WMI System Classes - Win32 apps
By stevewhims
Archived: 2026-04-05 22:58:44 UTC
__AbsoluteTimerInstruction Causes an event to be generated on a specific date at a specific time. __ACE
Represents an access control entry (ACE). __AggregateEvent Represents an aggregate event of several individual
intrinsic or extrinsic events. __ArbitratorConfiguration Configuration class that limits the internal resources that
are used by operations initiated by WMI clients. __CacheControl Determines when WMI should release a
Component Object Model (COM) object. __CIMOMIdentification Describes the local installation of WMI.
__ClassCreationEvent Represents a class creation event, which is a type of intrinsic event generated when a new
class is added to the namespace. __ClassDeletionEvent Represents a class deletion event, which is a type of
intrinsic event generated when a class is removed from the namespace. __ClassModificationEvent Represents a
class modification event, which is a type of intrinsic event generated when a class is changed in the namespace.
__ClassOperationEvent A base class for all intrinsic events that relate to a class. __ClassProviderRegistration
Registers class providers in WMI. __ConsumerFailureEvent Represents the occurrence of some other event that
is being dropped because of the failure of an event consumer. __Event An abstract base class that serves as the
parent class for all intrinsic and extrinsic events. __EventConsumer An abstract base class that is used in the
registration of a permanent event consumer. __EventConsumerProviderCacheControl Determines when WMI
should release an event consumer provider. __EventConsumerProviderRegistration Registers event consumer
providers with WMI. __EventDroppedEvent Represents the occurrence of an event that is dropped. A dropped
event is an event that is not delivered to an event consumer. __EventFilter Registration of a permanent event
consumer requires an instance of the __EventFilter system class. __EventGenerator Serves as a parent class for
classes that control the generation of events, such as timer events. __EventProviderCacheControl Controls when
an event provider is unloaded. __EventProviderRegistration Registers event providers with WMI.
__EventQueueOverflowEvent Reports when an event is dropped as a result of delivery queue overflow.
__EventSinkCacheControl Used to determine when WMI releases an event consumer provider's
IWbemUnboundObjectSink pointer. __ExtendedStatus Used to report detailed status and error information.
__ExtrinsicEvent Serves as a parent class for all user-defined event types, also known as extrinsic events.
__FilterToConsumerBinding Used in the registration of permanent event consumers to relate an instance of the
of __EventConsumer to an instance of __EventFilter. __IndicationRelated Serves as a parent class for all
event-related classes. __InstanceCreationEvent Reports an instance creation event, which is a type of intrinsic
event that is generated when a new instance is added to the namespace. __InstanceDeletionEvent Reports an
instance deletion event, which is a type of intrinsic event generated when an instance is deleted from the
namespace. __InstanceModificationEvent Reports an instance modification event, which is a type of intrinsic
event generated when an instance changes in the namespace. __InstanceOperationEvent Serves as a base class
for all intrinsic events that relate to an instance. __InstanceProviderRegistration Registers instance providers in
WMI. __IntervalTimerInstruction Generates events at intervals, similar to a WM_TIMER message in
Windows programming. __MethodInvocationEvent This class is not implemented.
__MethodProviderRegistration Registers method providers with WMI. __Namespace Represents a WMI
https://docs.microsoft.com/en-us/windows/win32/wmisdk/wmi-system-classes
Page 1 of 2

namespace. __NamespaceCreationEvent Reports a namespace creation event, which is a type of intrinsic event
generated when a new namespace is added to the current namespace. __NamespaceDeletionEvent Reports a
namespace deletion event, which is a type of intrinsic event that is generated when a sub-namespace is removed
from the current namespace. __NamespaceModificationEvent Reports a namespace modification event, which is
a type of intrinsic event that is generated when a namespace is modified. __NamespaceOperationEvent A base
class for all intrinsic events that relate to a namespace. __NotifyStatus Serves as the parent class for provider-defined error classes. __NTLMUser9X Controls remote access to a computer running unsupported versions of
Windows. __ObjectProviderCacheControl Controls when a class or instance provider is unloaded.
__ObjectProviderRegistration Serves as the parent for classes that are used to register class and instance
providers in WMI. __PARAMETERS Defines the input and output parameters for methods.
__PropertyProviderCacheControl Controls the cache when a property provider is unloaded.
__PropertyProviderRegistration Registers property providers in WMI. __Provider Serves as the parent class
for the __Win32Provider system class. __ProviderHostQuotaConfiguration Allows limits to be set on host
process usage of system resources. __ProviderRegistration Serves as the parent class for registration classes for
various types of providers. __SecurityDescriptor Represents a security descriptor. __SecurityRelatedClass
Serves as a parent class for all types of security classes. __SystemClass Base class from which most system
classes derive. __SystemEvent Represents a system event. __SystemSecurity Contains methods that let you
access and modify the security settings for a namespace. __thisNAMESPACE Holds the security rights for the
namespace in the form of a security descriptor. __TimerEvent Reports an event generated by WMI in response to
a consumer's request for an interval timer event or an absolute timer event. __TimerInstruction Specifies
instructions on how timer events should be generated for consumers. __TimerNextFiring Reserved for operating
system use. __Trustee Represents a trustee. Either a name or a SID (byte array) can be used. __Win32Provider
Registers information about a provider's physical implementation in WMI.
Source: https://docs.microsoft.com/en-us/windows/win32/wmisdk/wmi-system-classes
https://docs.microsoft.com/en-us/windows/win32/wmisdk/wmi-system-classes
Page 2 of 2