Here's a really neat tip sent by Jose Rodas, a real life OpsManager Support Engineer in Charlotte, North Carolina. If you've ever wanted to be altered whenever a new network file share is created or modified or deleted then he can show you how:
========
To create a rule that generates an alert when a network share is being created follow these steps:
- Within the UI, go to Authoring, select Rules
- Right click on Rules and go to Create New Rule
- On the Create Rule Wizard, expand Collection Rules > Event Based > WMI Event and click Next
- On the Rule Name and Description page, on Rule name, enter a name for your new rule
- On the Rule Target field, click Select, click on View all Targets, and select Windows Computer
- On the WMI Configuration window, on WMI Namespace, type root\cimv2
- On the Query Field, type the following:
SELECT * FROM __InstanceCreationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_Share'
Once this is entered simply finish your rule and now you'll get an alert any time a new network share is created. In addition, you can also use __InstanceModificationEvent and/or __InstanceDeletionEvent to detect modification or deletion of shares, respectively.
For more info, please review the following links:
- http://technet.microsoft.com/en-us/magazine/cc160917.aspx
- http://www.microsoft.com/technet/scriptcenter/guide/sas_wmi_ukpj.mspx?mfr=true
========
Thanks Jose!
J.C. Hornbeck | Manageability Knowledge Engineer
After creating this run my client reports an error. Is there something I am missing?
Event Type: Warning
Event Source: Health Service Modules
Event Category: None
Event ID: 10357
Date: 10/9/2008
Time: 11:12:43 AM
User: N/A
Computer: SERVER1
Description:
Module was unable to execute the notification query.
Error: 0x80041058
Details: Unparsable query.
One or more workflows were affected by this.
Workflow name: MomUIGeneratedRuledd91b8487b46473b88e82c1b4c87a518
Instance name: server1.com
Instance ID: {31BF3F9A-B868-8B0E-34D6-7D09A8D1F4A7}
Management group: USA
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
thank you