0

Is there any way to know when user group members list has changed? I've tried to use WMI query like:

SELECT * 
FROM __InstanceModificationEvent WITHIN 5 
WHERE TargetInstance ISA 'Win32_Group'

But it doesn't work (the event never fires). Maybe there is a Win32 event that is being fired when a user group members are changed?

UPDATE 1

__InstanceOperationEvent doesn't work either. I need to get the event when the group policy is applied and a user is added/removed from a user group on the local machine to display this change.

2 Answers 2

1

It seems which the __InstanceModificationEvent event is not trigger in this class, but you can use these others events.

To detect changes use the __InstanceOperationEvent event,

Select * From __InstanceOperationEvent Within 1 Where TargetInstance ISA 'Win32_Group'

To detect the creation of a group use the __InstanceCreationEvent event,

Select * From __InstanceCreationEvent Within 1 Where TargetInstance ISA 'Win32_Group'

To detect the deletion of a group use the __InstanceDeletionEvent event

Select * From __InstanceDeletionEvent Within 1 Where TargetInstance ISA 'Win32_Group'
0
1

try this:

SELECT * FROM __InstanceOperationEvent WITHIN 1 WHERE TargetInstance ISA 'Win32_Group';

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.