# Retrieve and remove the FilterToConsumerBinding instance
$Binding = Get-WmiObject -Namespace root/subscription -Class __FilterToConsumerBinding | Where-Object {
$_.Filter -match "MyLogonFilter" -and $_.Consumer -match "MyLogonConsumer"
}
if ($Binding) {
$Binding.Delete()
Write-Output "Removed FilterToConsumerBinding."
} else {
Write-Output "FilterToConsumerBinding not found."
}
# Retrieve and remove the CommandLineEventConsumer instance
$Consumer = Get-WmiObject -Namespace root/subscription -Class CommandLineEventConsumer | Where-Object {
$_.Name -eq "MyLogonConsumer"
}
if ($Consumer) {
$Consumer.Delete()
Write-Output "Removed CommandLineEventConsumer."
} else {
Write-Output "CommandLineEventConsumer not found."
}
# Retrieve and remove the EventFilter instance
$Filter = Get-WmiObject -Namespace root/subscription -Class __EventFilter | Where-Object {
$_.Name -eq "MyLogonFilter"
}
if ($Filter) {
$Filter.Delete()
Write-Output "Removed EventFilter."
} else {
Write-Output "EventFilter not found."
}
Save this as burnit.ps1
.\\burnit.psq