1. Windows Management Instrumentation WMI Eran Spitz (www.myitforum.com) EDS-Israel

2. What is the WMI? MS implementation of DMTF ’ s WBEM initiative Centralized resource for desktops data

3. WMI Components Location: %SystemRoot%\System32\WBEM Repository: WBEM\Repository\CIM.rep Logging: WBEM\Logs Process: Winmgmt.exe

4. WMI Structure Namespace Class Instance Win32_Service Cimv2 Alerter

5. Class Parameters Path: Root\Cimv2\Win32_Service Display Name Process ID Path (exe file) Start Mode Start Name (account) State

6. Class Methods Stop Service User control service Change start mode Create Delete Pause Service Resume Service Start Service Path: Root\Cimv2\Win32_Service

7. Tools for configuration and analyzing Wbemtest.exe Wbemperm.exe WMI SDK – Object Browser CIM Studio WMI Event Viewer Wbemdump.exe Scripting (vbs,js etc.)

8. WMI Framework Flow

9. Extending the WMI Extension done through MOF files (managed objects format) ASCII files that represent a Schema structure Compiled using Mofcomp.exe

10. Management Applications and WMI Tasks: Collection of data from managed computers Alerts based on WMI events Execution of methods on managed computers

11. Scripting With WMI 2 ways for connecting the WMI: SwbemLocator Object “ Winmgmts: ” Moniker

12. Monikers ProgID -> CLSID -> DLL file Mapping is also found: HKCR “ Winmgmts: ” Moniker uses the: %sys32%\wbem\wbemdisp.dll

13. Using WMI Moniker 3 optional parts for using WMI moniker: 1. Using the “ Winmgmts: ” Perfix 2. Security Settings-Ipmersonation 3. Object Path.

14. Object Path Specifying Object path: Remote Computer WMI Namespace WMI Class\Instance