__InstanceOperationEvent class

The __InstanceOperationEvent system class serves as a base class for all intrinsic events that relate to an instance.

The following syntax is simplified from Managed Object Format (MOF) code and includes all inherited properties. Properties are listed in alphabetic order, not MOF order.


class __InstanceOperationEvent : __Event
  object TargetInstance;
  uint64 TIME_CREATED;


The __InstanceOperationEvent class has these types of members:


The __InstanceOperationEvent class has these properties.


Data type: uint8 array

Access type: Read-only

Descriptor used by the event provider to determine which users can receive the event. This property is inherited from __Event.


Data type: object

Access type: Read-only

Instance affected by the event. For creation events, this is the newly created instance. For modification events, this is the new version of the changed instance. For deletion events, this is the deleted instance.


Data type: uint64

Access type: Read-only

Unique value that indicates the time at which the event was generated. This is a 64-bit value that represents the number of 100-nanosecond intervals after January 1, 1601. The information is in the Coordinated Universal Times (UTC) format. This property is inherited from __Event.

For more information about using uint64 values in scripts, see Scripting in WMI.


The __InstanceOperationEvent class is derived from __Event.

Instances of __InstanceOperationEvent are not created; only instances of its subclasses are created. The following classes derive from __InstanceOperationEvent:





Just as there is a WMI class that represents each type of system resource that can be managed using WMI, there is a WMI class that represents each type of WMI event. When an event that can be monitored by WMI occurs, an instance of the corresponding WMI event class is created. A WMI event occurs when that instance is created.

There are three major types of WMI event classes, all of which are derived from the __Event WMI class: Intrinsic Events, Extrinsic Events, and Timer Events. Intrinsic Events, in turn, are represented by three distinct classes derived from the __Event class: __NamespaceOperationEvent, __InstanceOperationEvent, and __ClassOperationEvent.

Intrinsic Events

Intrinsic events are used to monitor a resource represented by a class in the CIM repository. Each resource is represented by an instance of a class. This means that monitoring a resource using WMI actually involves monitoring the instances that correspond to the resource.

Intrinsic events can also be used to monitor changes to a namespace or class in the repository. However, monitoring changes to namespaces or classes is of limited value to system administrators.

An intrinsic event is represented by an instance of a class derived from __InstanceOperationEvent, __NamespaceOperationEvent, or __ClassOperationEvent. Any changes to instances in WMI are represented by the __InstanceOperationEvent class and the classes derived from it: __InstanceCreationEvent, __InstanceModificationEvent, and __InstanceDeletionEvent.

Monitoring resources using WMI involves monitoring instances and all changes to instances are represented by __InstanceOperationEvent and the classes derived from it. This means that monitoring resources ultimately involves monitoring instances of __InstanceOperationEvent-derived classes.

You register interest in instances of one of these classes by issuing a notification query expressed in WQL. The query uses syntax similar to the following:

SELECT * FROM __InstanceOperationEventOrDerivedClass WITHIN PollingInterval WHERE TargetInstance ISA WMIClassName AND TargetInstance.WMIClassPropertyName = Value

For a longer discussion of using the WMI instance events to monitor computer activity, see How Can I Monitor for Different Types of Events With Just One Script?


The Monitor process event VBScript code sample on TechNet Gallery uses __InstanceOperationEvent to monitors the first WMI instance event for Win32_Process.


Requirement Value
Minimum supported client
Windows Vista
Minimum supported server
Windows Server 2008
All WMI namespaces

See also


WMI System Classes

Determining the Type of Event to Receive

Writing to a Log File Based on an Event