1

I have a script that restarts a few services on server B, this script can be executed from server A. I need to execute this script when SQL has been stopped/started on Server C.

I've looked into WMI events, and that works if I add it on the SQL server (C), but I can't make a remote connection form that server to server A or B.

So I'm looking for a "trigger/event" on server A that triggers when SQL on a remote server has started/stopped.

I found that the __EventFilter instance has a PScomputerName variable, but I can't change that to another name than the local machine. This is the event/filter and consumer:

#Creating a new event filter
$instanceFilter = ([wmiclass]"\\.\root\subscription:__EventFilter").CreateInstance()
$instanceFilter.QueryLanguage = "WQL"
$instanceFilter.Query = "select * from __instanceModificationEvent within 5 where targetInstance isa 'win32_Service' and TargetInstance.Name='sql service'"
$instanceFilter.Name = "ServiceFilter"
#$instanceFilter.PSComputerName = "SQL server"
$instanceFilter.EventNamespace = 'root\cimv2'

$result = $instanceFilter.Put()
$newFilter = $result.Path

#Creating a new event consumer
$instanceConsumer = ([wmiclass]"\\.\root\subscription:ActiveScriptEventConsumer").CreateInstance()
$instanceConsumer.ScriptingEngine = "VBScript"
$instanceConsumer.ScriptFileName = "script.vbs"

$result = $instanceConsumer.Put()
$newConsumer = $result.Path

#Bind filter and consumer
$instanceBinding = ([wmiclass]"\\.\root\subscription:__FilterToConsumerBinding").CreateInstance()

$instanceBinding.Filter = $newFilter
$instanceBinding.Consumer = $newConsumer
$result = $instanceBinding.Put()
$newBinding = $result.Path
Quint van Dijk
  • 303
  • 2
  • 12
  • 1
    Try using the class instances from the remote machine. `[wmiclass]"\\YOUR-SERVER-HERE\root\subscription:__EventFilter"` – Tomalak Sep 29 '17 at 10:52
  • I get the following error: `Error: "The RPC server is unavailable. (Exception from HRESULT: 0x800706BA)"`. According to this: https://stackoverflow.com/questions/12922033/the-rpc-server-is-unavailable-exception-from-hresult-0x800706ba It's a firewall issue, I don't think I change anything in the firewall. – Quint van Dijk Sep 29 '17 at 11:08
  • Then you can't get WMI data from the remote machine. – Tomalak Sep 29 '17 at 11:22
  • Is there another way to do this? without WMI? – Quint van Dijk Sep 29 '17 at 11:26
  • 1
    Well, you need *some* kind of access to the remote machine. If you can't subscribe to events, you must resort to polling. Can you try `sc.exe` or the `Get-Service` cmdlet? – Tomalak Sep 29 '17 at 11:48
  • Yeah the cmdlets with the -computerName parameter do work. So a solution could be a script that runs every minute and checks the sql service, but I don't think that's a clean solution. I'm asking the admins to enable RPC – Quint van Dijk Oct 02 '17 at 13:19
  • Polling may not be elegant, but it's robust. And, when done in long intervals (like once per minute) it's not resource-intensive either. So if you don't get firewall permissions, I'd recommend a plain old batch file with a combination of `sc.exe` and `findstr`. – Tomalak Oct 02 '17 at 14:38

0 Answers0