怪事~

 

    private   void  Form1_Load( object  sender, EventArgs e)
        {
            ConnectionOptions co  =   new  ConnectionOptions();
            co.Impersonation  =  ImpersonationLevel.Impersonate;
            co.EnablePrivileges  =   true ;
            ManagementScope mgrScope  =   new  ManagementScope( @" \\.\root\default " , co);
            WqlEventQuery evQuery  =   new  WqlEventQuery();
            evQuery.WithinInterval  =   new  TimeSpan( 0 ,  0 ,  0 ,  15 ,  0 );
             // evQuery.QueryString = @"Select * From RegistryKeyChangeEvent Where Hive='HKEY_USERS' And KeyPath='S-1-5-21-3743974248-512206057-3529231067-1000\\Software\\Microsoft\\Internet Explorer\\Main'"; // ①
            evQuery.QueryString  =   @" Select * From RegistryKeyChangeEvent Where Hive='HKEY_USERS' And KeyPath=' "   +  GetUserSID()  +   " \\Software\\Microsoft\\Internet Explorer\\Main' " ; // ②

            ManagementEventWatcher RegKeyWacher  =   new  ManagementEventWatcher();
            RegKeyWacher.Query  =  evQuery;
            RegKeyWacher.EventArrived  +=   new  EventArrivedEventHandler(OnRegistryKeyChange);
            RegKeyWacher.Scope  =  mgrScope;
            RegKeyWacher.Start();

        
        }

         private   string  GetUserSID()
        {
             string  strUserSID  =   "" ;
            ConnectionOptions co  =   new  ConnectionOptions();
            co.Impersonation  =  ImpersonationLevel.Impersonate;
            co.EnablePrivileges  =   true ;
            ManagementScope mgrScope  =   new  ManagementScope( " \\\\.\\root\\cimv2 " , co);
            ObjectQuery myQuery  =   new  ObjectQuery( " SELECT * FROM Win32_UserAccount WHERE Domain=\ ""  + Environment.UserDomainName +  " \ ""   +   "  And Name=\ ""  + Environment.UserName +  " \ "" );
            ManagementObjectSearcher searcher  =   new  ManagementObjectSearcher(mgrScope, myQuery);
            ManagementObjectCollection oReturnCollection  =  searcher.Get();
             foreach  (ManagementObject sid  in  oReturnCollection)
            {
                strUserSID  =  sid[ " SID " ].ToString();
            }
             return  strUserSID;
        }

 

 

 

运行完①②之后，evQuery.QueryString 的值都是一样的，但①可以正常监视，但②RegKeyWacher.Start()的总是时候异常!!怪事！