Tuesday, September 25, 2012

WMI - Windows Management Instrumentation


What is it?
Windows Management Instrumentation (WMI) is Microsoft’s implementation of Web-Based Enterprise Management (WBEM), an industry initiative to provide a Common Information Model (CIM) for pretty much any information about a computer system.
The Python WMI module is a lightweight wrapper on top of the pywin32 extensions, and hides some of the messy plumbing needed to get Python to talk to the WMI API. It’s pure Python and has been tested against all versions of Python from 2.4 to 3.2. It should work with any recent version of pywin32.
Where do I get it?
How do I install it?
When all’s said and done, it’s just a module. But for those who like setup programs:
Introduction to WMI Topics
WMI Perspective
Examples of WMI in Action
WMI - Components
CIMv2 - Common Information Model
CIMOM - (winmgmts)
WBEM
WMI and PowerShell
Summary
WMI Perspective
To appreciate the beauty of a jewel, you should view the crystals from different angles.  The same applies to the diamond that is WMI, I recommend that to gain perspective and understanding, examine WMI from these five angles.
Think of WMI as a database holding information about a computer's disk, services, processor and objects.
Regard WMI as a method to automate the collection of hardware and software data.
View WMI as a pipe connecting magically to the inner secrets of the Microsoft operating system.
Approach WMI as a distinctive dialect of VBScript with its own WQL language.
Treat WMI as a tool rather like a microscope to probe, and to measure the operating system's properties.
  
If you think about it, the operating system knows everything!  Windows Server 2008 / 2003 must know how much memory each process is using, how much free space there is on each partition, which devices are on which Bus.  With WMI scripting, you can tap into the operating system's CIM library and thus query information about any aspect of the Windows Server 2008 / 2003 or XP.
Examples of WMI in Action
Create WMI filters for Group Policies.
Discover how much free disk space on their servers.
Terminate a process remotely.
Restart services without the need for a reboot
Measure disk, processor or RAM statistics.
Query Printer attributes.
Filter specific Event ID from the Application or System logs.
Receive an alert when anyone changes the membership of the administrators group
Investigate tasks that WMI can control or automate on your network.
Research which machines have Windows Server 2008 / 2003 SP1 installed.
Automate by scripting scheduled tasks.

WMI - Components
There is no escaping acronyms. The more acronyms that you see on a page, the greater the degree of difficulty you are about to encounter.
Knowledge is power.  Until you know what an acronym means you feel intimidated, rather like an outsider to a clique.  However, once you understand what the letters stand for, you can join the club and savour the power of those capital letters, for example WMI (Windows Management Instrumentation).
 
As aside, to me, all acronyms have a personality, WMI is like a no-nonsense inspector and in fact, WMI reminds me of an HMI.  In England, an HMI is better known as a school inspector.  Imagine that I made a mistake and addressed WMI as Windows Management Information, I half expect that it would sharply correct me and say, 'Actually, I'm Windows Management Instrumentation'.  WMI is all about monitoring what is going on, all the way from the hardware to the operating system's services.  For example, from disk sectors, to SCSI Bus to the File Replication Service.
CIMv2 - Common Information Model
To my subconscious mind, the acronym Cimv2 is saying, Sim or even Sin.  Perhaps my negative vibes are coming from the word Common in its title, Common Information Model (CIM).  Actually, far from being sinful or common, CIM is a great idea.  Common refers to shared standards, which are agreed by Microsoft, Oracle, Intel and everyone else in computing.
When you build WMI scripts, the most frequently used connection is to root\cimv2.  However, you can also try: root\default or root\directory\ldap.
DMTF (Distributed Management Task Force) are behind the idea of CIM.  As a result, Microsoft, Intel, Oracle and many other manufacturers agree standards for computer schemas.  The CIM system works on Instances of objects, Classes of object (Sub-Classes), and Properties of the object.  Naturally WMI has methods to get, select, delete or enumerate an instance of that object.  My advice is just trust that with DMTF in the background, the CIM schema has been planned and implemented in minute detail.
Another view of CIM is that it provides a handle so that we can probe the processor and measure all sorts of properties, for example, L2Cache, CurrentClockspeed, Temperature and Fan voltage.  Whenever I look at a Class of object for the first time, I am stunned by the sheer number of properties that WMI can display.  Every object has features that I did not even know existed.  I hope that your imagination is leaping ahead and thinking of tasks which you can automate using CIM and WMI.
I expect that you have already worked out that v2 means version two.  As of 2010, CIM specifications and schemas are up to version 2.9, and what do cynics say - never trust a program until it reaches version three.  On that score CIM is just about to come of age, and with the backing of the DMTF, it surely has a bright future.

Windows Management Instrumentation (WMI) is one of the hidden treasures of Microsoft operating systems.  Fortunately, Solarwinds have created the WMI Monitor so that you can examine these gems of performance information for free.  Take the guess work out of which WMI counters to use for applications like Microsoft Active Directory, SQL or Exchange Server. 
CIMOM - CIM Object Manager. CIMOM is better known as winmgmts
Officially, winmgmt.exe provides the shell for the CIM objects.  To me winmgmts is like a butler who looks after his guests efficiently and unobtrusively.  Almost every WMI script will call for the CIM 'butler', watch out for command: GetObject("winmgmts...root\cimv2....  If you want to get a feel for these components, I challenge you to try winmgmt /? from the command line.  (Don't ask me why the command line requires the singular, winmgmt, whereas the VBScript needs the plural winmgmts.)
WBEM - Web Based Enterprise Management.
WBEM, says to me Web Management.  Compared with the heavyweight WMI, WBEM is the lightweight front end.  The manager in WBEM is like a boxer's manager or a showbiz presenter, WBEM is the mouthpiece while the boxer or star puts on the show.  Talking of being flashy, you can see WBEM in action by typing WBEMTEST in the Run command's dialog box.  If you try this, watch out for the CIM schema, also note the WQL window in WBEMTEST.  As we will see later, WQL is a dialect of SQL.

Two ways of seeing WMI in action:

1)
 Scriptomatic V2.  A 'must have utility for WMI', make sure you get version two.  
2)
 WBEMTEST - Built-in, just type from the command line.
Summary
Think of WMI as multi-faceted jewel.  In practical terms, WMI opens doors for you to control and automate your computers.  However, there is much to learn, so assemble your tools and start creating scripts. 
Who will benefit from building WMI scripts to monitor the Operating System?   These are the people that I had in mind when I wrote this section.  Network managers, IT professionals and those techies who love remote control without hassle.