I am looking for information on detecting the dis/connection of network resources. Anything about taking events from the MPR and AddConnectNotify() (I think that's right) OR WMI.

I think detecting outgoing network connections is pretty easy, but detecting incoming connections from remote machines to the local machine is another story....

Thanks.

Hello,

Thanks for your post. As I understand, you want to detect incoming
connections to your network shares. Please correct me if there is any
misunderstanding.

Based on my experience and research, you can use the
Win32_SessionConnection class in WMI. Please refer to the following MSDN
document and my VB Script sample:

Win32_SessionConnection
http://msdn.microsoft.com/library/de...us/wmisdk/wmi/
win32_sessionconnection.asp?frame=true

'-----------------------------------------VB Script------------------------
Set services = GetObject("WinMgmts:")

services.security_.privileges.addasstring "sedebugprivilege"

Set sink = WScript.CreateObject("WbemScripting.SWbemSink","SINK_")

services.ExecNotificationQueryAsync sink,"select * from
__InstanceCreationEvent WITHIN 1 where Targetinstance ISA
'Win32_ServerConnection'"
MsgBox "Wait for an event. " & VBCRLF & "Click OK to stop watching for
events!"

Sub SINK_OnObjectReady(objWbemObject, objAsyncContext)
Wscript.Echo " Share Name: " &
objWbemObject.TargetInstance.ShareName
Wscript.Echo " Computer : " &
objWbemObject.TargetInstance.ComputerName
Wscript.Echo " User : " &
objWbemObject.TargetInstance.UserName
Wscript.Echo
End Sub
'--------------------------------------end
of----------------------------------------

Please feel free to let me know if you have any problems or concerns.

Regards,

HuangTM
Microsoft Online Partner Support
MCSE/MCSD

Get Secure! -- www.microsoft.com/security
This posting is provided "as is" with no warranties and confers no rights.