ManageEngine x Forrester | Tips to strengthen security in the age of AI

Active Directory Fundamentals

WMI classes and categories

Listing every class in Windows Management Instrumentation (WMI) would be extensive, as WMI includes hundreds of classes that cover a wide range of functionalities. However, I can guide you on how to find a comprehensive list of all WMI classes and offer a general overview of some of the key categories these classes fall into.

Finding All WMI Classes and categories

To get a complete list of all WMI classes, you can use WMI tools like the WMI Explorer or the Windows Management Instrumentation Tester (wbemtest.exe), which is built into Windows. These tools allow you to connect to different WMI namespaces (like root\CIMv2) and list all available classes within those namespaces.

Categories of WMI Classes

WMI classes can be broadly categorized as follows:

  1. Hardware: Classes that provide information about the physical hardware of a system, such as processors, BIOS, memory, disk drives, and more.
  2. Operating System and Services: Classes for managing and getting information about the Windows operating system, its configurations, and services running on the machine.
  3. Networking: Classes that deal with various aspects of networking, including network adapters, connections, settings, and protocols.
  4. User Accounts and Security: Classes related to user accounts, groups, security settings, and permissions.
  5. Applications and Software: Classes that provide information about installed software, running processes, and applications.
  6. Performance Monitoring: Classes used for monitoring system performance, including CPU usage, memory usage, disk activity, and network activity.
  7. Event Logs and Alerts: Classes for accessing and managing Windows event logs and alerts.
  8. System Configuration: Classes that provide information about system configuration, including environmental variables, startup configuration, and more.
  9. Scheduled Tasks: Classes for managing scheduled tasks in Windows.
  10. Data Storage and Files: Classes related to data storage, file systems, and file manipulation.

How to Use

To use these classes, you typically need to write scripts (in VBScript, C#, or another language with WMI support) that interact with the WMI service. These scripts can query, create, modify, or delete instances of these classes, allowing for a wide range of system management tasks.

For a full, detailed list of WMI classes, it is best to refer to the official Microsoft documentation or use a WMI browser tool on a Windows machine. Remember, the available classes may vary depending on the version of Windows and the specific configuration of the system.

Here’s an overview of some of the key WMI classes, categorized by their general purpose:

System and Hardware Management

  1. Win32_Processor: Information about the processors in the computer.
  2. Win32_ComputerSystem: General properties of a computer, like the manufacturer, model, roles, etc.
  3. Win32_PhysicalMemory: Details about the physical memory (RAM) including capacity and speed.
  4. Win32_DiskDrive: Information about physical disk drives.
  5. Win32_NetworkAdapter: Details about network adapters.
  6. Win32_BIOS: Information about the system BIOS.

Operating System and User Information

  1. Win32_OperatingSystem: Comprehensive details about the operating system, including version, architecture, and status.
  2. Win32_UserAccount: Information about user accounts on the computer.
  3. Win32_Group: Information about groups defined on the computer.

Software and Application Management

  1. Win32_Product: Information about installed software products.
  2. Win32_Service: Details about services installed on the computer.
  3. Win32_StartupCommand: Information about programs that run at system startup.

Performance and Monitoring

  1. Win32_PerfFormattedData_PerfOS_Memory: Provides memory usage data.
  2. Win32_PerfFormattedData_PerfDisk_PhysicalDisk: Performance data for physical disks.
  3. Win32_PerfFormattedData_PerfNet_Server: Server performance data.

Event and Log Management

  1. Win32_NTLogEvent: Information from Windows event logs.
  2. Win32_NTEventlogFile: Represents event log files.


  1. Win32_IP4RouteTable: Information about the network routing table.
  2. Win32_NetworkConnection: Represents active network connections.

System Configuration

  1. Win32_BootConfiguration: Represents the boot configuration of the operating system.
  2. Win32_Environment: Represents system and user environment variables.


  1. Win32_SecurityDescriptor: Represents security descriptors for WMI objects.
  2. Win32_NTEventLogFile: Information about the security event log files.

Task Scheduling

  1. Win32_ScheduledJob: Represents a task in the task scheduler.

Other Useful Classes

  1. Win32_ShadowCopy: Information about volume shadow copies.
  2. Win32_Printer: Represents installed printers.
  3. Win32_Battery: Details about the battery status in laptops.

This list represents just a fraction of the available WMI classes. Each class has its set of properties and methods that can be used for querying and manipulating various aspects of the Windows operating system. For a complete list and detailed descriptions, the Microsoft Documentation on WMI classes is an invaluable resource. Remember, the availability of some classes may vary based on the version and configuration of the Windows operating system.

Related posts
Active Directory Fundamentals

How to schedule a process remotely via WMI

Active Directory Fundamentals

How to create a process via WMI remotely

Active Directory Fundamentals

How to create a task via WMI

Active Directory Fundamentals

Find a user's last logon time


There are over 8,500 people who are getting towards perfection in Active Directory, IT Management & Cyber security through our insights from Identitude.

Wanna be a part of our bimonthly curation of IAM knowledge?

  • -Select-
  • By clicking 'Become an insider', you agree to processing of personal data according to the Privacy Policy.