注册WMI事件时出现不可解析的查询

Question

我想通过powershell注册WMI中的事件，但是下面的查询不断返回'unparsable query'，我正在努力弄清楚。该文件夹已被创建。

$Action = { New-Event "PowerShell.ProcessCreated" -Sender $Sender -EventArguments $EventArgs.NewEvent.TargetInstance } 
Register-WmiEvent -Query "SELECT * FROM __InstanceCreationEvent WITHIN 10 WHERE targetInstance ISA 'CIM_DataFile' AND targetInstance.Path = 'E:\MyTestFolder'" -SourceIdentifier "ProcessStarted" -Action $Action 

事件是监视一个文件夹，事件的动作是发送一个通知给窗口中的事件查看器。

Answer 1

也许你可以试试下面的语法（我用的双\路径和双打引号）：

$Action = { New-Event "PowerShell.ProcessCreated" -Sender $Sender -EventArguments $EventArgs.NewEvent.TargetInstance } 
Register-WmiEvent -Query "SELECT * FROM __InstanceCreationEvent WITHIN 10 WHERE TargetInstance ISA `"CIM_DataFile`" AND TargetInstance.Path=`"E:\\MyTestFolder`"" -SourceIdentifier "ProcessStarted" -Action $Action