Objects from the system classes are used to support WMI activities, such as: event and provider registration, security, and event notification. Some objects are temporary, and some are stored in the repository as instances of the system classes.
System classes follow a naming convention that consists of a double-underscore (__) followed by the class name. When you write an MOF file to define classes for a WMI provider, Mofcomp.exe does not compile any class with an initial double-underscore (__) because that is reserved for WMI system class names.
The documentation for the system classes includes only the nonsystem local properties. Links are provided in class definitions so that you can navigate the class hierarchy quickly and easily.
The following table lists the various system classes.
| System class | Description |
|---|
| __AbsoluteTimerInstruction | Causes an event to be generated on a specific date at a specific time. |
| __ACE | Represents an access control entry (ACE). Windows Server 2003, Windows XP, Windows 2000, and Windows NT Server: This class is not available.
|
| __ADAPStatus | Obsolete. The AutoDiscovery/AutoPurge (ADAP) process is replaced by the WmiPerfClass provider.Windows Server 2003, Windows XP, and Windows 2000: The current state of the ADAP process.
|
| __AggregateEvent | Represents an aggregate event of several individual intrinsic or extrinsic events. |
| __ArbitratorConfiguration | Configuration class that limits the internal resources that are used by operations initiated by WMI clients.Windows 2000, Windows NT 4.0, and Windows Me/98/95: This class is not available.
|
| __CacheControl | Determines when WMI should release a Component Object Model (COM) object. |
| __CIMOMIdentification | Describes the local installation of WMI. |
| __ClassCreationEvent | Represents a class creation event, which is a type of
intrinsic event generated when a new class is added to the namespace. |
| __ClassDeletionEvent | Represents a class deletion event, which is a type of
intrinsic event generated when a class is removed from the namespace. |
| __ClassModificationEvent | Represents a class modification event, which is a type of
intrinsic event generated when a class is changed in the namespace. |
| __ClassOperationEvent | A base class for all intrinsic events that relate to a class. |
| __ClassProviderRegistration | Registers class providers in WMI. |
| __ConsumerFailureEvent | Represents the occurrence of some other event that is being dropped because of the failure of an event consumer. |
| __Event | An abstract base class that serves as the parent class for all intrinsic and extrinsic events. |
| __EventConsumer | An abstract base class that is used in the registration of a permanent event consumer. |
| __EventConsumerProviderCacheControl | Determines when WMI should release an event consumer provider. |
| __EventConsumerProviderRegistration | Registers event consumer providers with WMI. |
| __EventDroppedEvent | Represents the occurrence of an event that is dropped. A dropped event is an event that is not delivered to an event consumer. |
| __EventFilter | Registration of a permanent event consumer requires an instance of the __EventFilter system class. |
| __EventGenerator | Serves as a parent class for classes that control the generation of events, such as
timer events. |
| __EventProviderCacheControl | Controls when an event provider is unloaded. |
| __EventProviderRegistration | Registers event providers with WMI. |
| __EventQueueOverflowEvent | Reports when an event is dropped as a result of delivery queue overflow. |
| __EventSinkCacheControl | Used to determine when WMI releases an event consumer provider's
IWbemUnboundObjectSink pointer. |
| __ExtendedStatus | Used to report detailed status and error information. |
| __ExtrinsicEvent | Serves as a parent class for all user-defined event types, also known as
extrinsic events. |
| __FilterToConsumerBinding | Used in the registration of permanent event consumers to relate an instance of the of __EventConsumer to an instance of __EventFilter.
|
| __IndicationRelated | Serves as a parent class for all event-related classes. |
| __InstanceCreationEvent | Reports an instance creation event, which is a type of
intrinsic event that is generated when a new instance is added to the namespace. |
| __InstanceDeletionEvent | Reports an instance deletion event, which is a type of
intrinsic event generated when an instance is deleted from the namespace. |
| __InstanceModificationEvent | Reports an instance modification event, which is a type of
intrinsic event generated when an instance changes in the namespace. |
| __InstanceOperationEvent | Serves as a base class for all intrinsic events that relate to an instance. |
| __InstanceProviderRegistration | Registers instance providers in WMI. |
| __IntervalTimerInstruction | Generates events at intervals, similar to a WM_TIMER message in Windows programming. |
| __MethodInvocationEvent | This class is not implemented. |
| __MethodProviderRegistration | Registers method providers with WMI. |
| __Namespace | Represents a WMI namespace. |
| __NamespaceCreationEvent | Reports a namespace creation event, which is a type of
intrinsic event generated when a new namespace is added to the current namespace. |
| __NamespaceDeletionEvent | Reports a namespace deletion event, which is a type of
intrinsic event that is generated when a sub-namespace is removed from the current namespace. |
| __NamespaceModificationEvent | Reports a namespace modification event, which is a type of
intrinsic event that is generated when a namespace is modified. |
| __NamespaceOperationEvent | A base class for all intrinsic events that relate to a namespace. |
| __NotifyStatus | Serves as the parent class for provider-defined error classes. |
| __NTLMUser9X | Controls remote access to a Windows Me, Windows 98, or Windows 95 computer. |
| __ObjectProviderCacheControl | Controls when a class or instance provider is unloaded. |
| __ObjectProviderRegistration | Serves as the parent for classes that are used to register class and instance providers in WMI. |
| __PARAMETERS | Defines the input and output parameters for methods. |
| __PropertyProviderCacheControl | Controls the cache when a property provider is unloaded. |
| __PropertyProviderRegistration | Registers property providers in WMI. |
| __Provider | Serves as the parent class for the
__Win32Provider system class. |
| __ProviderHostQuotaConfiguration | Allows limits to be set on host process usage of system resources.Windows XP, Windows 2000, Windows NT 4.0, and Windows Me/98/95: This class is not available.
|
| __ProviderRegistration | Serves as the parent class for registration classes for various types of providers. |
| __SecurityDescriptor | Represents a security descriptor.Windows Server 2003, Windows XP, Windows 2000, Windows NT 4.0, and Windows Me/98/95: This class is not available.
|
| __SecurityRelatedClass | Serves as a parent class for all types of security classes. |
| __SystemClass | Base class from which most system classes derive. |
| __SystemEvent | Represents a system event. |
| __SystemSecurity | Contains methods that let you access and modify the security settings for a namespace. |
| __thisNAMESPACE | Holds the security rights for the namespace in the form of a security descriptor.Windows XP, Windows 2000, Windows NT 4.0, and Windows Me/98/95: This class is not available.
|
| __TimerEvent | Reports an event generated by WMI in response to a consumer's request for an interval timer event or an absolute timer event. |
| __TimerInstruction | Specifies instructions on how
timer events should be generated for consumers. |
| __TimerNextFiring | Reserved for operating system use. |
| __Trustee | Represents a trustee. Either a name or a SID (byte array) can be used.Windows Server 2003, Windows XP, Windows 2000, Windows NT 4.0, and Windows Me/98/95: This class is not available.
|
| __Win32Provider | Registers information about a provider's physical implementation in WMI. |