WMI Windows Management Instrumentation

A WMI monitor in DomainScan supports WQL queries.

A WQL query uses SQL syntax, and a typical query could be:

Select * from win32_operatingsystem

(This query must target the cimv2 namespace)

A monitor in DomainScan compares the returned information with a comparison value, and if the comparison fails, then an event will be created.

DomainScan will pick the first item in the returned dataset, which means that the column
BootDevice is the value that DomainScan will most likely compare with. To pick a specific value – for instance the buildnumber, then modify the above example to:

Select BuildNumber from win32_operatingsystem

In this case, DomainScan will compare with the value in BuildNumber and create an event if the comparison fails.

In Examples, examples can be found, which might help creating a desired monitor, and in External resources some helpful links to external sites with WMI documentation and examples are listed.

External resources

The following external links provide help and examples to how WMI works and how it is queried.

WMI background & overview - Microsoft© website

Microsoft© WMI - Windows Management Instrumentation

Windows Instrumentation Examples - Network traffic, CPU utilization etc.

Event log - Get data from event log

Computer Performance - A memory monitor example

2003 - 2012 GHIT ApS (Formerly GH Software). Contact