Kixtart WMI Example using ExecNotificationQuery with __InstanceModificationEvent

You can download the scripting program for generating these scripts at:

http://www.planetmps.com/wmiscriptsENQ_M.html

$locator = CreateObject("WbemScripting.SWbemLocator")
$svc = $locator.ConnectServer(".", "root\cimv2")
$svc.Security_.AuthenticationLevel = 0
$svc.Security_.ImpersonationLevel = 3
$ob = $svc.ExecNotificationQuery("Select * From __InstanceModificationEvent WITHIN 1 where targetInstance ISA 'Win32_Process'")
for each $obj in $objs
    for each $obj in $objs
    next
Exit For
next