3.2 The WMI providers

Each of the providers examined in this chapter can be considered as specialized providers. Some of them provide functionality about system components not supported by the Win32 providers, such as the Windows Product Activation provider and the Active Directory Trust Monitoring provider. On the other hand, some providers complement functionality supported by the Win32 providers. For example, in the previous chapter, when we examined the classes related to the file system, we saw that the CIM_DataFile class is supported by the Win32 provider. Even if the CIM_DataFile class is a superclass of the Win32_NTEventLogFile class, the Win32_NTEventLogFile class is supported by a set of specialized providers, which are designed to manage the Windows NT Event Log files: the NT Event Log providers.

All WMI providers are designed to manage a particular Windows Server 2003 component and therefore implement some capabilities relevant to that component. For example, the Ping provider is implemented as an instance provider and retrieves the ping command status code when pinging a host. The DNS provider is implemented as an instance provider to manipulate DNS zones and DNS records stored in these zones. Another example is the Power management provider, which is able to trigger an event when the power state of the system changes.

To ease the discovery of the WMI providers available, they are classified in different categories, which will be examined section by section in this chapter. These categories are:

Core OS components providers: This category contains WMI providers that manage Operating System components such as the NT Event Logs, the registry, and the trusts.
Core OS components event providers: This category contains WMI providers that trigger events when something occurs in the Operating System. The Power management and the Shutdown WMI event providers are just two examples of providers in this category.
Core OS file system components providers: This category contains providers managing specific features of the file system, such as disk quotas or the Distributed File System (DFS).
Active Directory components providers: The WMI providers in this category only support features related to Active Directory. For example, accessing objects in Active Directory or monitoring Active Directory Replication are two features offered by the WMI providers of this category.
Network components providers: This category only contains the providers supporting features related to network components. For example, in this category we find WMI providers that manage DNS, the IP routing table, and SNMP devices.
Performance providers: This category contains providers giving access to performance counter information. Performance counters exist for applications as well as the Operating System, but we will only focus on the latter in this category.
Helper providers: The providers included in this category are the specialized WMI providers that are not directly managing real-world entities but are helping to access some information in the CIM repository from a local or a remote system. The View provider and the Forwarding consumer provider are in this category.

Note that some of the providers examined in this chapter are also available under Windows 2000 and Windows NT! During the WMI provider discussion, we will mention in which operating system they are available.

Let's start the WMI providers discovery!