Win32_NetworkAdapterConfiguration: Event-Driven Monitoring (WQL __InstanceCreationEvent)

<#
.SYNOPSIS
    WQL reference: event-driven monitoring for new Win32_NetworkAdapterConfiguration instances.

.DESCRIPTION
    WQL supports event queries against WMI's built-in event classes, not
    just static SELECT against data classes. This query fires whenever a
    new Win32_NetworkAdapterConfiguration instance is created, checked via a 2-second polling
    interval — useful for near-real-time monitoring.

.EXAMPLE
    .\NetworkAdapterConfigEventQuery.ps1
    Runs until Ctrl+C.
#>

[CmdletBinding()]
param()

$wqlQuery = "SELECT * FROM __InstanceCreationEvent WITHIN 2 WHERE TargetInstance ISA 'Win32_NetworkAdapterConfiguration'"
$sourceId = "NetworkAdapterConfigWatch"

Write-Host "Watching for new Win32_NetworkAdapterConfiguration instances (Ctrl+C to stop)..." -ForegroundColor Cyan
Write-Host "WQL: $wqlQuery" -ForegroundColor DarkGray

Register-CimIndicationEvent -Query $wqlQuery -SourceIdentifier $sourceId -Action {
    $created = $Event.SourceEventArgs.NewEvent.TargetInstance
    Write-Host "$(Get-Date -Format 'HH:mm:ss') New Win32_NetworkAdapterConfiguration: $($created.Description)"
} | Out-Null

try {
    Wait-Event -SourceIdentifier $sourceId | Out-Null
} finally {
    Unregister-Event -SourceIdentifier $sourceId -ErrorAction SilentlyContinue
}