Windows WMI monitoring