

Thanks!

Answer 1

There is a space in the event class name, ie. __ InstanceCreationEvent should be __InstanceCreationEvent. Other than that you shouldn't use the LIKE operator in the query because it will force WMI to search your machine for all files that have 'test' as one of their parent directories. Better to use the exact path.

Answer 2

This is giving you Invalid query error as you are runnign this as a query, but _instancecreationEvent or all subClass of "_InstanceOperationEvent" must be called as NotificationQuery.

Thanks.