Eventtriggers



ڱػԶ̼ʾ¼


Ҫ鿴﷨뵥


eventtriggers create



¼Ӳڰʾ־¼


﷨



eventtriggers[.exe] /create [/s Computer [/u Domain\User [/p Password]]] /tr TriggerName [/l [APPLICATION] [SYSTEM] [SECURITY] ["DNS server"] [LOG] [DirectoryLogName] [*] ] {[/eid ID]|[/t {ERROR|INFORMATION|WARNING|SUCCESSAUDIT|FAILUREAUDIT}]|[/so Source]} [/d  Description] /tk TaskName
[/ru {[Domain\]User | "System"} [/rp Password]]






/s Computer
ָԶ̼ƻ IP ַʹ÷бܣĬֵǱؼ

/u Domain\User
о User  Domain\User ָûʻȨ޵Ĭֵǵǰ¼ļûȨޡ

/p Password
ָûʻ룬ûʻ /u ָ

/tr TriggerName
ָҪ¼Ѻơ

/l  [APPLICATION] [SYSTEM] [SECURITY] ["DNS server"] [LOG] [DirectoryLogName] [*] }
ָҪӵ¼־ЧͰӦáϵͳȫDNS ־Ŀ¼־ʹͨ (*)ΪĬֵ


/eid ID
ָ¼Ӧӵض¼ IDЧֵΪЧ /type  /so һʹá

/t  {ERROR|INFORMATION|WARNING|SUCCESSAUDIT|FAILUREAUDIT}
ָ¼Ӧӵ¼͡ЧֵERRORINFORMATIONWARNINGSUCCESSAUDIT  FAILUREAUDIT /id  /so һʹá

/so Source
ָ¼Ӧӵ¼ԴЧֵΪκַ /id  /type һʹá

/d Description
ָ¼ϸ˵ЧֵΪκַ

/tk TaskName
ָ¼ʱҪִе//С

/ru {[Domain\]User | "System"}
ʹָûʻȨִСĬ£ʹõ¼ SchTasks ļϵûȨִ

ֵ˵[Domain\]Userָûʻ
"System"  ""ָ NT Authority\System ʻɲϵͳʹá


/rp Password
ָ /ru ָûʻ롣ָûʻʱʡԸòSchTasks.exe ʾ벢ؼ֡ʹ NT Authority\System ʻȨִеҪ룬 SchTasks.exe ʾ롣



/?ʾʾ







зʾʹ eventtriggers /create 

eventtriggers /create /tr "Disk Cleanup" /l system /t error /tk c:\windows\system32\cleanmgr.exe
 eventtriggers /create /s srvmain /u maindom\hiropln /p p@ssW23 /tr "Low Disk Space" /eid 4133 /t warning /tk \\server\share\diskcleanup.cmd
 eventtriggers /create /s srvmain /user maindom\hiropln  /p p@ssW23 /tr "Disk Backup" /eid 4133 /l system /t error /tk \\server\share\ntbackup.exe 


eventtriggers delete



¼ ID ϵͳɾ¼


﷨



eventtriggers[.exe] /delete [/s Computer [/u Domain\User [/p Password]]] /tid {ID|*}






/s Computer
ָԶ̼ƻ IP ַʹ÷бܣĬֵǱؼ

/u Domain\User
о User  Domain\User.ָûʻȨ޵Ĭֵǵǰ¼ļûȨޡ

/p Password
ָûʻ룬ûʻ /u ָ

/tid {ID|*}
ָҪEvent Trigger IDɾ¼ʹͨ (*)

/?ʾʾ







зʾʹ eventtriggers /delete 

eventtriggers /delete /tid 1 /tid 2 /tid 4 /tid 6
 eventtriggers /delete /s srvmain /u maindom\hiropln /p p@ssW23 /tid *
 eventtriggers /delete /s srvmain /u maindom\hiropln /p p@ssW23 /tid 1




eventtriggers query



ѯʾϵͳ¼Ժá


﷨



eventtriggers[.exe] /query [/s Computer [/u Domain\User [/p Password]]] [/fo {TABLE|LIST|CSV}] [/nh] [/v]






/s Computer
ָԶ̼ƻ IP ַʹ÷бܣĬֵǱؼ

/u Domain\User
о User  Domain\User.ָûʻȨ޵Ĭֵǵǰ¼ļûȨޡ

/p Password
ָûʻ룬ûʻ /u ָ

/fo {TABLE|LIST|CSV}
ָѯĸʽЧֵΪ TABLELIST  CSVĬϸʽΪ TABLE

/nh
ѹеĿͷ /fo Ϊ TABLE  CSV ʱЧ

/v
ָʾеϸϢ

/?ʾʾ







зʾʹ eventtriggers /query 

eventtriggers /query
 eventtriggers /query /s srvmain
 eventtriggers /query /s srvmain /u maindom\hiropln /p p@ssW23 /fo list 


ע

ָʱeventtriggers һ¼бҪʾ¼б룺

eventtriggers

 
 ID   ¼              
========== ========================== ==============================================
1 Disk Cleanup               c:\windows\system32\cleanmgr.exe
ִ¼ʧʱeventtriggers  \windows\system32\wbem\logs Ŀ¼дһΪ TriggerConsumer.log ־ļаһ˵¼ʧܵϢ


XOX



