---

$src     = '\\ваш-домен.local\NETLOGON\FFClean\Clear-FirefoxCache.ps1'
$dstDir  = 'C:\Scripts'
$dst     = Join-Path $dstDir 'Clear-FirefoxCache.ps1'
$ns      = 'root\subscription'
$psExe   = "$env:SystemRoot\System32\WindowsPowerShell\v1.0\powershell.exe"
$cmdLine = "`"$psExe`" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File `"$dst`""

if (-not (Test-Path $dstDir)) { New-Item -ItemType Directory -Path $dstDir | Out-Null }
Copy-Item -LiteralPath $src -Destination $dst -Force

Get-WmiObject -Namespace $ns -Class __FilterToConsumerBinding |
    Where-Object { $_.Filter -like '*FFStop*' } | Remove-WmiObject
Get-WmiObject -Namespace $ns -Class __EventFilter -Filter "Name='FFStop'" | Remove-WmiObject
Get-WmiObject -Namespace $ns -Class CommandLineEventConsumer -Filter "Name='FFClean'" | Remove-WmiObject

$filter = Set-WmiInstance -Namespace $ns -Class __EventFilter -Arguments @{
    Name           = 'FFStop'
    EventNamespace = 'root\cimv2'
    QueryLanguage  = 'WQL'
    Query          = "SELECT * FROM Win32_ProcessStopTrace WHERE ProcessName='firefox.exe'"
}
$consumer = Set-WmiInstance -Namespace $ns -Class CommandLineEventConsumer -Arguments @{
    Name                = 'FFClean'
    CommandLineTemplate = $cmdLine
    RunInteractively    = $false
}
Set-WmiInstance -Namespace $ns -Class __FilterToConsumerBinding -Arguments @{
    Filter   = $filter
    Consumer = $consumer
} | Out-Null