Links

System Events

Launch scripts when certain events happen in Windows.
System Events in the Admin Console
System events subscribe to WMI events within Windows and run scripts. You can then take action by running scripts.

Defining a System Event

To define a system event, you can use the New-PSUSystemEvent cmdlet within the systemEvents.ps1 file. The following example triggers the systemEvent.ps1 script when a pwsh.exe process is started.
New-PSUSystemEvent -Script "systemEvent.ps1" -Environment "Default" -Credential "Default" -Type "Create" -Condition "TargetInstance isa `"Win32_Process`" and TargetInstance.Name = `"pwsh.exe`"" -Name "PowerShell Started"

Accessing Event Data

When a script is executed, you will receive a $TargetInstance parameter. This contains the WMI object that caused the event to trigger.
param($TargetInstance)
New-BurntToastNotification -Text "PowerShell Started! $TargetInstance"
Copyright 2022 Ironman Software