I'm working on implementing additional WMI monitoring configurations for use within our Monitoring system.
Ultimately, we can monitor anything that is compatible with WQL. This has proven to be extensive, but I'm running into an issue where I want to know how old a file is.
The below WQL query has been constructed to list how many Windows Fax Queued jobs there are, but I'd like to add one more constraint. The CIM_DataFile class offers CreationDate as part of it's dataset.
select * from CIM_DataFile where Path = '\\Documents and Settings\\All Users\\Application Data\\Microsoft\\Windows NT\\MSFax\\Queue\\' AND Extension = 'tif'
Somehow, I'd like to add a clause to this to show me only files that were created more than 24 hours ago. I only have access to WQL, I'm not going to be able to run VBS to process anything before reporting output back.