WMI Architecture

  • Article

WMI is designed to function as a middle layer, by serving as a standard interface between management applications and the systems that they manage. Figure B.1 illustrates the WMI architecture.

Figure B.1 WMI architecture

ops_ac_c1c

The Common Information Model (CIM) Object Manager is implemented in the WMI service on Windows NT 4.0, Windows 2000, Windows XP, and operating systems in the Windows Server 2003 family. The WMI service runs WinMgmt.exe and related dynamic-link libraries (DLLs) from the %Windir%\System32\Wbem directory. In Windows XP and operating systems in the Windows Server 2003 family, the WMI service runs as part of a Svchost service.

Using WMI Control, you can back up the repository, control logging, and configure elements of WMI.

The CIM Repository is a database for static WMI data and object definitions. The CIM Repository is stored in the CIM.rep file in the %Windir%\System32\Wbem\Repository directory or in files in the Repository\FS directory for Windows XP and later operating systems. The CIM Repository is built during WMI setup from Managed Object Format (MOF) files, such as CIMwin32.mof, that are found in the %Windir%\System32\Wbem directory.

With the exception of Advanced Client settings, the CIM Repository does not contain data. It mostly contains definitions. Most of the data is retrieved dynamically and is therefore only accurate at the time that you ask for it. The classes that are defined to use providers specify which provider to use and supply sufficient details for the provider to get the data. When WMI receives a request for data, it checks the class definition for the details and then asks the relevant provider to get the data from the system.

Other possible directories in the %Windir%\System32\Wbem directory tree are:

  • AdStatus - for the trust monitor provider.

  • Logs - see the "WMI Troubleshooting Techniques" section later in this appendix.

  • Mof - MOF files placed in this directory are automatically compiled. Those that are successfully compiled are placed in a subdirectory named Good. Those that fail to compile are placed in a subdirectory named Bad. Using this directory is discouraged.

  • Performance - for the high-performance provider.

  • Snmp - for the SNMP provider.

  • Xml - for files to support XML extensions to WMI.

Providers can be implemented as separate DLLs, in DLLs with other functions, or in an application executable file. They can operate in the context of the WMI service or the application. Providers can be located in any directory. If installed, the WMI SDK files can be found in the \Program Files\WMI directory.

Common WMI file types and file name extensions are:

  • .mof - for Managed Object Format files. For more information, see the "Using MOF Files" section later in this appendix.

  • .mfl - for MOF localization files.

You can connect to WMI on any computer on your network that has WMI installed, if the security configuration on that computer allows it. You can remotely connect to WMI by using the Distributed Common Object Model (DCOM) protocol, which uses the remote procedure call (RPC) protocol, which in turn uses TCP/IP.

The WMI registry tree is HKLM\Software\Microsoft\WBEM.

Internal components of WMI include:

  • The event subsystem - processes WMI events.

  • The Framework - the core providers including the Microsoft Win32 provider.

  • Connection proxy - facilitates connections between WMI-based applications and WMI using DCOM.

For computers running Windows XP or operating systems in the Windows Server 2003 family, WMI providers are loaded into one or more processes running WMIPrvse.exe. The providers provide the same functionality as before, but they do it in a more secure and reliable manner.

For More Information

Did you find this information useful? Please send your suggestions and comments about the documentation to smsdocs@microsoft.com.