PowerShell Logo Small


This is the built-in help made by Microsoft for the command 'Register-CimIndicationEvent', in PowerShell version 5 - as retrieved from Windows version 'Microsoft Windows Server 2012 R2 Standard' PowerShell help files on 2016-06-23.

For PowerShell version 3 and up, where you have Update-Help, this command was run just before creating the web pages from the help files.


Subscribes to indications using a filter expression or a query expression.


Register-CimIndicationEvent [-ClassName] <String> [[-SourceIdentifier] <String>] [[-Action] <ScriptBlock>] [-ComputerName <String>] [-Forward] [-MessageData <PSObject>]
[-Namespace <String>] [-OperationTimeoutSec <UInt32>] [-SupportEvent] [<CommonParameters>]
Register-CimIndicationEvent [-Query] <String> [[-SourceIdentifier] <String>] [[-Action] <ScriptBlock>] [-Forward] [-MessageData <PSObject>] [-Namespace <String>]
[-OperationTimeoutSec <UInt32>] [-QueryDialect <String>] [-SupportEvent] -CimSession <CimSession> [<CommonParameters>]
Register-CimIndicationEvent [-ClassName] <String> [[-SourceIdentifier] <String>] [[-Action] <ScriptBlock>] [-Forward] [-MessageData <PSObject>] [-Namespace <String>]
[-OperationTimeoutSec <UInt32>] [-SupportEvent] -CimSession <CimSession> [<CommonParameters>]
Register-CimIndicationEvent [-Query] <String> [[-SourceIdentifier] <String>] [[-Action] <ScriptBlock>] [-ComputerName <String>] [-Forward] [-MessageData <PSObject>]
[-Namespace <String>] [-OperationTimeoutSec <UInt32>] [-QueryDialect <String>] [-SupportEvent] [<CommonParameters>]

Search powershellhelp.space


The Register-CimIndicationEvent cmdlet subscribes to indications using an indication class name or a query expression.

Use the SourceIdentifier parameter give a name to the subscription.

This cmdlet returns a PS EventSubscription object. You can use this object to cancel the subscription.







Example 1: Register the events generated by a class

@{navigationLink=System.Management.Automation.PSObject[]; #text=System.Management.Automation.PSObject[]}

This set of commands subscribes to the events generated by the class named Win32_ProcessStartTrace which raises an event whenever a process starts, and gets the events with
ProcessStarted subscription using the Get-Event cmdlet. For more information about Get-Event, see http://technet.microsoft.com/library/hh849909.aspx.

Note: for this example, you must run wps_2 as an Administrator.

Example 2: Register the events using a query

PS C:\>$query = "SELECT * FROM CIM_InstModification WHERE TargetInstance ISA 'Win32_LocalTime'"

PS C:\>Register-CimIndicationEvent -Query $query -SourceIdentifier "Timer"

This set of commands uses a query to subscribe to an event generated whenever there is a change in the instance of a class named Win32_LocalTime.

Example 3: Execute Run a script when the event arrivesRun

PS C:\>$action = {$name = $event.SourceEventArgs.NewEvent.ProcessName; $id = $event.SourceEventArgs.NewEvent.ProcessId; Write-Host –Object "New Process Started : Name =
$name; ID = $id"}

PS C:\>Register-CimIndicationEvent -ClassName 'Win32_ProcessStartTrace' -SourceIdentifier "ProcessStarted" -Action $action

This set of commands shows how to use an action in response to an event. The variable $action holds the script block for Action, which uses the $event variable to access the
event received from CIM. Using $action, the Register-CimIndicationEvent cmdlet subscribes to the event generated by the class named Win32_ProcessStartTrace.

For more information about Win32_ProcessStartTrace, see http://msdn.microsoft.com/library/windows/desktop/aa394374(v=vs.85).aspx

Example 4: Register the events on a remote computer

PS C:\>Register-CimIndicationEvent -ClassName 'Win32_ProcessStartTrace' -SourceIdentifier "ProcessStarted" -ComputerName Server01

PS C:\>Get-Event -SourceIdentifier "ProcessStarted"

This set of commands subscribes to events on a remote computer named Server01 using the Register-CimIndicationEvent cmdlet. Events received from the CIM server are stored in
the event queue in the current wps_2 session and then runs a local Get-Event to retrieve the events.