About WMI

Windows Management Instrumentation (WMI) is the Microsoft implementation of Web-based Enterprise Management (WBEM), which is an industry initiative to develop a standard technology for accessing management information in an enterprise environment. WMI uses the Common Information Model (CIM) industry standard to represent systems, applications, networks, devices, and other managed components. CIM is developed and maintained by the Distributed Management Task Force (DMTF).

The ability to obtain management data from remote computers is what makes WMI useful. Remote WMI connections are made through DCOM. An alternative is to use Windows Remote Management (WinRM), which obtains remote WMI management data using the WS-Management SOAP-based protocol.

WMI provides a uniform interface for any local or remote applications or scripts that obtain management data from a computer system, a network, or an enterprise. The uniform interface is designed such that WMI client applications and scripts do not have to call a wide variety of operating system application programming interfaces (APIs). Many APIs cannot be called by automation clients like scripts or Visual Basic applications. Other APIs do not make calls to remote computers.

In the WMI infrastructure, the WMI service (Winmgmt) is the operating system component that acts as the mediator between management applications and WMI data providers. The WMI repository is a storage area for WMI-related static data.

The WMI service is implemented as a service process within a shared service host process (SVCHOST).

The WMI service interacts with management applications through the COM interface. When an application makes a request through the interface, WMI determines whether the request is for static or dynamic data. If the request involves static data, such as the name of a managed object, WMI retrieves the data from the repository. If the request involves dynamic data, such as the amount of memory a managed object is currently using, WMI passes the request on to a provider.

Providers register their location with the WMI service, which allows WMI to route data requests. A provider also registers support for particular operations, such as data retrieval, modification, deletion, enumeration, or query processing. The WMI service uses the provider registration information to match application requests with the appropriate provider. WMI also uses the registration information to load and unload providers, as necessary. When a provider finishes processing a request, the provider returns the result back to the WMI service. WMI then forwards the result on to the application through the COM interface.

WMI can be used to manage and access WMI data on remote computers. Remote connections in WMI are affected by the Windows Firewall and DCOM settings. In Windows Vista and later operating systems, User Account Control (UAC) may also require changes to some settings.