Änderungen der Adaptereinstellungen loggen

# wmic nicconfig get description,settingid
$CLSID = '{XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}'  
$PFAD = 'HKLM:\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\'  
$NIC = Get-Item $PFAD$CLSID

$Q = 'SELECT * FROM __InstanceModificationEvent  
WITHIN 5 WHERE TargetInstance ISA "Win32_NetworkAdapter"'  

Register-WMIEvent -Query $Q -Action {
    Write-Host Neue Konfiguration
    Write-Host $NIC.getvalue('IpAddress')  
    Write-Host $NIC.getvalue('SubnetMask')  
    Write-Host $NIC.getvalue('DefaultGateway')  
}

# Permanentes WMI-Ereignis einrichten, um die Konfigurationsänderungen der
# Ethernet-Schnittstellen zu überwachen und in C:\nicconfig.log zu loggen.

if ($args -and $args -eq '-e') {  
	Write-Host "Entferne permanente WMI-Objekte..." -F Green  
	Get-WMIObject -Namespace root\Subscription `
		-Class __EventFilter -Filter "Name='NicFilter'" `  
	| Remove-WmiObject -Verbose
	Get-WMIObject -Namespace root\Subscription `
		-Class LogFileEventConsumer -Filter "Name='NicConsumer'" `  
	| Remove-WmiObject -Verbose
	Get-WMIObject -Namespace root\Subscription `
		-Class __FilterToConsumerBinding `
		-Filter "__Path LIKE '%NicFilter%'" `  
	| Remove-WmiObject -Verbose
	exit
}

# Allgemeine WMI-Parameter
$wmipar = @{
	Computername = $env:COMPUTERNAME
	ErrorAction = 'Stop'  
	NameSpace = 'root\subscription'  
}

Write-Host "Richte permanente WMI-Objekte ein... (mit -e wieder entfernen)" -F Green  
# Ereignis-Filter einrichten
$wmipar.Class = '__EventFilter'  
$wmipar.Arguments = @{
	Name = 'NicFilter'  
	EventNamespace = 'root\CIMV2'  
	QueryLanguage = 'WQL'  
	Query = "select * from __instanceModificationEvent within 5" +  
            "where targetInstance isa 'win32_NetworkAdapterConfiguration'"  
}
$flterg = Set-WmiInstance @wmipar # Filter-Ergebnis

# Ereignis-Verbraucher einrichten
$wmipar.Class = 'LogFileEventConsumer'  
$wmipar.Arguments = @{
	Name = 'NicConsumer'  
	Text = "$(Get-Date -Format o) %TargetInstance.IpSubnet%"  
	FileName = "C:\nicconf.log"  
}
$konerg = Set-WmiInstance @wmipar # Konsument-Ergebnis


$wmipar.Class = '__FilterToConsumerBinding'  
$wmipar.Arguments = @{
	Filter = $flterg
	Consumer = $konerg
}
$anberg = Set-WmiInstance @wmipar # Anbindungsergebnis

Text = "Neue Konfiguration(%TIME_CREATED%):`r`n" +   
        "`tIP=%TargetInstance.IpAddress%`r`n" +   
        "`tNM=%TargetInstance.IpSubnet%`r`n" +  
        "`tGW=%TargetInstance.DefaultIpGateway%"