批处理之家 - Powered by Discuz! Board

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colMonitoredProcesses = objWMIService. _
ExecNotificationQuery("select * from __instancecreationevent " _
& " within 1 where TargetInstance isa 'Win32_Process'")
i = 0
Do While i = 0
Set objLatestProcess = colMonitoredProcesses.NextEvent
Wscript.Echo objLatestProcess.TargetInstance.Name
Loop

复制代码

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colMonitoredProcesses = objWMIService. _
ExecNotificationQuery("select * from __instancedeletionevent " _
& "within 1 where TargetInstance isa 'Win32_Process'")
i = 0
Do While i = 0
Set objLatestProcess = colMonitoredProcesses.NextEvent
Wscript.Echo objLatestProcess.TargetInstance.Name
Loop

复制代码

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colServices = objWMIService. _
ExecNotificationQuery("Select * from __instancemodificationevent " _
& "within 30 where TargetInstance isa 'Win32_Service'")
i = 0
Do While i = 0
Set objService = colServices.NextEvent
If objService.TargetInstance.State <> _
objService.PreviousInstance.State Then
Wscript.Echo objService.TargetInstance.Name _
& " is " & objService.TargetInstance.State _
& ". The service previously was " & objService.PreviousInstance.State & "."
End If
Loop

复制代码

Const LOCAL_HARD_DISK = 3
strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colMonitoredDisks = objWMIService.ExecNotificationQuery _
("Select * from __instancemodificationevent within 30 where " _
& "TargetInstance isa 'Win32_LogicalDisk'")
i = 0
Do While i = 0
Set objDiskChange = colMonitoredDisks.NextEvent
If objDiskChange.TargetInstance.DriveType = LOCAL_HARD_DISK Then
If objDiskChange.TargetInstance.Size < 100000000 Then
Wscript.Echo "Hard disk space is below 100000000 bytes."
End If
End If
Loop

复制代码

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colDiskDrives = objWMIService.ExecQuery _
("Select * from win32_perfformatteddata_perfdisk_logicaldisk where Name <> '_Total'")
For each objDiskDrive in colDiskDrives
Wscript.Echo "Drive Name: " & objDiskDrive.Name
Wscript.Echo "Free Space: " & objDiskDrive.FreeMegabytes
Next

复制代码

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate, (Security)}!\\" & strComputer & "\root\cimv2")
Set colMonitoredEvents = objWMIService.ExecNotificationQuery _
("Select * from __instancecreationevent where TargetInstance isa 'Win32_NTLogEvent' and TargetInstance.EventCode = '533' ")
Do
Set objLatestEvent = colMonitoredEvents.NextEvent
strAlertToSend = objLatestEvent.TargetInstance.User _
& " attempted to access DatabaseServer."
Wscript.Echo strAlertToSend
Loop

复制代码

StrComputer = "."
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate, (Security)}!\\" & strComputer & "\root\cimv2")
Set colMonitoredEvents = objWMIService.ExecNotificationQuery _
("Select * from __instancecreationevent where TargetInstance isa 'Win32_NTLogEvent' and TargetInstance.EventCode = '528' ")
Do
Set objLatestEvent = colMonitoredEvents.NextEvent
strAlertToSend = objLatestEvent.TargetInstance.user _
&MSGBOX ("某个用户已经成功登陆此计算机！.",48,"警告！")
Loop

复制代码

Set wmiServices = GetObject("winmgmts:root/default")
Set wmiSink = WScript.CreateObject("WbemScripting.SWbemSink", "SINK_")
wmiServices.ExecNotificationQueryAsync wmiSink, _
"SELECT * FROM RegistryKeyChangeEvent WHERE Hive='HKEY_LOCAL_MACHINE' AND " & _
"KeyPath='SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion'"
WScript.Echo "Listening for Registry Change Events..." & vbCrLf
While(1)
WScript.Sleep 1000
Wend
Sub SINK_OnObjectReady(wmiObject, wmiAsyncContext)
WScript.Echo "Received Registry Change Event" & vbCrLf & _
"------------------------------" & vbCrLf & _
wmiObject.GetObjectText_()
End Sub

复制代码

'>nul 2>nul&@echo off&cls&color 70&setlocal EnableDelayedExpansion&set Get=2&set /a BSc=59&set /a BSl=3&set sec=%time:~3,2%&set min=0&mode con: cols=!BSc! lines=!BSl!&title C^:\^>Process Monitor_
':setPuocess>nul 2>nul
'>nul 2>nul&cls&echo.       Please input the name of target process^:
'>nul 2>nul&set /p Puocess1= ^>
'>nul 2>nul&if "!Puocess1!"=="" goto :setPuocess>nul 2>nul
':SetAlarm>nul 2>nul
'>nul 2>nul&cls&echo. If catch up the target object then send out alarm ? (Y/N)
'>nul 2>nul&set /p alarm= ^>
'>nul 2>nul&If !alarm!==Y (set "alarm1= ALARM  ON"&set "alarm2= ALARM OFF "&set "c1=a"&set "c2=c"&goto :box>nul 2>nul)
'>nul 2>nul&If !alarm!==y (set "alarm1= ALARM  ON"&set "alarm2= ALARM OFF "&set "c1=a"&set "c2=c"&goto :box>nul 2>nul)
'>nul 2>nul&If !alarm!==N (set "alarm2= ALARM  ON"&set "alarm1= ALARM OFF "&set "c2=a"&set "c1=c"&goto :box>nul 2>nul)
'>nul 2>nul&If !alarm!==n (set "alarm2= ALARM  ON"&set "alarm1= ALARM OFF "&set "c2=a"&set "c1=c"&goto :box>nul 2>nul)
'>nul 2>nul&goto :SetAlarm>nul 2>nul
':box>nul 2>nul
'>nul 2>nul&set /a BSc-=2
'>nul 2>nul&mode con: cols=!BSc!
'>nul 2>nul&If not !BSc!==15 ( goto :box>nul 2>nul )
'>nul 2>nul&title !min! /mins
':loop>nul 2>nul
'>nul 2>nul&cls&color 0a
'>nul 2>nul&if not %time:~3,2%==!sec! ( set /a min+=1 &set sec=%time:~3,2%&title  !min! /mins )
'>nul 2>nul&for /f  "skip=3" %%a in ('tasklist /svc /fi "imagename eq !Puocess1!" 2^>NUL') do set Puocess2=%%a
'>nul 2>nul&if "!Puocess1!"=="!Puocess2!" set Get=1
'>nul 2>nul&call color %%c!Get!%%0&echo.&call echo.%%alarm!Get!%%&set Get=2&set Puocess2=
'>nul 2>nul&CScript.EXE ""%0 2"" //Nologo //e:VBS
'>nul 2>nul&goto :loop>nul 2>nul
Wscript.Sleep 1000