WMI is installed as a series of providers. The information on creating the classes comes from MOF files. I was recently asked about a problem with a specific class & could it be restored – in this case it was easier to rebuild WMI as the provider created a large part of the root\cimv2 namespace (namespaces can require multiple namespaces to complete their creation).
That got me thinking about how you discover the mof file associated with a class. Which leads to
$ns = "root\cimv2" $class = "Win32_Logicaldisk" $p = Get-WmiObject -Namespace $ns -Class $class | select -f 1 | select -ExpandProperty qualifiers | where {$_.Name -eq 'provider'} $class $p Get-ChildItem -Path C:\Windows\System32\wbem -Filter "*$($p.Value)*"
Get the first instance of a class, expand the qualifiers and select the qualifier with a name of provider.
Then perform a dir on the wbem folder to find the appropriate files. This isn’t infallible due to files names not necessarily being consistent but its a good starting point for the standard classes