Windows Management Instrumentation (WMI) is a set of extensions to the Windows Driver Model that provides an operating system interface through which instrumented components provide information and notification. WMI is Microsoft's implementation of the Web-Based Enterprise Management (WBEM) and Common Information Model (CIM) standards from the Distributed Management Task Force (DMTF).
WMI allows scripting languages (such as VBScript or PowerShell) to manage Microsoft Windows personal computers and servers, both locally and remotely. WMI comes preinstalled in Windows 2000 and later. It is available as a download for Windows NT 4.0,[1] Windows 95, and Windows 98.[2]
Also included with Windows was Windows Management Instrumentation Command-line (WMIC), a CLI utility to interface with WMI.[3] However, starting with Windows 10, version 21H1 and Windows Server 2022, WMIC is deprecated in favor of PowerShell.[4]
The purpose of WMI is to define a proprietary set of environment-independent specifications that enable sharing management information between management apps. WMI prescribes enterprise management standards and related technologies for Windows that work with existing management standards, such as Desktop Management Interface (DMI) and Simple Network Management Protocol (SNMP). WMI complements these other standards by providing a uniform model for accessing management data from any source.
Because WMI abstracts the manageable entities with Common Information Model (CIM) and a collection of providers, the development of a provider implies several steps. The major steps can be summarized as follows:
Since the release of the first WMI implementation during the Windows NT 4.0 SP4 era (as an out-of-band download), Microsoft has consistently added WMI providers to Windows:
Many customers have interpreted the growth in numbers of providers as a sign that Microsoft envisions WMI as the ubiquitous management layer of Windows.
Beyond the scripting needs, most leading management solutions, such as Microsoft Operations Mamager (MOM), System Center Configuration Manager (SCCM), Active Directory Services (ADS), HP OpenView (HPOV), and the various offerings of BMC Software and CA, Inc. are WMI-enabled, i.e., capable of consuming and providing WMI information. This enables administrators who lack WMI coding skills to benefit from WMI.
WMI offers many features out of the box. Here are the most important advantages:
System.Management
To speed up the process of writing a WMI provider, the WMI team developed the WMI ATL Wizard to generate the code template implementing a provider. The code generated is based on the WMI class model initially designed by the developer. The WMI provider developer will be able to interface the pre-defined COM or DCOM interfaces for the WMI provider with its set of native APIs retrieving the management information to expose.
WMI is based on an industry standard called Common Information Model (CIM) defined by the Distributed Management Task Force (DMTF). The CIM class-based schema is defined by a consortium of manufacturers and software developers for the requirements of the industry. Any developer can write code that fits into this model. For instance, Intel develops WMI providers for its network adapters. HP leveraged existing WMI providers and developed custom WMI providers for its OpenView enterprise management solutions. IBM's Tivoli management suite consumes WMI. Starting with Windows XP SP2, Microsoft leverages WMI to get status information from antivirus software and firewalls.
On the Windows NT family of operating systems, WMI runs as a Windows service called WinMgmt. On the Windows 9x family, WMI runs in the context of the WinMgmt.exe executable file. On both Windows 9x and Windows NT families, WinMgmt.exe is available as a command-line utility for servicing the WMI repository.[9]
WinMgmt
WinMgmt.exe
Microsoft provides the following WMI tools for developers and IT pros:
MOFComp.exe
%SystemRoot%\System32\WBEM
WBEMTest.exe
wmi-client
WBEMDump.exe
In the .NET Framework, the ManagementClass class represents a Common Information Model (CIM) management class. A WMI class can be a Win32_LogicalDisk in the case of a disk drive, or a Win32_Process, such as a running program like Notepad.exe.
Win32_LogicalDisk
Win32_Process
Notepad.exe
This example shows how MSNdis_80211_ServiceSetIdentifier WMI class is used to find the SSID of the Wi-Fi network that the system is currently connected to in the language C#:
MSNdis_80211_ServiceSetIdentifier
ManagementClass mc = new ManagementClass("root\\WMI", "MSNdis_80211_ServiceSetIdentifier", null); ManagementObjectCollection moc = mc.GetInstances(); foreach (ManagementObject mo in moc) { string wlanCard = (string)mo["InstanceName"]; bool active; if (!bool.TryParse((string)mo["Active"], out active)) { active = false; } byte[] ssid = (byte[])mo["Ndis80211SsId"]; }
The MSNdis_80211_ServiceSetIdentifier WMI class is only supported on Windows XP and Windows Server 2003.
The WMI extensions to WDM provide kernel-level instrumentation such as publishing information, configuring device settings, supplying event notification from device drivers, and allowing administrators to set data security through a WMI provider known as the WDM provider. The extensions are part of the WDM architecture; however, they have broad utility and can be used with other types of drivers as well (such as SCSI and NDIS).
The WMI Driver Extensions service monitors all drivers and event trace providers that are configured to publish WMI or event trace information. Instrumented hardware data is provided by way of drivers instrumented for WMI extensions for WDM. WMI extensions for WDM offer a set of Windows device driver interfaces for instrumenting data within the driver models native to Windows, so OEMs and IHVs can easily extend the instrumented data set and add value to a hardware/software solution. The WMI Driver Extensions, however, are not supported by Windows Vista and later operating systems.[12]