Windows Management Instrumentation Control

  • For help on using WMI Control, see Windows Management Instrumentation Control How To.

  • To understand more about WMI Control, see Windows Management Instrumentation Control Concepts.


Windows Management Instrumentation Control How To

  • Backup or restore WMI repository

  • Change WMI scripting settings

  • Authorize WMI users and set permissions

  • Modify permissions or delete authorized users


Backup or restore WMI repository

To back up or restore the WMI repository

  1. Open the WMI Control console: Click Start, click Run, type wmimgmt.msc and then click OK.

  2. In the console tree, right-click WMI Control, and then click Properties.

  3. Click the Backup/Restore tab.

  4. Click Back Up Now or Restore Now.

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

  • You must be running as the local computer administrator to save the backup file in the %Windir%\System32\Wbem\Repository folder. Otherwise, you can save it in the Documents folder for the account profile.

  • When you click Back Up Now to back up the repository manually, you can back up to a specified file name, and later restore from that saved file. This approach can be useful if you want to save a specific configuration of classes. You also can run the Winmgmt command at a command prompt and restore from the saved file. For more information about using the Winmgmt command, click Start, click Run, and type winmgmt /?


Change WMI scripting settings

To change WMI scripting settings

  1. Open the WMI Control console: Click Start, click Run, type wmimgmt.msc and then click OK.

  2. In the console tree, right-click WMI Control, and then click Properties.

  3. Click the Advanced tab.

  4. Under Default namespace for scripting, click Change.

  5. In the Browser for Namespace dialog box, select a different default namespace as a target for your scripts.

Additional considerations

  • Set the default targeted namespace to one you use most often in your WMI scripts. If no namespace is identified within a script, the default is used.

  • If the computer you manage runs Microsoft Windows NT 4.0, you can define whether WMI scripts can be run from within an Active Server Page (ASP). If you enable this option, your ASP connects to Windows Management services using the process level identity of Internet Information Services, which might compromise security.

  • You can change the scripting namespace on a remote computer or a local computer. To access a remote computer, right-click WMI Control, click Connect to another computer, click Another computer, and then type the name of the computer to which you want to connect. If you are using WMI Control from the Computer Management console, right-click the Computer Management node to connect to the other computer.

  • To connect to another computer, your logon account must be a member of the Administrators group on the remote computer. For more information, see Connecting to WMI on a Remote Computer.


Authorize WMI users and set permissions

To authorize WMI users and set permissions

  1. Open the WMI Control console: Click Start, click Run, type wmimgmt.msc and then click OK.

  2. In the console tree, right-click WMI Control, and then click Properties.

  3. Click the Security tab.

  4. Select the namespace for which you want to give a user or group access, and then click Security.

  5. In the Security dialog box, click Add.

  6. In the Select Users, Computers, or Groups dialog box, enter the name of the object (user or group) that you want to add. Click Check Names to verify your entry and then click OK. You might have to change the location or click the Advanced button to query for objects. See the dialog box Help for more details.

  7. In the Security dialog box, under Permissions, select the permissions to allow or deny the new user or group:

Level | Description
Execute Methods | Allows a user to execute WMI class methods.
Full Write | Allows full read, write, and delete access to all WMI objects, classes, and instances (dynamic and static).
Partial Write | Allows write access to static WMI objects.
Provider Write | Allows write access to dynamic WMI class instances.
Enable Account | Allows read access to WMI objects.
Remote Enable | Allows remote access to the namespace.
Read Security | Allows read-only access to security information.
Edit Security | Allows read and write access to security information.

Additional considerations

  • To perform this task on the local computer, you must be logged on as a member of the local Administrators group.

  • To perform this task on a remote computer, the account with which you are logged on must be a member of the Administrators group of that computer. To access a remote computer, right-click WMI Control, click Connect to another computer, click Another computer, and then type the name of the computer to which you want to connect. If you are using WMI Control from the Computer Management console, right-click Computer Management to connect to the other computer.

  • You can delete a user's or group's authorization to access WMI services by selecting that user or group and clicking Remove.

Additional references

  • Managing WMI security

  • Modify permissions or delete authorized users


Modify permissions or delete authorized users

To modify permissions or delete authorized users

  1. Open the WMI Control console: Click Start, click Run, type wmimgmt.msc and then click OK.

  2. In the console tree, right-click WMI Control, and then click Properties.

  3. Click the Security tab.

  4. Select the namespace for which you want to change a user's or group's permissions or delete a user or group, and then click Security.

  5. In the Security dialog box, under Name, select the user or group you want to remove or whose permissions you want to modify.

  6. Perform one of the following steps:

    • To remove the user or group, click Remove.

    • To change security settings, under Permissions, modify the permissions that are allowed or denied to the user or group by clearing or selecting the appropriate check boxes.

Additional considerations

  • To perform this task, you must be an administrator or use a domain account that is a member of the Administrators group on the computer you are managing.

  • WMI security is verified only when a user logs on to Windows Management services. Thus, any changes made to a user's permissions while the user is connected do not take effect until the next time the user logs on to WMI. For example, if a user's access is revoked, the changes do not take effect until the user logs off Windows Management services and attempts to log on again.

  • You can modify user or group permissions on a remote or local computer. To access a remote computer, right-click WMI Control, click Connect to another computer, click Another computer, and then type the name of the computer to which you want to connect. If you are using WMI Control from the Computer Management console, right-click the Computer Management node to connect to the other computer.

Additional references

  • Managing WMI security.

  • Authorize WMI users and set permissions.


Windows Management Instrumentation Control Concepts

  • WMI Control Overview

  • WMI Overview

  • Managing WMI security


WMI Control Overview

Windows Management Instrumentation (WMI) Control is a tool that enables you to configure WMI settings on a remote or local computer. Using WMI Control, you can perform the following tasks:

Back up the repository

You can configure the WMI Control to back up your WMI repository on a regular schedule, or you can back up the repository manually at any time. The repository is the database of objects you can access through WMI. You can also restore a previous version of the repository.

See Backup or restore WMI repository

Change the default namespace for scripting

You can change the default namespace that is targeted in WMI scripts.

See Change WMI scripting settings

Authorize users or groups and set permission levels

You can authorize a user or group to access WMI. For each user or group you authorize, you can set their permission level for specific namespaces.

See:

  • Authorize WMI users and set permissions

  • Modify permissions or delete authorized users

Additional Considerations

  • For more information on WMI, see WMI Overview

  • For information about using the command-line interface of WMI, view the command-line usage of Windows Management Instrumentation Control Command-line (Wmic.exe) by running wmic.exe -? at a command prompt.


WMI Overview

Windows Management Instrumentation (WMI) is the main source of management data and functionality on local and remote computers that run Microsoft Windows operating systems. You can obtain WMI management data directly through scripts and applications or through enterprise management tools such as Microsoft Systems Management Server (SMS) and Microsoft Operations Manager (MOM). You can use scripts written in any scripting language that can work with Windows Script Host.

Starting with Windows Vista, applications or scripts that use the WS-Management protocol can obtain WMI data through Windows Remote Management.

WMI is the Microsoft implementation of WEBM , an industry initiative to establish standards for accessing and sharing management information over an enterprise network. WMI is WBEM-compliant and provides integrated support for the Common Information Model (CIM), the data model that describes the objects that exist in an enterprise management environment.

WMI includes a CIM-compliant object repository and the CIM Object Manager. The object repository contains object definitions that supply data for manageable hardware and software. Examples of WMI classes are the Win32 classes, such as Win32_Printer or Win32_ComputerSystem, and StdRegProv, which supplies registry data.

The CIM Object Manager handles the collection and manipulation of objects in the repository and gathers information from WMI providers. WMI providers act as intermediaries between WMI and components of the operating system, drivers, applications, and other systems. Several Windows system management tools are WMI-enabled.

Additional references

  • For information about using the WMI Control to configure WMI settings and security on a remote or local computer, see WMI Control Overview.

  • For information about developing scripts and applications that use WMI data and functions, see Windows Management Instrumentation.

  • For information about using the command-line interface of WMI, view the command-line usage of Windows Management Instrumentation Control Command-line (Wmic.exe) by running wmic.exe -? at a command prompt.


Managing WMI security

Windows Management Instrumentation (WMI) supports a limited form of security that validates each user before the user is allowed to connect to WMI, on a remote or local computer. This security is layered on top of operating system security. WMI does not override or circumvent security provided by the operating system.

By default, only the local computer Administrator account has full control of the WMI services on the computer that is being managed. Members of the Administrators group have access to remote computers, but may not have access to all data. All others have read/write/execute permissions on their local computer only.

Permissions can be changed by adding a user to the Administrators group on the managed computer or by authorizing users or groups in WMI and setting their permission level. Access is based on WMI namespaces.

Security is checked only when a user connects to the WMI service and a namespace. Thus, any changes made to a user's permissions while the user is connected do not take effect until the next time the user connects to the WMI service. For example, if a user's access is revoked, the changes do not take effect until the user exits from WMI and attempts to connect to the service again.

Additional Considerations

  • Authorize WMI users and set permissions

  • Modify permissions or delete authorized users