Monthly Archive


WMI provider and MOF file

WMI is installed as a series of providers. The information on creating the classes comes from MOF files. I was recently asked about a problem with a specific class & could it be restored – in this case it was easier to rebuild WMI as the provider created a large part of the root\cimv2 namespace (namespaces can require multiple namespaces to complete their creation).

That got me thinking about how you discover the mof file associated with a class. Which leads to

$ns = "root\cimv2"            
$class = "Win32_Logicaldisk"            
$p = Get-WmiObject -Namespace $ns -Class $class |             
select -f 1 |             
select -ExpandProperty qualifiers |             
where {$_.Name -eq 'provider'}            
Get-ChildItem -Path C:\Windows\System32\wbem -Filter "*$($p.Value)*"

Get the first instance of a class, expand the qualifiers and select the qualifier with a name of provider.

Then perform a dir on the wbem folder to find the appropriate files. This isn’t infallible due to files names not necessarily being consistent but its a good starting point for the standard classes

Leave a Reply