The Microsoft Windows Managment Service

The "Windows Management Instrumentation" service winmgmt "Provides a common interface and object model to access management information about operating system, devices, applications, and services. If this service is stopped, most Windows-based software will not function properly. If this service is disabled, any services that depend on it will fail to start."

The Windows Management service automatically starts when the first management application makes a call to connect.

• On computers running Windows XP, the Windows Management service is implemented as a
  service process within SVCHOST.exe -k netsvcs.

  The additional security added by Windows XP SP2 requires a new Platform SDK

• On computers running Windows NT/Windows 2000, the Windows Management service runs as a
  separate service process.

  The WMI core WMI functionality introduced in the Windows 2000 Professional SP2 operating system (that comes as part of Windows 2000 Pro, 98 SE, and NT4 SP6) can be downloaded as part of the .NET Framework for use on older systems.

• On computers running Windows 98, the Windows Management service runs as a
  standard executable file (Winmgmt.exe) specified for invocation at start-up these Windows Registry entries.

Windows 2000 and XP offer more information than previous OS versions. Windows 2000 includes WMI version 1.5 (1085.005), which is SMBIOS aware.

L.J. Johnson notes that accessing Win32_QuickFixEngineering class on a pre-SP3 version of W2K causes the WinMgmt process to hang at 100% processor activity. Also, the WMI object seems to incorrectly parse some of the QEF information in the registry, and provides duplicate data for many of the QEFs. This bug is fixed in a post SP2 QEF, and in SP3 for W2K, so it is advisable to use his code to abort the WMI calls if the machine is running W2K SP3 or above,

Private Function GetOS_
                    (ByVal xi_sWbemServices As SWbemServices) As Variant
                    Dim vntTmp                          As Variant
                    Dim vntRtn                          As Variant
                    ReDim vntRtn(1 To 2) As Variant
                    vntTmp = GetOsData(xi_sWbemServices)
                    If Left$(vntTmp(1, 13), 4) = "5.0." Then
                    If CLng(vntTmp(1, 25)) >= 3 Then
                    vntRtn(1) = True
                    vntRtn(2) = vbNullString
                    Else
                    vntRtn(1) = False
                    vntRtn(2) = "If you are running W2K, _
                    you must have at least SP3 to run this " & _
                    "method. You are running SP " & vntTmp(1, 25)
                    End If
                    Else
                    vntRtn(1) = True
                    vntRtn(2) = vbNullString
                    End If
                    GetOS = vntRtn
                    End Function
                    

The "Windows Management Instrumentation Driver Extensions" service provides "systems management information to and from drivers."

Query Namespaces

The great thing about WMI is that it provides metadata about itself. Maclin provides this example of WSH VBScript code to recursively enumerate namespaces: The namespaces are:

root/SECURITY
                    root/SecurityCenter
                    root/WMI
                    root/WMI/ms_409
                    root/CIMV2
                    root/CIMV2/ms_409
                    root/CIMV2/Applications
                    root/CIMV2/Applications/MicrosoftACT
                    root/CIMV2/Applications/MicrosoftIE
                    root/Microsoft
                    root/Microsoft/HomeNet
                    root/DEFAULT
                    root/DEFAULT/ms_409
                    root/directory
                    root/directory/LDAP
                    root/directory/LDAP/ms_409
                    root/subscription
                    root/subscription/ms_409
                    root/MSAPPS11
                    

Example:

 wbemdump /Q root\cimv2 WQL "select Manufacturer from Win32_SystemEnclosure

This returns a number (such as "6").

Some applications provide an English translation, such as a datamap.ini that contains:

[INV_List_ChassisTypes]
                    0 = Unknown
                    1 = Other
                    2 = Unknown
                    3 = Desktop
                    4 = Low Profile Desktop
                    5 = Pizza Box
                    6 = Mini Tower
                    7 = Tower
                    8 = Portable etc.
                    9 = Laptop
                    10 = Notebook
                    11 = Hand Held
                    12 = Docking Station
                    13 = All in One
                    14 = Sub Notebook
                    15 = Space-Saving
                    16 = Lunch Box
                    17 = Main System Chassis
                    18 = Expansion Chassis
                    19 = SubChassis
                    20 = Bus Expansion Chassis
                    21 = Peripheral Chassis
                    22 = Storage Chassis
                    23 = Rack Mount Chassis
                    24 = Sealed-Case PC
                    

Every WMI class has a "Caption" property — a short description of the object-a one-line string.

A WSH query to a remote computer can be defined using the winmgmts: object:

Set objWMIService = GetObject("winmgmts://Computer_B\root\cimv2)

The .NET sample application "Processes and Services Explorer" PsView.exe is installed by running the .NET nmake (from the VS.NET Bin folder) while in Program Files\Microsoft Visual Studio .NET 2003 folder SDK\v1.1\Samples\Technologies\Interop\Applications\WMI

The installation depends on the WBEMSCRIPTING.dll which is also used by HealthMonitor, a free Windows Service app developed Vitorio Parvesi with VB.NET and WMI to check Windows system status (event viewer, disk free space, services status, performance, etc....)

The C# source for the program is in subfolder Form

Repository Schemas

The root of the schema contains these namespaces :

SECURITY
                    SecurityCenter
                    WMI
                    CIMV2
                    Microsoft
                    DEFAULT
                    directory
                    subscription
                    MSAPPS11

WMI MMC CIM WBEM for Namespace control

By default, the namespace is “root\cimv2” since WMI implements on Microsoft machines the Common Information Model (CIM) schema proposed by the Distributed Management Task Force (DMTF).

On the Windows XP install CD, the CIMv2r5.mof file provides a strictly compliant schema to the DMTF's CIM version 2.5. Compiling this MOF (using a local account that is a member of the 'Administrators' group) places schema in the root\CIMv2r5 Namespace.

The default namespace can be change manually using the MMC snap-in called WMI Control Properties :

1. In the Control Panel, double-click on Administrative Tools.
2. In the Administrative Tools window, double-click on Computer Management.
3. In the Computer Management window, expand the Services and Applications tree and double-click on the WMI Control.
4. Right-click on the WMI Control icon and select Properties.
5. Click on the Advanced tab.

This MMC provides the GUI to set security for each namespace.

Changes here are stored in the Windows Registry Scripting/Default/Namespace key under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\
"WBEM" is used because WMI is Microsoft's implementation of the implementation-neutral Web-Based Enterprise Management (WBEM) standard.

The WMI scripting library is implemented in a single automation component named wbemdisp.dll in the %SystemRoot%\system32\wbem directory.

There are twenty-four automation objects and thirteen enumerations in the Microsoft Windows XP and Windows Server 2003 version of wbemdisp.dll (nineteen in Windows 2000 and earlier).

Programming API Support

The WbemScripting library and API's are available for VBScript and JScript — the SWbemObjectSet collection of SWbemObject objects located on the SWbemObjectPath.

The moniker winmgmts: is used to get WMI objects. For example:

MsgBox (GetObject("WinMgmts:Win32_LogicalDisk='C:'").VolumeSerialNumber)

The classes are defined WMI Win32 hardware classes

ADSI API Support

To obtain information from the Windows 2000 Active Directory, the IWMIExtension interface extends Microsoft's Active Directory Service Interface (ADSI) computer objects returned from the LDAP namespace. The Active Directory Provider supports the standard IWbemInit interface. It is initiated with the IWbemProviderInit interface.

Microsoft provides a COM API library for C++ classes.

C programs use the Wbemads.h header file and Wbemuuid.lib.
VB programs use the Wbemadsi.tlb.

Query Language

The WMI Query Language (WQL) is similar to simple SELECT queries in SQL for the WMI ODBC Adapter. For example, to obtain capacity and free space for each logical drive:
Select Space, FreeSpace, DeviceID From Win32_LogicalDisk

WMI Utilities

Download Microsoft WMITools. These use ActiveX, so must be run using Internet Explorer (not Mozilla/Netscape browsers) and active must be allowed.
• WMI Object Browser: view objects, edit property values and qualifiers, and run methods from instance of Win32_ComputerSystem.
• WMI CIM Studio: view and edit classes, properties, qualifiers, and instances in a CIM repository; run selected methods; generate and compile MOF files.
• WMI Event Registration Tool: creates, permanent event consumers, creates or views instances of event consumers, filters, bindings, and timer system classes.
• WMI Event Viewer: displays the occurrence of WMI events you have configured in the WMI Event Registration.

wmic command-line utility,

wbemdump.exe displays WMI classes, runs methods, and executes queries against classes in a namespace.

WMI browser from Microsoft's WMI SDK uses Microsoft's Distributed COM (DCOM) to obtain information about accessing remote machines, especially machines with Windows XP SP2

$99 Admin Script Editor (ASE) features a WMI Wizard

Microsoft's WMI home page

Microsoft's WMI Glossary

microsoft.public...
win32.programmer.wmi
dotnet.framework.wmi
microsoft.public.windowsxp.wmi
microsoft.public.scripting.vbscript
platformsdk.security

Michael Maston's MSDN News, November/December 1999 article

Articles on WMI at DevX


$40 Developing WMI Solutions: A Guide to Windows Management Instrumentation by Craig Tunstall, Gwyn Cole includes use of C# to access .Net apps. Addison Wesley Nov 2002.

Understanding Windows Management Instrumentation (WMI) Scripting by Alain Lissoir Digital Press; (March 2003)

Leveraging Windows Management Instrumentation (WMI) Scripting by Alain Lissoir Digital Press; (March 2003)

Microsoft® Windows® 2000 Scripting Guide by The Microsoft Windows Resource Kit Scripting Team Microsoft Press; 1st edition (December 16, 2002)

Developing WMI Solutions: A Guide to Windows Management Instrumentation by Craig Tunstall and Gwyn Cole Addison Wesley Professional; 1st edition (November 12, 2002)

Windows Management Instrumentation (WMI) by Matthew Lavy and Ashley Meggitt New Riders Publishing; 1st edition (October 15, 2001)

WMI Essentials for Automating Windows Management by Marcin Policht Sams; 1st edition (July 23, 2001)

Scripting XML and WMI for Microsoft SQL 2000 by Tobias Martinsson John Wiley & Sons; Book & CD edition (January 12, 2001)

Retrieving WMI info by Google Gadget

VBScript Examples

    'Get the set
                        Set objProcSet = objService.InstancesOf(strWBEMClass)
                        If blnErrorOccurred("Could not obtain " & _
                        strWBEMClass & " instance.") Then
                        Exit Sub
                        End If
                        If objProcSet.Count = 0 Then
                        Call WriteLine("No processor information is available.", objOutputFile)
                        Exit Sub
                        End If
                        Call WriteLine("Processor information for Machine " _
                        & strServer, objOutputFile)
                        Call WriteLine("", objOutputFile)
                        For Each objProc In objProcSet
                        Call WriteLine("Name                = " & _
                        objProc.Name, objOutputFile)
                        Call WriteLine("Current Voltage     = " & _
                        objProc.CurrentVoltage, objOutputFile)
                        Call WriteLine("Device ID           = " & _
                        objProc.DeviceID, objOutputFile)
                        Call WriteLine("Status              = " & _
                        objProc.CpuStatus, objOutputFile)
                        Call WriteLine("Data Width          = " & _
                        objProc.DataWidth, objOutputFile)
                        Call WriteLine("Current Clock Speed = " & _
                        objProc.CurrentClockSpeed, objOutputFile)
                        Call WriteLine("L2 Cache Size       = " & _
                        objProc.L2CacheSize, objOutputFile)
                        Call WriteLine("Level               = " & _
                        objProc.Level, objOutputFile)
                        Call WriteLine("External Clock      = " & _
                        objProc.ExtClock, objOutputFile)
                        Call WriteLine("", objOutputFile)
                        Next
                        

ActiveXperts Network Monitor provides examples of WMI in VB.

To display properties of objProc objects in WBEMClass "Win32_Processor", run this from the Resource Kit:

Cscript "processor.vbs"

Name                = Intel Celeron processor
                            Current Voltage     = 33
                            Device ID           = CPU0
                            cpu Status          = 1
                            Data Width          = 32
                            Current Clock Speed = 499
                            L2 Cache Size       = 128
                            Level               = 6
                            Ext(ernal) Clock    = 83
                            

To display properties of objMBOI objects in WBEMClass "Win32_MotherboardDevice", run this from the Resource Kit:

Cscript "motherboard.vbs"

Name = Motherboard
                                    Device ID = Motherboard
                                    Primary Bus Type = PCI
                                    Secondary Bus Type = ISA
                                    

To display properties of objCache objects in WBEMClass "Win32_CacheMemory", the Size and Error Correction type used by your Cache, run this from the Resource Kit:

Cscript "Cacheinfo.vbs"

Name               = Cache Memory
                                        Error Correct Type = Unknown
                                        Location           = Internal
                                        Max Cache Size     = 32
                                        Name               = Cache Memory
                                        Error Correct Type = Unknown
                                        Location           = External
                                        Max Cache Size     = 2048
                                        

MS dot NET Implementation

The .NET Framework WMI implementation defined its System.Management namespace to manage applications with these first level operations:
• ManagementQuery used as the basis for all query classes.
• ManagementObjectSearcher to retrieve a collection of ManagementObject or
  ManagementClass objects based on a specified query or enumeration.
• ManagementEventWatcher to subscribe to event notifications from WMI.
• To obtain a list of namespaces:
  Using C# .NET code, list all WMI instances of __namespace WMI class

  ManagementClass nsClass = new
                                          ManagementClass(
                                          new ManagementScope("root"),
                                          new ManagementPath("__namespace"),
                                          null);
                                          foreach(ManagementObject ns in nsClass.GetInstances()) {
                                          Console.WriteLine( ns["Name"].ToString() );
                                          }

  Using .VBS script:

  Option Explicit
                                          Dim strNS
                                          Dim strComputerName
                                          strNS = "root"
                                          If WScript.Arguments.Count > 0 Then
                                          strComputerName = WScript.Arguments(0)
                                          Else
                                          strComputerName = "."
                                          End If
                                          GetNamespaces(strNS)
                                          Sub GetNamespaces(strNameSpace)
                                          Dim colNameSpaces
                                          Dim objNS
                                          Set colNameSpaces = GetObject( _
                                          "winmgmts:{impersonationLevel=impersonate}//" & _
                                          strComputerName & "/" & _
                                          strNameSpace).InstancesOf ("__NAMESPACE")
                                          For Each objNS In colNameSpaces
                                          GetNamespaces(strNameSpace & "/" & objNS.Name)
                                          Next
                                          End Sub
                                          

An In-Depth Look at WMI and Instrumentation, Part I and II by Klaus Salchner

Sample: TweakOMatic

Microsoft's WMI SDK

MS dot NET WMI Queries

In my WMIW32Queries.cs C# .NET console .exe program:
• To obtain the Win32_OperatingSystem collection of objects (as in John O'Donnell's program to query information provided by the WinMgmt.exe service)
  1. Instantiate a ManagementObjectSearcher query object with a query string formatted in SQL-like syntax:

     ManagementObjectSearcher query1 = new
                                                 ManagementObjectSearcher("SELECT * FROM Win32_OperatingSystem") ; 

  2. Populate a ManagementObjectCollection object with an overrided Get method:

      ManagementObjectCollection queryCollection1 = query1.Get(); 

  3. Iterate through each ManagementObject in the collection:

      foreach( ManagementObject mo in queryCollection1 ) {
                                                 Console.WriteLine("Name : " + mo["name"].ToString());

• To obtain Win32_Environment variables:
  1. Instantiate a SelectQuery object for a user:

     SelectQuery query2 = new
                                                 SelectQuery("Win32_Environment", "UserName=\"\"");

  2. Instantiate a ManagementObjectSearcher query object:

     ManagementObjectSearcher searcher = new
                                                 ManagementObjectSearcher(query2);

  3. Iterate through each ManagementBaseObject :

     foreach (ManagementBaseObject envVar in searcher.Get()) {
                                                 Console.WriteLine("{0} = {1}",
                                                 envVar["Name"],
                                                 envVar["VariableValue"]);

• To obtain a list of Windows services from the Win32_Service schema using multiple threads (as explained in Microsoft's Windows Management Instrumentation (WMI) Tutorial demonstrating how instance enumeration can be synchronous or asynchronous)
  1. Instantiate a SelectQuery object while instantiating a ManagementObjectSearcher query object:

     ManagementObjectSearcher searcher = new
                                                 ManagementObjectSearcher(new SelectQuery("Win32_Service"));

  2. Instantiate an OperationObserver object:

     ManagementOperationObserver results = new
                                                 ManagementOperationObserver();

  3. Instantiate a custom ObjectHandler for results and completion:

     ObjectHandler objectHandler = new
                                                 ObjectHandler();

  4. Attach the ObjectHandler to events for results and completion:

     results.ObjectReady += new
                                                 ObjectReadyEventHandler(objectHandler.NewObject);
                                                 results.Completed += new
                                                 CompletedEventHandler(objectHandler.Done);

  5. Call the asynchronous overload of ManagementOperationObserver Get() to start the enumeration:

     searcher.Get(results);

  6. Sleep while results complete asynchronously:

     while (!objectHandler.IsCompleted) {
                                                 System.Threading.Thread.Sleep (1000);
                                                 }
                                                 objectHandler.Reset();

AutoDiscovery/AutoPurge ( ADAP) mechanism

Windows 2000 introduced the ability for applications to make its counters available among the Performance Object list within the Perfmon System Monitor

This is done through the Reverse Adapter service wmiapsrv.exe through a custom high-performance WMI provider that creates WMI performance classes that:

• inherits from Win32_PerfRawData in root\cimv2 or \root\wmi namespaces.
• provides class qualifiers HiPerf, Provider, and Dynamic .
• These qualifiers are not of the class: Abstract, GenericPerfCtr, nor Cooked.
• The property provides qualifiers CounterType, DefaultScale, and PerfDetail .

AutoDiscovery/AutoPurge ( ADAP) mechanism of WMI. This switch is only available on Windows 2000 and later.

wmiadap.exe runs the AutoDiscovery/Auto Purge (ADAP) process that parse or clear performance libraries.