WMI System Classes
The WMI system classes are a collection of predefined classes based on the Common Information Model (CIM). Unlike classes supplied by providers, the system classes are not declared in a Managed Object Format (MOF) file. WMI creates a set of these classes whenever a new WMI namespace is created.
Objects from the system classes are used to support WMI activities, such as: event and provider registration, security, and event notification. Some objects are temporary, and some are stored in the repository as instances of the system classes.
System classes follow a naming convention that consists of a double-underscore (__) followed by the class name. When you write an MOF file to define classes for a WMI provider, Mofcomp.exe does not compile any class with an initial double-underscore (__) because that is reserved for WMI system class names.
The documentation for the system classes includes only the nonsystem local properties. Links are provided in class definitions so that you can navigate the class hierarchy quickly and easily.
WMI System Classes
The following table lists the various system classes.
| System class | Description |
|---|---|
| __AbsoluteTimerInstruction | Causes an event to be generated on a specific date at a specific time. |
| __ACE | Represents an access control entry (ACE). |
| __AggregateEvent | Represents an aggregate event of several individual intrinsic or extrinsic events. |
| __ArbitratorConfiguration | Configuration class that limits the internal resources that are used by operations initiated by WMI clients. |
| __CacheControl | Determines when WMI should release a Component Object Model (COM) object. |
| __CIMOMIdentification | Describes the local installation of WMI. |
| __ClassCreationEvent | Represents a class creation event, which is a type of intrinsic event generated when a new class is added to the namespace. |
| __ClassDeletionEvent | Represents a class deletion event, which is a type of intrinsic event generated when a class is removed from the namespace. |
| __ClassModificationEvent | Represents a class modification event, which is a type of intrinsic event generated when a class is changed in the namespace. |
| __ClassOperationEvent | A base class for all intrinsic events that relate to a class. |
| __ClassProviderRegistration | Registers class providers in WMI. |
| __ConsumerFailureEvent | Represents the occurrence of some other event that is being dropped because of the failure of an event consumer. |
| __Event | An abstract base class that serves as the parent class for all intrinsic and extrinsic events. |
| __EventConsumer | An abstract base class that is used in the registration of a permanent event consumer. |
| __EventConsumerProviderCacheControl | Determines when WMI should release an event consumer provider. |
| __EventConsumerProviderRegistration | Registers event consumer providers with WMI. |
| __EventDroppedEvent | Represents the occurrence of an event that is dropped. A dropped event is an event that is not delivered to an event consumer. |
| __EventFilter | Registration of a permanent event consumer requires an instance of the __EventFilter system class. |
| __EventGenerator | Serves as a parent class for classes that control the generation of events, such as timer events. |
| __EventProviderCacheControl | Controls when an event provider is unloaded. |
| __EventProviderRegistration | Registers event providers with WMI. |
| __EventQueueOverflowEvent | Reports when an event is dropped as a result of delivery queue overflow. |
| __EventSinkCacheControl | Used to determine when WMI releases an event consumer provider's IWbemUnboundObjectSink pointer. |
| __ExtendedStatus | Used to report detailed status and error information. |
| __ExtrinsicEvent | Serves as a parent class for all user-defined event types, also known as extrinsic events. |
| __FilterToConsumerBinding | Used in the registration of permanent event consumers to relate an instance of the of __EventConsumer to an instance of __EventFilter. |
| __IndicationRelated | Serves as a parent class for all event-related classes. |
| __InstanceCreationEvent | Reports an instance creation event, which is a type of intrinsic event that is generated when a new instance is added to the namespace. |
| __InstanceDeletionEvent | Reports an instance deletion event, which is a type of intrinsic event generated when an instance is deleted from the namespace. |
| __InstanceModificationEvent | Reports an instance modification event, which is a type of intrinsic event generated when an instance changes in the namespace. |
| __InstanceOperationEvent | Serves as a base class for all intrinsic events that relate to an instance. |
| __InstanceProviderRegistration | Registers instance providers in WMI. |
| __IntervalTimerInstruction | Generates events at intervals, similar to a WM_TIMER message in Windows programming. |
| __MethodInvocationEvent | This class is not implemented. |
| __MethodProviderRegistration | Registers method providers with WMI. |
| __Namespace | Represents a WMI namespace. |
| __NamespaceCreationEvent | Reports a namespace creation event, which is a type of intrinsic event generated when a new namespace is added to the current namespace. |
| __NamespaceDeletionEvent | Reports a namespace deletion event, which is a type of intrinsic event that is generated when a sub-namespace is removed from the current namespace. |
| __NamespaceModificationEvent | Reports a namespace modification event, which is a type of intrinsic event that is generated when a namespace is modified. |
| __NamespaceOperationEvent | A base class for all intrinsic events that relate to a namespace. |
| __NotifyStatus | Serves as the parent class for provider-defined error classes. |
| __NTLMUser9X | Controls remote access to a computer running unsupported versions of Windows. |
| __ObjectProviderCacheControl | Controls when a class or instance provider is unloaded. |
| __ObjectProviderRegistration | Serves as the parent for classes that are used to register class and instance providers in WMI. |
| __PARAMETERS | Defines the input and output parameters for methods. |
| __PropertyProviderCacheControl | Controls the cache when a property provider is unloaded. |
| __PropertyProviderRegistration | Registers property providers in WMI. |
| __Provider | Serves as the parent class for the __Win32Provider system class. |
| __ProviderHostQuotaConfiguration | Allows limits to be set on host process usage of system resources. |
| __ProviderRegistration | Serves as the parent class for registration classes for various types of providers. |
| __SecurityDescriptor | Represents a security descriptor. |
| __SecurityRelatedClass | Serves as a parent class for all types of security classes. |
| __SystemClass | Base class from which most system classes derive. |
| __SystemEvent | Represents a system event. |
| __SystemSecurity | Contains methods that let you access and modify the security settings for a namespace. |
| __thisNAMESPACE | Holds the security rights for the namespace in the form of a security descriptor. |
| __TimerEvent | Reports an event generated by WMI in response to a consumer's request for an interval timer event or an absolute timer event. |
| __TimerInstruction | Specifies instructions on how timer events should be generated for consumers. |
| __TimerNextFiring | Reserved for operating system use. |
| __Trustee | Represents a trustee. Either a name or a SID (byte array) can be used. |
| __Win32Provider | Registers information about a provider's physical implementation in WMI. |