Share via

Couldn't register WMI __EventConsumer

Pei Yao-Chang 1 Reputation point
2020-08-11T08:17:17.277+00:00

My PC environment is Windows 10 Enterprise Evaluation, Build 17763.rs5_release.180914-1434

When I entered this command

$consumer = ([wmiclass]"\.\root\subscription:CommandLineEventConsumer").CreateInstance()

in Powershell (Run as Administrator), I got an exception like below. 

Cannot convert value "\\.\root\subscription:CommandLineEventConsumer" to type "System.Management.ManagementClass". Error: "Not found
"
At line:1 char:1
+ $consumer = ([wmiclass]"\\.\root\subscription:CommandLineEventConsume ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidArgument: (:) [], RuntimeException
    + FullyQualifiedErrorId : InvalidCastToWMIClass

I tried to digger more deeper information, then I got some messages like below 

System.Management.Automation.RuntimeException: Cannot convert value "\\.\root\subscription:CommandLineEventConsumer" to type "System.Management.ManagementClass". Error: "Not found " ---> System.Management.Automation.PSInvalidCastException: Cannot convert value "\\.\root\subscription:CommandLineEventConsumer" to type "System.Management.ManagementClass". Error: "Not found " ---> System.Management.ManagementException: Not found 
   at System.Management.ManagementException.ThrowWithExtendedInfo(ManagementStatus errorCode)
   at System.Management.ManagementObject.Initialize(Boolean getObject)
   at System.Management.ManagementBaseObject.get_wbemObject()
   at System.Management.PropertyData.RefreshPropertyInfo()
   at System.Management.PropertyDataCollection.get_Item(String propertyName)
   at System.Management.Automation.LanguagePrimitives.ConvertToWMIClass(Object valueToConvert, Type resultType, Boolean recursion, PSObject originalValueToConvert, IFormatProvider formatProvider, TypeTable backupTable)
   --- End of inner exception stack trace ---
   at System.Management.Automation.LanguagePrimitives.ConvertToWMIClass(Object valueToConvert, Type resultType, Boolean recursion, PSObject originalValueToConvert, IFormatProvider formatProvider, TypeTable backupTable)
   at System.Management.Automation.Interpreter.DynamicInstruction`2.Run(InterpretedFrame frame)
   at System.Management.Automation.Interpreter.EnterTryCatchFinallyInstruction.Run(InterpretedFrame frame)
   --- End of inner exception stack trace ---
   at System.Management.Automation.ExceptionHandlingOps.CheckActionPreference(FunctionContext funcContext, Exception exception)
   at System.Management.Automation.Interpreter.ActionCallInstruction`2.Run(InterpretedFrame frame)
   at System.Management.Automation.Interpreter.EnterTryCatchFinallyInstruction.Run(InterpretedFrame frame)
   at System.Management.Automation.Interpreter.EnterTryCatchFinallyInstruction.Run(InterpretedFrame frame)

Actually, I could register __EventFilter, __EventComsumer and __FilterToConsumerBinding at first.
However, after trying some commands related to register and unregister WMI, I couldn't register __EventComsumer anymore, even though I tried to reboot PC and unregister all of them, I still get the exception like above.

Windows 10
Windows 10
A Microsoft operating system that runs on personal computers and tablets.
10,792 questions

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Young Yang (Shanghai Wicresoft Co,.Ltd.) 661 Reputation points
    2020-08-20T01:32:18.607+00:00

    I searched for your post on another forum, and the problem seems to have been resolved, so I copied the answer here to facilitate the query of users with similar problems.
    $Properties = @{
    "Name"="Test"
    "CommandLineTemplate"="C:\Windows\Notepad.exe"
    }

    New-CimInstance -Namespace 'ROOT\subscription' -ClassName 'CommandLineEventConsumer' -Arguments $Properties

    If the WMI library is damaged, please follow the method below to repair：
    https://superuser.com/questions/190960/repair-wmi-on-windows-7

    If you encounter an error, it says Cannot convert value ".\root\subscription:CommandLineEventConsumer" to type "System.Management.ManagementClass". Error: "Invalid parameter"，plz try [wmiclass]::new("root\subscription:CommandLineEventConsumer").CreateInstance()

    0 comments