CODEWITHSUNDEEP
c#wmi
user1438082
user1438082

Reputation: 2748

Combine WMI Query into one line

I was looking to detect using WMI events, when a user or a usergroup is modified in local users and groups.Below are 2 queries that work. How can i combine them into one query ? I tried an or operand but WMI code creator throws an invalid query exception.

Working Detect usergroup modification

"SELECT * FROM __InstanceOperationEvent WITHIN 1 WHERE TargetInstance ISA 'Win32_Group'"

Working Detect user modification

"SELECT * FROM __InstanceOperationEvent WITHIN 1 WHERE TargetInstance ISA 'Win32_GroupUser'"

Not Working - This is what i tried

"SELECT * FROM __InstanceOperationEvent WITHIN 1 WHERE TargetInstance ISA 'Win32_Group' or SELECT * FROM __InstanceOperationEvent WITHIN 1 WHERE TargetInstance ISA 'Win32_GroupUser'");

Upvotes: 1

Views: 482

Answers (2)

Steve Wellens
Steve Wellens

Reputation: 20638

Try this (I think the parens are needed):

SELECT * FROM __InstanceOperationEvent WITHIN 1 
WHERE (TargetInstance ISA 'Win32_Group' OR TargetInstance ISA 'Win32_GroupUser')

Upvotes: 1

Dmitry
Dmitry

Reputation: 14059

Try this:

SELECT * FROM __InstanceOperationEvent WITHIN 1
WHERE (TargetInstance ISA 'Win32_Group') OR (TargetInstance ISA 'Win32_GroupUser')

Upvotes: 1

Related Questions