The Windows Management Instrumentation (WMI) facilities in Windows offer thousands of classes that provide information of interest to administrators. Table G-1 lists the categories and subcategories covered by WMI and can be used to get a general idea of the scope of WMI classes. Table G-2 provides a selected subset of the most useful WMI classes. For more information about a category, search the official WMI documentation at http://msdn.microsoft.com.
Table G-1. WMI class categories and subcategories
Table G-2. Selected WMI Classes
Represents a baseboard, which is also known as a motherboard or system board. | |
Represents the attributes of the computer system’s basic input/output services (BIOS) that are installed on a computer. | |
Represents a CD-ROM drive on a Windows computer system. Be aware that the name of the drive does not correspond to the logical drive letter assigned to the device. | |
Represents a device that can
interpret a sequence of instructions on a computer running on a
Windows operating system. On a multiprocessor computer, one instance
of the | |
Represents a product. This includes software and hardware used on this computer system. | |
Represents a named collection of data or executable code. Currently, the provider returns files on fixed and mapped logical disks. In the future, only instances of files on local fixed disks will be returned. | |
Represents the common characteristics of a user’s desktop. The properties of this class can be modified by the user to customize the desktop. | |
Represents the type of monitor or display device attached to the computer system. | |
Represents a physical disk drive as seen by a computer running the Windows operating system. Any interface to a Windows physical disk drive is a descendant (or member) of this class. The features of the disk drive seen through this object correspond to the logical and management characteristics of the drive. In some cases, this may not reflect the actual physical characteristics of the device. Any object based on another logical device would not be a member of this class. | |
Tracks disk space usage for NTFS filesystem volumes. A system administrator can configure Windows to prevent further disk space use and log an event when a user exceeds a specified disk space limit. An administrator can also log an event when a user exceeds a specified disk space warning level. This class is new in Windows XP. | |
Represents a direct memory access (DMA) channel on a Windows computer system. DMA is a method of moving data from a device to memory (or vice versa) without the help of the microprocessor. The system board uses a DMA controller to handle a fixed number of channels, each of which can be used by one (and only one) device at a time. | |
Represents an environment or system environment setting on a Windows computer system. Querying this class returns environment variables found in HKLMSystemCurrentControlSetControlSessionmanagerEnvironment as well as HKEY_USERS<user sid>Environment. | |
Represents a directory entry on a
Windows computer system. A directory is a type
of file that logically groups data files and provides path
information for the grouped files. | |
Represents data about a group account. A group account allows access privileges to be changed for a list of users (for example, Administrators). | |
Manages the capabilities of an integrated device electronics (IDE) controller device. | |
Represents an interrupt request line (IRQ) number on a Windows computer system. An interrupt request is a signal sent to the CPU by a device or program for time-critical events. IRQ can be hardware- or software-based. | |
Represents a job created with the
Windows 2000 and Windows NT 4.0: You can use the Scheduled Tasks UI to modify the task you originally created with WMI. However, although the task is successfully modified, you can no longer access the task using WMI. Each job scheduled against the schedule service is stored persistently (the scheduler can start a job after a reboot) and is executed at the specified time and day of the week or month. If the computer is not active or if the scheduled service is not running at the specified job time, the schedule service runs the specified job on the next day at the specified time. Jobs are scheduled according
to Universal Coordinated Time (UTC) with bias offset from Greenwich
mean time (GMT), which means that a job can be specified using any
time zone. The | |
Represents a group of system services that define execution dependencies. The services must be initiated in the order specified by the Load Order Group, as the services are dependent on one another. These dependent services require the presence of the antecedent services to function correctly. The data in this class is derived by the provider from the registry key SystemCurrentControlSetControl GroupOrderList. | |
Represents a data source that resolves to an actual local storage device on a Windows system. | |
Describes the logon session or sessions associated with a user logged on to Windows NT or Windows 2000. | |
Represents internal and external cache memory on a computer system. | |
Represents the layout and availability of memory on a Windows system. Beginning with Windows Vista, this class is no longer available in the operating system. Windows XP and Windows
Server 2003: This class is no longer supported. Use the | |
Represents details about the computer system physical memory. This includes the number of memory devices, memory capacity available, and memory type (for example, system or video memory). | |
Represents a network client on a Windows system. Any computer system on the network with a client relationship to the system is a descendant (or member) of this class (for example, a computer running Windows 2000 Workstation or Windows 98 that is part of a Windows 2000 domain). | |
Represents the network login information of a specific user on a Windows system. This includes but is not limited to password status, access privileges, disk quotas, and login directory paths. | |
Represents a protocol and its network characteristics on a Win32 computer system. | |
Represents an active network connection in a Windows environment. | |
Represents a network adapter of a computer running on a Windows operating system. | |
Represents the attributes and behaviors of a network adapter. This class includes extra properties and methods that support the management of the TCP/IP and Internetworking Packet Exchange (IPX) protocols that are independent from the network adapter. | |
Used to translate instances from
the Windows NT event log. An application must have | |
Represents a logical file or directory of Windows NT events. The file is also known as the event log. | |
Represents common adapter devices built into the motherboard (system board). | |
Represents an operating system
installed on a computer running on a Windows operating system. Any
operating system that can be installed on a Windows system is a
descendant or member of this class. Windows Server 2003, Windows XP, Windows 2000, and Windows NT 4.0: If a computer has multiple operating systems installed, this class returns only an instance for the currently active operating system. | |
Represents the file used for handling virtual memory file swapping on a Win32 system. Information contained within objects instantiated from this class specifies the runtime state of the page file. | |
Represents the settings of a page
file. Information contained within objects instantiated from this
class specifies the page file parameters used when the file is
created at system startup. The properties in this class can be
modified and deferred until startup. These settings are different
from the runtime state of a page file expressed through the
associated class | |
Represents the capabilities and management capacity of a partitioned area of a physical disk on a Windows system (for example, Disk #0, Partition #1). | |
Represents physical connection ports, such as DB-25 pin male, Centronics, or PS/2. | |
Represents a device connected to a computer running on a Microsoft Windows operating system that can produce a printed image or text on paper or another medium. | |
Represents the configuration for a printer device. This includes capabilities such as resolution, color, fonts, and orientation. | |
Represents a print job generated by a Windows application. Any unit of work generated by the Print command of an application that is running on a computer running on a Windows operating system is a descendant or member of this class. | |
Represents products as they are installed by Windows Installer. A product generally correlates to one installation package. For information about support or requirements for installation of a specific operating system, visit http://msdn.microsoft.com and search for “Operating System Availability of WMI Components”. | |
Represents system-wide Quick Fix Engineering (QFE) or updates that have been applied to the current operating system. | |
Represents the types of information that will be gathered from memory when the operating system fails. This includes boot failures and system crashes. | |
Represents the system registry on a Windows computer system. | |
Provides raw data from performance counters that monitor communications using the WINS Server service. | |
Represents a service on a computer running on a Microsoft Windows operating system. A service application conforms to the interface rules of the Service Control Manager (SCM), and can be started by a user automatically at system start through the Services Control Panel utility or by an application that uses the service functions included in the Windows API. Services can start when there are no users logged on to the computer. | |
Represents a shared resource on a Windows system. This may be a disk drive, printer, interprocess communication, or other shareable device. | |
Represents a software element, part
of a software feature (a distinct subset of a product, which may
contain one or more elements). Each software element is defined in a
| |
Represents a distinct subset of a
product that consists of one or more software elements. Each
software element is defined in a | |
Represents the properties of a sound device on a Windows computer system. | |
Represents a command that runs automatically when a user logs on to the computer system. | |
Represents a system account. The system account is used by the operating system and services that run under Windows NT. There are many services and processes within Windows NT that need the capability to log on internally, for example, during a Windows NT installation. The system account was designed for that purpose. | |
Represents the properties that are associated with a physical system enclosure. | |
Represents physical connection points, including ports, motherboard slots and peripherals, and proprietary connection points. | |
Represents a tape drive on a Windows computer. Tape drives are primarily distinguished by the fact that they can be accessed only sequentially. | |
Represents the properties of a temperature sensor (e.g., electronic thermometer). | |
Represents the time zone information for a Windows system, which includes changes required for the daylight saving time transition. | |
Represents the capabilities and management capacity of an uninterruptible power supply (UPS). Beginning with Windows Vista, this class is obsolete and not available, because the UPS service is no longer available. This service worked with serially attached UPS devices, not USB devices. Windows Server 2003 and Windows XP: This class is available, but not usable, because the UPS service fails. Windows Server 2003, Windows XP, Windows 2000, and Windows NT 4.0: This class is available and implemented. | |
Contains information about a user account on a computer running on a Windows operating system. Because both the | |
Represents the properties of a voltage sensor (electronic voltmeter). | |
Relates disk quota settings with a specific disk volume. Windows 2000/NT: This class is not available. | |
Contains the operational parameters for the WMI service. This class can have only one instance, which always exists for each Windows system and cannot be deleted. Additional instances cannot be created. |