Catching Configuration Change Events
Microsoft implemented the configuration change provider as an event provider in Windows 2003 and XP. This provider and the Win32_SystemConfigurationChangeEvent event class indicate when the system's device list has been refreshed. Located in the root\cimv2 namespace, the Win32_SystemConfigurationChangeEvent event class is the only class supported by the configuration change provider and is documented at http://msdn.microsoft.com/library/en-us/wmisdk/wmi/win32_systemconfigurationchangeevent.asp. The Win32_SystemConfigurationChangeEvent event class is a subclass of the Win32_DeviceChangeEvent superclass, which is also the parent class of the Win32_VolumeChangeEvent class (which I discuss next).
To subscribe to the Win32_SystemConfigurationChangeEvent event class, you must submit the WQL event query that Figure 3 shows. You'll then receive a notification when you add, remove, or reconfigure a system device. For instance, if you use GenericEventAsyncConsumer.wsf to submit the query, then connect a USB device to your Windows 2003 or XP system, you'll get results similar to those that Figure 3 shows. The EventType property indicates the type of device change that has occurred (Configuration Changed=1, Device Arrival=2, Device Removal=3, Docking=4). . . .