OpsMgr 2007: How to create a monitor to alert when a network share is created

Here's a really neat tip sent by Jose Rodas, a real life OpsManager Support Engineer in Charlotte, North Carolina.  If you've ever wanted to be altered whenever a new network file share is created or modified or deleted then he can show you how:


To create a rule that generates an alert when a network share is being created follow these steps:

  1. Within the UI, go to Authoring, select Rules
  2. Right click on Rules and go to Create New Rule
  3. On the Create Rule Wizard, expand Collection Rules > Event Based > WMI Event and click Next
  4. On the Rule Name and Description page, on Rule name, enter a name for your new rule
  5. On the Rule Target field, click Select, click on View all Targets, and select Windows Computer
  6. On the WMI Configuration window, on WMI Namespace, type root\cimv2
  7. On the Query Field, type the following:

SELECT * FROM __InstanceCreationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_Share'

Once this is entered simply finish your rule and now you'll get an alert any time a new network share is created.  In addition, you can also use __InstanceModificationEvent and/or __InstanceDeletionEvent to detect modification or deletion of shares, respectively.

For more info, please review the following links:


Thanks Jose!

J.C. Hornbeck | Manageability Knowledge Engineer

Comments (2)

  1. Anonymous says:

    After creating this run my client reports an error. Is there something I am missing?

    Event Type: Warning

    Event Source: Health Service Modules

    Event Category: None

    Event ID: 10357

    Date: 10/9/2008

    Time: 11:12:43 AM

    User: N/A

    Computer: SERVER1


    Module was unable to execute the notification query.

    Error: 0x80041058

    Details: Unparsable query.

    One or more workflows were affected by this.  

    Workflow name: MomUIGeneratedRuledd91b8487b46473b88e82c1b4c87a518

    Instance name: server1.com

    Instance ID: {31BF3F9A-B868-8B0E-34D6-7D09A8D1F4A7}

    Management group: USA

    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Skip to main content