powershell - Register-WmiEvent（Win32_ProcessStopTrace）-アクションスイッチで変数を使用する方法は？

Answer 1

Here's my take on the task with an alternate query, registering for Win32_Service modification events where Win32_Service.State value is 'Stopped'. I used $Event.SourceEventArgs.NewEvent.TargetInstance.Name to get the service name:

function Stop-MyService($SystemName)
{
    $ControllerSvc = $SystemName

    $query = "SELECT * FROM __InstanceModificationEvent WITHIN 2 " +
             "WHERE TargetInstance Isa 'Win32_Service' " +
             "AND TargetINstance.Name = '" + $ControllerSvc + "' " +
             "AND TargetInstance.State = 'Stopped'"

    $action = 
    { 
        Write-Host $Event.SourceEventArgs.NewEvent.TargetInstance.Name," stopped "
        Unregister-Event -SourceIdentifier "ControllerSvcEvent"    
    }

    Register-WMIEvent -query $query -SourceIdentifier "ControllerSvcEvent" -action $action
}

Stop-MyService 'MSSQL$SQLEXPRESS'

I used SQL Server Express for testing.

Answer 2

Try passing $ControllerSvc through -MessageData parameter of Register-WMIEvent, then it should be accessible through $Event, according to this article.