Windows Management Interface (WMI)

Summary

Download this Visio 2002 file.

1. To access management information about hardware devices, operating system, network services, and software applications,
2. utilities such as
3. VB Scripts called from Windows Scripting Hosts
4. and C# and VB.NET apps
5. make queries in SQL-like WMI Query Language (WQL) syntax to the
6. winmgmt.exe Windows Management service "core" component within Microsoft operating systems.
7. This service" in turn queries various WMI Providers which actually obtain information from items under their jurisdiction.
8. For Active Directory information, the ADSI Extension remote interface IWMIExtension is not available for Windows Server 2003, which instead use Active Directory Service Interfaces (ADSI)
9. WMI queries can be made to the WMI core service from within a variety of langagues
10. The names of objects queried are defined in a repository which
11. is updated by the mofcomp.exe SDK utility which compiles
12. Managed Object Format (MOF) statements based on the Interface Definition Language (IDL).

The Microsoft Windows Managment Service The "Windows Management Instrumentation" service winmgmt "Provides a common interface and object model to access management information about operating system, devices, applications, and services. If this service is stopped, most Windows-based software will not function properly. If this service is disabled, any services that depend on it will fail to start." The Windows Management service automatically starts when the first management application makes a call to connect. On computers running Windows XP, the Windows Management service is implemented as a service process within SVCHOST.exe -k netsvcs. The additional security added by Windows XP SP2 requires a new Platform SDK   On computers running Windows NT/Windows 2000, the Windows Management service runs as a separate service process. The WMI core WMI functionality introduced in the Windows 2000 Professional SP2 operating system (that comes as part of Windows 2000 Pro, 98 SE, and NT4 SP6) can be downloaded as part of the .NET Framework for use on older systems.   On computers running Windows 98, the Windows Management service runs as a standard executable file (Winmgmt.exe) specified for invocation at start-up these Windows Registry entries.   Windows 2000 and XP offer more information than previous OS versions. Windows 2000 includes WMI version 1.5 (1085.005), which is SMBIOS aware. L.J. Johnson notes that accessing Win32_QuickFixEngineering class on a pre-SP3 version of W2K causes the WinMgmt process to hang at 100% processor activity. Also, the WMI object seems to incorrectly parse some of the QEF information in the registry, and provides duplicate data for many of the QEFs. This bug is fixed in a post SP2 QEF, and in SP3 for W2K, so it is advisable to use his code to abort the WMI calls if the machine is running W2K SP3 or above, Private Function GetOS_ (ByVal xi_sWbemServices As SWbemServices) As Variant Dim vntTmp As Variant Dim vntRtn As Variant ReDim vntRtn(1 To 2) As Variant vntTmp = GetOsData(xi_sWbemServices) If Left$(vntTmp(1, 13), 4) = "5.0." Then If CLng(vntTmp(1, 25)) >= 3 Then vntRtn(1) = True vntRtn(2) = vbNullString Else vntRtn(1) = False vntRtn(2) = "If you are running W2K, _ you must have at least SP3 to run this " & _ "method. You are running SP " & vntTmp(1, 25) End If Else vntRtn(1) = True vntRtn(2) = vbNullString End If GetOS = vntRtn End Function The "Windows Management Instrumentation Driver Extensions" service provides "systems management information to and from drivers."

Query Namespaces The great thing about WMI is that it provides metadata about itself. Maclin provides this example of WSH VBScript code to recursively enumerate namespaces: The namespaces are: root/SECURITY root/SecurityCenter root/WMI root/WMI/ms_409 root/CIMV2 root/CIMV2/ms_409 root/CIMV2/Applications root/CIMV2/Applications/MicrosoftACT root/CIMV2/Applications/MicrosoftIE root/Microsoft root/Microsoft/HomeNet root/DEFAULT root/DEFAULT/ms_409 root/directory root/directory/LDAP root/directory/LDAP/ms_409 root/subscription root/subscription/ms_409 root/MSAPPS11 Example: wbemdump /Q root\cimv2 WQL "select Manufacturer from Win32_SystemEnclosure This returns a number (such as "6"). Some applications provide an English translation, such as a datamap.ini that contains: [INV_List_ChassisTypes] 0 = Unknown 1 = Other 2 = Unknown 3 = Desktop 4 = Low Profile Desktop 5 = Pizza Box 6 = Mini Tower 7 = Tower 8 = Portable etc. 9 = Laptop 10 = Notebook 11 = Hand Held 12 = Docking Station 13 = All in One 14 = Sub Notebook 15 = Space-Saving 16 = Lunch Box 17 = Main System Chassis 18 = Expansion Chassis 19 = SubChassis 20 = Bus Expansion Chassis 21 = Peripheral Chassis 22 = Storage Chassis 23 = Rack Mount Chassis 24 = Sealed-Case PC Every WMI class has a "Caption" property — a short description of the object-a one-line string. A WSH query to a remote computer can be defined using the winmgmts: object: Set objWMIService = GetObject("winmgmts://Computer_B\root\cimv2) The .NET sample application "Processes and Services Explorer" PsView.exe is installed by running the .NET nmake (from the VS.NET Bin folder) while in Program Files\Microsoft Visual Studio .NET 2003 folder SDK\v1.1\Samples\Technologies\Interop\Applications\WMI The installation depends on the WBEMSCRIPTING.dll which is also used by HealthMonitor, a free Windows Service app developed Vitorio Parvesi with VB.NET and WMI to check Windows system status (event viewer, disk free space, services status, performance, etc....) The C# source for the program is in subfolder Form

Repository Schemas The root of the schema contains these namespaces : SECURITY SecurityCenter WMI CIMV2 Microsoft DEFAULT directory subscription MSAPPS11   WMI MMC CIM WBEM for Namespace control By default, the namespace is “root\cimv2” since WMI implements on Microsoft machines the Common Information Model (CIM) schema proposed by the Distributed Management Task Force (DMTF). On the Windows XP install CD, the CIMv2r5.mof file provides a strictly compliant schema to the DMTF's CIM version 2.5. Compiling this MOF (using a local account that is a member of the 'Administrators' group) places schema in the root\CIMv2r5 Namespace. The default namespace can be change manually using the MMC snap-in called WMI Control Properties : In the Control Panel, double-click on Administrative Tools. In the Administrative Tools window, double-click on Computer Management. In the Computer Management window, expand the Services and Applications tree and double-click on the WMI Control. Right-click on the WMI Control icon and select Properties. Click on the Advanced tab. This MMC provides the GUI to set security for each namespace. Changes here are stored in the Windows Registry Scripting/Default/Namespace key under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\ "WBEM" is used because WMI is Microsoft's implementation of the implementation-neutral Web-Based Enterprise Management (WBEM) standard. The WMI scripting library is implemented in a single automation component named wbemdisp.dll in the %SystemRoot%\system32\wbem directory. There are twenty-four automation objects and thirteen enumerations in the Microsoft Windows XP and Windows Server 2003 version of wbemdisp.dll (nineteen in Windows 2000 and earlier). Programming API Support The WbemScripting library and API's are available for VBScript and JScript — the SWbemObjectSet collection of SWbemObject objects located on the SWbemObjectPath. The moniker winmgmts: is used to get WMI objects. For example: MsgBox (GetObject("WinMgmts:Win32_LogicalDisk='C:'").VolumeSerialNumber) The classes are defined WMI Win32 hardware classes ADSI API Support To obtain information from the Windows 2000 Active Directory, the IWMIExtension interface extends Microsoft's Active Directory Service Interface (ADSI) computer objects returned from the LDAP namespace. The Active Directory Provider supports the standard IWbemInit interface. It is initiated with the IWbemProviderInit interface. Microsoft provides a COM API library for C++ classes. C programs use the Wbemads.h header file and Wbemuuid.lib. VB programs use the Wbemadsi.tlb. Query Language The WMI Query Language (WQL) is similar to simple SELECT queries in SQL for the WMI ODBC Adapter. For example, to obtain capacity and free space for each logical drive: Select Space, FreeSpace, DeviceID From Win32_LogicalDisk WMI Utilities Download Microsoft WMITools. These use ActiveX, so must be run using Internet Explorer (not Mozilla/Netscape browsers) and active must be allowed. WMI Object Browser: view objects, edit property values and qualifiers, and run methods from instance of Win32_ComputerSystem.   WMI CIM Studio: view and edit classes, properties, qualifiers, and instances in a CIM repository; run selected methods; generate and compile MOF files.   WMI Event Registration Tool: creates, permanent event consumers, creates or views instances of event consumers, filters, bindings, and timer system classes.   WMI Event Viewer: displays the occurrence of WMI events you have configured in the WMI Event Registration. wmic command-line utility, wbemdump.exe displays WMI classes, runs methods, and executes queries against classes in a namespace. WMI browser from Microsoft's WMI SDK uses Microsoft's Distributed COM (DCOM) to obtain information about accessing remote machines, especially machines with Windows XP SP2 $99 Admin Script Editor (ASE) features a WMI Wizard

Microsoft's WMI home page Microsoft's WMI Glossary microsoft.public... win32.programmer.wmi dotnet.framework.wmi microsoft.public.windowsxp.wmi microsoft.public.scripting.vbscript platformsdk.security Michael Maston's MSDN News, November/December 1999 article Articles on WMI at DevX $40 Developing WMI Solutions: A Guide to Windows Management Instrumentation by Craig Tunstall, Gwyn Cole includes use of C# to access .Net apps. Addison Wesley Nov 2002. Understanding Windows Management Instrumentation (WMI) Scripting by Alain Lissoir Digital Press; (March 2003) Leveraging Windows Management Instrumentation (WMI) Scripting by Alain Lissoir Digital Press; (March 2003) Microsoft® Windows® 2000 Scripting Guide by The Microsoft Windows Resource Kit Scripting Team Microsoft Press; 1st edition (December 16, 2002) Developing WMI Solutions: A Guide to Windows Management Instrumentation by Craig Tunstall and Gwyn Cole Addison Wesley Professional; 1st edition (November 12, 2002) Windows Management Instrumentation (WMI) by Matthew Lavy and Ashley Meggitt New Riders Publishing; 1st edition (October 15, 2001) WMI Essentials for Automating Windows Management by Marcin Policht Sams; 1st edition (July 23, 2001) Scripting XML and WMI for Microsoft SQL 2000 by Tobias Martinsson John Wiley & Sons; Book & CD edition (January 12, 2001) Retrieving WMI info by Google Gadget

VBScript Examples 'Get the set Set objProcSet = objService.InstancesOf(strWBEMClass) If blnErrorOccurred("Could not obtain " & _ strWBEMClass & " instance.") Then Exit Sub End If If objProcSet.Count = 0 Then Call WriteLine("No processor information is available.", objOutputFile) Exit Sub End If Call WriteLine("Processor information for Machine " _ & strServer, objOutputFile) Call WriteLine("", objOutputFile) For Each objProc In objProcSet Call WriteLine("Name = " & _ objProc.Name, objOutputFile) Call WriteLine("Current Voltage = " & _ objProc.CurrentVoltage, objOutputFile) Call WriteLine("Device ID = " & _ objProc.DeviceID, objOutputFile) Call WriteLine("Status = " & _ objProc.CpuStatus, objOutputFile) Call WriteLine("Data Width = " & _ objProc.DataWidth, objOutputFile) Call WriteLine("Current Clock Speed = " & _ objProc.CurrentClockSpeed, objOutputFile) Call WriteLine("L2 Cache Size = " & _ objProc.L2CacheSize, objOutputFile) Call WriteLine("Level = " & _ objProc.Level, objOutputFile) Call WriteLine("External Clock = " & _ objProc.ExtClock, objOutputFile) Call WriteLine("", objOutputFile) Next ActiveXperts Network Monitor provides examples of WMI in VB. To display properties of objProc objects in WBEMClass "Win32_Processor", run this from the Resource Kit: Cscript "processor.vbs" Name = Intel Celeron processor Current Voltage = 33 Device ID = CPU0 cpu Status = 1 Data Width = 32 Current Clock Speed = 499 L2 Cache Size = 128 Level = 6 Ext(ernal) Clock = 83 To display properties of objMBOI objects in WBEMClass "Win32_MotherboardDevice", run this from the Resource Kit: Cscript "motherboard.vbs" Name = Motherboard Device ID = Motherboard Primary Bus Type = PCI Secondary Bus Type = ISA To display properties of objCache objects in WBEMClass "Win32_CacheMemory", the Size and Error Correction type used by your Cache, run this from the Resource Kit: Cscript "Cacheinfo.vbs" Name = Cache Memory Error Correct Type = Unknown Location = Internal Max Cache Size = 32 Name = Cache Memory Error Correct Type = Unknown Location = External Max Cache Size = 2048

MS dot NET Implementation The .NET Framework WMI implementation defined its System.Management namespace to manage applications with these first level operations: ManagementQuery used as the basis for all query classes. ManagementObjectSearcher to retrieve a collection of ManagementObject or ManagementClass objects based on a specified query or enumeration. ManagementEventWatcher to subscribe to event notifications from WMI. To obtain a list of namespaces: Using C# .NET code, list all WMI instances of __namespace WMI class ManagementClass nsClass = new ManagementClass( new ManagementScope("root"), new ManagementPath("__namespace"), null); foreach(ManagementObject ns in nsClass.GetInstances()) { Console.WriteLine( ns["Name"].ToString() ); } Using .VBS script: Option Explicit Dim strNS Dim strComputerName strNS = "root" If WScript.Arguments.Count > 0 Then strComputerName = WScript.Arguments(0) Else strComputerName = "." End If GetNamespaces(strNS) Sub GetNamespaces(strNameSpace) Dim colNameSpaces Dim objNS Set colNameSpaces = GetObject( _ "winmgmts:{impersonationLevel=impersonate}//" & _ strComputerName & "/" & _ strNameSpace).InstancesOf ("__NAMESPACE") For Each objNS In colNameSpaces GetNamespaces(strNameSpace & "/" & objNS.Name) Next End Sub

An In-Depth Look at WMI and Instrumentation, Part I and II by Klaus Salchner Sample: TweakOMatic Microsoft's WMI SDK

MS dot NET WMI Queries In my WMIW32Queries.cs C# .NET console .exe program: To obtain the Win32_OperatingSystem collection of objects (as in John O'Donnell's program to query information provided by the WinMgmt.exe service) Instantiate a ManagementObjectSearcher query object with a query string formatted in SQL-like syntax: ManagementObjectSearcher query1 = new ManagementObjectSearcher("SELECT * FROM Win32_OperatingSystem") ;   Populate a ManagementObjectCollection object with an overrided Get method: ManagementObjectCollection queryCollection1 = query1.Get();   Iterate through each ManagementObject in the collection: foreach( ManagementObject mo in queryCollection1 ) { Console.WriteLine("Name : " + mo["name"].ToString());   To obtain Win32_Environment variables: Instantiate a SelectQuery object for a user: SelectQuery query2 = new SelectQuery("Win32_Environment", "UserName=\" \"");   Instantiate a ManagementObjectSearcher query object: ManagementObjectSearcher searcher = new ManagementObjectSearcher(query2);   Iterate through each ManagementBaseObject : foreach (ManagementBaseObject envVar in searcher.Get()) { Console.WriteLine("{0} = {1}", envVar["Name"], envVar["VariableValue"]);   To obtain a list of Windows services from the Win32_Service schema using multiple threads (as explained in Microsoft's Windows Management Instrumentation (WMI) Tutorial demonstrating how instance enumeration can be synchronous or asynchronous) Instantiate a SelectQuery object while instantiating a ManagementObjectSearcher query object: ManagementObjectSearcher searcher = new ManagementObjectSearcher(new SelectQuery("Win32_Service"));   Instantiate an OperationObserver object: ManagementOperationObserver results = new ManagementOperationObserver();   Instantiate a custom ObjectHandler for results and completion: ObjectHandler objectHandler = new ObjectHandler();   Attach the ObjectHandler to events for results and completion: results.ObjectReady += new ObjectReadyEventHandler(objectHandler.NewObject); results.Completed += new CompletedEventHandler(objectHandler.Done);   Call the asynchronous overload of ManagementOperationObserver Get() to start the enumeration: searcher.Get(results);   Sleep while results complete asynchronously: while (!objectHandler.IsCompleted) { System.Threading.Thread.Sleep (1000); } objectHandler.Reset();

AutoDiscovery/AutoPurge ( ADAP) mechanism Windows 2000 introduced the ability for applications to make its counters available among the Performance Object list within the Perfmon System Monitor This is done through the Reverse Adapter service wmiapsrv.exe through a custom high-performance WMI provider that creates WMI performance classes that: inherits from Win32_PerfRawData in root\cimv2 or \root\wmi namespaces. provides class qualifiers HiPerf, Provider, and Dynamic . These qualifiers are not of the class: Abstract, GenericPerfCtr, nor Cooked. The property provides qualifiers CounterType, DefaultScale, and PerfDetail . AutoDiscovery/AutoPurge ( ADAP) mechanism of WMI. This switch is only available on Windows 2000 and later. wmiadap.exe runs the AutoDiscovery/Auto Purge (ADAP) process that parse or clear performance libraries.

Directory-Enabled Networking (DEN) Directory-Enabled Networking (DEN) was proposed by Microsoft and Cisco Systems in 1998 to enhance interoperability between Microsoft's Active Directory and Cisco's Cisco Directory Services (CDS), integrated by the Cisco Networking Services for Active Directory (CNS/AD) product. DEN is a specification of generalized object-oriented data structures organized into a comprehensive single-inheritance schema for a common namespace across the entire network (DHCP, DNS, RADIUS, Kerberos, Netscape, Novell, ERP, etc.). The schema is extended from a superclass to a subclass. DEN v3.0 incorporated three existing directory standards: the Common Information Model (CIM) from the Desktop Management Task Force (DMTF) X.500, the global directory standard from the International Standards Organization (ISO). LDAP (Lightweight Directory Access Protocol) originally developed by the University of Michigan, now under the auspices of the IETF. Each DEN class describes a set of objects that share the same attributes, operations, methods, relationships, and semantics. A DEN object is a network element that exists within a class, with a well-defined boundary: an identity that encapsulates state and behavior. In other words, DEN is a very detailed specification that describes anything a human or machine using a network is likely to need to know. Each such element description is a class. A class is a prototype of a unique data structure designed to serve as a template for a particular entity. The data structure arranges the class's attributes (also called variables) in a record that best represents the relationships of the attributes. A class inherits some of its properties from a parent class higher up the food chain, and classes below it derive some of their properties from the higher class-thus the terms superclass and subclass. The four types of DEN classes-abstract, structural, container, and auxiliary-define what the classes can do. Derived From - The superclass for this class. Possible Superiors - A list of classes that may serve as a parent of instances of this class. Auxiliary Class - A class used to bind one class of objects to another-for example, to bind hostConditionAuxClass and routeConditionAuxClass, together, to the policyCondition structural class. Must Contain - List of attributes this class must contain. May Contain - List of attributes this class may contain. Relationships - List of associations and/or aggregations defined for this class.

from : http://www.wilsonmar.com/1wmiwbem.htm