5.3 WMI and some (server) products

5.3 WMI and some (server) products

5.3.1 Internet Information Server provider

The Internet Information Server (IIS) provider is available with IIS 6.0, which comes with Windows Server 2003. It is made up of one single provider implemented as a method, instance, and class provider. It is available from the Root\MicrosoftIISv2 namespace (see Table 5.18).

Table 5.18: The Internet Information Server Provider

Provider Name	Provider Namespace	Class Provider	Instance Provider	Method Provider	Property Provider	Event Provider	Event Consumer Provider	Support Get	Support Put	Support Enumeration	Support Delete	Windows Server 2003	Windows XP	Windows 2000 Server	Windows 2000 Professional	Windows NT 4.0
IIS_Provider
[IIS_PROVIDER	Root/MicrosoftIISv2	X	X	X				X	X	X	X	X

This provider supports a collection of WMI classes whose purpose is to expose the information contained in the IIS metabase. The IIS metabase is nothing more than a database containing all IIS configuration settings. This information is stored in a collection of objects and properties defining the various settings supported by IIS. Of course, if we have objects and properties in the metabase, it means we have a schema defining those objects and properties. Therefore, as in any schema implementation, we also have objects with properties (part of the schema) defining objects and properties that can be stored in the metabase. These objects are called the Schema Management Objects. We will not go into the IIS metabase schema discovery, since this would detract from the WMI focus, but it is important to know that WMI classes reflect the IIS metabase schema definitions, whose object instances are represented by WMI instances. This is the reason why the IIS provider is implemented as a class provider (to retrieve the IIS metabase schema definitions as WMI classes) and an instance provider (to retrieve the IIS metabase data stored in the IIS metabase objects).

Understanding how WMI maps the IIS metabase is not an easy thing. So, let's take a concrete example. For instance, the IIS metabase schema contains definitions for the IISWebServer metabase class and its related properties, such as the ServerBindings property. Therefore, the CIM repository contains some equivalent WMI classes and properties to expose the same information through WMI. In this specific example (see Figure 5.17), we will have an IISWebServer WMI class made from the CIM_ManagedSystemElement superclass (left-center position). However, the CIM repository object model is slightly different from the IIS metabase object model. For example, the IISWebServer WMI class doesn't have a property called ServerBindings. Instead, the IISWebServer WMI class has an association with the IISWebServerSetting WMI class made from the CIM_Setting superclass (right upper-corner position), which exposes a WMI class property called ServerBindings. The association between the IISWebServer and IISWebServerSetting WMI classes is made with the IISWbServer_IIsWebServerSetting association class made from the CIM_ElementSetting class (center-top position).

Figure 5.17: The IISWebServer class associations with their respective superclasses.

The ServerBindings property of the IISWebServerSetting WMI class contains a WMI instance of an object made from the ServerBinding class (which is made from the IIsStructuredDataClass superclass), as shown with WMI CIM Studio in Figure 5.18.

Figure 5.18: The ServerBindings property and ServerBinding instance.

As we can see in Figure 5.17, the IISWebServer WMI class has some other associations. All associations are made from association classes derived from the CIM_ElementSetting or CIM_Component superclasses. On the other hand, all associated classes are made from the CIM_Setting or CIM_ManagedSystemElement superclasses. Next, when a WMI class exposing IIS settings requires a structured representation, the property that should expose the structured information actually exposes an instance made from a class derived from the IIsStructuredDataClass superclass (i.e., ServerBinding class). This indicates that all IIS WMI classes are always made from five superclasses (see Figure 5.17):

• The CIM_ManagedSystemElement class: The CIM_ManagedSystemElement class contains subclasses that correspond to node definitions of the metabase Schema. For example, an IIsWebServer WMI instance corresponds to the IIsWebServer node of the IIS metabase, which represents an instance of an IIS Web server. As another example, the IIsWebVirtualDir instance corresponds to the IIsWebVirtualDir node of the IIS metabase, which represents an instance of a Web virtual directory. The IIsWebServer WMI instance and the IIsWebVirtualDir instance expose read-only properties and methods, whereas the associated instances made from the CIM_Setting subclasses contain the writeable properties for the nodes. For example, the IIsWebServer class derived from the CIM_ManagedSystemElement class exposes readonly properties for an IIS Web server as well as methods that can modify some properties of the IIsWebServerSetting class instance and manage the IIS Web Server (i.e., start or stop the Web server).

  On the other hand, the IIsWebServerSetting class properties (derived from the CIM_Setting class and associated with the IISWebServer class) can be updated to modify the IIS Web server settings (see Figure 5.19).

  
  Figure 5.19: The associations of the CIM_ManagedSystemElement superclass.

• The CIM_Setting class: The classes derived from the CIM_Setting superclass expose properties corresponding to the metabase node properties that can be set at those nodes. The associated classes derived from the CIM_ManagedSystemElement class expose methods that manipulate the node properties. As previously mentioned, the IIsWebServerSetting class (derived from the CIM_Setting superclass) and the IIsWebServer class (derived from the CIM_ManagedSystemElement class) refer to Web sites on your Web server, where the IIsWebServer class contains the read-only properties of a Web site and the IIsWebServerSetting class contains the writeable properties of a Web site (see Figure 5.20).

  
  Figure 5.20: The associations of the CIM_Setting superclass.

• The IIsStructuredDataClass class: The classes derived from the IIsStructuredDataClass class contain properties whose data requires a structured representation. For example, the ServerBindings property in the metabase is a string whose format is "IP:Port:Hostname." In the WMI representation, a ServerBinding class is available with three properties corresponding to the IP address, the port number, and the host name. In Figure 5.18, a class such as the IIsWebServerSetting class (made from the CIM_Setting class) contains a property called ServerBindings, which is an array of ServerBinding class instances.

• The CIM_Component class: The classes created from this association superclass map each class made from the CIM_ManagedSystemElement superclass to another class made from the CIM_ManagedSystemElement superclass. As with any association classes, the properties of these classes are references to the two associated classes (see Figure 5.21).

  
  Figure 5.21: The CIM_Component class with its references.

• The CIM_ElementSetting class: The classes created from this association class associate each class made from the CIM_ManagedSystemElement superclass to its matching class made from the CIM_Setting superclass. The properties of these classes are references to the two associated classes (see Figure 5.22).

  
  Figure 5.22: The CIM_ElementSetting class with its references.

To read information from the metabase with scripts, it is possible to use ADSI in the IIS: namespace (all IIS versions) or WMI (IIS 6.0 only). A script reading the IISWebServer ServerBindings property with ADSI will look as follows:

    1: Set objIISWebServer = GetObject ("IIS://LocalHost/W3SVC/1")    2:    3: arrayServerBindings = objIISWebServer.Get ("ServerBindings")    4:    5: For Each varServerBinding In arrayServerBindings    6: WScript.Echo "ServerBindings: '" & varServerBinding & "''    7: Next 

At line 1, the "W3SVC/1" represents the IIS Web server instance to be accessed via ADSI. Next, the script requests the ServerBindings property from the object representing the Web service instance (line 3). From line 5 through 7, the "For Each" loop enumerates all values found in the ServerBindings property.

The ADSUTIL.VBS script from an IIS installation (check %SystemDrive%\Inetpub\AdminScripts folder) uses ADSI to access the IIS metabase. For example, to read the IISWebServer ServerBindings property with ADSUTIL.VBS, we should use the following command line:

 C:\>adsutil.vbs GET W3SVC/l/ServerBindings Microsoft (R) Windows Script Host Version 5.6 Copyright (C) Microsoft Corporation 1996–2001. All rights reserved. ServerBindings                  : (LIST)  (1 Items)   ":81:" 

In addition to being able to retrieve all properties stored in the IIS metabase, ADSUTIL.VBS also allows most configuration settings and operations handled by the "Internet Information Services" MMC from the command line.

With WMI, to retrieve the ServerBindings of the IISWebServer "W3SVC/1" node from the metabase, we should retrieve the IISWebServerSettings WMI instance (which is actually associated with the IISWebServer WMI class and contains the Web server configuration settings). This is illustrated in Sample 5.15. However, for information completeness, the code enumerates all properties of the IISWebServerSettings WMI instance, which explains why it is slightly longer than the ADSI example.

Sample 5.15: Viewing the IISWebServer ServerBindings property with WMI

  1: <?xml version="1.0"?>  .:  8:<package>  9:  <job> ..: 13:    <runtime> ..: 17:    </runtime> 18: 19:    <script language="VBScript" src="/books/2/679/1/html/2/..\Functions\DisplayFormattedPropertiesFunction.vbs" /> 20:    <script language="VBScript" src="/books/2/679/1/html/2/..\Functions\DisplayFormattedPropertyFunction.vbs" /> 21:    <script language="VBScript" src="/books/2/679/1/html/2/..\Functions\TinyErrorHandler.vbs" /> 22: 23:    <object prog  reference="true"/> 24: 25:    <script language="VBscript"> 26:    <![CDATA[ ..: 30:    Const cComputerName = "LocalHost" 31:    Const cWMINameSpace = "root\MicrosoftIISv2" 32:    Const cWMIClass = "IISWebServer" ..: 59:    objWMILocator.Security_.AuthenticationLevel = wbemAuthenticationLevelDefault 60:    objWMILocator.Security_.ImpersonationLevel = wbemImpersonationLevelImpersonate 61: 62:    Set objWMIServices = objWMILocator.ConnectServer(strComputerName, cWMINameSpace, _ 63:                                                     strUserID, strPassword) ..: 66:    Set objWMIWebServerInstances = objWMIServices.InstancesOf (cWMIClass) ..: 69:    For Each objWMIWebServerInstance In objWMIWebServerInstances 70:        DisplayFormattedProperties objWMIWebServerInstance, 0 71: 72:        Set objWMIAssociatedInstances = objWMIServices.ExecQuery _ 73:                                           ("Associators Of {IISWebServer='" & _ 74:                                           objWMIWebServerInstance.Name & "'}") 75:        For Each objWMIAssociatedInstance In objWMIAssociatedInstances 76:            DisplayFormattedProperties objWMIAssociatedInstance, 2 77:        Next ..: 79:    Next ..: 85:    ]]> 86:    </script> 87:  </job> 88:</package> 

Sample 5.15 does not use any new scripting techniques. However, it exploits the IISWebServer class associations in place to retrieve all required information. First, the script retrieves all instances of the IISWebServer WMI class (line 66) to enumerate all instances retrieved (lines 69 through 77). For each instance of the IISWebServer class, the script requests all existing associations (lines 72 through 74), as shown in Figure 5.17. This is done with the help of the WQL data query:

 Associators Of   {IISWebServer='W3SVC/1'} 

To restrict the list of associations to the IISWebServerSetting class, the following WQL data query can be used:

 "Associators Of {IISWebServer='W3SVC/1'} Where AssocClass=IIsWebServer_IIsWebServerSetting" 

Next all instances are enumerated to display all their properties (lines 75 through 77). The display of the properties is performed in the DisplayFormattedProperties() function. This function acts recursively if a property, such as the ServerBindings property of the IISWebServerSetting class, exposes an object instance. Therefore, the output will be as follows for the first IIS Web server instance:

   1:    C:\>ViewIISSettings.wsf   2:    Microsoft (R) Windows Script Host Version 5.6   3:    Copyright (C) Microsoft Corporation 1996–2001. All rights reserved.   4:   5:   6:    - IIsWebServer --------------------------------------------------------------------   7:    AppIsolated: ............................. 2   8:    AppPackageID: ............................   9:    AppPackageName: ..........................  10:    *Name: ................................... W3SVC/1  11:    ServerState: ............................. 2  12:  13:      - IIsWebServerSetting -----------------------------------------------------------  14:      AccessExecute: ......................... FALSE  15:      AccessFlags: ........................... 1 ...: 146:      EnableDocFooter: ....................... FALSE 147:      EnableReverseDns: ...................... FALSE 148:      FrontPageWeb: .......................... FALSE 149: 150:        - HttpCustomHeader ------------------------------------------------------------ 151:        *Keyname: ............................ 152: 153: 154:        - HttpError ------------------------------------------------------------------- 155:        *HandlerLocation: .................... J:\WINDOWS\help\iisHelp\common\400.htm 156:        *HandlerType: ........................ FILE 157:        *HttpErrorCode: ...................... 400 158:        *HttpErrorSubcode: ................... * ...: 334:        - HttpError ------------------------------------------------------------------- 335:        *HandlerLocation: .................... J:\WINDOWS\help\iisHelp\common\500-15.htm 336:        *HandlerType: ........................ FILE 337:        *HttpErrorCode: ...................... 500 338:        *HttpErrorSubcode: ................... 15 339: 340:      HttpExpires: ........................... D, 0x15180 341:      HttpPics: .............................. ...: 379:     MaxEndpointConnections: ................ 255 380: 381:       - MimeMap --------------------------------------------------------------------- 382:       *Extension: .......................... 383: 384:     *Name: ................................. W3SVC/1 385:     NetLogonWorkstation: ................... 0 386:     NotDeletable: .......................... FALSE ...: 396:     RevocationFreshnessTime: ............... 128 397:     RevocationURLRetrievalTimeout: ......... 0 398: 399:       - ScriptMap ------------------------------------------------------------------- 400:       *Extensions: ......................... .asp 401:       *Flags: .............................. 1 ...: 556:       - SecureBinding --------------------------------------------------------------- 557:       *IP: ................................. 558:       *Port: ............................... 443: 559: 560:     ServerAutoStart: ....................... TRUE 561: 562:       - ServerBinding --------------------------------------------------------------- 563:       *Hostname: ........................... 564:       *IP: ................................. 565:       *Port: ............................... 80 566: 567:     ServerComment: ......................... Default Web Site 568:     ServerListenBacklog: ................... 40 ...: 577:     UseHostName: ........................... FALSE 578:     Win32Error: ............................ 0 579: 580:   - IIsWebServer -------------------------------------------------------------------- 581:   AppIsolated: ............................. 2 582:   AppPackageID: ............................ 583:   AppPackageName: .......................... 584:   *Name: ................................... W3SVC/2 585:   ServerState: ............................. 2 ...: ...: ...: 

We recognize from line 562 through 565 the properties of the ServerBinding class instance. Of course, Sample 5.15 retrieves all available properties. To just retrieve the IlSWebServer ServerBindings property, such as we did with ADSI, the code to use will look as follows:

  1:   Set objWMIServices = GetObject ("winmgmts:root\MicrosoftIISv2")  2:  3:   Set objWMIWebServerInstance = objWMIServices.Get ("IISWebServerSetting='W3SVC/1'")  4:   arrayWMIServerBindings = objWMIWebServerInstance.ServerBindings  5:  6:   For Each objWMIServerBindingInstance In arrayWMIServerBindings  7:       WScript.Echo objWMIServerBindingInstance.Port  8:       WScript.Echo objWMIServerBindingInstance.Hostname  9:       WScript.Echo objWMIServerBindingInstance.IP 10:   Next 

Even if it is possible to perform many IIS metabase configurations through ADSI or WMI, the ADSI metabase access method has some limitations compared with the WMI access method. For example, the WMI access method implicitly offers all advantages of the WMI architecture, such as the WQL queries, the standard WMI COM API object model and instrumentation (i.e., Event notifications), and the CIM repository object model capabilities to associate entities. ADSI doesn't have these features. On the other hand, it is important to note that only ADSI allows you to extend the IIS metabase. However, once the extensions are created, the IIS WMI provider can return existing schema extensions. This can be done because the IIS provider is also implemented as a class provider.

Even if the IIS metabase object model is slightly different from the WMI class object model, it is clear that a good knowledge of the IIS metabase is an indispensable foundation in understanding the meaning of each WMI class representing manageable IIS entities. The Root\MicrosoftIISv2 namespace contains more than 300 WMI classes related to the IIS management, which makes it impossible to review them one by one in this section. Moreover, all these classes reflect the IIS metabase schema. However, with the Internet Information Server 6.0 in Windows Server 2003, Microsoft has created a very nice IIS Provider Tutorial. It is available from the Internet Information Server MMC by selecting "Help" and "Help Topics." This tutorial is located in the "Programmatic Administration Guide" and is entitled the "IIS WMI Provider Tutorial." It is also possible to access the tutorial directly from the IISMMC.CHM help file located in the %SystemRoot%\System32\Help directory. For anyone interested in delving into the IIS management from WMI, this tutorial is worth reading! Of course, you can also continue to use the LoadCIMinXL.Wsf (see Sample 4.32 in the appendix) to retrieve detailed information about the IIS WMI classes.

5.3.2 Exchange 2000

With the release of Exchange 2000, Microsoft included three WMI providers: ExchangeRoutingTableProvider, ExchangeQueueProvider, and ExchangeClusterProvider, which provide an easy way for any application to access Exchange 2000 management information. Each of the three providers relates to a specific component set of Exchange 2000:

• The ExchangeRoutingTableProvider runs on top of the routing API.

• The ExchangeQueueProvider runs on top of the queue API.

• The ExchangeClusterProvider runs on top of the cluster API.

Each of these providers delivers information with a set of classes available in the Root\CIMv2\Applications\Exchange namespace to ease the notification and diagnostics of some problems that may occur in Exchange 2000. With the release of Service Pack 2, Exchange 2000 delivers two additional WMI providers:

• The Exchange Message Tracking provider runs on top of the message tracking API.

• The Exchange DS Access provider runs on top of the DSAccess API.

These two providers expose a set of classes available from the Root\MicrosoftExchangeV2 WMI namespace (see Table 5.19).

Table 5.19: The Exchange 2000 WMI Providers

Provider Name	Provider Namespace	Class Provider	Instance Provider	Method Provider	Property Provider	Event Provider	event Consumer Provider	Support Get	Support Put	Support Enumeration	Support Delete	Exchange 2000 RTM	Exchange 2000 SP1	Exchange 2000 SP2
Exchange 2000 Providers
Exchange Queue provider	Root/CIMv2/Applications/Exchange		X							X		X	X
Exchange Cluster provider	Root/CIMv2/Applications/Exchange		X							X		X	X
Exchange Routing Table provider	Root/CIMv2/Applications/Exchange		X						X	X		X	X
Exchange Message Tracking Log provider	root/MicrosoftExchangeV2		X					X	X	X	X			X
Exchange DS Access provider	root/MicrosoftExchangeV2		X					X		X				X

The release of Exchange 2000 Service Pack 3 does not add anything new regarding WMI.

Note that none of these providers is implemented as event providers. This will imply the use of the WITHIN statement when executing WQL event queries. Moreover, as we will see in the following text, none of the classes supported by these providers is associated with any other classes. They are implemented as standalone classes providing information about some specific Exchange components.

5.3.2.1 The Routing Table provider

The Exchange Routing Table WMI provider works on top of the Exchange Transport Core. You may think that the purpose of this provider is to access available existing routes from the routing table of Exchange 2000, but you'd be wrong. Rather, its purpose is as follows:

• To publish the status of the local Exchange 2000 server in the routing table, based on the monitoring conditions configured with the Exchange System Manager (ESM).

• To retrieve the status of other Exchange 2000 servers in the organization from the routing table, based on the monitoring conditions configured with the ESM.

• To publish the status of the Exchange 2000 local connectors in the routing table.

• To retrieve the status of other Exchange 2000 connectors present in the organization from the routing table.

The routing table is used as a transport to publish the local status of the server and the local connector states in the organization. To perform this task, the Exchange Routing Table provider implements a dedicated way of access to and from the routing table only for the System Attendant. Every Exchange 2000 server in the organization is publishing its state in the routing table in this way. This means that it is possible for one server to get the status of all the servers and connectors in the enterprise as they are seen from that server. To distinguish the information retrieved between the server and the connectors, the Exchange Routing Table provider implements two WMI classes: ExchangeServerState and ExchangeConnectorState. Each of these classes has a specific set of properties.

The states retrieved from the ExchangeServerState class are based on the monitoring conditions set with the ESM. Different information states are available from this class for the critical components of an Exchange 2000 server installation. The ESM allows an Administrator to configure a set of conditions determining a state for the monitored component (see Figure 5.23). With the ESM, it is possible to define a monitoring condition with a corresponding state for:

• The queues

• The disk space available on any disk in the system

• The memory usage

• The CPU usage for a "warning" and/or a "critical" threshold

• Any Windows 2000 services relevant to Exchange 2000

Figure 5.23: The Exchange System Manager monitoring settings.

The ExchangeConnectorState class is based on the same principle as the ExchangeServerState class. The class provides a monitoring capability of the connectors configured in an Exchange organization. The state is published in the routing table. When this class is interrogated from the ESM or by a script, the class offers a list of the connectors available from the routing table with their corresponding status. Using this class, it is possible to know the current state of all the connectors in the Exchange 2000 organization as seen from that server (see Figure 5.24).

Figure 5.24: The Exchange System Manager showing the Exchange servers and connectors state.

The set of properties exposed by the ExchangeServerState class can be retrieved with the LoadCIMinXL.Wsf script (see Sample 4.32 in the appendix). If we reuse the GetCollectionOfInstances.wsf script (see Sample

1.5, "Listing all instances of a class with their properties formatted"), we obtain the following output for the ExchangeServerState class:

  1:    C:\>GetCollectionOfInstances.wsf ExchangeServerState                                         /NameSpace:Root\CIMV2\Applications\Exchange  2:    Microsoft (R) Windows Script Host Version 5.6  3:    Copyright (C) Microsoft Corporation 1996–2001. All rights reserved.  4:  5:  6:    ClusterState: ............................ 1  7:    ClusterStateString: ...................... OK  8:    CPUState: ................................ 1  9:    CPUStateString: .......................... OK 10:    DisksState: .............................. 1 11:    DisksStateString: ........................ OK 12:    *DN: ..................................... CN=NET-DPEN6400A,CN=Servers,                                                   CN=Administrative Group - EMEA,                                                   CN=Administrative Groups,CN=LissWareNET,                                                   CN=Microsoft Exchange,CN=Services,                                                   CN=Configuration,DC=LissWare,DC=NET 13:    GroupDN: ................................. CN=Seattle,CN=Routing Groups,                                                   CN=Administrative Group - EMEA,                                                   CN=Administrative Groups,CN=LissWareNET,                                                   CN=Microsoft Exchange,CN=Services,                                                   CN=Configuration,DC=LissWare,DC=NET 14:    GroupGUID: ............................... {088D875C-335A-4429-807F-B8B257CE15DE} 15:    GUID: .................................... {B5ED627E-E59A-4A43-8B6C-F71E5F2CEC6E} 16:    MemoryState: ............................. 1 17:    MemoryStateString: ....................... OK 18:    Name: .................................... NET-DPEN6400A 19:    QueuesState: ............................. 1 20:    QueuesStateString: ....................... OK 21:    ServerMaintenance: ....................... FALSE 22:    ServerState: ............................. 1 23:    ServerStateString: ....................... OK 24:    ServicesState: ........................... 1 25:    ServicesStateString: ..................... OK 26:    Unreachable: ............................. FALSE 27:    Version: ................................. 6132 

Table 5.20 lists the ExchangeServerState class properties.

Table 5.20: The ExchangeServerState Class Properties

Name	Description
ClusterState Property	When the ExchangeServerState instance represents a clustered Exchange server, the ClusterState property specifies the state of the clustered resources on that server.
ClusterStateString Property	When the ExchangeserverState instance represents a clustered Exchange server, the ClusterStateString property specifies the state of the cluster resources on that server.
CPUState Property	The CPUState property specifies the current state of the CPU on the Exchange server. This is the same state information shown on the Monitoring and Status Properties page of the Exchange System Manager.
CPUStateString Property	The CPUStateString property specifies the current state of the CPU on the Exchange server.
DisksState Property	The DisksState property specifies the current state of the disk storage on the computer running Exchange 2000 Server.
DisksStateString Property	The DisksStateString property specifies the current state of the disk storage on the computer running Exchange 2000 Server.
DN Property	The DN property specifies the Microsoft Active Directory distinguished name (DN) of the Exchange server object.
GroupDN Property	The GroupDN property specifies the DN of the Exchange 2000 Server routing group in Active Directory.
GroupGUID Property	The GroupGUID property specifies the globally unique identifier (GUID) of the Exchange 2000 Server routing group in Active Directory.
GUID Property	The GUID property specifies the GUID of the Exchange 2000 Server server object in Active Directory.
MemoryState Property	The MemoryState property specifies the current state of the memory on the computer running Exchange 2000 Server.
MemoryStateString Property	The MemoryStateString property specifies the current state of the memory on the computer running Exchange 2000 Server.
Name Property	The Name property specifies the name of the computer running Exchange 2000 Server.
QueuesState Property	The QueuesState property specifies the current state of the queues on the computer running Exchange 2000 Server.
QueuesStateString Property	The QueuesStateString property specifies the current state of the queues on the computer running Exchange 2000 Server.
ServerMaintenance Property	The ServerMaintenance property, when TRUE, specifies that the notifications set up in the Exchange 2000 Server System Manager Monitoring and Status page have been disabled.
ServerState Property	The ServerState property specifies the current state of the computer running Exchange 2000 Server.
ServerStateString Property	The ServerStateString property specifies the current state of the computer running Exchange 2000 Server.
ServicesState Property	The ServicesState property specifies the current state of the monitoring services running on the Exchange 2000 Server computer.
ServicesStateString Property	The ServicesStateString property specifies the current state of the monitoring services running on the Exchange 2000 Server computer.
Unreachable Property	The Unreachable property, when TRUE, specifies that the Exchange 2000 Server computer is currently Unreachable.
Version Property	The Version property indicates the version of the Exchange server.

5.3.2.2 The Queue provider

The WMI Queue provider is based on the Queue API. The scope of this provider is local to the Exchange 2000 server. The provider implements two WMI classes:

• The ExchangeLink class to retrieve information about the Exchange links directly from the Queue API

• The ExchangeQueue class to retrieve information about the Exchange queues directly from the Queue API

For both classes, most of the properties are the ones exposed by the Queue API.

From a scripting and management perspective, for both classes, the most interesting data is the IncreasingTime property. The Queue API does not provide this property directly. This is a property calculated by the WMI Queue provider (see Figure 5.25).

Figure 5.25: The IncreasingTime property behavior from the ExchangeLink and ExchangeQueue classes.

The IncreasingTime value represents the length of time, while the number of messages in the Link/Queue has not decreased. The time is returned in milliseconds. To monitor this property, it is important to understand how the calculation is made. Two important factors influence how to monitor the value:

• The sampling frequency (Tx interval in Figure 5.25)

• The IncreasingTime value threshold to determine a critical situation

Each time a sample is taken, the IncreasingTime property is calculated and a new value is determined. The first polling interval (A in Figure 5.25) always returns an IncreasingTime value of zero, because it is the first sample read. But when the second polling interval occurs (A' in Figure 5.25), the IncreasingTime value will be equal to the T1 interval, because the number of messages has not decreased between A and A'.

When the next polling interval occurs (B in Figure 5.25), the IncreasingTime value will be equal to zero, because the number of messages has decreased between A' and B. It is important to note that the number of messages has decreased below the prior measured level. If the number of message levels does not decrease below the prior level, the IncreasingTime value is equal to T1 + T2. If the number of messages decreases to below the prior level, then the IncreasingTime value is set to zero.

For the same situation, if the polling interval is changed to measure at point A for the first sample and at point C for the second sample, the IncreasingTime value will not be equal to zero, because the number of messages has not been detected as decreasing below the number of messages measured at point A. The IncreasingTime value will be equal to T1 + T2 + T3 + T4.

Furthermore, if the polling is done between:

• A and B: IncreasingTime is equal to T1 + T2.

• B and C: IncreasingTime is equal to T1 + T2 + T3 + T4.

• C and D: IncreasingTime is equal to T1 + T2 + T3 + T4 + T5 + T6.

• D and E: IncreasingTime is equal to zero.

  Now, if the polling is done in the following way:

• A and A': IncreasingTime is equal to T1.

• A' and B: IncreasingTime is equal to zero.

• B and B': IncreasingTime is equal to T3.

• B' and C: IncreasingTime is equal to T3 + T4.

• C and C': IncreasingTime is equal to T3 + T4 + T5.

• C' and D: IncreasingTime is equal to T3 + T4 + T5 + T6.

• D and D': IncreasingTime is equal to zero.

• D' and E: IncreasingTime is equal to T8.

• E and E': IncreasingTime is equal to zero.

By changing the sampling frequency, we see that the IncreasingTime value can be very different. With the slowest sampling frequency, we miss the decreasing period between A and B. With the fastest polling frequency, this decreasing period is detected. Now, it is important to look at this behavior in a real-time scale.

If we suppose that the Tx interval is equal to one minute, the alert threshold for the IncreasingTime value is set on 30,000 ms (30 s), and the polling interval is set every Tx (every one minute), you will get a notification at point A'. This will be useless, because the queue has decreased between A' and B. It is clear that you don't want to be notified for such a situation. In a production environment the number of messages can increase suddenly for one minute (or more), but the number of messages can decrease rapidly in the next few minutes. In such a case, you get an alert for a noncritical situation.

Now, if we suppose that the Tx interval is equal to one hour, the alert threshold for the IncreasingTime value is set on 14,400,000 ms (4 h), and the polling interval is set every Tx (every one hour), you will only get a notification at point D. This is a better situation, because you are notified for a nondecreasing situation after four hours. On the other hand, it is a little bit too long to be notified, because this situation may hide a real problem.

The key is to find a compromise between the polling intervals to detect quickly any nondecreasing situations without getting an alert for increasing situations that are temporary. A best practice is to choose, for instance, to poll every 10 s and an IncreasingTime threshold value of 1,800,000 ms (30 min). In this situation, the flow represented in Figure 5.25 will never generate an alert. Only real nondecreasing situations longer than a half-hour will be detected with a precision of 10 s.

Again, you can use the LoadCIMinXL.Wsf script (see Sample 4.32 in the appendix) to discover the ExchangeLink and ExchangeQueue class properties. To get a notification if the IncreasingTime reaches a fixed value, the following WQL event query can be used:

  1:    C:\>GenericEventAsyncConsumer.wsf "Select * From __InstanceModificationEvent Within 5                                          Where TargetInstance ISA 'ExchangeQueue' And                                          TargetInstance.IncreasingTime > 10000"                                          /Namespace:root\CIMV2\Applications\Exchange  2:    Microsoft (R) Windows Script Host Version 5.6  3:    Copyright (C) Microsoft Corporation 1996–2001. All rights reserved.  4:  5:    Waiting for events...  6:  7:    BEGIN - OnObjectReady.  8:    Saturday, 22 June, 2002 at 09:33:17: '__InstanceModificationEvent' has been triggered.  9:      PreviousInstance (wbemCimtypeObject) 10:        CanEnumAll (wbemCimtypeBoolean) = True 11:        CanEnumFailed (wbemCimtypeBoolean) = True 12:        CanEnumFirstNMessages (wbemCimtypeBoolean) = True 13:        CanEnumFrozen (wbemCimtypeBoolean) = True 14:        CanEnumInvertSense (wbemCimtypeBoolean) = True 15:        CanEnumLargerThan (wbemCimtypeBoolean) = True 16:        CanEnumNLargestMessages (wbemCimtypeBoolean) = False 17:        CanEnumNOldestMessages (wbemCimtypeBoolean) = False 18:        CanEnumOlderThan (wbemCimtypeBoolean) = True 19:        CanEnumRecipient (wbemCimtypeBoolean) = True 20:        CanEnumSender (wbemCimtypeBoolean) = True 21:        GlobalStop (wbemCimtypeBoolean) = False 22:        IncreasingTime (wbemCimtypeUint32) = 5227 23:        *LinkName (wbemCimtypeString) = CurrentlyUnreachableLink 24:        MsgEnumFlagsSupported (wbemCimtypeUint32) = -1073741505 25:        NumberOfMessages (wbemCimtypeUint32) = 1 26:        *ProtocolName (wbemCimtypeString) = SMTP 27:        *QueueName (wbemCimtypeString) = net-dpep6400a.Emea.LissWare.NET 28:        SizeOfQueue (wbemCimtypeUint64) = 243 29:        Version (wbemCimtypeUint32) = 4 30:        VirtualMachine (wbemCimtypeString) = NET-DPEN6400A 31:        *VirtualServerName (wbemCimtypeString) = 1 32:      SECURITY_DESCRIPTOR (wbemCimtypeUint8) = (null) 33:      TargetInstance (wbemCimtypeObject) 34:        CanEnumAll (wbemCimtypeBoolean) = True 35:        CanEnumFailed (wbemCimtypeBoolean) = True 36:        CanEnumFirstNMessages (wbemCimtypeBoolean) = True 37:        CanEnumFrozen (wbemCimtypeBoolean) = True 38:        CanEnumInvertSense (wbemCimtypeBoolean) = True 39:        CanEnumLargerThan (wbemCimtypeBoolean) = True 40:        CanEnumNLargestMessages (wbemCimtypeBoolean) = False 41:        CanEnumNOldestMessages (wbemCimtypeBoolean) = False 42:        CanEnumOlderThan (wbemCimtypeBoolean) = True 43:        CanEnumRecipient (wbemCimtypeBoolean) = True 44:        CanEnumSender (wbemCimtypeBoolean) = True 45:        GlobalStop (wbemCimtypeBoolean) = False 46:        IncreasingTime (wbemCimtypeUint32) = 10415 47:        *LinkName (wbemCimtypeString) = CurrentlyUnreachableLink 48:        MsgEnumFlagsSupported (wbemCimtypeUint32) = -1073741505 49:        NumberOfMessages (wbemCimtypeUint32) = 1 50:        *ProtocolName (wbemCimtypeString) = SMTP 51:        *QueueName (wbemCimtypeString) = net-dpep6400a.Emea.LissWare.NET 52:        SizeOfQueue (wbemCimtypeUint64) = 243 53:        Version (wbemCimtypeUint32) = 4 54:        VirtualMachine (wbemCimtypeString) = NET-DPEN6400A 55:        *VirtualServerName (wbemCimtypeString) = 1 56:      TIME_CREATED (wbemCimtypeUint64) = (null) 57:    END - OnObjectReady. 

As we can see, the IncreasingTime value is higher than 10 s between the PreviousInstance (line 22) and the TargetInstance (line 46). Tables 5.21 and 5.22 list the ExchangeLink and ExchangeQueue properties, respectively.

Table 5.21: The ExchangeLink Properties

Name	Description
ActionFreeze Property	The ActionFreeze property, when TRUE, specifies that the link supports freezing messages in its queues. The ActionFreeze property corresponds to the sixth bit (0x00000020) of the SupportedLinkActions property.
ActionKick Property	The ActionKick property, when TRUE, specifies that the link can trigger its queues to retry transmitting waiting messages immediately, instead of waiting for the default protocol timeout before retrying the transmission. The ActionKick property corresponds to the first bit (0x00000001) of the SupportedLinkActions property.
ActionThaw Property	The ActionThaw property, when TRUE, specifies that the link supports thawing messages in its queues. Thawing a queue is also known as "unfreezing" that queue. The ActionThaw property corresponds to the seventh bit (0x00000040) of the SupportedLinkActions property.
ExtendedStateInfo P	The ExtendedStatelnfo property specifies the text description of the current link status.
GlobalStop Property	The GlobalStop property specifies whether the link is currently stopped.
IncreasingTime Property	The IncreasingTime property specifies the amount of time, in milliseconds, that the number of messages waiting to be transferred by the link has been increasing.
LinkDN Property	The LinkDN property specifies the Active Directory globally unique identifier (GUID) of the connector object that generated the link.
LinkName Property	The LinkName property specifies the name of the link.
NextScheduledConnection Property	The NextScheduledConnection property specifies the date and time when a connection will be attempted to transfer waiting messages.
NumterOfMessages Property	The NumberOfMessages property specifies the number of messages that are waiting for transmission across the link
OldestMessge Property	The OldestMessage property specifies the date and time that the oldest message that is still waiting to be transmitted was received into the link
ProtocolName Property	The ProtocolName property specifies the transmission protocol for the link.
SizeOfQueue Property	The SizeOfQueue property specifies the total size of the messages in the link, in bytes.
StateActive Property	The StateActive property, when TRUE, specifies that the link is active. The StateActive property corresponds to first bit (0x00000001) of the StateFlags property.
StateFlags Property	The StateFlags property specifies the state of the link. The individual bits of this property are available as the link State... and Type... properties of this class.
StateFrozen Property	The StateFrozen property indicates whether the link is currently frozen. The StateFrozen property corresponds to the sixth bit (0x00000020) of the StateFlags property.
StateReady Property	The StateReady property, when TRUE, specifies that the link is ready to accept new messages. The StateReady property corresponds to the second bit (0x00000002) of the StateFlags property.
StateRemote Property	The StateRemote property, when TRUE, specifies that the destination for messages in this link is on a remote server, instead of the messages being delivered to a local store. The StateRemote property corresponds to the fifth bit (0x00000010) of the StateFlags property.
StateRetry Property	The StateRetry property, when TRUE, specifies that the link is retrying a transmission that was unsuccessful. The StateRetry property corresponds to the third bit (0x00000004) of the StateFlags property.
StateScheduled Property	The StateScheduled property, when TRUE, specifies that the link is scheduled for periodic activation, as compared with asynchronous, on-demand activation. The StateScheduled property corresponds to the fourth bit (0x00000008) of the StateFlags property.
SupportedLinkActions Property	The SupportedLinkActions property specifies the actions supported by the link. The individual bits of this property are available as the Action... properties in this class.
TypeCurrentlyUnreachable Property	The TypeCurrentlyUnreachable property, when TRUE, specifies that the link holds messages for destinations that currently cannot be reached. The TypeCurrentiyUnreachable property corresponds to the thirteenth tit (0x00001000) of the StateFlags property.
TypeDeferredDelivery Property	The TypeDeferredDelivery property, when TRUE, specifies that the link holds mail that is awaiting a trigger to start transmission. The TypeDeferredDelivery property corresponds to the fourteenth bit (0x00002000) of the StateFlags property.
TypeInternal Property	The TypeInternal property indicates that the link is used for internal message processing. The Typelnternal property corresponds to the fifteenth tit (0x00004000) of the StateFlags property.
TypeLocalDelivery Property	The TypeLocalDelivery property, when TRUE, specifies that the link handles local mail delivery. The TypeLocalDelivery property corresponds to the tenth bit (0x00000200) of the StateFlags property.
TypePendingCategorization Property	The TypePendingCategorization property, when TRUE, specifies that the link is resolving addresses against entries in Active Directory. The TypePendingCategorization property corresponds to the twelfth tit (0x00000800) of the StateFlags property.
TypePendingRouting Properly	The TypePendingRouting property, when TRUE, specifies that the link is determining the routing of the next message that is waiting to be transmitted. The TypePendingRouting property corresponds to the eleventh tit (0x00000400) of the StateFlags property.
TypePendingSubmission Property	The TypePendingSubmission property, when TRUE, specifies that the link handles messages that have not yet been submitted to the routing engine. The TypePendingSubmission property corresponds to the sixteenth bit (0x00008000) of the StateFlags property.
TypeRemoteDelivery Property	The TypeRemoteDelivery property, when TRUE, specifies that the link is currently handling a remote message delivery. The TypeRemoteDelivery property corresponds to the ninth tit (0x00000100) of the StateFlags property.
Version Property	The Version property specifies the version number of the underlying link control software.
VirtualMachine Property	The VirtualMachine property specifies the name of the virtual machine that is the source of the link.
VirtualServerName Property	The value of the VirtualServerName property is the integer number of the virtual machine that is the source of the link This number is the Microsoft Active Directory common name (CN) for the virtual server object

Table 5.22: The ExchangeQueue Properties

Name	Description
CanEnumAll Property	The CanEnumAII property, when TRUE, specifies that the queue can enumerate all of the messages that it has waiting for transmission. The CanEnumAII property corresponds to the thirty-first bit (0x40000000) of the MsgEnumFlagsSupported property.
CanEnumFailed Property	The CanEnumFailed property, when TRUE, specifies that the queue can enumerate the messages that it has waiting for transmission that it was unable to transfer. The CanEnumFailed property corresponds to the ninth bit (0x00000100) of the MsgEnumFlagsSupported property.
CanEnumFirstNMessages Property	The CanEnumFirstNMessages property, when TRUE, specifies that the queue can enumerate the first N messages that it has waiting for transmission. The CanEnumFirstNMessages property corresponds to the first bit (0x00000001) of the MsgEnumFlagsSupported property.
CanEnumFrozen Property	The CanEnumFrozen property, when TRUE, specifies that the queue can enumerate messages that it has waiting for transmission that have been frozen. The CanEnumFrozen property corresponds to the sixth bit (0x00000020) of the MsgEnumFlagsSupported property.
CanEnumInvertSense Property	The CanEnumInvertSense property, when TRUE, specifies that the queue can enumerate messages that it has waiting for transmission that do not match the criteria requested. For example, requesting the oldest messages while inverting the request sense would return the newest messages. The CanEnumInvertSense property corresponds to the thirty-second bit (0x80000000) of the MsgEnumFlagsSupported property.
CanEnumLargerThan Property	The CanEnumLargerThan property, when TRUE, specifies that the queue can enumerate the messages that it has waiting for transmission that are larger than a specified value. The Can EnumLargerThan property corresponds to the fourth bit (0x00000008) of the MsgEnumFlagsSupported property.
CanEnumNLargestMessages Property	The CanEnumNLargestMessages property, when TRUE, specifies that the queue can enumerate the specified number of the largest messages that it has waiting for transmission. The CanEnumNLargestMessages property corresponds to the seventh bit (0x00000040) of the MsgEnumFlagsSupported property.
CanEnumNOldestMessages Property	The CanEnumNOldestMessages property, when TRUE, specifies that the queue can enumerate the specified number of the oldest messages that it has waiting for transmission. The CanEnumNOldestMessages property corresponds to the eighth bit (0x00000080) of the MsgEnumFlagsSupported property.
CanEnumOlderThan Property	The CanEnumOlderThan property, when TRUE, specifies that the queue can enumerate the messages that it has waiting for transmission that arrived before a specified date and time. The CanEnumOlderThan property corresponds to the fifth tit (0x00000010) of the MsgEnumFlagsSupported property.
CanEnumRecipient Property	The CanEnumRecipient property, when TRUE, specifies that the queue can enumerate the recipients of messages that it has waiting for transmission. The CanEnumRecipient property corresponds to the fourth tit (0x00000004) of the MsgEnumFlagsSupported property.
CanEnumSender Property	The CanEnumSender property, when TRUE, specifies that the queue can enumerate the senders of messages that it has waiting for transmission. The Can EnumSender property corresponds to the second bit (0x00000002) of the MsgEnumFlagsSupported property.
GlobalStop Property	The GlobalStop property specifies whether the queue is currently stopped.
IncreasingTime Property	The IncreasingTime property specifies the amount of time, in milliseconds, that the number of messages waiting to be transferred by the queue has been increasing.
LinkName Property	The LinkName property specifies the name of the link in which this queue is contained.
MsgEnumFlagsSupported Property	The MsgEnumFlagsSupported property specifies a tit-mapped set of flags that indicate what types of objects can be enumerated. The individual tits of this property are available as the queue CanEnum... properties in the class.
NumberOfMessages Property	The NumberOfMessages property specifies the number of messages that are waiting for transmission by the queue.
ProtocolName Property	The ProtocolName property specifies the transmission protocol for the queue.
QueueName Property	The QueueName property specifies the name of the queue.
SizeOfQueue Property	The SizeOfQueue property specifies the total size of all messages in the queue, in bytes.
Version Property	The Version property specifies the version number of the Exchange software.
VirtualMachine Property	The VirtualMachine property specifies the name of the virtual machine that is the source of the link.
VirtualServerName Property	The value of the VirtualServerName property is the integer number of the virtual machine that is the source of the queue. This number is the Microsoft Active Directory common name (CN) for the virtual server object.

5.3.2.3 The Cluster provider

The Cluster provider implements the ExchangeClusterResource class directly, based on the cluster service. The State property contains the state of the Exchange 2000 Cluster group. This class is similar in function to the ExchangeServerState, but it works at the cluster level instead of the server level. Table 5.23 lists the ExchangeClusterResource properties.

Table 5.23: The ExchangeClusterResource Properties

Name	Description
Name Property	The Name property returns the name of the Exchange cluster resource.
Owner Property	The Owner property for a cluster resource specifies the cluster node of which the resource is a part.
State Property	The State property specifies the current state of the duster resource.
Type Property	The Type property specifies the resource type.
VirtualMachine Property	The VirtualMachine property returns the name of the virtual machine that owns this resource.

5.3.2.4 The Message Tracking Logs provider

When "Message Tracking" is enabled on an Exchange 2000 server, all messages that go through this server are logged in a shared directory. The content of this directory can be examined with the Exchange System Manager, via the "Message Tracking Center," as shown in Figure 5.26.

Figure 5.26: The "Message Tracking" user interface.

With the tracking center, it is possible to track messages by sender, target recipients, server name, and message ID. It is also possible to select a window time (start date, end date) for the selection.

Before Exchange 2000 Service Pack 2, this was the only easy way to retrieve this information. Once Service Pack 2 is installed, it is possible to retrieve the same information with WMI.

The Message Tracking Logs WMI provider is called the ExchangeMessageTrackingProvider and gives access in read-only mode to the messages logged in the "Exchange Message Tracking" system. This provider supports one single class, called the Exchange_MessageTrackingEntry class (see Tables 5.24 and 5.25), which is a template representing a message tracking entry. With the GetCollectionOfInstances.wsf script (see Sample 1.5, "Listing all instances of a class with their properties formatted"), it is possible to list all instances of the Exchange_MessageTrackingEntry class.

Table 5.24: The Exchange_MessageTrackingEntry Class Properties

Name	Description
KeyID	The KeyID property uniquely identifies the message to which the log entry pertains.
AttemptedPartnerServer	The AttemptedPartnerServer property indicates the server to which Exchange tried to send a message, but was unable to complete the transfer.
ClientIP	The ClientIP property indicates the Transmission Control Protocol/Internet Protocol (TCP/IP) address of the messaging client that originally submitted the message.
ClientName	The ClientName property indicates the name of the messaging client application that submitted the message.
Cost	The Cost property indicates the relative effort required to transfer the message. There are no specific units used in this property. Higher values indicate slower network connections must be used, or a greater number of transfers is required to transfer the message.
DeliveryTime	The DeliveryTime property indicates the date and time, in coordinated universal time (UTC), when the message was transferred successfully from the computer running Microsoft Exchange 2000 Server.
Encrypted	The Encrypted property indicates, when TRUE, that the message is encrypted.
EntryType	The EntryType property indicates what occurred to cause the message tracking log entry to be created.
ExpansionDL	The ExpansionDL property indicates the name of the Exchange distribution list that was expanded. After the distribution list is expanded, the message recipient list includes the names of the individual members of that distribution list.
LinkedMessageID	The LinkedMessagelD property provides a string that can be used to retrieve message tracking log entries for the message after it has been transferred.
MessageID	The MessageID property indicates the identifier string for the message. The identifier may be assigned by the messaging client application or by the computer running Exchange 2000 Server.
OriginationTime	The OriginationTime property indicates the date and time, in UTC, when the message was created by the messaging client application.
PartnerServer	The PartnerServer property indicates the server to which Exchange transferred the message.
Priority Property	The Priority property specifies the importance of the message, as displayed by the messaging client application. "Urgent" "Normal" "Not Urgent"
RecipientAddress	The RecipientAddress property is an array that specifies the email addresses of each message recipient.
RecipientCount	The RecipientCount property indicates how many recipients are in the recipients list for the message.
RecipientStatus	The RecipientStatus property is an array that indicates the status of an individual message recipient.
SenderAddress	The SenderAddress property specifies the email address of the message sender.
ServerIP	The ServerIP property indicates the TCP/IP protocol address of the computer running Exchange 2000 Server.
ServerName	The Server property indicates the computer name of the computer running Exchange 2000 Server that created the message tracking log entry.
Size	The Size property indicates the message size, including attachments, in bytes.
Subject	The Subject property indicates the subject of the message, as found in the Subject: message header.
SubjectID	The SubjectID property specifies an identifier created by the messaging client application.
TimeLogged	The TimeLogged property indicates the date and time, in UTC, when the message tracking log entry was created.
Version	The Version property indicates the version of the service that created the message tracking log entry.

Table 5.25: The Exchange_MessageTrackingEntry EntryType Property Meaning

Values	Description
0	Message received through X400
1	tevtProbeTransferIn
3	Report received
4	Message submitted
5	tevtProbeSubmission
6	tevtProbeTransferOut
7	Message transferred out
8	Report transferred out
9	Message delivered
10	Report delivered
18	tevtStartAssocByMTSUser
23	tevtReleaseAssocByMTSUser
26	Distribution list expanded
28	Message redirected
29	Message rerouted
31	Server downgraded by MTA
33	Report absorbed
34	Report generated
43	Unroutable report discarded
50	Message deleted by Administrator
51	Probe deleted by Administrator
52	Report deleted by Administrator
1000	Message delivered locally
1001	Message transferred in over backbone
1002	Message transferred out over backbone
1003	Message transferred out over gateway
1004	Message transferred in over gateway
1005	Report transferred in over gateway
1006	Report transferred out over gateway
1007	Report generated
1010	SMTP: Message queued outbound
1011	SMTP: Message transferred out
1012	SMTP: Inbound message received
1013	SMTP: Inbound message transferred
1014	SMTP: Message rerouted
1015	SMTP: Report transferred in
1016	SMTP: Report transferred out
1017	SMTP: Report generated
1018	SMTP: Report absorbed
1019	SMTP: Message submitted to Advanced Queuing
1020	SMTP: Started outbound transfer of message
1021	SMTP: Message sent to badmail directory
1022	SMTP: Advanced Queue failure
1023	SMTP: Message delivered locally
1024	SMTP: Message submitted to Categorizer
1025	SMTP: Started message submission to Advanced Queue
1026	SMTP: Advanced Queue failed to deliver message
1027	SMTP Store Driver: Message submitted from Store
1028	SMTP Store Driver: Message delivered locally to Store
1029	SMTP Store Driver: Message submitted to MTA
1030	SMTP: Non-delivery report (NDR) generated
1031	SMTP: Message transferred out

  1     C:\>GetCollectionOfInstances.wsf Exchange_MessageTrackingEntry                     /NameSpace:Root\MicrosoftExchangeV2 /Machine:net-dpep6400a.emea.LissWare.NET  2:    Microsoft (R) Windows Script Host Version 5.6  3:    Copyright (C) Microsoft Corporation 1996–2001. All rights reserved.  4:  5:    ClientIP: ................................ 10.10.10.3  6:    ClientName: .............................. net-dpen6400a.LissWare.NET  7:    DeliveryTime: ............................ 0  8:    Encrypted: ............................... FALSE  9:    EntryType: ............................... 1019 10:    InstallDate: ............................. 10-05-2002 12:15:01 11:    *KeyID: ..................................                        \\net-dpep6400a.Emea.LissWare.NET\NET-DPEP6400A.log\20020510.log,2082 12:    MessageID: ...............................                        [e-mail] 13:    OriginationTime: ......................... 10-05-2002 12:15:31 14:    Priority: ................................ 0 15:    RecipientAddress: ........................ [e-mail] 16:    RecipientCount: .......................... 1 17:    RecipientStatus: ......................... 0 18:    SenderAddress: ........................... [e-mail] 19:    ServerIP: ................................ 192.10.10.3 20:    ServerName: .............................. net-dpep6400a.Emea.LissWare.NET 21:    Size: .................................... 3339 22:    TimeLogged: .............................. 10-05-2002 12:15:31 23:    Version: ................................. Version: 6.0.3590.0 24: 25:    ClientIP: ................................ 10.10.10.3 26:    ClientName: .............................. net-dpen6400a.LissWare.NET 27:    DeliveryTime: ............................ 0 28:    Encrypted: ............................... FALSE 29:    EntryType: ............................... 1025 30:    InstallDate: ............................. 10-05-2002 12:15:31 31:    *KeyID: ..................................                        \\net-dpep6400a.Emea.LissWare.NET\NET-DPEP6400A.log\20020510.log,2361 32:    MessageID: ...............................                        [e-mail] 33:    OriginationTime: ......................... 10-05-2002 12:15:31 34:    Priority: ................................ 0 35:    RecipientAddress: ........................ [e-mail] 36:    RecipientCount: .......................... 1 37:    RecipientStatus: ......................... 0 38:    SenderAddress: ........................... [e-mail] 39:    ServerIP: ................................ 192.10.10.3 40:    ServerName: .............................. net-dpep6400a.Emea.LissWare.NET 41:    Size: .................................... 3339 42:    TimeLogged: .............................. 10-05-2002 12:15:31 43:    Version: ................................. Version: 6.0.3590.0 44: ..: 84: 85:    DeliveryTime: ............................ 1 86:    Encrypted: ............................... FALSE 87:    EntryType: ............................... 1028 88:    InstallDate: ............................. 10-05-2002 12:15:31 89:    *KeyID: ..................................                        \\net-dpep6400a.Emea.LissWare.NET\NET-DPEP6400A.log\20020510.log,3198 90:    MessageID: ...............................                        [e-mail] 91:    OriginationTime: ......................... 10-05-2002 12:15:31 92:    Priority: ................................ 0 93:    RecipientAddress: ........................ [e-mail] 94:    RecipientCount: .......................... 1 95:    RecipientStatus: ......................... 0 96:    SenderAddress: ........................... [e-mail] 97:    ServerName: .............................. net-dpep6400a.Emea.LissWare.NET 98:    Size: .................................... 3339 99:    TimeLogged: .............................. 10-05-2002 12:15:32 

5.3.2.5 The DSAccess provider

The DSAccess component of Exchange 2000 manages access to the Active Directory for various Exchange components. DSAccess also caches Active Directory requests to improve performance. Because the Active Directory is a critical component of Exchange 2000, it is important to closely monitor which Active Directory server(s) Exchange 2000 is using. Having too many Exchange 2000 servers working with the same Active Directory server(s) may seriously impact overall system performance. As shown in Figure 5.27, once Service Pack 2 is installed, the Exchange System Manager displays which Active Directory Domain Controller is being used by the Exchange 2000 server.

Figure 5.27: The "DSAccess" user interface.

Besides this user interface extension, Microsoft also implemented a WMI provider, called ExchangeDsAccessProvider, supporting one WMI class called the Exchange_DSAccessDC class. Basically, this provider, with its supported class, retrieves the same set of information. However, due to the WMI capabilities, it is possible to monitor the DSAccess state—something that is not possible from the Exchange System Manager. By reusing the GetCollectionOfInstances.wsf script (see Sample 1.5, "Listing all instances of a class with their properties formatted"), the following output shows the list of properties exposed by the Exchange_DSAccessDC class.

  1:    C:\>GetCollectionOfInstances.wsf Exchange_DSAccessDC /NameSpace:Root\MicrosoftExchangeV2  2:    Microsoft (R) Windows Script Host Version 5.6  3:    Copyright (C) Microsoft Corporation 1996–2001. All rights reserved.  4:  5:  6:    ConfigurationType: ....................... 1  7:    DirectoryType: ........................... 0  8:    InstallDate: ............................. 01-01-2000  9:    IsFast: .................................. TRUE 10:    IsInSync: ................................ TRUE 11:    IsUp: .................................... TRUE 12:    LDAPPort: ................................ 389 13:    *Name: ................................... net-dpen6400a.LissWare.NET 14:    *Type: ................................... 0 15: 16:    ConfigurationType: ....................... 1 17:    DirectoryType: ........................... 0 18:    InstallDate: ............................. 01-01-2000 19:    IsFast: .................................. TRUE 20:    IsInSync: ................................ TRUE 21:    IsUp: .................................... TRUE 22:    LDAPPort: ................................ 389 23:    *Name: ................................... net-dpen6400a.LissWare.NET 24:    *Type: ................................... 1 25: 26:    ConfigurationType: ....................... 1 27:    DirectoryType: ........................... 0 28:    InstallDate: ............................. 01-01-2000 29:    IsFast: .................................. TRUE 30:    IsInSync: ................................ TRUE 31:    IsUp: .................................... TRUE 32:    LDAPPort: ................................ 3268 33:    *Name: ................................... net-dpen6400a.LissWare.NET 34:    *Type: ................................... 2 

Table 5.26 lists the Exchange_DSAccessDC properties.

Table 5.26: The Exchange_DSAccessDC Class Properties

Name	Description
Name	The Name property specifies the computer name of the domain controller. When creating new DSAccessDC instances, or when retrieving a specific DSAccessDC instance, the Name property is required.
Type	The DirectoryType property indicates the role that the domain controller plays in the Exchange system. "Configuration Domain Controller" "Local Domain Controller" "Global Catalog"
AsyncConnectionCount	The AsyncConnectionCount indicates the number of asynchronous (non-blocking) connections currently open between the computer running Exchange 2000 Server and the domain controller.
ConfigurationType	The ConfigurationType property indicates whether the instance describes a domain controller that was detected automatically, or one that was specified manually. "Manual" "Automatic"
DirectoryType	The DirectoryType property indicates whether the domain controller is an Active Directory or an Exchange Server 5.5 directory service. "Active Directory" "Exchange 5.5 Directory"
IsFast	The IsFast property indicates, when TRUE, that the domain controller response time has been less than two seconds.
IsInSync	The IsInSync property indicates whether the domain controller is synchronized with the Global Catalog server and with the Configuration domain controller.
IsUp	The IsUp property indicates whether the domain controller was available the last time Exchange attempted to access it.
LDAPPort	The LDAPPort property specifies the Transmission Control Protocol/Internet Protocol (TCP/IP) port on which the domain controller listens for Lightweight Directory Access Protocol (LDAP) requests.
SyncConnectionCount	The SyncConnectionCount indicates the number of synchronous (blocking) connections currently open between the computer running Exchange 2000 Server and the domain controller.

With the script in Sample 6.17 ("A generic script for asynchronous event notification") in the appendix, the following command-line sample can be used to receive a notification for any changes that occur to any instances of the Exchange_DSAccessDC class. Note the presence of the WITHIN statement, since none of the Exchange WMI providers is implemented as event providers. The WQL event query will look as follows:

 Select * From_InstanceModificationEvent Within 5 Where TargetInstance ISA 'Exchange_DSAccessDC' 

5.3.3 SQL Server 2000

When installing SQL Server 2000, no WMI support is provided with the installation. To add the WMI management capabilities to your SQL Server installation, another setup from the folder "\x86\Other\WMI," located on the SQL Server 2000 CD, must be executed. This setup creates the Root\MicrosoftSQLServer namespace and registers the unique WMI SQL provider implemented as an instance and method provider in the CIM repository (see Table 5.27).

Table 5.27: The WMI SQL Provider Capabilities

Provider Name	Provider Namespace	Class Provider	Instance Provider	Method Provider	Property Provider	Event Provider	Event Consumer Provider	Support Get	Support Put	Support Enumeration	Support Delete
MS SQL Provider
MicrosoftSQLServer 2000	Root/MicrosoftSQLServer		X	X				X	X	X	X

During the setup, a collection of WMI classes is created in the Root\MicrosoftSQLServer namespace that maps manageable instances of SQL Server 2000. The SQL Server WMI classes model objects, such as databases and tables, with their associated settings. The SQL Server WMI implementation provides several management capabilities, including:

• Create, change, or delete managed objects, such as creating or deleting a database. For instance, to create a database, the Create method of the MSSQL_Database class must be invoked. However, to delete a database, the WMI instance of the database must be retrieved, and then the Delete_ method of the SWBemObject object representing the database instances must be invoked.

• Administer managed objects, such as backing up databases and logs. For instance, invoking the SQLBackup method of the MSSQL_ SQLServer class will perform a backup of the SQL server.

• Retrieve information on specific managed objects, such as determining whether full-text indexing is enabled on a table. This can be done easily by reading the FullTextIndexActive property of the MSSQL_ Table instance.

• Query managed objects that meet a specific criterion, such as listing all encrypted stored procedures. This can be performed with some traditional WQL data queries.

• Execute methods defined for managed objects. For instance, to rebuild indexes from a table it is necessary to invoke the RebuildIndex method of the MSSQL_Table class.

• Generate events when a managed object is created, changed, or deleted, such as sending an event when a database option is changed. This can be done easily with a WQL event query. However, since the SQL WMI provider is not implemented as an event provider, the WQL event query requires the use of the WITHIN statement.

• Enumerate managed objects. As another example, to list all tables in a database it is necessary to retrieve all MSSQL_Table instances associated with the MSSQL_Database instance.

• Describe relationships between managed objects. For instance, to identify which logins are authorized to access a database it is necessary to enumerate MSSQL_Login instances associated with the MSSQL_ Database instance via the MSSQL_DatabaseLogin association class.

  Besides these functionalities, there are two interesting points to note:

• The SQL Server 2000 WMI implementation maps over the SQL Distributed Management Objects API (SQL-DMO) but does not support the management of the SQL replication.

• The SQL Server 2000 WMI implementation can also be used with SQL Server 7.0.

The SQL WMI classes supported are listed in Table 5.28.

Table 5.28: The WMI SQL Classes

Name	Type	Description
MSSQL_BackupDevice	Dynamic	The MSSQL_BackupDevice class represents backup devices known to the SQL Server installation.
MSSQL_Check	Dynamic	The MSSQL_Check class represents the attributes of a SQL Server integrity constraint.
MSSQL_Column	Dynamic	The MSSQL_Column class represents columns in a SQL Server table.
MSSQL_ConfigValue	Dynamic	The MSSQL_ConfigValue class represents the SQL Server configuration values. Some SQL Server configuration options do not take effect until the SQL Server service has been stopped and restarted. You can force the server to immediately accept changes in some options by using the ReconfigureWithOverride method. The DynamicReconfigure property indicates whether the ConfigValue object requires a restart.
MSSQL_Database	Dynamic	The MSSQL_Database class represents a SQL Server database. Each SQL Server installation can contain one or more databases.
MSSQL_DatabaseFile	Dynamic	The MSSQL_DatabaseFile class is an extension to the CIM_DataFile class. It contains properties that are relevant to an operating system file that is also a file storing SQL Server database data.
MSSQL_DatabaseRole	Dynamic	The DatabaseRole object represents the properties of a SQL Server database role. SQL Server database roles establish groups of users with similar security attributes. Database permissions can be granted by role, simplifying database security planning and administration.
MSSQL_DatabaseSetting	Dynamic	The MSSQL_DatabaseSetting class represents the settings for a database. These settings control the access to and the behavior of the database.
MSSQL_Default	Dynamic	The MSSQL_Default object represents the attributes of a SQL Server default. Defaults provide data to columns and user-defined data types when no other data is available on an INSERT statement execution. Unlike DRI defaults, represented by the MSSQL_DRIDefault class, the defaults represented by the MSSQL_Default class can be bound to one or more columns and datatypes.
MSSQL_DRIDefault	Dynamic	The MSSQL_DRI Default class represents the properties of a Microsoft SQL Server column default. Defaults provide data to columns and user-defined data types when no other data is available on an INSERT statement execution. Unlike other defaults, the Declarative Referential Integrity defaults are associated with one and only one column.
MSSQL_ErrorLog	Dynamic	The MSSQL_ErrorLog class represents the error logs used by the SQL Server installation.
MSSQL_ErrorLogEntry	Dynamic	The MSSQL_ErrorLogEntry class represents the entries in a SQL Service error log.
MSSQL_FileGroup	Dynamic	The MSSQL_FileGroup class represents the groups of operating system files used to store a database. A SQL Server filegroup categorizes the operating system files containing data from a single SQL Server database to simplify database administration tasks, such as backup. A filegroup cannot contain the operating system files of more than one database, though a single database can contain more than one filegroup.
MSSQL_ForeignKey	Dynamic	The MSSQL_ForeignKey class represents the foreign keys defined for a SQL Server database table.
MSSQL_FullTextCatalog	Dynamic	The MSSQL_FullTextCatalog class represents a single Microsoft Search persistent data store. Microsoft Search enables full-text queries on data maintained by Microsoft SQL Server. The service both builds the indexes providing full-text query capability and participates in query resolution by providing result data during a full-text query. Index data is maintained within a full-text catalog.
MSSQL_FullTextCatalogService	Dynamic	The MSSQL_FullTextCatalogService class represents the Microsoft Search full-text indexing service. The Microsoft Search full-text indexing service enables full-text queries on data maintained by SQL Server. Microsoft Search both builds the indexes providing full-text query capability and participates in query resolution by providing result data during a full-text query.
MSSQL_Index	Dynamic	The MSSQL_Index class represents an index for a SQL Server table. A SQL Server index optimizes access to data in SQL Server tables. Indexes are also used to enforce some constraints, such as UNIQUE and PRIMARY KEY constraints.
MSSQL_IndexTableInformation	Dynamic	The MSSQL_Index Table Information class represents the information regarding the age and structure of the index statistical information.
MSSQL_IntegratedSecuritySetting	Dynamic	The MSSQL_IntegratedSecurity Setting class represents the security settings of a SQL Server installation. This setting affects all login connections to SQL Server regardless of the login authentication type.
MSSQL_LanguageSetting	Dynamic	The MSSQL_LanguageSetting class represents the properties of an installed SQL Server language record. Language record identifiers categorize system messages so that error and status information can be presented as localized text. A language record specifies the format for dates displayed in system messages.
MSSQL_Login	Dynamic	The MSSQL_Login class represents the login authentication records present in a SQL Server installation.
MSSQL_PrimaryKey	Dynamic	The MSSQL_PrimaryKey class represents a primary key of a table. A primary key must also be a candidate key of the table.
MSSQL_Process	Dynamic	The MSSQL_Process class represents SQL Server processes. Note that these are not the same as an operating system's notion of a process. These are the processes identified by the SQL Server and assigned a SQL Server process ID by SQL Server.
MSSQL_RegistrySetting	Dynamic	The MSSQL_Registry Setting class represents the installation and run-time parameters of SQL Server stored in the registry.
MSSQL_Rule	Dynamic	The MSSQL_Rule class represents a single Microsoft SQL Server data-integrity rule. SQL Server offers several mechanisms for ensuring data integrity. A SQL Server rule is a Transact-SQL condition_expression syntax element that defines a data-integrity constraint. A rule can be bound to a column or user-defined data type.
MSSQL_SQLServer	Dynamic	The MSSQL_SQLServer class represents a SQL Server installation. There will be one instance of this class for each installation of SQL Server on the computer system.
MSSQL_SQLServerRole	Dynamic	The MSSQL_SQLServerRole class represents a SQL Server security role not constrained to operation within a single database. Roles are used to establish groups of users, in order to make it convenient to set permissions for a group of users.
MSSQL_StoredProcedure	Dynamic	The MSSQL_StoredProcedure class represents standard as well as extended stored procedure defined in a SQL Server database. SQL Server stored procedures can contain input and output parameters and can return the results of one or more SELECT statements or a single long integer. In order to create an instance of a new stored procedure, the Text properties need to be specified along with the key properties of the class. The Text property specifies the Transact-SQL script that defines the stored procedure.
MSSQL_StoredProcedureParameter	Dynamic	The MSSQL_StoredProcedureParameter class represents the input and output parameters of a SQL Server stored procedure.
MSSQL_SystemDatatype	Dynamic	The MSSQL_SystemDatatype class represents base data type defined in Microsoft SQL Server.
MSSQL_Table	Dynamic	The MSSQL_Table class represents a table in the SQL Server database.
MSSQL_TransactionLog	Dynamic	The MSSQL_TransactionLog class represents the transaction log of a Microsoft SQL Server database. A SQL Server transaction log maintains a record of modifications to the Operating System files containing the data of an SQL Server database. The transaction log provides data-recovery assistance in the event of system failure and an SQL Server database has at least one operating system file that stores transaction log records. A transaction log can be written to more than one operating system file. Each SQL Server database maintains its own transaction log and the operating system file or files that store log records cannot be shared with another database.
MSSQL_Trigger	Dynamic	The MSSQL_Trigger class represents a trigger. SQL Server supports using triggers as a kind of stored procedure. Triggers are executed when a specified data modification, such as an attempt to delete a row, is attempted on the table on which the trigger is defined.
MSSQL_UniqueKey	Dynamic	The MSSQL_UniqueKey object represents a unique key in a database. All candidate keys that are not the primary key are unique keys.
MSSQL_User	Dynamic	The User object exposes the attributes of a single Microsoft SQL Server database user.
MSSQL_UserDatatype	Dynamic	The MSSQL_UserDatatype class represents a data type defined by a user.
MSSQL_UserDefinedFunction	Dynamic	The MSSQL_UserDefinedFunction class represents a user-defined function in the SQL Server database.
MSSQL_View	Dynamic	The MSSQL_View class represents view tables in the database.
MSSQL_BaseDatatype	Association	The MSSQL_BaseDatatype class represents an association between a user-defined datatype and the system datatype from which it is derived.
MSSQL_ColumnDatatype	Association	The MSSQL_ColumnDatatype class associates a column its data type.
MSSQL_ColumnDefault	Association	The MSSQL_ColumnDefault class associates a column to the default for the column.
MSSQL_ColumnDRIDefault	Association	The MSSQL_ColumnDRIDefault class associates a column to a DRI default.
MSSQL_ColumnRule	Association	The MSSQL_ColumnRule class represents an association between a column and a rule bound to the column.
MSSQL_DatabaseCandidateKey	Association	The MSSQL_DatabaseCandidateKey class represents an association between a database and a candidate key that is present in one of the tables in the database. This association allows an application to perform a single traversal to find the candidate keys in a database
MSSQL_DatabaseDatabaseRole	Association	The MSSQL_DatabaseDatabaseRole class associates database role to the database within which the role is defined.
MSSQL_DatabaseDatabaseSetting	Association	The MSSQL_DatabaseDatabaseSetting class associates a SQL Server database to an instance of the MSSQL_DatabaseSetting class that contains the settings for the database.
MSSQL_DatabaseDatatype	Association	The MSSQL_DatabaseDatatype class associates a database to the datatypes defined within the database.
MSSQL_DatabaseDefault	Association	The MSSQL_DatabaseDefault association associates a database to the defaults defined within the database.
MSSQL_DatabaseFileDataFile	Association	The MSSQL_DatabaseFileDataFile class associates a CIM_DataFile class to the MSSQL_DatabaseFile class that contains database file-specific properties of an Operating System file.
MSSQL_DatabaseFileGroup	Association	The MSSQL_DatabaseFileGroup class represents an association between a database and the file group that contains the operating system files that store the data for the database.
MSSQL_DatabaseFullTextCatalog	Association	The MSSQL_DatabaseFullTextCatalog class represents an association between a database and a full-text catalog that stores index data used for full-text queries against the database.
MSSQL_DatabaseLogin	Association	The MSSQL_DatabaseLogin class represents an association between a database and a login that is mapped to a user defined in the database. This association allows an application to perform a single traversal to find the logins mapped to the users defined in the database.
MSSQL_DatabaseOwnerLogin	Association	The MSSQL_DatabaseOwnerLogin class represents an association between a database and the login mapped to the user that owns the database.
MSSQL_DatabaseRoleDatabasePermission	Association	The MSSQL_DatabaseRoleDatabasePermission class represents the permissions that a database role has for the database in which it is defined. The instances of this class represent only the permission that has been explicitly granted or denied to the user object. For example, if a database role has permissions to access a database by virtue of being a member of another database role, then there will not be a permission association instance between the role and the database.
MSSQL_DatabaseRoleStoredProcedurePermission	Association	The MSSQL_DatabaseRoleStoredProcedurePermission class represents the permissions that a database role has for a stored procedure. The instances of this class represent only the permission that has been explicitly granted or denied to the user object. For example, if a database role has permissions to access the stored procedure by virtue of being a member of another database role, then there will not be a permission association instance between the role and the stored procedure.
MSSQL_DatabaseRoleTablePermission	Association	The MSSQL_DatabaseRoleTablePermission class represents the permissions that a database role has for a table. The instances of this class represent only the permissions that have been explicitly granted or denied to the user object. For example, if a database role has permissions to access the table by virtue of being a member of another database role, then there will not be a permission association instance between the role and the table.
MSSQL_DatabaseRoleUserDefinedFunctionPermission	Association	The MSSQL_DatabaseRoleUserDefined Function Permission class represents the permissions that a database role has for a table. The instances of this class represent only the permissions that have been explicitly granted or denied to the user object. For example, if a database role has permissions to access the user-defined function by virtue of being a member of another database role, then there will not be a permission association instance between the role and the user-defined function.
MSSQL_DatabaseRoleViewPermission	Association	The MSSQL_DatabaseRoleViewPermission class represents the permissions that a database role has for a view. The instances of this class represent only the permissions that have been explicitly granted or denied to the user object. For example, if a database role has permissions to access the view by virtue of being a member of another database role, then there will not be a permission association instance between the role and the view.
MSSQL_DatabaseRule	Association	The MSSQL_DatabaseRule class represents an association between a database and the rules defined within the database.
MSSQL_DatabaseStoredProcedure	Association	The MSSQL_DatabaseStoredProcedure class represents an association between the database and a stored procedure defined within the database.
MSSQL_DatabaseTable	Association	The MSSQL_DatabaseTable class represents an association between a database and a table contained within the database.
MSSQL_DatabaseTransactionLog	Association	The MSSQL_DatabaseTransactionLog class represents an association between the database and the transaction log for the database.
MSSQL_DatabaseUser	Association	The MSSQL_DatabaseUser class represents an association between a database and a user defined for the database.
MSSQL_DatabaseUserDefinedFunction	Association	The MSSQL_DatabaseUserDefinedFunction class represents an association between a database and a user-defined function defined within the database.
MSSQL_DatabaseView	Association	The MSSQL_DatabaseView class represents an association between a database and a view contained within the database.
MSSQL_DBMSObjectOwner	Association	The MSSQL_DBMSObjectOwner class represents an association between a SQL database object and the user who owns the object.
MSSQL_ErrorLogDataFile	Association	The MSSQL_ErrorLogDataFile class represents an association between a SQL Server error log, and the operating system file used to store the error log.
MSSQL_ErrorLogErrorLogEntry	Association	The MSSQL_ErrorLogErrorLogEntry class represents an association between an error log and an entry in the error log.
MSSQL_FileGroupDatabaseFile	Association	The MSSQL_FileGroupDatabaseFile class represents an association between a database file group and an operating system files that is part of the group.
MSSQL_FullTextWin32Service	Association	The MSSQL_FullTextWin32Service represents an association between an instance of MSSQL_FullTextCatalogService and the corresponding instance of the Win32_Service.
MSSQL_IndexColumn	Association	The MSSQL_IndexColumn class represents an association between an index and a column that participates in the index.
MSSQL_IndexFileGroup	Association	The MSSQL_IndexFileGroup class represents an association between an index and a file group that stores the index.
MSSQL_IndexStatistics	Association	The MSSQL_IndexStatistics class represents an association between an index and the statistical information stored with the index.
MSSQL_KeyColumn	Association	The MSSQL_KeyColumn class represents an association between a key and a column that is part of the key.
MSSQL_KeyFileGroup	Association	The MSSQL_KeyFileGroup class represents an association between a key and the file group used to store the key.
MSSQL_LoginDefaultDatabase	Association	The MSSQL_LoginDefaultDatabase class represents an association between a login and the default database for the login.
MSSQL_LoginWin32Group	Association	The MSSQL_LoginWin32Group class represents an association between a login and the Win32 user group used for authentication by the login.
MSSQL_LoginWin32UserAccount	Association	The MSSQL_LoginWin32UserAccount class represents an association between a login and the Win32 user account used for authentication by the login.
MSSQL_MemberDatabaseRole	Association	The MSSQL_MemberDatabaseRole class represents an association between two database roles, one being a member of the other.
MSSQL_MemberLogin	Association	The MSSQL_MemberLogin class represents an association between a SQL Server role and a login that is a member of the role.
MSSQL_MemberUser	Association	The MSSQL_MemberUser class represents an association between a database role and a user that is a member of the role.
MSSQL_ ReferencedKey	Association	The MSSQL_ReferencedKey class represents an association between a foreign key and the candidate key that the foreign key references.
MSSQL_ReferencedTable	Association	The MSSQL_ReferencedTable class represents an association between a foreign key and the table that contains the primary key referenced by the foreign key.
MSSQL_SQLServerBackupDevice	Association	The MSSQL_SQLServerBackupDevice class represents an association between a SQL Server installation and a backup device known to SQL Server.
MSSQL_SQLServerConfigValue	Association	The MSSQL_SQLServerConfigValue class represents an association between a SQL Server installation and the configured value settings for the installation.
MSSQL_SQLServerDatabase	Association	The MSSQL_SQLServerDatabase class represents an association between a SQL Server installation and a database that is part of the installation.
MSSQL_SQLServerErrorLog	Association	The MSSQL_SQLServerErrorLog represents an association between a SQL Server installation and the error log used by the installation.
MSSQL_SQLServerIntegratedSecuritySetting	Association	The MSSQL_SQLServerIntegratedSecuritySetting class represents an association between a SQL Server installation and its security settings.
MSSQL_SQLServerLanguageSetting	Association	The MSSQL_SQLServerLanguageSetting class represents an association between a SQL Server installation and its language settings.
MSSQL_SQLServerLogin	Association	The MSSQL_SQLServerLogin class represents an association between a SQL server and a login defined within the SQL Server.
MSSQL_SQLServerRegistry	Association	The MSSQL_SQLServerRegistry class represents an association between a SQL Server installation and its registry setting.
MSSQL_SQLServerServerRole	Association	The MSSQL_SQLServerServerRole class represents an association between a SQL server and server roles defined within the SQL server.
MSSQL_SQLServerSQLServerConnectionSetting	Association	The MSSQL_SQLServerSQLServerConnectionSetting class represents an association between a SQL Server installation and the settings used by the SQL Server provider to connect to the SQL Server.
MSSQL_SQLServerUser	Association	The MSSQL_SQLServerUser class represents an association between a SQL Server and a database user. This association allows an application to perform a single traversal to find the database users in a SQL Server and the login that they are mapped to.
MSSQL_StoredProcedureStoredProcedureParameter	Association	The MSSQL_StoredProcedureStoredProcedureParameter class associates a stored procedure to a parameter used in the stored procedure.
MSSQL_TableCheck	Association	The MSSQL_TableCheck class represents an association between a table and the checks defined for the table.
MSSQL_TableColumn	Association	The MSSQL_TableColumn class represents an association between a table and a column contained in the table.
MSSQL_TableFileGroup	Association	The MSSQL_TableFileGroup class represents an association between a table and the file groups used to store the table.
MSSQL_TableIndex	Association	The MSSQL_Tablelndex class represents an association between a table and an index defined for the table.
MSSQL_TableKey	Association	The MSSQL_TableKey class represents an association between a table and a key defined for the table.
MSSQL_TableTextFileGroup	Association	This class associates a table with the file group that is used to store the variable-length data in the table.
MSSQL_TableTrigger	Association	The MSSQL_TableTrigger class represents an association between a table and a trigger defined for the table.
MSSQL_TransactionLogDataFile	Association	The MSSQL_TransactionLogDataFile class represents an association between SQL Server transaction log and the Operating System file that is used to store the log.
MSSQL_UserDatabasePermission	Association	The MSSQL_UserDatabasePermission class represents the permissions granted to a user for a database. The instances of this class represent only the permission that has been explicitly granted or denied to the user object. For example, if a user has permissions to access a database by virtue of being a member of a certain database role, then there will not be a permission association instance between the user and the database.
MSSQL_UserDatatypeDefault	Association	The MSSQL_UserDatatypeDefault class represents an association between a user-defined datatype and the rule bound to the column.
MSSQL_UserDatatypeRule	Association	The MSSQL_UserDatatypeRule class represents an association between a user-defined datatype and the rule bound to the column.
MSSQL_UserLogin	Association	The MSSQL_UserLogin class represents an association between a database user and the login used to authenticate the user.
MSSQL_UserStoredProcedurePermission	Association	The MSSQL_UserStoredProcedurePermission class represents the permissions granted to a user for a stored procedure. The instances of this class represent only the permission that has been explicitly granted or denied to the user object. For example, if a user has permissions to access a stored procedure by virtue of being a member of a certain database role, then there will not be a permission association instance between the user and the stored procedure.
MSSQL_UserTablePermission	Association	The MSSQL_UserTablePermission class represents the permissions granted to a user for a table. The instances of this class represent only the permission that has been explicitly granted or denied to the user object. For example, if a user has permissions to access a table by virtue of being a member of a certain database role, then there will not be a permission association instance between the user and the table.
MSSQL_UserUserDefinedFunctionPermission	Association	The MSSQL_UserUserDefinedFunctionPermission class represents the permissions granted to a user for a stored procedure. The instances of this class represent only the permission that has been explicitly granted or denied to the user object. For example, if a user has permissions to access a user defined function by virtue of being a member of a certain database role, there will not be a permission association instance between the user and the user defined function.
MSSQL_UserViewPermission	Association	The MSSQL_UserViewPermission class represents the permissions granted to a user for a view. The instances of this class represent only the permission that has been explicitly granted or denied to the user object. For example, if a user has permissions to access a view by virtue of being a member of a certain database role, then there will not be a permission association instance between the user and the view.
View Classes
CIM_DataFile	Dynamic	CIM_DataFile is a type of logical file that is a named collection of data or executable code.
CIM_LogicalFile	Dynamic	The CIM_LogicalFile class represents a named collection of data (this can be executable code) located in a file system on a storage extent.
CIM_Service	Dynamic	A logical element that contains the information necessary to represent and manage the functionality provided by a device and/or software feature. A service is a general -purpose object to configure and manage the implementation of functionality. It is not the functionality itself.
Win32_BaseService	Dynamic	The Win32_BaseService class represents executable objects that are installed in a registry database maintained by the Service Control Manager. The executable file associated with a service can be started at boot time by a boot program or by the system. It can also be started on-demand by the Service Control Manager. Any service or process that is not owned by a specific user, and that provides an interface to some functionality supported by the computer system, is a descendent (or member) of this class. Example: The dynamic host configuration protocol (DHCP) client service on a Windows NT/Windows 2000 computer system.
Win32_Group	Dynamic	The Win32_Group class represents data about a group account. A group account allows access privileges to be changed for a list of users. Example: Marketing2.
Win32_Process	Dynamic	The Win32_Process class represents a sequence of events on a Win32 system. Any sequence consisting of the interaction of one or more processors or interpreters, some executable code, and a set of inputs, is a descendent (or member) of this class. Example: A client application running on a Win32 system.
Win32_Service	Dynamic	The Win32_Service class represents a service on a Win32 computer system. A service application conforms to the interface rules of the Service Control Manager (SCM) and can be started by a user automatically at system boot through the Services control panel utility, or by an application that uses the service functions included in the Win32 API. Services can execute even when no user is logged on to the system.
Win32_UserAocount	Dynamic	The Win32_UserAccount class contains information about a user account on a Win32 system.
Win32_GroupUser	Association	The Win32_GroupUser class represents an association between a group and an account that is a member of that group.

It is important to mention that the Root\MicrosoftSQLServer namespace doesn't only contain SQL server classes. It also contains classes from the Root\CIMv2 namespace. Actually, the Root\MicrosoftSQLServer namespace contains a registration of the WMI View provider (see Chapter 3, section 3.9.1) to make classes such as Win32_Service and Win32_Process from the Root\CIMv2 namespace available in the Root\MicrosoftSQLServer (see bottom of Table 5.28). Figure 5.28 shows the view class Qualifiers for the Win32_Process class.

Figure 5.28: The Win32_Process View class in the Root\MicrosoftSQLServer namespace.