EV Reach - WMI Explorer - Using the WMI Query View by Namespace and Classview

Last modified on 2023/07/12 14:02

Using the WMI Explorer's Browser view to navigate through the WMI set of objects and their attributes doesn't disclose the full set of objects WMI has to offer. Also, different machines may have a different set of objects available depending on the version of the WMI repository installed. You can use the View by Namespace & Classview to fully explore what the remote Windows client has to offer.

Using this view you will be able to:

  • Explore the full set of namespaces and classes available on a machine.
  • View object class definitions.
  • View object task parameter definitions.
  • Query object instances.
  • Add new root objects in the Browser View.

Using this view you will NOT be able to execute tasks on an object.

Querying the WMI Repository

The WMI repository is organized in a hierarchy of namespaces. Each namespace contains classes which are themselves organized in a hierarchy and may contain child namespaces. A WMI Class can either be an object definition or an association definition. Furthermore, a class can either be concrete, abstract or pure abstract. The following is a legend of the miscellaneous icons you may find in the View by Namespace & Class view.

WMIX-30.png

Namespace A namespace is a logical grouping of classes which belong to the same management environment.

WMIX-31.png

Localised Namespace A localised namespace contains a specific language's version of class definitions. This is a system object which should be of little interest.

WMIX-32.png

Concrete Class An object definition which can generate instances.

WMIX-33.png

Abstract Concrete Class A class which is used to define a set of common properties and methods to be inherited by derived concrete classes. Querying the instances of an abstract concrete class results in the instances of all its child concrete classes.

WMIX-34.png

Association A class which expresses the relationship between two or more concrete classes. The relationship is identified by the definition of two or more references in the association.

WMIX-35.png

Abstract Association An association class which is used to define a set of common properties and methods to be inherited by derived associations.
 Pure Abstract Class A pure abstract class is an abstract class which does not have any concrete class or association which is derived from it. Such a class cannot generate instances. A method parameter class is an example of a pure abstract class.

WMI Query: Navigating through Namespaces and Classes

The initial view displays the Root namespace and its direct child namespaces and classes. The Root namespace only contains system classes. The most important namespace is the CIMV2 child namespace. It contains the object definition of most components a system has to offer.

  • To open a namespace and disclose its child classes and namespaces, double click on it, or select View Namespace Objects from its context sensitive menu. Once the hierarchy of child classes is displayed, you can navigate through them by expanding each child item.
  • To refresh the list of objects a namespace contains, right click on the namespace item and select Reload Namespace Objects from the menu.
  • To abort the querying of a namespace's child objects, click on the Stop Action button in the main toolbar.

WMI Query: Controlling the View Appearance

The WMI repository of namespaces and classes is intricate. WMIX includes a set of options to help navigate through it. You can find them at the top and bottom of the view as a set of radio buttons and check boxes.

Display objects using Friendly Names / WMI NamesWMIX can display objects using friendly names or the WMI original object names. An original class name, for instance, Win32_ComputerSystem, is by convention formatted with first the class provider name (here Win32) and then the object name (here ComputerSystem). The friendly name of Win32_ComputerSystem would simply be Computer System.
Show Class HierarchyEnable to show the namespace class hierarchy or disable to show all classes in a flat namespace. Displaying all classes in a flat namespace is sometimes easier when you are looking for a particular class. You do not need to search through the class hierarchy to disclose the available class definitions.
Simplify ViewEnable to hide objects which are usually of little interest or rarely used. Disable to display all child objects. If enabled, system classes, pure abstract objects and localized namespaces are hidden from the view.
Show Association ClassesEnable to show association classes or disable to hide association classes from the view.

WMI Query: Searching for an Object

If you are looking for an object but do not know its name or location in the namespace's hierarchy, click on the Search WMI... button in the main toolbar. The Search WMI window allows you to enter a search string and search for any object which includes this string in its name, property, method or description. Once the desired object is found, select it and click on the OK button, WMIX will then automatically find the selected object in the hierarchy and set the focus on it. For more information about the search feature, see Searching for Objects.

Note: The Search WMI window can only return objects which are allowed by this view. For instance, if you selected to hide the Association objects, the Search WMI window will not include any associations in the result list. Likewise, if theSimplify View option is enabled, the Search WMI window will not return system classes or pure abstract objects. If you need to find association objects, system objects or pure abstract classes, make sure that the appropriate options are set accordingly before searching for objects.

Adding WMI Objects to the Browser View

As you explore the available objects in a namespace, you may find interesting classes that you wish to add to the list of root objects in the Browser view. To do so, simply select the object and either right click on the mouse and select Add Class to Browser View or click on the Add Object to Root button in the ribbon bar.

See Find out more

Viewing WMI Objects Definition

While navigating through the Namespace & Classes view, you will notice that the Information Panel updates its display to show the selected item's description and available methods definition. At any time, you can click on the Class Definition link or on any of the available Method Definition links to open its respective property window.

Viewing a Class Definition

Select the class object in the view and either right click on the mouse and selectView Class Definition from the menu or click on the Class Definition link of the Information Panel. For example, the Class Definition for the User Account class object looks like this:

wmix25.png

Legend

WMIX-37.png

Read Only Property

WMIX-38.png

Read/Write Property

WMIX-39.png

Inherited Property A property item with this icon is a property which is inherited from a parent class object.

WMIX-41.png

Key Property A key property is a property which uniquely identifies the object. An object can have more than one key property.

Window Options

Show Inherited PropertiesEnable to display properties that this class inherited from parent classes.
Show System PropertiesEnable to display the system properties of this class (properties specific to WMI.)

 To show or hide any column, right click within the column bar and select (or un-select) the column by its name.
)))

Viewing a Class Method Definition

If the selected class has methods, they will be displayed in the Information Panel. To view the set of method parameters configured for a particular method, either right click on the item and select View Methods Definition >> Method NAME or click on the link with the method name in the Information Panel.

Querying Class Instances

At any time, you can select a WMI object definition class and query the available instances the computer system holds. Simply select the object, right click on the mouse and select Query Instances... from the menu.

WMIX queries the available instances of the selected class and displays them in the Instances Panel. You can abort the querying process at any time by clicking on the Stop Action button of the main toolbar.

You can view the instance properties of any object in the Instances Panel by double clicking on it.

Abstract versus Concrete WMI Classes

You do not need to select a concrete class or association to retrieve a set of instances. You can select abstract objects as long as they have one or more concrete classes or associations which derive from them. However, the higher up the hierarchy you go, more instances exist, and it will take longer to see the results.

For example, the Managed System Element (CIM_ManagedSystemElement) abstract class can be used to query available instances. However, this results in the full set of logical and physical component instances available on the system.It is preferable to restrict your queries to the lowest level parent of the object type you want  to query. If you need to query the instances of every user device available on a system, you can either query the Pointing Device (Win32_PointingDevice), Keyboard (Win32_Keyboard) and Desktop Monitor (Win32_DesktopMonitor) leaf classes, or your can simply query their common parent abstract class: User Device (CIM_UserDevice).

Association Classes

Querying association classes is the same as querying object classes. An association is a class which defines the relationship between two or more objects in the system. For example, a share object has a relationship with the directory which it shares. Identically, the directory may have a relationship with a set of security settings. An association is the means by which WMI defines these relationships.

An association class has a set of reference properties which are used to define a relationship. These special properties point to external objects. However, this doesn't mean that Association classes cannot have properties which are not references. Though it is rare, some associations do have standard properties in addition to their reference properties.

For example, from within the Namespace & Class view, do the following:

  1. Enable the Show Associations option for the view.
  2. Click on the Search WMI button. Enter the string 'QUOTA' and search for objects which contain this word in their names. Make sure that you are searching the CIMV2 namespace. From the results list, double click on the Disk Quota object.
  3. Once WMIX has set the focus on the Disk Quota (Win32_DiskQuota) association object, open the Class Definition window for this association.

wmix26.png

As you can see, this association has two references, one pointing to Win32_LogicalDisk and the other pointing to Win32_Account. Indeed, a disk quota is the relationship between a disk drive and a user account since it defines the maximum number of bytes a user may consume on a disk drive. In addition, you can see that this association defines the actual quota settings: Quota Volume, Warning Limit, etc.

Close this window and query this association's instances. Select the association class, double click on it and select Query Instances from the menu. WMIX returns all available quotas as configured in the system of the target machine in the Instances Panel.

WMIX always shows the summary line of an association instance by displaying the actual relationship it defines. For example, the last instance of the previous result set means that the Logical Disk with device ID 'I:' is related to the Account with domain 'LELUDEV' and name 'Administrator' in the association Disk Quota.

To view all information about any association instance, open its property window. The actual parameters of this disk quota association is displayed in addition to the references the association points to. If you select any of the reference properties, you will notice a [...] button on the right column. Click on this button to view the property window of the object this reference points to.

Tags:
Powered by XWiki © EasyVista 2022