Click here to Skip to main content
15,921,606 members
Articles / Programming Languages / C#

A simple guide to WMI providers

Rate me:
Please Sign up or sign in to vote.
4.84/5 (61 votes)
12 Oct 200310 min read 347.3K   4.4K   206   57
How to write WMI providers in C#

Table of contents


This article's purpose is to describe how to develop a WMI provider in the .NET framework. There are several incentives for writing this article:

  • The lack of simple examples for writing WMI provider in c#.
  • Many developers are not familiar with WMI and therefore don’t make use of this powerful technology.
  • By now there are too many Management buzz words that requires simple explanations.

This article does not include the use of SNMP and does not answer to the following questions:

  • How to write MIB?
  • How to configure the Windows SNMP service?
  • How to subscribe for traps?
Nevertheless, anyone who interest in those questions can find some useful notes regarding the required steps to expose managed application to SNMP (see appendix D).

Management includes a ‘Managed object’, ‘Managed object provider’ and a ‘Management consumer’. A Managed object can be a hardware device, driver or a software application that we would like to configure and to receive events from. The management consumer is the client application that wants to receive those events and the managed object provider is the mediator that provides this interaction between the two. The Windows Management Instrumentation (WMI) supplies the standards means to do this.

What is Platform Management?

In a nut shell, Platform Management is the means to manage and monitor the health of a system. This may fall into the following categories :

  • Configuration - initialization and settings of various aspects of the platform objects such as timeout values, user count thresholds, database connection strings etc.
  • Performance measurements - measure end to end process in regards to duration, optimization etc.
  • Hearth beats monitoring - manage component life time. Start and stop services, receiving components state etc.
  • Information exposing - expose platform information that might be valuable for system administrators, billing etc.
  • Alerts mechanism – informative events, errors and critical errors that happens in the platform.
  • Corrective events mechanism – As opposed to post mortem events this kind of events gives to the administrators the ability to perform actions in order to prevent up coming errors.

What is WMI?

WMI stands for Windows Management Instrumentation. This is the Microsoft implementation to two industry standards of DMTF (Desktop Management Task Force) the first is CIM (Common Information Model) and the second is WBEM (Web-Based Enterprise Management).

Image 1

WMI core is already a part of windows ME/2000 and XP. The WMI enables the management capabilities by supplying the standard storage component (CIM), the means to set and get information to and from the storage and the ability to dock third party providers (same as plug-in) to the Providers Manager (CIMOM). This industry standard compliancy allows alien components to share management environment locally and remotely by using SNMP.

What is WMI provider?

WMI Provider is a software component that functions as mediator between the CIM Object Manager and managed objects. Using the WMI APIs, providers supply the CIM Object Manager with data from managed objects, handle requests on behalf of management applications, and generate event notifications.

Developing WMI Provider – Where to start?

In order to expose software component such as a service through the WMI one need to write WMI provider. This plug-in (provider) exposes the service to the WMI and provides the interface to receive information and to interact with the service. Till recently WMI Providers was written as a COM component and now with the emerging of .NET framework it is easier to develop providers.

In case you aren’t familiar with the MOF syntax you can simply start with developing the WMI Provider(see the sample section). When it all done and finished use the InstallUtil.exe (see appendix B) tool to enter the managed class into the CIM schema, then if you want you can generate the MOF file from the WMI CIM Studio (it is highly recommended since it is the best way to learn this syntax). If you do know how to write MOF file (lucky guy) then use the Mgmtclassgen utility (see appendix B) to create the C# classes and events for the WMI provider.

Defining Namespace

Namespace enables you to logically gather related managed objects under one logic umbrella. It is recommended to define your own namespace for several reasons:

  • Order
  • Efficiency – Namespace like 'CIMV2' and 'Default' contains a lot of Managed objects. By defining unique namespace enables you to save time while looking for your objects.

Sample project

The demo includes a simple .NET service (‘Parachute service’ - Managed application ) and a WMI provider (‘Parachute provider’). For simplicity reasons, the sample use the MSDEV IDE extension for VS.NET Server Explorer (see Appendix B) as the consumer application.

Image 2

The Service code is quite simple. Adding a reference to the ParachuteProvider and to System.Managment assemblies. In the ExposeMeToWMI method we instantiate the provider, set some values and then publish (Instrumentation.Publish(<PROVIDER instance>) )the provider to the WMI. The publish call registered the provider and the managed object is mapped into the CIM schema. Events are fired when the service starts and stops.

Note: The provider instance is valid only when the service is started.

The Provider code contains the following actions:

  • Adding reference to theSystem.Management assembly.
  • Defining the instrumented namespace parachute_company under root: [assembly:Instrumented("root/parachute_company")]
Note: The managed object schema will be defined under this namespace.

Adding an instance installer in case we want to publish the provider directly via the InstallUtil tool. In this example we publish the provider through the service. Defining events by using the InstrumentationType.Event attribute: [InstrumentationClass( InstrumentationType.Event )]. Defining WMI Provider instance using the InstrumentationType.Instance attribute: [InstrumentationClass( InstrumentationType.Instance )]

Note: The provider code can be just as well written in the service.

How to use the Demo project

  1. Register the Parachute service to the SCM (Service Control Manager) with the InstallUtil tool (%systemroot%%\Microsoft.NET\Framework\ <framework version> \InstallUtil.exe).
    InstallUtil.exe <service file>. 

  2. Open the SCM <control panel="">\Administrative tools\ Services
  3. Log on as ‘This account’- Right click on the service name (Parachute) -> Properties -> Log on tab -> check the ‘This account’ enter user name and password (the user must be under Administrator group).
  4. Start the service
  5. Install the MSDEV IDE Management extension for VS.NET Server Explorer.
  6. Open the MSDEV in ‘Server Explorer’ view.
  7. Add your computer to the explorer: Right click on the Servers root tree -> Add Server.
  8. Add Management class to the ‘Management Classes’ item. Look for the Parachute class under to the parachute_company namespace.

    Image 3

  9. Expend the Parachute item you should see the brand new instance. Take a look at the instance properties you can see that the parachute color is exposed (red) by WMI.

    Image 4

  10. Subscribe for events: ‘Add Event Query ‘to the ‘Management Events’ item.

    Image 5

  11. Check the ‘Custom’ Events type.

    Image 6

  12. Add the Landing and Jump events (situated under the parachute_company namespace).
  13. Start and stop the service. The MSDEV output window will display the events data.

Image 7

Known problems in .NET WMI implementation


Well, that's it folks. Hopefully, this article will stimulate you to drill down into the WMI technology and to make advantage of it. Please send feedback, bug reports or suggestions here.

Appendix A : Definitions & Acronyms

  • CIM - Common Information Model – this is the premier concept of WBEM by this model WMI stores the Managed objects data (namespace, classes, methods, properties etc.).
  • CIM Repository – This is the storage that holds the Managed objects data. The structure of the CIM repository is build upon the DMTF.
  • CIMOM - Common Information Model object manager. The CIM repository is managed by the CIMOM, which acts as an agent for object requests. The CIMOM tracks available classes and determines which provider is responsible for supplying instances of these classes..
  • DMTF - Distributed Management Task Force – The DMTF consortium was founded in May of 1992. This initiative was conceived and created by eight companies like: BMC Software Inc., Cisco Systems Inc., Compaq Computer Corp., Intel Corp., and Microsoft Corp. etc. The aims of this consortium are to define industry standards for management.
  • MIB – Management Information Base describes a set of managed objects. Each managed object in a MIB has a unique identifier.
  • MOF - Managed Object Format. This text file includes the class definition of on or more managed object. You can export and import this definition from the CIM repository by using the WMI CIM Studio.
  • Schema - a group of classes that describe a particular management environment.
  • SNMP - Simple Network Management Protocol. SNMP is an Internet standard defined by the IETF and is a part of TCP/IP suite of protocols. SNMP is the protocol by which managed information is travel between stations and agents. Management information refers to a collection of managed objects that reside in a virtual information store called a Management Information Base (MIB).
  • WBEM - Web-Based Enterprise Management – WBEM stands for several DMTF industry standards including the Common Information Model. WBEM provides a standardized way to access information from various hardware and software management systems in an enterprise environment.

Appendix B : WMI tools

  • Download the WMI Administrative Tools at: It includes the following:
    • WMI CIM Studio: view and edit classes, properties, qualifiers, and instances in a CIM repository; run selected methods; generate and compile MOF files. WMI Object Browser: view objects, edit property values and qualifiers, and run methods.
    • WMI Event Registration Tool: configure permanent event consumers, create or view instances of event consumers, filters, bindings, and timer system classes.
    • WMI Event Viewer: displays events for all instances of registered consumers.
  • Mgmtclassgen.exe - Microsoft Visual Studio .NET tool. Convert MOF file into .cs/.vb/.js files.
  • Management [WMI] Extension for VS.NET Server Explorer :
  • Platform SDK tools – %systemroot%\system32\wbem
  • mofcomp.exe – Compiles MOF files and adds the managed objects to the CIM Repository. It is also possible to check the MOF file correctness.
  • wbemtest.exe - Windows Management Instrumentation Tester, also called WBEMTest, is a general-purpose utility for viewing or modifying Common Information Model (CIM) classes, instances etc. It is functions as the CIM studio only it UI is humble.
  • MIB Browser -
  • MIB editor, builder and browser -

Appendix C : Important reading


  • “Developing WMI Solution” - Chapter 8 – Developing .NET Management Application.


Appendix D : Developing steps to support SNMP

  1. Obtain an OID (Object IDentifier) from IANA To participate in the SNMP arena you need to define your classes and events in a MIB file. First, The SNMP root node must be a unique number (Only ONE MIB/SNMP Private Enterprise number is permitted per organization). IANA:
  2. Create a MIB (Management Information Base) file (check out the appendix B for some useful and easy to use MIB editors). Define classes and SNMP traps (events) that will eventually expose by the WMI Provider.
  3. Compile the MIB file using the SMI2SMIR utility. This will generate a MOF file.
  4. Compile the MOF file using the mofcomp.exe compiler to check the MOF file syntax correctness.
  5. Create the C# classes and events with the Mgmtclassgen utility (see appendix B). Use the C# classes to create WMI provider:


This article has no explicit license attached to it but may contain usage terms in the article text or the download files themselves. If in doubt please contact the author via the discussion board below.

A list of licenses authors might use can be found here

Written By
Israel Israel
This member has not yet provided a Biography. Assume it's interesting and varied, and probably something to do with programming.

Comments and Discussions

QuestionVery good article! Pin
Volynsky Alex3-Jan-14 6:42
professionalVolynsky Alex3-Jan-14 6:42 
GeneralHow about the "MSDEV IDE extension for VS.NET Server Explorer"? Pin
vannes26-Apr-11 23:17
vannes26-Apr-11 23:17 
GeneralWriting a Permanent Event Consumer in C# Pin
Bíró Ádám Dögi31-Jan-11 10:05
Bíró Ádám Dögi31-Jan-11 10:05 
Questionwhy i got 3 diferents DiveceID using __InstanceCreationEvent classEvent and Win32_USBControllerDevice targetInstance Pin
gguedes23-Apr-09 17:47
gguedes23-Apr-09 17:47 
QuestionWho generated the C:\Windows\System32\wbem\Framework\root\parachute_company files? Pin
Al Beback6-Apr-09 11:46
Al Beback6-Apr-09 11:46 
Generalcreating a wmi permanent event consumer in c# Pin
lwiji-tn18-Mar-09 2:57
lwiji-tn18-Mar-09 2:57 
Generalconverting SNMP agent to SNMP Agent provider Pin
PraneshVK16-Jul-08 22:46
PraneshVK16-Jul-08 22:46 
QuestionHOw to detect drive letter assigned to a USB flash drive Pin
nitinr7085-Aug-07 21:23
nitinr7085-Aug-07 21:23 
AnswerRe: HOw to detect drive letter assigned to a USB flash drive Pin
Cohen Shwartz Oren5-Aug-07 21:55
Cohen Shwartz Oren5-Aug-07 21:55 
AnswerRe: HOw to detect drive letter assigned to a USB flash drive Pin
ChunkyStool29-Jan-09 3:44
ChunkyStool29-Jan-09 3:44 
Questionprovider is and dll or service? Pin
oualido12-Jun-07 23:24
oualido12-Jun-07 23:24 
AnswerRe: provider is and dll or service? Pin
oualido14-Jun-07 3:28
oualido14-Jun-07 3:28 
QuestionMethods and Properties in .Net Pin
Paul Ruiz Pauker17-Mar-07 4:47
professionalPaul Ruiz Pauker17-Mar-07 4:47 
AnswerRe: Methods and Properties in .Net Pin
dancelicious19-Apr-07 7:43
dancelicious19-Apr-07 7:43 
QuestionRe: Methods and Properties in .Net Pin
llombardo31-Aug-07 10:32
llombardo31-Aug-07 10:32 
AnswerRe: Methods and Properties in .Net Pin
ChunkyStool29-Jan-09 3:32
ChunkyStool29-Jan-09 3:32 
GeneralDeleting Namepaces Pin
wakazula31-Aug-06 11:39
wakazula31-Aug-06 11:39 
GeneralWMI to Trap Win32 Events Pin
Gil Orlev23-Nov-05 4:00
Gil Orlev23-Nov-05 4:00 
GeneralProblem with 'using' Pin
Jochen Klein3-Nov-05 0:18
Jochen Klein3-Nov-05 0:18 
GeneralRe: Problem with 'using' Pin
Cohen Shwartz Oren3-Nov-05 8:05
Cohen Shwartz Oren3-Nov-05 8:05 
GeneralRe: Problem with 'using' Pin
Jochen Klein4-Nov-05 0:13
Jochen Klein4-Nov-05 0:13 
AnswerRe: Problem with 'using' Pin
andre271113-Dec-06 7:55
andre271113-Dec-06 7:55 
General,Getting a single instance Pin
Erik Burger4-Mar-05 4:42
Erik Burger4-Mar-05 4:42 
GeneralRe: ,Getting a single instance Pin
Erik Burger4-Mar-05 4:47
Erik Burger4-Mar-05 4:47 
GeneralException Pin
Erik Burger28-Feb-05 22:58
Erik Burger28-Feb-05 22:58 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.