Share This Post

WMI Event basics

Given my pretty strong background in SCCM / ConfigMgr most of this WMI blog will be related to SCCM. This product has been one of the prime and still is one of the largest consumers of WMI.

WMI and WQL are used by:

  • Dynamic Collections
  • Queries
  • Hardware inventory
  • DCM
  • The Admin console
  • And to store the client settings on a ConfigMgr client

Plenty has been said and written about a lot of these uses, yet one thing has been left out over the years, yet it was there staring us in the face from day1. WMI eventing has been around for nearly a decade, and we could have made great use of it over that time, so that’s what I’ll focus on in the next coming weeks.

What is WMI eventing?

Very simply put, WMI eventing allows you to perform certain actions each time any WMI class or instance is created, deleted or modified. This might seem like a benign thing, but once you put your head around the power this could bring to any ConfigMgr / SCCM environment I promise that each and everyone SCCM Administrator reading this blog will be shouting: “The M in WMI stands for Magic because schedules are boring and events are sexy”.

WMI eventing has 6 different event classes called:

  • __instancecreationevent
  • __instancemodificationevent
  • __instancedeletionevent
  • __classcreationevent
  • __classdeletionevent
  • __classmodificationevent

The names are rather self-explanatory and as you might have figured out they generate an event for instance or class creation, deletion or modification.

That’s it for now, in the next post I will start by explaining how you work with WMI events by using Wbemtest.

Enjoy your first baby steps into the Dark Magic of WMI.

Share This Post

Leave a Reply