Hi,
I use the following code
Import-Module PowerEvents$MyFilter= New-WMIEventFilter -Name NICDisabledTrigger -Query "Select * from __InstanceModificationEvent within 2 Where TargetInstance ISA 'Win32_NetworkAdapter' AND TargetInstance.ConfigManagerErrorCode = 22"$MyConsumer= New-WMIEventConsumer -Name NICDisabledActionner -ConsumerType EventLog -EventType Information -EventID 20 -SourceName MyAppLogSource -InsertionStringTemplates "Adapter %TargetInstance.Name% entered the state disabled" New-WMIFilterToConsumerBinding -Filter $MyFilter-Consumer $MyCons
It checks if a network adapter has been disabled. The problem is that in the eventlog source MyAppLogSource (that already exists of course), the evnt is well created, but the description is %1%, instead of 'Adapter %TargetInstance.Name%....'
Do you know why ?
Thx a lot and good job btw
