How to Properly Apply a Screen Protector [Video]

If the screen of your mobile phone /tablet isn’t scratch-resistant, you may consider getting an inexpensive screen protector to safeguard the glass display of your expensive mobile device from scratches and other wear and tear.

The following YouTube video illustrates a simple trick that will help you attach the screen protector film on any mobile device but without the annoying air bubbles or creases.

http://www.youtube.com/watch?v=_oJX99p3kEc

Put on the Screen Protector without the Bubbles

All you need is some Scotch tape (any transparent adhesive tape should do), a piece of lint-free cloth (to wipe off the dust) and a credit card (or something similar) for evenly pressing the film and to push away any bubbles and wrinkles.

Do You Have Users Hiding in Your Enterprise Servers?

Are you in control of the user accounts across your enterprise systems? Defunct user accounts, duplicate IDs, excessive rights – do these plague your current accounts database? More importantly - how many account databases are you maintaining…or failing to maintain?

Identity services like authentication and single sign-on are critical in today’s business environments.  Managing these services is often a manual process, complicated by redundancy and integration between systems.  Employees may have network credentials sprawled across multiple directory services or local accounts.  The proliferation of virtual machines and self-service deployment can make resource control even more challenging.  (link to previous blog on virtual server sprawl). When a person changes roles or leaves the company how do you know that all their credentials have been remove? Do you have users lurking in a local UNIX or Linux /etc/passwd file? Do you have the necessary tools to ensure that user account authorization is synchronized and up-to-date throughout your organization?

You need an integrated solution to manage and authenticate users in the same way across all platforms.  A solution that will granularly control access to sensitive resources, apply uniform policies, and provide detailed auditing and reporting on the state of your network security.  By leveraging your existing Active Directory infrastructure you can integrate your UNIX, Linux, and Max OS clients and servers and consolidate to a single directly service – and a single point of management - for account control and authorization. 

Power Broker Identity Services is a comprehensive Active Directory bridge solution delivering consolidated management, control and out-of-box compliance reporting.   With PowerBroker Identity Services you can eliminate security and compliance concerns. You can reduce the management overhead -- and overload -- of maintaining obsolete account services, such as NIS, or ad hoc directory services, such as custom LDAP implementations.  You can also, improve security with enhanced account control, Kerberos authentication, and integrated cross-platform group policy support and with single sign-On (SSO) for your Linux, UNIX and Mac OS X systems you can streamline the user experience and further enhance security.  Plus, with out-of-box compliance reports you can complete audits quickly and successfully.

PowerBroker Identity Services coupled with Active Directory provide a proven Identity Management System to deliver integrated authentication, secure authorization, consolidated management, and one-click reporting to help you meet compliance requirements.

3 Ways to Reduce Help Desk Costs

It doesn't matter if your organization's IT help desk requirements are satisfied in-house or outsourced, there are very tangible costs directly related to the misuse of privilege.  Whether that misuse was intentional, accidental or indirect is only a matter of impact to your bottom-line.

These costs can add up.  According to a 2009 Gartner -IT Key Metrics Data Summary Report "the average help desk cost per call is $23" while "83% help desk staff is in-house versus 17% outsourced" and a "single help desk employee will average 471 calls per month."  The IDC Report -The Relationship between IT Labor Costs and Best Practices for Identity and Access Management with Active Directory projected that "the cost of desktop configuration errors costs $120 per PC per year."

Calculating your costs is as simple as plugging in your values to this equation:

Total #help desk calls (desktops/laptops) X $23 = Your Yearly Costs

Implementing a least privilege solution and eliminating admin rights on desktops and laptops can have a dramatic positive impact on these costs.  According to the whitepaper Reducing the Threat from Microsoft Vulnerabilities you can achieve a 92% reduction in exploited vulnerabilities by eliminating admin rights and according to Gartner - Organizations That Unlock PCs Unnecessarily Will Face High Costs you can achieve a savings of $1,237 per PC per year.

If you are interested in these types of savings then you may be interested in a free evaluation of a solution to establish least privilege for your desktops and laptops.

5 Things You Should Know About Microsoft AppLocker

Microsoft AppLocker has also been touted as the next best thing in desktop security (in addition to UAC) but does it really satisfy all you need in order to ensure security, compliance and productivity?  The 5 things you should know about AppLocker include:

1. AppLocker can not elevate privileges for processes.  It is designed to block or allow the execution of explicitly listed applications only.
2. AppLocker does not allow organizations to remove administrator privileges.  If you have applications that require administrator privileges, and those applications are on the AppLocker whitelist, the users will need to be configured as administrators.
3. In order to make AppLocker secure, you must also remove admin rights from end users.  If users are administrators they can easily circumvent AppLocker policies and even disable the AppLocker service.
4. AppLocker does not prevent users from accessing protected areas of the filesystem.  If a user is an administrator and AppLocker is delivering a whitelist to the machine the user can still modify critical areas of the file system.
5. Managing an AppLocker whitelist can be difficult and cumbersome.  This may not be suitable for large organizations with thousands of "line of business" applications.

Check out this whitepaper on Securing Windows 7 Migrations to uncover best practices for eliminating the misuse of privilege from your organization.

Exchange 2003 Alias not working

I renamed an account in ADUC and I changed  the username, the account

details (name, address, phone #, etc) as well as the "Alias" field on

the Exchange General tab. (The email address was staying the same.) I

made sure the GAL was correct and then updated the Offline Address

Book. In Outlook, I went to "Send/Receive" and "Download Address Book".

However, when I begin typing in the the new user's name, it is the

*old* user whose alias displays next to the new user's name

Check if  recipient update service set to always run?

You can manually run the Recipient Update Service to update the user

information in the Global Address List. To do this, follow these steps:

1. Open Exchange System Manager.

2. Expand Recipients, and then click Recipient Update Service.

3. In the right pane, right-click Recipient Update Service (yourdomain.com)

and then click Update Now

& It worked :)

The Machine SID Duplication Myth (and Why Sysprep Matters)

On November 3 2009, Sysinternals retired NewSID, a utility that changes a computers machine Security Identifier (machine SID). I wrote NewSID in 1997 (its original name was NTSID) because the only tool available at the time for changing machine SIDs was the Microsoft Sysprep tool, and Sysprep doesn’t support changing the SIDs of computers that have applications installed. A machine SID is a unique identifier generated by Windows Setup that Windows uses as the basis for the SIDs for administrator-defined local accounts and groups. After a user logs on to a system, they are represented by their account and group SIDs with respect to object authorization (permissions checks). If two machines have the same machine SID, then accounts or groups on those systems might have the same SID. It’s therefore obvious that having multiple computers with the same machine SID on a network poses a security risk, right? At least that’s been the conventional wisdom.

The reason that I began considering NewSID for retirement is that, although people generally reported success with it on Windows Vista, I hadn’t fully tested it myself and I got occasional reports that some Windows component would fail after NewSID was used. When I set out to look into the reports I took a step back to understand how duplicate SIDs could cause problems, a belief that I had taken on faith like everyone else. The more I thought about it, the more I became convinced that machine SID duplication – having multiple computers with the same machine SID – doesn’t pose any problem, security or otherwise. I took my conclusion to the Windows security and deployment teams and no one could come up with a scenario where two systems with the same machine SID, whether in a Workgroup or a Domain, would cause an issue. At that point the decision to retire NewSID became obvious.

I realize that the news that it’s okay to have duplicate machine SIDs comes as a surprise to many, especially since changing SIDs on imaged systems has been a fundamental principle of image deployment since Windows NT’s inception. This blog post debunks the myth with facts by first describing the machine SID, explaining how Windows uses SIDs, and then showing that - with one exception - Windows never exposes a machine SID outside its computer, proving that it’s okay to have systems with the same machine SID. Note that Sysprep resets other machine-specific state that, if duplicated, can cause problems for certain applications like Windows Server Update Services (WSUS), so MIcrosoft's support policy will still require cloned systems to be made unique with Sysprep.

SIDs

Windows uses SIDs to represent not just machines, but all security principals. Security principals include machines, domain computer accounts, users and security groups. Names are simply user-friendly representations for SIDs, allowing you to rename an account and not have to update access control lists (ACLs) that reference the account to reflect the change. A SID is a variable-length numeric value that consists of a structure revision number, a 48-bit identifier authority value, and a variable number of 32-bit subauthority or relative identifier (RID) values. The authority value identifies the agent that issued the SID, and this agent is typically a Windows local system or a domain. Subauthority values identify trustees relative to the issuing authority, and RIDs are simply a way for Windows to create unique SIDs based on a common base SID.

You can use the Sysinternals PsGetSid tool to view a machine’s SID by running it with no command-line arguments:

Here, the revision number is 1, the authority is 5, and there are four subauthority values. At one point during the design of Windows NT, the machine SID might have been used for network identification, so in order to assure uniqueness, the SID that Setup generates has one fixed subauthority value (21) and three randomly-generated subauthority values (the numbers following “S-1-5-21” in the output). 

Even before you create the first user account on a system, Windows defines several built-in users and groups, including the Administrator and Guest accounts. Instead of generating new random SIDs for these accounts, Windows ensures their uniqueness by simply appending a per-account unique number, called a Relative Identifier (RID), to the machine SID. The RIDs for these initial accounts are predefined, so the Administrator user always has a RID of 500:

After installation, Windows assigns new local user and group accounts with RIDs starting at 1000. You can use PsGetSid to view the name of the account for a specified SID, and here you can see that the local SID that has a RID of 1000 is for the Abby account, the name of the administrator account Windows prompted me to name during setup:

In addition to these dynamically created SIDs, Windows defines a number of accounts that always have predefined SIDs, not just RIDs. One example is the Everyone group, which has the SID S-1-1-0 on every Windows system:

Another example, is the Local System account (System), which is the account in which several system processes like Session Manager (Smss.exe), the Service Control Manager (Services.exe) and Winlogon (Winlogon.exe) run:

SIDs and Access Control Lists

When an account logs on to a Windows system, the Local Security Authority Subsystem (LSASS -Lsass.exe) creates a logon session and a token for the session. A token is a data structure the Windows kernel defines to represent the account and it contains the account’s SID, the SIDs of the groups that the account belongs to at the time it authenticated, and the security privileges assigned to the account and the groups. When the last token that references a logon session is deleted, LSASS deletes the logon session and the user is considered logged off. Here you can see my interactive logon session, displayed with the Sysinternals LogonSessions utility:

And here you can see a token Lsass has created for the session in Process Explorer’s handle view. Note that number following the account name, 7fdee, matches the logon session ID shown by LogonSessions:

By default, processes inherit a copy of their parent process’s token. Every process running in my interactive session, for example, has a copy of the token that they inherited originally from the Userinit.exe process, the process Winlogon creates as the first of any interactive logon. You can view the contents of a process’s token by double-clicking on the process inProcess Explorer and switching to the Security page of the process properties dialog:

When one of my processes opens an operating system object, like a file or registry key, the security subsystem executes a permission check that evaluates entries in the object’s access control list (ACL) that reference a SID included in the process’s token.

A similar check happens for remote logon sessions, which are the kind created by a “net use” of a remote computer’s share. To successfully connect to a share you must authenticate to the remote system with an account known to that system. If the computer is part of a Workgroup, then the credentials you specify must be for a local account on the remote system; for a Domain-joined system, the credentials can be for a remote system’s local account or a Domain account. When you access a file on the share, the file server driver on that system uses the token from the logon session for the permission check, leveraging a mechanism called impersonation.

SID Duplication

The Microsoft-supported way to create a Windows installation that’s ready for deployment to a group of computers is to install Windows on a reference computer and prepare the system for cloning by running the Sysprep tool. This is calledgeneralizing the image, because when you boot an image created using this process, Sysprep specializes the installation by generating a new machine SID, triggering plug-and-play hardware detection, resetting the product activation clock, and setting other configuration data like the new computer name.

However, some IT administrators install Windows on one of their systems, install and configure applications, then use deployment tools that don’t reset the SIDs of the copies of the Windows installations. The best practice up to now has been to run a SID-resetting utility like NewSID to change SIDs. These utilities generate a new machine SID, try to find all the locations on a system, including all the file system and registry ACLs, that contain copies of the machine SID, and update them to the new SID. The reason that Microsoft doesn’t support systems modified in this way is that, unlike Sysprep, these tools don’t necessarily know about all the places where Windows stashes away references to the machine SID. The reliability and security of a system that has a mix of the old and new machine SID can’t be guaranteed.

So is having multiple computers with the same machine SID a problem? The only way it would be is if Windows ever references the machine SIDs of other computers. For example, if when you connected to a remote system, the local machine SID was transmitted to the remote one and used in permissions checks, duplicate SIDs would pose a security problem because the remote system wouldn’t be able to distinguish the SID of the inbound remote account from a local account with the same SID (where the SIDs of both accounts have the same machine SID as their base and the same RID). However as we reviewed, Windows doesn’t allow you to authenticate to another computer using an account known only to the local computer. Instead, you have to specify credentials for either an account local to the remote system or to a Domain account for a Domain the remote computer trusts. The remote computer retrieves the SIDs for a local account from its own Security Accounts Database (SAM) and for a Domain account from the Active Directory database on a Domain Controller (DC). The remote computer never references the machine SID of the connecting computer.

In other words, it’s not the SID that ultimately gates access to a computer, but an account’s user name and password: simply knowing the SID of an account on a remote system doesn’t allow you access to the computer or any resources on it.  As further evidence that a SID isn’t sufficient, remember that built-in accounts like the Local System account have the same SID on every computer, something that would be a major security hole if it was.

As I said earlier, there’s one exception to rule, and that’s DCs themselves. Every Domain has a unique Domain SID that’s the machine SID of the system that became the Domain’s first DC, and all machine SIDs for the Domain’s DCs match the Domain SID. So in some sense, that’s a case where machine SIDs do get referenced by other computers. That means that Domain member computers cannot have the same machine SID as that of the DCs and therefore Domain. However, like member computers, each DC also has a computer account in the Domain, and that’s the identity they have when they authenticate to remote systems.

Some articles on SID duplication, including this KB article, warn that if multiple computers have the same SID, that resources on removable media like an NTFS-formatted firewire disk can’t be secured to a local account. What they fail to mention is that permissions on removable media provide no security regardless, because a user can connect them to computers running operating systems that don’t honor NTFS permissions. Moreover, removable media tend to have default permissions that grant access to well-known SIDs, such as to the Administrators group, which are the same on all systems. That’s the fundamental rule of physical security and why Windows 7 introduced Bitlocker-to-Go, which enables you to encrypt removable storage.

The final case where SID duplication would be an issue is if a distributed application used machine SIDs to uniquely identify computers. No Microsoft software does so and using the machine SID in that way doesn’t work just for the fact that all DC’s have the same machine SID. Software that relies on unique computer identities either uses computer names or computer Domain SIDs (the SID of the computer accounts in the Domain).

The New Best Practice

It’s a little surprising that the SID duplication issue has gone unquestioned for so long, but everyone has assumed that someone else knew exactly why it was a problem. To my chagrin, NewSID has never really done anything useful and there’s no reason to miss it now that it’s retired. Note that Sysprep resets other machine-specific state that, if duplicated, can cause problems for certain applications like Windows Server Update Services (WSUS), so Microsoft’s support policy will still require cloned systems to be made unique with Sysprep

How to Configure LDAP on HP LaserJet Multifunction Printers

One of the convenient features of the HP LaserJet Multifunction Printer (MFP) series is the ability to populate the Control Panel with network user email addresses by utilizing ldap. This function is especially useful in Windows Active Directory environments. Once ldap connectivity is established with a domain controller, network user changes are immediately displayed and accessible at the printer. This article will review the minimal steps needed to configure ldap connectivty between an HP MFP and Windows Active Directory.
 

The following screen shots are from a M3035 MFP. The network environment consists of a Windows Server 2003 based domain and Exchange 2003.

First access the MFP web interface and select the "Digital Sending" tab

Then select "LDAP Settings"

Configure "Addressing Settings"  (click image for full size)  

Check off "Allow Device to directly access an LDAP Address Book" then fill in the login credentials. Note the "Username" is in UPN format. Included with the Windows 2003 Support tools is an ldap browser (ldp.exe) that can be used to find the proper UPN path for your environment. The "Find Server" function is optional and can be used to scan the network for ldap servers. You'll need to apply the credentials settings first before using "Find Server." Enter the LDAP Server ip address (your domain controller) manually if you already know it.

Fill out Searching the Database fields (click image for full size)

Enter the UPN path to the Active Directory container where all your users reside in the "Search Root" field. Select "Active Directory Defaults" from the drop down menu then apply your settings and select "Test."

Active Directory user name and email addresses should now be accessible under the Scan to Email function at the printers Control Panel. These settings were successfully configured and tested more recently on a newer HP M4345 MFP printer and should apply to most if not all of the MFP series machines. If you recieve a fail status, re-check your credentials configuration and ldap server address settings. Comments or questions welcomed.

Outlook 2007 very slow in Windows 7

Issue:
Outlook 2007 very slow in Windows 7 and freezes at times
Send/Receive is Slow
Switching folders is slow


Fix:


Microsoft has released an update for Microsoft Office Outlook 2007. This update provides the latest fixes to Office Outlook 2007. Additionally, this update contains stability and performance improvements.


If you installed the original version released on December 14, 2010 of this update, you may see performance degradation when you switch folders in Outlook. The resolution for this issue is to install a newer version of the update released on January 11, 2011 in the Resolution section.


http://support.microsoft.com/kb/2412171

Windows update hangs or Windows 7 keeps on checking or searching updates

Are you having one of the following problems related to Microsoft windows 7 update.

• Windows 7 keeps on checking update or searching updates
• Windows update stopped working
• Microsoft windows does not install the pending updates
• Windows does not show the installed updates.
• No windows updates after you install IE9.
• Windows7 failed to install updates many times.
• Windows update hangs

Cause: The problem is due to the default registry size limit in windows 7 which is is 0x8000000 (134217728). You can increase the registry size limit by following steps

Solution:

Open regedit (Run regedit)

Then goto and modify the value

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control

Key: RegistrySizeLimit, Type: REG_DWORD, Value: 0x8000000 (134217728)

Change the value: 0xFFFFFF (4294967295)

Now reboot the system and check for the updates. You should be able to update

Migration to Windows 7 and Deployment options

Exploring the User State Migration Toolkit (USMT) 4.0

http://www.microsoft.com/showcase/en/gb/details/e66a1aa1-9a4c-407c-86d6-694b122b3c99

Troubleshooting Your Crashed / Frozen Apple iPad

Most people might say that you should skip first generation devices (including the Apple iPad) altogether and wait for the second edition to come out. This is because most first generation electronics have bugs and problems that haven't been resolved yet. These bugs are usually fixed by the time the second edition of these devices is made available. 

Some of you, though, already have iPads and may have experienced some problems like crashing or freezing. There's no need to tear your hair out when this happens to your beloved Apple iPad. Below are some simple tips that you can use to troubleshoot your crashed or frozen iPad.

1. Try restarting your frozen iPad. Restarting your iPad is quite simple and easy to do. Just press and hold down the Hold button (located at the upper right corner of your iPad) for about three seconds or until the slider button appears on the screen. Use your finger to slide the button from left to right until your iPad shuts down. Wait for about 10 to 15 seconds before turning your iPad on again. Press the Hold button until the Apple logo on the screen, then everything should boot up properly.

2. If restarting doesn't work, do a soft reset. This is called a "soft reset" because all your files will remain intact and you won't lose any saved information in your Apple iPad. To do a soft reset when you experience an iPad crash, simply press the Home and Hold buttons at the same time. These buttons can be found below the center screen of your iPad. Continue to hold both buttons until you see the screen flash, then turn dark. Wait for about a minute or two before restarting your Apple iPad by pressing the Hold button until the Apple logo appears. This should fix your frozen iPad.

3. If both restarting and resetting don't work, try to do a hard reset. Before your do this, you should make sure that you have backed-up all your important files and documents in your Apple iPad. Restoring your iPad to its original (or factory) settings will erase all saved files and applications in your iPad. Make sure that you have thelatest iTunes installed in your computer. Connect your iPad to your PC or Mac and launch iTunes. Click on the "Restore" button (located under Devices / iPad / Summary). Click on the backup button when prompted to save all your files. Once the restore has been completed, your iPad will restart. Resave all your media into your iPad and enjoy your freshly restored gadget.

4. Update your iPad's firmware regularly. Apple releases updates to firmware often, so it's best to check online regularly. Recently, an important update was released for the Apple iPad that fixed WiFi connectivity problems.

5. Delete applications that have problems. There may be some applications installed in your iPad that can cause an iPad crash. If you notice that your iPad starts to hang or freeze after launching an application, remove or delete the application from the iPad immediately.

A lot of people have already bought first generation Apple iPads and have probably experienced some problems with them. If your Apple iPad has crashed, try the tips listed above before sending it over to an Apple service center. You might be able to fix your frozen iPad by simply restarting or restoring it.

Removing Users From The Local Administrators Group

When embarking on a project to remove administrator rights from users, it is important to understand all of the options available for modifying local group membership on your clients.  If you have hundreds or even thousands of desktops, it is not feasible to do this manually.  Fortunately, Microsoft provides two mechanisms in Group Policy to manage local group membership.  The first is a Group Policy extension called Restricted Groups.  Restricted Groups allows you to overwrite the existing local group with what you have configured in the Group Policy setting.  The other option is withinGroup Policy Preferences.  The Local Users and Groups extension allows you to modify the local group membership, without overwriting the existing groups.

Restricted Groups

Restricted Groups can be configured by opening a GPO and navigating to the following location:

Computer Configuration\Policies\Windows Settings\Security Settings\Restricted Groups

If you create a Restricted Group for the Local

Administrators group, the GPO will overwrite the existing local group membership and set the membership to whatever has been configured in the GPO.  If a user adds himself to the local administrators group, the next time the policy refreshes, the local group membership will be reset back to what is defined in the Restricted Group.

Another option to manage local group membership is to use Group Policy Preferences in Windows Server 2008.  Group Policy Preferences was introduced in Windows Server 2008 after Microsoft acquired DesktopStandard Corp in 2006 (BeyondTrust was spun out of that transaction).

To configure Group Policy Preferences, simply open a GPO and maximize the Preferences, then maximize the Control Panel Settings.

When you right-click and create a new policy, you will have the option to add, remove or even modify local group membership.  This method of managing local group membership provides more flexibility over Restricted Groups.  In the example below, the policy will remove all members of the local administrators group and add the Domain Admins group back in.

Once you have decided on your strategy on how to technically remove admin rights, it is time to consider the things that will break when you actually take the administrator privileges away from users.  Typically, there will be several applications that your business relies on that will require administrator privileges to run.  There will also be system tasks that users will no longer be able to run because they require administrator privileges.  Finally, users will no longer be able to install most applications since they also require administrator privileges.  These are challenges all organizations will face when removing administrator privileges from end users, even in Windows 7 deployments.  This is where PowerBroker Desktops, Windows Edition comes to the rescue.  PowerBroker Desktops can elevate these apps, tasks and installs, dynamically without any impact to the end users.  You can even measure your progress with robust reporting capabilities that include automatic discovery of applications that require administrator privileges in your enterprise, but it also will show you how many user accounts have local administrator privileges, as shown below. 

 

WMI - Windows Management Instrumentation

What is it?

Windows Management Instrumentation (WMI) is Microsoft’s implementation of Web-Based Enterprise Management (WBEM), an industry initiative to provide a Common Information Model (CIM) for pretty much any information about a computer system.

The Python WMI module is a lightweight wrapper on top of the pywin32 extensions, and hides some of the messy plumbing needed to get Python to talk to the WMI API. It’s pure Python and has been tested against all versions of Python from 2.4 to 3.2. It should work with any recent version of pywin32.

Where do I get it?

Subversion: http://svn.timgolden.me.uk/wmi/trunk/

Windows installer: http://timgolden.me.uk/python/downloads/WMI-1.4.6.win32.exe

Zipped-up source: http://timgolden.me.uk/python/downloads/WMI-1.4.6.zip

Older Versions: http://timgolden.me.uk/python/downloads

How do I install it?

When all’s said and done, it’s just a module. But for those who like setup programs:

Introduction to WMI Topics

WMI Perspective

Examples of WMI in Action

WMI - Components

CIMv2 - Common Information Model

CIMOM - (winmgmts)

WBEM

WMI and PowerShell

Summary

WMI Perspective

To appreciate the beauty of a jewel, you should view the crystals from different angles.  The same applies to the diamond that is WMI, I recommend that to gain perspective and understanding, examine WMI from these five angles.

Think of WMI as a database holding information about a computer's disk, services, processor and objects.

Regard WMI as a method to automate the collection of hardware and software data.

View WMI as a pipe connecting magically to the inner secrets of the Microsoft operating system.

Approach WMI as a distinctive dialect of VBScript with its own WQL language.

Treat WMI as a tool rather like a microscope to probe, and to measure the operating system's properties.

  
If you think about it, the operating system knows everything!  Windows Server 2008 / 2003 must know how much memory each process is using, how much free space there is on each partition, which devices are on which Bus.  With WMI scripting, you can tap into the operating system's CIM library and thus query information about any aspect of the Windows Server 2008 / 2003 or XP.

Examples of WMI in Action

Create WMI filters for Group Policies.

Discover how much free disk space on their servers.

Terminate a process remotely.

Restart services without the need for a reboot

Measure disk, processor or RAM statistics.

Query Printer attributes.

Filter specific Event ID from the Application or System logs.

Receive an alert when anyone changes the membership of the administrators group

Investigate tasks that WMI can control or automate on your network.

Research which machines have Windows Server 2008 / 2003 SP1 installed.

Automate by scripting scheduled tasks.

WMI - Components

There is no escaping acronyms. The more acronyms that you see on a page, the greater the degree of difficulty you are about to encounter.
Knowledge is power.  Until you know what an acronym means you feel intimidated, rather like an outsider to a clique.  However, once you understand what the letters stand for, you can join the club and savour the power of those capital letters, for example WMI (Windows Management Instrumentation). 
As aside, to me, all acronyms have a personality, WMI is like a no-nonsense inspector and in fact, WMI reminds me of an HMI.  In England, an HMI is better known as a school inspector.  Imagine that I made a mistake and addressed WMI as Windows Management Information, I half expect that it would sharply correct me and say, 'Actually, I'm Windows Management Instrumentation'.  WMI is all about monitoring what is going on, all the way from the hardware to the operating system's services.  For example, from disk sectors, to SCSI Bus to the File Replication Service.

CIMv2 - Common Information Model

To my subconscious mind, the acronym Cimv2 is saying, Sim or even Sin.  Perhaps my negative vibes are coming from the word Common in its title, Common Information Model (CIM).  Actually, far from being sinful or common, CIM is a great idea.  Common refers to shared standards, which are agreed by Microsoft, Oracle, Intel and everyone else in computing.
When you build WMI scripts, the most frequently used connection is to root\cimv2.  However, you can also try: root\default or root\directory\ldap.
DMTF (Distributed Management Task Force) are behind the idea of CIM.  As a result, Microsoft, Intel, Oracle and many other manufacturers agree standards for computer schemas.  The CIM system works on Instances of objects, Classes of object (Sub-Classes), and Properties of the object.  Naturally WMI has methods to get, select, delete or enumerate an instance of that object.  My advice is just trust that with DMTF in the background, the CIM schema has been planned and implemented in minute detail.
Another view of CIM is that it provides a handle so that we can probe the processor and measure all sorts of properties, for example, L2Cache, CurrentClockspeed, Temperature and Fan voltage.  Whenever I look at a Class of object for the first time, I am stunned by the sheer number of properties that WMI can display.  Every object has features that I did not even know existed.  I hope that your imagination is leaping ahead and thinking of tasks which you can automate using CIM and WMI.
I expect that you have already worked out that v2 means version two.  As of 2010, CIM specifications and schemas are up to version 2.9, and what do cynics say - never trust a program until it reaches version three.  On that score CIM is just about to come of age, and with the backing of the DMTF, it surely has a bright future.

Windows Management Instrumentation (WMI) is one of the hidden treasures of Microsoft operating systems.  Fortunately, Solarwinds have created the WMI Monitor so that you can examine these gems of performance information for free.  Take the guess work out of which WMI counters to use for applications like Microsoft Active Directory, SQL or Exchange Server. 

CIMOM - CIM Object Manager. CIMOM is better known as winmgmts

Officially, winmgmt.exe provides the shell for the CIM objects.  To me winmgmts is like a butler who looks after his guests efficiently and unobtrusively.  Almost every WMI script will call for the CIM 'butler', watch out for command: GetObject("winmgmts...root\cimv2....  If you want to get a feel for these components, I challenge you to try winmgmt /? from the command line.  (Don't ask me why the command line requires the singular, winmgmt, whereas the VBScript needs the plural winmgmts.)

WBEM - Web Based Enterprise Management.

WBEM, says to me Web Management.  Compared with the heavyweight WMI, WBEM is the lightweight front end.  The manager in WBEM is like a boxer's manager or a showbiz presenter, WBEM is the mouthpiece while the boxer or star puts on the show.  Talking of being flashy, you can see WBEM in action by typing WBEMTEST in the Run command's dialog box.  If you try this, watch out for the CIM schema, also note the WQL window in WBEMTEST.  As we will see later, WQL is a dialect of SQL.

Two ways of seeing WMI in action:

1) Scriptomatic V2.  A 'must have utility for WMI', make sure you get version two.  
2) WBEMTEST - Built-in, just type from the command line.

Summary

Think of WMI as multi-faceted jewel.  In practical terms, WMI opens doors for you to control and automate your computers.  However, there is much to learn, so assemble your tools and start creating scripts. 
Who will benefit from building WMI scripts to monitor the Operating System?   These are the people that I had in mind when I wrote this section.  Network managers, IT professionals and those techies who love remote control without hassle.