Update 11/12/2009: the vbscript below can be use in many ways, think of the options you have with this small script. After all, the goal of scripting or programming is to efficiently locate existing code, and modify for your use. And sometimes, if the rest of the world is lucky - maybe you'll share it with us. Nevertheless, this example only grazes the surface of event subscriptions. InstanceModificationEvent is deep down in the cimv repository and is often overlooked because most concentrate only in the Win32_ realm for their wmi scripting needs. Next up will be sink events, which is one of my favorites. A small demonstration can go a long way.

Description:
WMI monitoring script that issues an alert any time a service changes status (for example, a running service is stopped, a paused service is resumed, etc.).

Vbscript Code: (save as .vbs)

strComputer = "." Set objWmiService = GetObject("winmgmts:" & _ "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") Set objWmiEventSource = objWMIService.ExecNotificationQuery _ ("SELECT * FROM __InstanceModificationEvent " & _ "WITHIN 30 WHERE TargetInstance ISA 'Win32_Service'") Do Set objService = objWmiEventSource.NextEvent If objService.TargetInstance.State <> _ objService.PreviousInstance.State Then Wscript.Echo objService.TargetInstance.DisplayName & _ " is " & objService.TargetInstance.State & _ ". The service previously was " & _ objService.PreviousInstance.State & "." End If Loop