Home Up


WMI Reference


Win32 Classes

Microsoft® Windows® classes give you the means to manipulate a variety of objects. The following table identifies the categories of Windows classes.

Table C-1. Win32 Classes



Computer system hardware

Classes that represent hardware related objects.

Operating system

Classes that represent operating system related objects.

Installed applications

Classes that represent software related objects.

WMI service management

Classes used to manage WMI.

Performance counters

Classes that represent formatted and raw performance data.


WMI Providers

The providers in the following table can request information from and send instructions to Windows Management Instrumentation (WMI) objects.

Table C-2. WMI providers



Active Directory Provider

Maps Active Directory™ objects to WMI. By accessing the Lightweight Directory Access Protocol (LDAP) namespace in WMI, you can reference or make an object an alias in the Active Directory. Supports the standard IWbemInit interface.

Cooked Counter Provider

Windows XP:  High-performance provider that is the preferred source of cooked (calculated) data. Cooked data is the same data displayed in System Monitor. WMI supplies cooked classes such as Win32_PerfFormattedData_PerfOS_Cache, which allows applications to obtain cooked data for performance objects such as the cache.

DFS Provider

Windows Server 2003 family:  Supplies Distributed File System (DFS) functions that logically group shares on multiple servers, and link them transparently into a tree-like structure in a single namespace.

Disk Quota Provider

Windows XP:  Allows administrators to control the amount of data that each user stores on a Windows NT File System (NTFS) volume.

Event Log Provider

Windows NT/2000:  Provides access to data from the event log service to notifications of events.

IP Route Provider

Windows Server 2003 :  Supplies network routing information.

Job Object Provider

Windows XP:  Provides access to data on named kernel job objects.

Performance Counter Provider

Windows 2000 and later:  High-performance provider that is the preferred source of raw performance data. WMI supplies raw classes such as Win32_PerfRawData_PerfOS_Cache, which allows applications to obtain raw performance data for performance objects such as the cache.

Performance Monitoring Provider

Windows NT/2000 and earlier:  Provider for cooked data. In Windows XP, the Cooked Counter provider supplies the C++ and scripting APIs that access cooked data.

Ping Provider

Windows XP:  Supplies WMI access to the status information provided by the standard ping command.

Policy Provider

Windows XP:  Provides extensions to group policy, and permits refinements in the application of policy.

Power Management Event Provider

Windows 2000 and later:  Supplies information to the Win32_PowerManagementEvent class to describe power management events that result from power state changes by modeling the Windows 2000 power management protocols.

Security Provider

Retrieves or changes security settings that control ownership, auditing, and access rights to Windows NT/Windows 2000 file system (NTFS) files, directories, and shares.

Session Provider

Windows NT/2000 and later:  Manages network sessions and connections.

SNMP Provider

Maps Simple Network Management Protocol (SNMP) objects defined in Management Information Base (MIB) schema objects to WMI CIM classes. This provider is not preinstalled, but available for Windows NT/Windows 2000 and later.

System Registry Provider

Enables management applications to retrieve and modify data in the system registry; and receive notifications when changes occur. This provider is not preinstalled but available for all operating systems.

Terminal Services Provider

WMI classes that you can use for consistent server administration in a Terminal Services environment.

Trustmon Provider

Windows Server 2003:  Provides access information about domain trusts.

View Provider

Creates new instances and methods based on instances of other classes.

WDM Provider

Windows NT/2000 and later:  Provides access to the classes, instances, methods, and events of hardware drivers that conform to the Windows Driver Model (WDM).

Win32 Provider

Provides access and updates data from Windows systems such as the current settings of environment variables and the attributes of a logical disk.

Windows Installer Provider

Provides access information collected from Windows Installer-compliant applications, and makes Windows Installer procedures available remotely.


Windows Server 2003:  The Windows Installer provider is included on the CD as an optional Windows component that you can install by using Control Panel. Optional installation of the Windows Installer provider ensures backward compatibility with the Windows XP and Windows 2000 feature sets.

Windows Product Activation Provider

Windows XP:  Supports Windows Product Activation (WPA) administration by using WMI interfaces, and provides consistent server administration in Windows XP.


WMI Scripting API Objects

The following table describes WMI scripting objects and how they are used.

Table C-3. WMI Scripting API Objects




Constructs and parses CIM datetime values. This is a helper object that is available in Windows XP.


Retrieves events in conjunction with SWbemServices.ExecNotificationQuery.


Provides extended error information when an error occurs.


Obtains an SWbemServices object that can get access to WMI on a particular host computer.


Contains a single WMI method definition.


Gets a collection of SWbemMethod objects.


Contains a single named value.


Gets access to a collection of SWbemNamedValue objects.


Contains and manipulates a single WMI object class or instance.


Extends the functionality of SWbemObject in Windows XP operating systems. This object adds the Refresh method for SWbemRefresher objects.


Generates and validates an object path.


Gets access to a collection of SWbemObject objects.


Sets or clears a privilege.


Gets access to a collection of SWbemPrivilege objects.


Contains a single WMI property.


Gets access to a collection of SWbemProperty objects.


Contains a single property qualifier.


Gets access to a collection of SWbemQualifier objects.


Collects and updates object property values in one operation. This object is available in Windows XP.


Represents a single refreshable element in an SWbemRefresher object, such as a property. This object is available in Windows XP.


Manages security settings such as Component Object Model (COM) Privileges, AuthenticationLevel, and ImpersonationLevel.


Creates, updates, and retrieves instances or classes.


Extends the functionality of SWbemServices in Windows XP operating systems. This object adds the Put and PutAsync methods to allow a class or instance to be saved to multiple namespaces.


Receives the results of asynchronous operations and event notifications, which are used by client applications.


WMI log files

The following table lists those log files created by WMI and the WMI providers.

Table C-4. WMI log files




Trace information and error messages for the Directory Services Provider.


Trace information and error messages for the provider framework and the Win32 Provider.


Compilation details from the MOF compiler.


Trace messages from the Event Log Provider.


This provider requires that you set any bit value for the mask level in the system registry.


Report on those MOF files that failed to load during the setup process. However, the error that caused the failure is not reported. You must review the Mofcomp.log file to determine the reason for the failure. After the error has been corrected, you can recompile the MOF file (using mofcomp) with the -autorecover switch.


Trace information from the View Provider based on the mask level you set in the registry.


Wide spectrum of trace messages.


Log entries related to events.


Trace information for the WMI proxy server.


Trace information from the Simple Network Management Protocol (SNMP) Provider.


Trace information that is typically not used for diagnostics.


Error messages related to the AutoDiscoveryAutoPurge (ADAP) process.


Management data and events from WMI-enabled Windows Driver Model (WDM) drivers.


© Copyright 2004, Ed Wilson All Rights Reserved.