I have a file that always has the same name. It's location depends on the OS, but the location can be found within the registry. Within the file, there is a specific line that I am looking for, and I want to check and see if when it is modified. The line, the first time is like: username=test\jdoe then changes to: username=server\username I would like to be able to script this so that IE window pops up, shows red (or a red button or something like that) when it is the original, but then changes to green when the name changes. I can get the registry portion figured out. From TechNet, I found: strComputer = "." Set objWMIService = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" & _ strComputer & "\root\cimv2") Set colMonitoredEvents = objWMIService.ExecNotificationQuery _ ("SELECT * FROM __InstanceModificationEvent WITHIN 10 WHERE " _ & "TargetInstance ISA 'CIM_DataFile' and " _ & "TargetInstance.Name='c:\\scripts\\index.vbs'") This only shows me how to monitor if the file is changed, but not how to monitor a specific change within the file. Can anyone help?
I'm not exactly certain what you want to happen when the file changes, but here is one example that should give you all the pieces you need ... Dim objWMIService, objLatestEvent, colMonitoredEvents, _ objEvent, strComputer, oDisplay, sUserName, sTestName sTestName = "test\jdoe" strComputer = "." Set objWMIService = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" & _ strComputer & "\root\cimv2") Set colMonitoredEvents = objWMIService.ExecNotificationQuery _ ("SELECT * FROM __InstanceModificationEvent WITHIN 10 WHERE " _ & "TargetInstance ISA 'CIM_DataFile' and " _ & "TargetInstance.Name='C:\\scripts\\index.vbs'") Do ' Waits here for next event to occur set objLatestEvent = colMonitoredEvents.NextEvent ' With CreateObject("Scripting.FilesystemObject") sText = .OpenTextFile("C:\scripts\index.vbs", 1).ReadAll end with sUsername = lcase(split(split(sText, "username=")(1), vbnewline)(0)) if sUsername <> sTestName then sTestName = sUsername set oDisplay = HTABox("lightgrey", 100, 300, 400, 500) with oDisplay .document.title = "Username Change" .msg.innerHTML = "<input type=button id=btn " _ & "style='background-color:green' " _ & "value='Username Changed' title='Click to close' " _ & "onclick='vbscript:done.value=true'><br>" _ & sUsername wsh.sleep 3000 ' 3 second delay .done.value = true .close end with ' oDisplay end if Loop ' Author Tom Lavedas, June 2010 Function HTABox(sBgColor, h, w, l, t) Dim IE, HTA, sCmd, nRnd randomize : nRnd = Int(1000000 * rnd) sCmd = "mshta.exe ""javascript:{new " _ & "ActiveXObject(""InternetExplorer.Application"")" _ & ".PutProperty('" & nRnd & "',window);" _ & "window.resizeTo(" & w & "," & h & ");" _ & "window.moveTo(" & l & "," & t & ")}""" with CreateObject("WScript.Shell") .Run sCmd, 1, False do until .AppActivate("javascript:{new ") : WSH.sleep 10 : loop end with ' WSHShell For Each IE In CreateObject("Shell.Application").windows If IsObject(IE.GetProperty(nRnd)) Then set HTABox = IE.GetProperty(nRnd) IE.Quit HTABox.document.title = "HTABox" HTABox.document.write _ "<HTA:Application contextMenu=no border=thin " _ & "minimizebutton=no maximizebutton=no sysmenu=no />" _ & "<body scroll=no style='background-color:" _ & sBgColor & ";font:normal 10pt Arial;" _ & "border-Style:inset;border-Width:3px'" _ & "onbeforeunload='vbscript:if not done.value then " _ & "window.event.cancelBubble=true:" _ & "window.event.returnValue=false:" _ & "done.value=true:end if'>" _ & "<input type=hidden id=done value=false>" _ & "<center><span id=msg> </span><center></body>" Exit Function End If Next ' I can't imagine how this line can be reached, but just in case MsgBox "HTA window not found." wsh.quit End Function It uses a display function that I wrote a while back that is based on an HTA, rather than IE. It allows the removal of all of the 'chrome' normally associated with the use of IE. I wouldn't advise messing with the Function. Instead, make your changes to function's input parameters and the definition of the oDisplay.msg element (an HTML span block) that is exposed by the function. Note that the script runs forever, as written. It can only be stopped using the Task Manager, taskkill.exe at the command prompt or through the WMI Win32_Process class. It normally sits at the line marked, opens the display box and leaves it open for a period of time (note the wsh.sleep line) when the file is changed and then closes the box. The delay can be changed. As written, the user can also close the window by pressing the button. As I said, it may not be exactly what you wanted, but it's a start. _____________________ Tom Lavedas
I doubt that WMI would be capable of monitoring a file for specific content change. I think you will need to script it: - detect when file has changed - read in the current content of the file - read in the previous content of the file - write the current content of the file to another file (i.e. the one read in step 2 above) - compare the current content to the previous content to determine if the actual change is the one you are looking for. /Al
