List of Figures

Chapter 1: The Windows WMI Providers Discovery

Figure 1.1: The provider registration system classes.

Figure 1.2: The SNMP class provider registration.

Figure 1.3: The Registry instance provider registration.

Figure 1.4: The Registry property provider registration.

Figure 1.5: The Win32 method provider registration.

Figure 1.6: The NT Event Log event provider registration.

Figure 1.7: The Registry provider registration in the CIM repository and in the registry.

Figure 1.8: The provider qualifier of a class to determine the supported WMI provider.

Figure 1.9: The EventQueryList property of one __EventProviderRegistration instance.

Figure 1.10: The ConsumerClassNames property of one __EventConsumerProviderRegistration.

Chapter 2: The Win32 Providers

Figure 2.1: The Win32_LogicalDisk class associations.

Figure 2.2: Associated instances of one network adapter.

Figure 2.3: The static method qualifier.

Figure 2.4: The Win32_POTSModem class associations.

Figure 2.5: The Win32_Printer class associations.

Figure 2.6: Associated instances of one video controller.

Figure 2.7: The SNMP class provider COM information from the registry.

Figure 2.8: The WSHRemote settings modification.

Figure 2.9: The Win32_DCOMApplication class associations.

Figure 2.10: The Win32_Desktop class associations.

Figure 2.11: The CIM_Service class and its child classes.

Figure 2.12: The CIM_LogicalFile class and its child classes.

Figure 2.13: The Win32_ DiskPartition class associations.

Figure 2.14: The CIM_LogicalDisk and its subclasses.

Figure 2.15: The Win32_ MappedLogicalDisk class and its associations.

Figure 2.16: The Win32_LogonSession and its associations.

Figure 2.17: The Win32_NetworkAdapter class associations.

Figure 2.18: The Win32_ProcessStartup abstract class used only as a method parameter class.

Figure 2.19: The associations of the Win32_LogicalProgramGroup class.

Figure 2.20: The Win32_LogicalProgramGroupOrItem superclass.

Figure 2.21: The Win32_Group class associations.

Figure 2.22: Associated instances of one group.

Chapter 3: The WMI Providers

Figure 3.1: The Win32_WMISetting class associations.

Figure 3.2: The Win32_NTLogEvent associations.

Figure 3.3: The Win32_Share and Win32_ServerConnection classes are associated with the Win32_ConnectionShare association class.

Figure 3.4: The Win32_ServerSession and Win32_ServerConnection classes are associated with the Win32_SessionConnection association class.

Figure 3.5: The Win32_NamedJobObjectassociations.

Figure 3.6: The Win32_WindowsProductActivation class is associated with the Win32_ComputerSystem class.

Figure 3.7: Adding the Windows Installer provider under Windows Server 2003.

Figure 3.8: The classes associated with the Win32_Product class.

Figure 3.9: A WMI filter created for the Default Domain Controller Policy.

Figure 3.10: The RSOP subnamespaces.

Figure 3.11: The RSOP subnamespaces created during a CreateSession method invocation.

Figure 3.12: The RSOP_PolicySetting superclass.

Figure 3.13: The RSOP_IEAKPolicySetting associated classes.

Figure 3.14: A GPO to enforce the automatic startup of the SNMP Windows service at the organizational unit level.

Figure 3.15: A GPO to enforce the automatic startup of the SNMP Windows service at the site level.

Figure 3.16: The RSOP_GPO association.

Figure 3.17: The System Restore wizard.

Figure 3.18: The Win32_CurrentTime class and its child classes.

Figure 3.19: The Win32_DiskQuota association class.

Figure 3.20: The Win32_QuotaSetting class associations.

Figure 3.21: The Windows Explorer quota management interface.

Figure 3.22: The Win32_ DFSNodeTarget association class.

Figure 3.23: A DFS configuration example.

Figure 3.24: Managing the Shadow Copies of a volume from the user interface.

Figure 3.25: The Win32_Volume class and its associations.

Figure 3.26: The Active Directory WMI classes mapped to the Active Directory classes.

Figure 3.27: The WMI ads_user abstract class qualifiers.

Figure 3.28: The WMI ds_user dynamic instance class qualifiers.

Figure 3.29: Some of the Active Directory classes as seen from WMI.

Figure 3.30: The DS_LDAP_Class_Containment associations.

Figure 3.31: The DS_LDAP_Instance_Containment associations.

Figure 3.32: An Active Directory user created with WMI.

Figure 3.33: Querying Active Directory with LDAP from LDP.

Figure 3.34: The registry hive for the four WMI providers supporting activity logging.

Figure 3.35: The Win32_IP4RouteTable association.

Figure 3.36: The DNS server class is associated with the DNS domain class.

Figure 3.37: The DNS domain class is associated with itself.

Figure 3.38: The DNS domain class is associated with the DNS records superclass.

Figure 3.39: Adding the SNMP providers under Windows Server 2003.

Figure 3.40: The SNMP Module Information Repository classes in Root\SNMP\SMIR.

Figure 3.41: The SNMP service configuration.

Figure 3.42: The Root\SNMP\localhost namespace qualifier.

Figure 3.43: Enabling SNMP on your Cisco router.

Figure 3.44: The Cisco IOS loaded in the memory flash.

Figure 3.45: The Cisco Flash SNMP classes in the CIM repository.

Figure 3.46: Accessing SNMP data via the localhost namespace and the SWBemNamedValueSet object.

Figure 3.47: Accessing SNMP data via a dedicated namespace on the localhost.

Figure 3.48: Accessing SNMP data through a remote WMI computer via a dedicated namespace.

Figure 3.49: The NotificationMapper instances.

Figure 3.50: The SnmpV2Notification class and the varBindList property.

Figure 3.51: The SnmpVarBind class is an array of object instances.

Figure 3.52: The SNMP_OLD_CISCO_TS_MIB_lts class to send SNMP commands to a Cisco device (SNMP-enabled).

Figure 3.53: The tsMsgSend property qualifiers.

Figure 3.54: The Performance Monitor Process counters.

Figure 3.55: The Process counters of the Performance Counters available from WMI.

Figure 3.56: The new created Join View class.

Figure 3.57: The Win32_DiskQuota association class and the created Association View class.

Figure 3.58: The WMI Forwarding providers roles and locations.

Chapter 4: WMI Security Scripting

Figure 4.1: The default security settings on the Root namespace.

Figure 4.2: Granting all Scripting API permissions to the IIS account.

Figure 4.3: Setting the Windows Integrated Authentication.

Figure 4.4: Setting the passport or digest authentication.

Figure 4.5: Enabling remote access for remote users.

Figure 4.6: The three IIS locations where authentication can be defined.

Figure 4.7: The isolated file system directory from the WWWRoot folder.

Figure 4.8: Enabling anonymous access with IIS.

Figure 4.9: Ensuring WMI CIM repository access for the WMI-ASP dedicated account.

Figure 4.10: Viewing all Win32_Service instance states from the Web.

Figure 4.11: The security descriptor logical structure as seen from WMI.

Figure 4.12: The security descriptor logical structure as seen from ADSI.

Figure 4.13: The Win32_LogicalFileSecurity Setting class associations.

Figure 4.14: The owner and group associations.

Figure 4.15: The Win32_Account class and the Win32_SID class association.

Figure 4.16: Win32_LogicalShareSecuritySetting class associations.

Figure 4.17: The default share security descriptor.

Figure 4.18: The Control Flags bitwise values.

Figure 4.19: The files and folders security descriptor user interface.

Figure 4.20: The files and folders inheritance user interface.

Figure 4.21: The File System share security descriptor user interface

Figure 4.22: The Extended Rights enforced by Active Directory (left), enforced by applications (center), and enforced by the system (right).

Figure 4.23: The appliesTo GUID numbers of the "Personal Information" Extended Right in liaison with the schemaIDGUID attribute of the classSchema object.

Figure 4.24: Converting a GUID string to a GUID number and vice versa.

Figure 4.25: The appliesTo GUID numbers of the "Send As" Extended Right in liaison with the schemaIDGUID attribute of the classSchema object.

Figure 4.26: The attributeSecurityGUID attribute of the attributeSchema object contains the rights-GUID GUID number of the "Personal Information" Extended Right.

Figure 4.27: The Extended Rights attributes links.

Figure 4.28: The ACE ObjectType property used to grant or deny the creation or deletion of objects from a particular class.

Figure 4.29: ACE Inheritance to a specific object class.

Figure 4.30: The default Exchange 2000 mailbox security just after creation from the MMC.

Figure 4.31: The registry hive security descriptor user interface.

Figure 4.32: The Root\CIMv2 namespace security descriptor user interface.

Figure 4.33: An Active Directory security descriptor owner.

Figure 4.34: The Control Flags configuration.

Figure 4.35: The effect of resetting the SE_DACL_PROTECTED flag twice.

Figure 4.36: A WMI client application performing an asynchronous operation.

Figure 4.37: A WMI client application performing an asynchronous operation where UnSecApp.Exe is involved.

Figure 4.38: The registry activating the new lockdown mechanism of Windows Server 2003.

Figure 4.39: A WMI client application performing an asynchronous operation where UnSecApp.Exe is involved and when the Windows Server 2003 lockdown mechanism is activated.

Chapter 5: The Optional Windows Components and Application WMI Providers

Figure 5.1: The NLB network adapter user interface.

Figure 5.2: The NLB class associations.

Figure 5.3: The Node and Cluster classes.

Figure 5.4: The MSCluster_Cluster class associations.

Figure 5.5: The Terminal Services Configuration MMC.

Figure 5.6: The Terminal Services remote control configuration.

Figure 5.7: The Terminal Service connection limit settings.

Figure 5.8: The Terminal Services general connection settings.

Figure 5.9: The Terminal Services default client settings.

Figure 5.10: The Terminal Services connection environment settings.

Figure 5.11: The Terminal Services connection logon settings.

Figure 5.12: The Terminal Services connection session settings.

Figure 5.13: The Terminal Services connection permission settings.

Figure 5.14: The WMIBinaryMofResource class instances.

Figure 5.15: The WMIEvent extrinsic event class.

Figure 5.16: Detecting network cable disconnections with the MSNdis_StatusMediaDisconnect extrinsic event class.

Figure 5.17: The IISWebServer class associations with their respective superclasses.

Figure 5.18: The ServerBindings property and ServerBinding instance.

Figure 5.19: The associations of the CIM_ManagedSystemElement superclass.

Figure 5.20: The associations of the CIM_Setting superclass.

Figure 5.21: The CIM_Component class with its references.

Figure 5.22: The CIM_ElementSetting class with its references.

Figure 5.23: The Exchange System Manager monitoring settings.

Figure 5.24: The Exchange System Manager showing the Exchange servers and connectors state.

Figure 5.25: The IncreasingTime property behavior from the ExchangeLink and ExchangeQueue classes.

Figure 5.26: The "Message Tracking" user interface.

Figure 5.27: The "DSAccess" user interface.

Figure 5.28: The Win32_Process View class in the Root\MicrosoftSQLServer namespace.

Figure 5.29: The Insight Management Web-enabled Agents architecture of CIM, version 7 SP1.

Figure 5.30: The Insight Management Agents information.

Figure 5.31: Some Insight Management Agents SNMP classes in the CIM repository.

Figure 5.32: The CPQ_System_Performance superclass with its subclasses, as shown in WMI CIM Studio.

Figure 5.33: The HP OpenView Operations for Windows console showing alerts.

Figure 5.34: The .NET Framework and the WMI architecture.

Figure 5.35: The WMI-based management extension to the Visual Studio.NET Server Explorer tool.

Figure 5.36: Browsing WMI namespaces for classes.

Figure 5.37: Event subscription from Visual Studio.NET.

Figure 5.38: Viewing events from Visual Studio.NET.