Windows 10: Persistent MOF FIDO-Key Removal Issue

Hi,I have been struggling with a compiled MOF. What I'm trying to do is create an event filter which triggers when a FIDO key is removed from a machine. I am then trying to configure an event consumer to execute rundll32.exe user32.dll,LockWorkStation which will then lock the workstation whenever a FIDO key is removed.Please see the MOF below:#pragma namespace"\\\\.\\root\\subscription" instance of __EventFilter as $EventFilter { EventNamespace = "Root\\Cimv2"; Name = "Test Command Line Event Filter"; Query = "Select * From __InstanceDeletionEvent Within 2 " "Where

:)

 

Corrupt MOF file

Need to gain access to Wbem MOF files to include #pragma autorecover. Have compiled a list of MOF's requiring this change.

Have tried a number of suggestions without success!

 

Remove account

I suggest you backup your personalized files first before removing the account.
To delete an account, follow these steps:

1. Press WIN + X keys and click Command Prompt (Admin) from the menu.
2. Type the following command and press Enter. Replace test with the name of your sister's account. Code:

 

Saving issue in Windows 10

Hi,

Welcome to the Microsoft Community.

1. How many user accounts are setup on the PC?

I suggest you to check if issue persists in Hidden Admin account. Follow the steps to enable Hidden Admin:

• 
  Press Windows key + X.
  
• 
  Click on Command Prompt (Admin).
  
• 
  Type ‘net user administrator /active:yes’ and press Enter.
  
• 
  Now check if issue persists on the Hidden admin account.
  

Please get back to us with the results of the result of the proposed suggestion.