Need a sample query for example that can watch for the origination of
just a .XLS file in WMI. So far I've come up with this (note, not
entirely my work, cobbled together from websites as I'm still new to
WMI).

SELECT * FROM __InstanceCreationEvent WITHIN 10
WHERE TargetInstance ISA "CIM_DirectoryContainsFile"
AND TargetInstance.GroupComponent = "Win32_Directory.Name=\"e:\\\\Test
\""

Now within test can I trigger it to only return .xls files? Are
wildcards allowed? Thanks!

This is what you are looking for:

http://www.microsoft.com/technet/scr...4/hey1011.mspx


--
This posting is provided "AS IS" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm
--
"tekiegreg" <codesweeper (AT) codesweep (DOT) com> wrote