How can I trigger an action to be performed when certain Windows events occur?

A. Solutions such as Microsoft Operations Manager (MOM) have highly configurable options for performing actions that depend on Windows events. However, Windows XP and later provide a tool, eventtriggers.exe, which lets you schedule an action to be performed when certain events occur. The basic command syntax for creating a trigger is

eventtriggers /create /tr " <friendly name for trigger>"
/eid <event ID to trigger on>
/l <log to monitor, or omit to track all logs>
/t <type of event to monitor for, e.g., ERROR>
/tk <task to perform when event is found>
/ru <username  to run the action under; by default, the local system is used>
/rp <password of specified user account>

To display a detailed list of the triggers you've created, run the command

eventtriggers /query /v

You can configure the query to create the output in a specific format. For example, to create a comma-separated value (CSV) format, add the argument

/fo csv

to the end of the previous command (/fo means format). Other format options include table and list.

If you need to troubleshoot a trigger action, you can view the log file at \%systemroot%\system32\wbem\logs\cmdtriggerconsumer.log. However, the log doesn't give much information. Typically, the best way to debug a trigger action is to try to run the trigger action manually. Remember that specifying credentials (i.e., the /ru and /rp arguments) to use might fix the problem because by default the action will run under the local system context.

To remove all the triggers on your system, use this command:

eventtriggers /delete /tid *