#pragma namespace ("\\\\.\\Root\\BVTAPITEST") // register me as a Physical Event Consumer Provider. instance of __Win32Provider as $P { Name = "CmdLineEventConsumer"; Clsid = "{892C6A1B-266C-4699-96FA-2FF67D647FC8}"; }; instance of __EventConsumerProviderRegistration { Provider = $P; ConsumerClassNames = {"CmdLineEventConsumer"}; }; // This is my logical consumer class. You MUST derive a class from // __EventConsumer and you MUST add a [key] property. This // definition is tightly tied to the consumer that potentially // uses it. class CmdLineEventConsumer : __EventConsumer { [key] string Name; [read, write] string cmdLine; [read, write] uint8 showWindow; }; // Make an instance. Make more if want. instance of CmdLineEventConsumer { Name = "Start Notepad"; cmdLine = "notepad"; showWindow = 1; }; // These are for event binding. Normally, these are done separately // because everything above here is one-time only. instance of __EventFilter { Name = "New One"; QueryLanguage="WQL"; Query="select * from __InstanceCreationEvent where TargetInstance isa \"PermClass1\""; }; // register for the event. instance of __FilterToConsumerBinding { Consumer = "CmdLineEventConsumer.Name=\"Start Notepad\""; Filter = "__EventFilter.Name=\"New One\""; };