TABLE 1: Win2K WMI Providers
Provider MOF DLL or EXE File What the Provider Does Namespace
Win32 provider Cimwin32.mof Cimwin32.dll Provides information about the computer, peripheral devices, OS, Win32 subsystems, services, processes, file system, security, and more. Root\cimv2
DS provider Dsprov.mof Dsprov.dll Provides a bridge to AD. Uses a consistent set of standards-based interfaces to access and manage AD and WMI data. Root\directory\ldap
Event Log provider Ntevt.mof Ntevt.dll Provides properties and methods to manage the event logs (e.g., read, backup, clear, copy, delete, rename, compress, uncompress, change event-log settings). WMI events can be generated as records and written to any of the Win2K and NT event logs. Root\cimv2
Performance Counter provider Perf.mof† Wbemperf.dll Win2K-only high-performance provider that provides access to raw performance data. Root\cimv2
Registry provider Regevent.mof Stdprov.dll Provides the ability to read, write, enumerate, create, and delete Registry keys and values. WMI events can be triggered based on a Registry change. Root\default
SNMP provider Snmpreg.mof Snmpincl.dll Provides access to SNMP MIB data and traps from SNMP-managed devices. Root\snmp
View provider †† Viewprov.dll Provides a mechanism to create user-defined views of several classes. ††
Windows Installer provider Msi.mof Msiprov.dll Provides access to information about installed software. Root\cimv2
WDM provider Wmi.mof Wmiprov.dll Provides access to information on WDM device drivers. Root\wmi
†WMI doesn't use the performance counter MOF files that Win2K ships. If you examine the perf.mof files, you see a comment stating that they are placeholders for future use. Currently, winmgmt.exe dredges PerfLib (HKEY_PERFORMNCE_DATA) at startup to load performance counter classes into the CIM. Winmgmt.exe loads the classes into the root\cimv2 namespace. You can enumerate all classes that derive from the Win32_PerfRawData class to locate the raw performance data classes.
††Custom MOF files define view classes. View classes are based on instances of other classes. You can create view classes across namespace and computer boundaries.