How can I trigger an action to be performed when certain Windows events occur?

A. Solutions such as Microsoft Operations Manager (MOM) have highly configurable options for performing actions that depend on Windows events. However, Windows XP and later provide a tool, eventtriggers.exe, which lets you schedule an action to be performed when certain events occur. The basic command syntax for creating a trigger is

eventtriggers /create /tr " "/eid /l /t /tk /ru /rp 

To display a detailed list of the triggers you've created, run the command

eventtriggers /query /v

You can configure the query to create the output in a specific format. For example, to create a comma-separated value (CSV) format, add the argument

/fo csv

to the end of the previous command (/fo means format). Other format options include table and list.

If you need to troubleshoot a trigger action, you can view the log file at %systemroot%system32wbemlogscmdtriggerconsumer.log. However, the log doesn't give much information. Typically, the best way to debug a trigger action is to try to run the trigger action manually. Remember that specifying credentials (i.e., the /ru and /rp arguments) to use might fix the problem because by default the action will run under the local system context.

To remove all the triggers on your system, use this command:

eventtriggers /delete /tid *