C:\WINDOWS>EVENTTRIGGERS /?
C:\WINDOWS>eventtriggers /?
EVENTTRIGGERS /parameter
[arguments
]Description:
This command-line tool enables an administrator to display and
configure "Event Triggers" on local or remote system.
Parameter List:
/Create Create a new Event Trigger that will monitor and act
upon the occurrence of NT Log Events of given criteria.
/Delete Deletes an Event Trigger by its trigger ID.
/Query Displays the Event Trigger properties and settings.
/? Displays this help/usage.
Examples:
EVENTTRIGGERS /Create /?
EVENTTRIGGERS /Delete /?
EVENTTRIGGERS /Query /?
C:\WINDOWS>EVENTTRIGGERS /CREATE /?
EVENTTRIGGERS /Create
[/S system
[/U username
[/P
[password
]]]] /TR triggername /TK taskname
[/D description
] [/L log
] [/RU username
[/RP
password
]]Description:
Create a new Event Trigger that will monitor and act upon the
occurrence of NT Log Events of a given criteria.
NOTE: Using /EID, /T and /SO together act as a series of AND's.
Parameter List:
/S system Specifies the remote system to connect to.
/U
[domain\
]user Specifies the user context under which the
command should execute.
/P
[password
] Specifies the password for the given user
context. Prompts for input if omitted.
/TR triggername Specifies a friendly name to associate with
the Event Trigger.
/L log Specifies the NT Event Log(s) to monitor
events from. Valid types include:
Application, System, Security, DNS Server
Log and Directory Log. The wildcard "*"
may be used and the default value is "*".
/EID id Specifies a specific Event ID the Event
Trigger should monitor for.
/T type Specifies an Event Type that the trigger
should monitor for. Valid values include:
"ERROR", "INFORMATION", "WARNING",
"SUCCESSAUDIT" and "FAILUREAUDIT".
/SO source Specifies a specific Event Source the Event
Trigger should monitor for.
/D description Specifies the description of the Event
Trigger.
/TK taskname Specifies the task to execute when the
Event Trigger conditions are met.
/RU username Specifies the user account (user context)
under which the task runs. For the system
account value must be "".
/RP password Specifies the password for the user.
To prompt for the password, the value
must be either "*" or none.
Password will not effect for the "SYSTEM"
account.
/? Displays this help/usage.
Examples:
EVENTTRIGGERS /Create /?
EVENTTRIGGERS /Create /TR "Disk Cleanup" /L SYSTEM /T ERROR
/TK c:\windows\system32\cleanmgr.exe
EVENTTRIGGERS /Create /S system /U user /TR "Low Disk Space"
/EID 4133 /T WARNING
/TK \\srv\share\dsk.cmd
EVENTTRIGGERS /Create /S system /U domain\user /P password
/TR "Disk Backup" /EID 4133 /L SYSTEM
/T ERROR /TK \\system\share\ntbackup.exe
EVENTTRIGGERS /Create /RU user /RP password /TR "Disk Backup"
/TK \\system\share\ntbackup.exe /EID 4
C:\WINDOWS>EVENTTRIGGERS /DELETE /?
EVENTTRIGGERS /Delete
[/S system
[/U username
[/P
[password
]]]] /TID id
[/TID id1
[...
[/TID idn
]]]Description:
Delete an Event Trigger from the system by its ID.
Parameter List:
/S system Specifies the remote system to connect to.
/U
[domain\
]user Specifies the user context under which the
command should execute.
/P
[password
] Specifies the password for the given user
context. Prompts for input if omitted.
/TID id Specifies the Event Trigger to be deleted
by "Event Trigger ID". The "*" wildcard
may be used.
/? Displays this help/usage.
Examples:
EVENTTRIGGERS /Delete /?
EVENTTRIGGERS /Delete /TID 1 /TID 2 /TID 4 /TID 6
EVENTTRIGGERS /Delete /S system /U domain\user /TID *
EVENTTRIGGERS /Delete /S system /U username /P password /TID 1
