ManagementEventWatcher为Win32_ProcessStartTrace不再在Win 8.1工作 [英] ManagementEventWatcher for Win32_ProcessStartTrace no longer working in Win 8.1

问题描述

我一直使用ManagementEventWatcher在过去的几个月里，以观察开始的新工艺，它已经没有任何问题的工作。不过，我刚刚试过我的应用程序再次，它似乎是一个新的进程的事件不再获取调用。

I have been using the ManagementEventWatcher in the past few months to watch for new processes starting, and it has worked without any issues. However, I just recently tried my app again, and it seems that the events for a new process are no longer getting called.

下面是示例code：

   var startWatch = new ManagementEventWatcher(new WqlEventQuery("SELECT * FROM Win32_ProcessStartTrace"));

和事件：

private static void ProcessStart_EventArrived(object sender, EventArrivedEventArgs e)
{
            Console.WriteLine("AppStarted");
}

我还测试了这款在另一个朋友的机器（也赢得8.1）谁有一个旧的二进制（在过去的几个月以及工作就好了），并且他不再接收事件，无论是。

I also tested this on another friend's machine (also Win 8.1) who had an old binary (which worked just fine in the past few months as well), and he is no longer receiving the events either.

这个问题似乎只与Win32_ProcessStartTrace存在，因为Win32_ProcessStopTrace工作得很好，并接收事件时，一个进程停止。

The issue only seems to exist with the Win32_ProcessStartTrace because Win32_ProcessStopTrace works just fine and receives events when a process stops.

以前有任何Windows更新最近，可以或许与此干预？因为去年我的工作系统的ENV没有改变（除了形成双赢更新）。

Has there been any windows updates lately that could perhaps interfere with this? My system's env has not changed since it last worked (aside form the win updates).

推荐答案

这是由Windows更新的 kb3045999 。

This is caused by Windows Update kb3045999.

在您在Windows 8.1或Windows安装此安全更新   服务器2012 R2，调用Windows管理程序   规范（WMI）的API直接，或调用API的依赖   WMI（如ManagementEventWatcher类）不接收   方法（正确的状态，无论过程是否是   运行或不运行）。

After you install this security update in Windows 8.1 or Windows Server 2012 R2, applications that call Windows Management Instrumentation (WMI) APIs directly, or that call APIs that rely on WMI (such as the ManagementEventWatcher class) do not receive the correct status of the process (regardless of whether the process is running or not running).

解决方法：   要解决此问题，安装修补程序 3094199 。

Solution: To resolve this issue, install hotfix 3094199.

更新2015年7月11日： Microsoft发布了一个修补程序

Update 07/11/2015: Microsoft has released a hotfix.

您可以使用命令行卸载此更新。

wusa /uninstall /kb:3045999

请参阅 WUSA - Windows更新独立安装程序了解参数

更新23/08/2015：对我来说，解决办法是不再工作

Update 23/08/2015: For me, the solution is no longer working.

这篇关于ManagementEventWatcher为Win32_ProcessStartTrace不再在Win 8.1工作的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！