注册WMI事件时的Unparsable Query

Question

我正在尝试通过powershell在WMI中注册一个事件，但是下面的查询会继续返回'难以理解的查询'，我正在努力弄清楚。该文件夹已经创建。

$Action = { New-Event "PowerShell.ProcessCreated" -Sender $Sender -EventArguments $EventArgs.NewEvent.TargetInstance }
Register-WmiEvent -Query "SELECT * FROM __InstanceCreationEvent WITHIN 10 WHERE targetInstance ISA 'CIM_DataFile' AND targetInstance.Path = 'E:\MyTestFolder'" -SourceIdentifier "ProcessStarted" -Action $Action

事件是监视文件夹，事件的动作是向窗口中的事件查看器发送通知。

Answer 1

也许您可以尝试以下语法（我在路径中使用double \并引用双引号）：

$Action = { New-Event "PowerShell.ProcessCreated" -Sender $Sender -EventArguments $EventArgs.NewEvent.TargetInstance }
Register-WmiEvent -Query "SELECT * FROM __InstanceCreationEvent WITHIN 10 WHERE TargetInstance ISA `"CIM_DataFile`" AND TargetInstance.Path=`"E:\\MyTestFolder`"" -SourceIdentifier "ProcessStarted" -Action $Action