WindowsManagementExperts.Win32_NTEventlogFile.Class.Discovery (Discovery)

Element properties:

Target	Microsoft.Windows.Computer
Enabled	True
Frequency	3600
Remotable	False

Object Discovery Details:

Discovered Classes and their attribuets:
WindowsManagementExperts.Win32_NTEventlogFile.Class AccessMask Archive Caption Compressed CompressionMethod CreationClassName CreationDate CSCreationClassName CSName Description Drive EightDotThreeFileName Encrypted EncryptionMethod Extension FileName FileSize FileType FSCreationClassName FSName Hidden InstallDate InUseCount LastAccessed LastModified LogfileName Manufacturer MaxFileSize Name NumberOfRecords OverwriteOutDated OverWritePolicy Path Readable Sources Status System Version Writeable

Discovered Classes and their attribuets:

WindowsManagementExperts.Win32_NTEventlogFile.Class

AccessMask
Archive
Caption
Compressed
CompressionMethod
CreationClassName
CreationDate
CSCreationClassName
CSName
Description
Drive
EightDotThreeFileName
Encrypted
EncryptionMethod
Extension
FileName
FileSize
FileType
FSCreationClassName
FSName
Hidden
InstallDate
InUseCount
LastAccessed
LastModified
LogfileName
Manufacturer
MaxFileSize
Name
NumberOfRecords
OverwriteOutDated
OverWritePolicy
Path
Readable
Sources
Status
System
Version
Writeable

Member Modules:

ID	Module Type	TypeId	RunAs
DS	DataSource	Microsoft.Windows.TimedPowerShell.DiscoveryProvider	Default

Source Code:

<Discovery ID="WindowsManagementExperts.Win32_NTEventlogFile.Class.Discovery" Enabled="true" Target="Windows!Microsoft.Windows.Computer" ConfirmDelivery="false" Remotable="true" Priority="Normal">

  <Category>Discovery</Category>

  <DiscoveryTypes>

    <DiscoveryClass TypeID="WindowsManagementExperts.Win32_NTEventlogFile.Class">

      <Property PropertyID="AccessMask"/>

      <Property PropertyID="Archive"/>

      <Property PropertyID="Caption"/>

      <Property PropertyID="Compressed"/>

      <Property PropertyID="CompressionMethod"/>

      <Property PropertyID="CreationClassName"/>

      <Property PropertyID="CreationDate"/>

      <Property PropertyID="CSCreationClassName"/>

      <Property PropertyID="CSName"/>

      <Property PropertyID="Description"/>

      <Property PropertyID="Drive"/>

      <Property PropertyID="EightDotThreeFileName"/>

      <Property PropertyID="Encrypted"/>

      <Property PropertyID="EncryptionMethod"/>

      <Property PropertyID="Extension"/>

      <Property PropertyID="FileName"/>

      <Property PropertyID="FileSize"/>

      <Property PropertyID="FileType"/>

      <Property PropertyID="FSCreationClassName"/>

      <Property PropertyID="FSName"/>

      <Property PropertyID="Hidden"/>

      <Property PropertyID="InstallDate"/>

      <Property PropertyID="InUseCount"/>

      <Property PropertyID="LastAccessed"/>

      <Property PropertyID="LastModified"/>

      <Property PropertyID="LogfileName"/>

      <Property PropertyID="Manufacturer"/>

      <Property PropertyID="MaxFileSize"/>

      <Property PropertyID="Name"/>

      <Property PropertyID="NumberOfRecords"/>

      <Property PropertyID="OverwriteOutDated"/>

      <Property PropertyID="OverWritePolicy"/>

      <Property PropertyID="Path"/>

      <Property PropertyID="Readable"/>

      <Property PropertyID="Sources"/>

      <Property PropertyID="Status"/>

      <Property PropertyID="System"/>

      <Property PropertyID="Version"/>

      <Property PropertyID="Writeable"/>

    </DiscoveryClass>

  </DiscoveryTypes>

  <DataSource ID="DS" TypeID="Windows!Microsoft.Windows.TimedPowerShell.DiscoveryProvider">

    <IntervalSeconds>3600</IntervalSeconds>

    <SyncTime/>

    <ScriptName>Win32_NTEventlogFile.ps1</ScriptName>

    <ScriptBody><Script>



                  param($sourceId,$managedEntityId,$computerName)





                  $oAPI = new-object -comobject "MOM.ScriptAPI"

                  $oDiscoveryData = $oAPI.CreateDiscoveryData(0, $sourceId, $managedEntityId)

                  

                  $l = new-object -comobject "WbemScripting.SWbemLocator"

                  $svc = $l.ConnectServer($computerName, "root\CIMV2")

                  $svc.Security_.AuthenticationLevel=6

                  $svc.Security_.ImpersonationLevel=3

                  $objs = $svc.InstancesOf("Win32_NTEventlogFile")

                  



                  $range = $objs



                  $count = $range.Count



                  For($i=0; $i -lt $count; $i++)

                  {



                    $obj = $objs.ItemIndex($i)

                    $oInst = $oDiscoveryData.CreateClassInstance("$MPElement[Name='WindowsManagementExperts.Win32_NTEventlogFile.Class']$")

                    $oInst.AddProperty("$MPElement[Name='Windows!Microsoft.Windows.Computer']/PrincipalName$", $computerName)

                    $oInst.AddProperty("$MPElement[Name='WindowsManagementExperts.Win32_NTEventlogFile.Class']/AccessMask$", $obj.Properties_.Item("AccessMask").Value)

                    $oInst.AddProperty("$MPElement[Name='WindowsManagementExperts.Win32_NTEventlogFile.Class']/Archive$", $obj.Properties_.Item("Archive").Value)

                    $oInst.AddProperty("$MPElement[Name='WindowsManagementExperts.Win32_NTEventlogFile.Class']/Caption$", $obj.Properties_.Item("Caption").Value)

                    $oInst.AddProperty("$MPElement[Name='WindowsManagementExperts.Win32_NTEventlogFile.Class']/Compressed$", $obj.Properties_.Item("Compressed").Value)

                    $oInst.AddProperty("$MPElement[Name='WindowsManagementExperts.Win32_NTEventlogFile.Class']/CompressionMethod$", $obj.Properties_.Item("CompressionMethod").Value)

                    $oInst.AddProperty("$MPElement[Name='WindowsManagementExperts.Win32_NTEventlogFile.Class']/CreationClassName$", $obj.Properties_.Item("CreationClassName").Value)

                    $oInst.AddProperty("$MPElement[Name='WindowsManagementExperts.Win32_NTEventlogFile.Class']/CreationDate$", $obj.Properties_.Item("CreationDate").Value)

                    $oInst.AddProperty("$MPElement[Name='WindowsManagementExperts.Win32_NTEventlogFile.Class']/CSCreationClassName$", $obj.Properties_.Item("CSCreationClassName").Value)

                    $oInst.AddProperty("$MPElement[Name='WindowsManagementExperts.Win32_NTEventlogFile.Class']/CSName$", $obj.Properties_.Item("CSName").Value)

                    $oInst.AddProperty("$MPElement[Name='WindowsManagementExperts.Win32_NTEventlogFile.Class']/Description$", $obj.Properties_.Item("Description").Value)

                    $oInst.AddProperty("$MPElement[Name='WindowsManagementExperts.Win32_NTEventlogFile.Class']/Drive$", $obj.Properties_.Item("Drive").Value)

                    $oInst.AddProperty("$MPElement[Name='WindowsManagementExperts.Win32_NTEventlogFile.Class']/EightDotThreeFileName$", $obj.Properties_.Item("EightDotThreeFileName").Value)

                    $oInst.AddProperty("$MPElement[Name='WindowsManagementExperts.Win32_NTEventlogFile.Class']/Encrypted$", $obj.Properties_.Item("Encrypted").Value)

                    $oInst.AddProperty("$MPElement[Name='WindowsManagementExperts.Win32_NTEventlogFile.Class']/EncryptionMethod$", $obj.Properties_.Item("EncryptionMethod").Value)

                    $oInst.AddProperty("$MPElement[Name='WindowsManagementExperts.Win32_NTEventlogFile.Class']/Extension$", $obj.Properties_.Item("Extension").Value)

                    $oInst.AddProperty("$MPElement[Name='WindowsManagementExperts.Win32_NTEventlogFile.Class']/FileName$", $obj.Properties_.Item("FileName").Value)

                    $oInst.AddProperty("$MPElement[Name='WindowsManagementExperts.Win32_NTEventlogFile.Class']/FileSize$", $obj.Properties_.Item("FileSize").Value)

                    $oInst.AddProperty("$MPElement[Name='WindowsManagementExperts.Win32_NTEventlogFile.Class']/FileType$", $obj.Properties_.Item("FileType").Value)

                    $oInst.AddProperty("$MPElement[Name='WindowsManagementExperts.Win32_NTEventlogFile.Class']/FSCreationClassName$", $obj.Properties_.Item("FSCreationClassName").Value)

                    $oInst.AddProperty("$MPElement[Name='WindowsManagementExperts.Win32_NTEventlogFile.Class']/FSName$", $obj.Properties_.Item("FSName").Value)

                    $oInst.AddProperty("$MPElement[Name='WindowsManagementExperts.Win32_NTEventlogFile.Class']/Hidden$", $obj.Properties_.Item("Hidden").Value)

                    $oInst.AddProperty("$MPElement[Name='WindowsManagementExperts.Win32_NTEventlogFile.Class']/InstallDate$", $obj.Properties_.Item("InstallDate").Value)

                    $oInst.AddProperty("$MPElement[Name='WindowsManagementExperts.Win32_NTEventlogFile.Class']/InUseCount$", $obj.Properties_.Item("InUseCount").Value)

                    $oInst.AddProperty("$MPElement[Name='WindowsManagementExperts.Win32_NTEventlogFile.Class']/LastAccessed$", $obj.Properties_.Item("LastAccessed").Value)

                    $oInst.AddProperty("$MPElement[Name='WindowsManagementExperts.Win32_NTEventlogFile.Class']/LastModified$", $obj.Properties_.Item("LastModified").Value)

                    $oInst.AddProperty("$MPElement[Name='WindowsManagementExperts.Win32_NTEventlogFile.Class']/LogfileName$", $obj.Properties_.Item("LogfileName").Value)

                    $oInst.AddProperty("$MPElement[Name='WindowsManagementExperts.Win32_NTEventlogFile.Class']/Manufacturer$", $obj.Properties_.Item("Manufacturer").Value)

                    $oInst.AddProperty("$MPElement[Name='WindowsManagementExperts.Win32_NTEventlogFile.Class']/MaxFileSize$", $obj.Properties_.Item("MaxFileSize").Value)

                    $oInst.AddProperty("$MPElement[Name='WindowsManagementExperts.Win32_NTEventlogFile.Class']/Name$", $obj.Properties_.Item("Name").Value)

                    $oInst.AddProperty("$MPElement[Name='WindowsManagementExperts.Win32_NTEventlogFile.Class']/NumberOfRecords$", $obj.Properties_.Item("NumberOfRecords").Value)

                    $oInst.AddProperty("$MPElement[Name='WindowsManagementExperts.Win32_NTEventlogFile.Class']/OverwriteOutDated$", $obj.Properties_.Item("OverwriteOutDated").Value)

                    $oInst.AddProperty("$MPElement[Name='WindowsManagementExperts.Win32_NTEventlogFile.Class']/OverWritePolicy$", $obj.Properties_.Item("OverWritePolicy").Value)

                    $oInst.AddProperty("$MPElement[Name='WindowsManagementExperts.Win32_NTEventlogFile.Class']/Path$", $obj.Properties_.Item("Path").Value)

                    $oInst.AddProperty("$MPElement[Name='WindowsManagementExperts.Win32_NTEventlogFile.Class']/Readable$", $obj.Properties_.Item("Readable").Value)

                    $myarray = [string]::Join(",", $obj.Properties_.Item("Sources").Value)

                    $oInst.AddProperty("$MPElement[Name='WindowsManagementExperts.Win32_NTEventlogFile.Class']/Sources$", $myarray)

                    $oInst.AddProperty("$MPElement[Name='WindowsManagementExperts.Win32_NTEventlogFile.Class']/Status$", $obj.Properties_.Item("Status").Value)

                    $oInst.AddProperty("$MPElement[Name='WindowsManagementExperts.Win32_NTEventlogFile.Class']/System$", $obj.Properties_.Item("System").Value)

                    $oInst.AddProperty("$MPElement[Name='WindowsManagementExperts.Win32_NTEventlogFile.Class']/Version$", $obj.Properties_.Item("Version").Value)

                    $oInst.AddProperty("$MPElement[Name='WindowsManagementExperts.Win32_NTEventlogFile.Class']/Writeable$", $obj.Properties_.Item("Writeable").Value)

                    $oDiscoveryData.AddInstance($oInst)            

                  }                 

                  $oDiscoveryData



            </Script></ScriptBody>

    <Parameters>

      <Parameter>

        <Name>sourceID</Name>

        <Value>$MPElement$</Value>

      </Parameter>

      <Parameter>

        <Name>managedEntityID</Name>

        <Value>$Target/Id$</Value>

      </Parameter>

      <Parameter>

        <Name>computerName</Name>

        <Value>$Target/Property[Type="Windows!Microsoft.Windows.Computer"]/PrincipalName$</Value>

      </Parameter>

    </Parameters>

    <TimeoutSeconds>120</TimeoutSeconds>

  </DataSource>

</Discovery>