MSFT_WmiProvider_OperationEvent class

The MSFT_WmiProvider_OperationEvent base class is the root definition of all WMI provider events. A provider operation is defined as some execution on behalf of a client using WMI that results in one or more calls to a provider executable file. The properties of this class define the identity of the provider associated with the operation being executed and is uniquely associated with instances of the class MSFT_Providers. Each instance of __Win32Provider can have an associated operation and be identified using the properties below.

Internally, WMI can contain any number of objects that refer to a particular instance of __Win32Provider because it differentiates each object based on whether the provider supports per user or per locale instantiation and also depending on where the provider is being hosted. Currently, the TransactionIdentifier property is always an empty string.

The following syntax is simplified from Managed Object Format (MOF) code and includes all inherited properties. Properties are listed in alphabetic order, not MOF order.


class MSFT_WmiProvider_OperationEvent : MSFT_WmiSelfEvent
  uint64 TIME_CREATED;
  string HostingGroup;
  uint32 HostingSpecification;
  string Locale;
  string Namespace;
  string Provider;
  string TransactionIdentifier;
  string User;
  String TransactionIdentifer;


The MSFT_WmiProvider_OperationEvent class has these types of members:


The MSFT_WmiProvider_OperationEvent class has these properties.

Data type: string
Access type: Read-only

Second component of the __Win32Provider HostingModel property when the hosting model is one of "LocalSystemHost", "LocalSystemHostOrSelfHost", "NetworkServiceHost", or "LocalServiceHost". The hosting group defines a particular instantiation of a WMI provider host. Providers that share the same hosting model and hosting group share the same surrogate process.

Data type: uint32
Access type: Read-only

The first component of the __Win32Provider HostingModel property. For the possible values of this property, see the HostingSpecification property in the MSFT_Providers class.

Data type: string
Access type: Read-only

Particular instantiation of a provider instance when the provider is configured for per local initialization.

Data type: string
Access type: Read-only

Namespace associated with a particular provider instance.

Data type: string
Access type: Read-only

Name associated with a particular provider instance. The name is identical to the __Win32Provider property.

Data type: uint8 array
Access type: Read-only

Descriptor that the event provider uses to determine which users can receive the event. For more information, see WMI Security Constants.

This property is inherited from __Event.

Data type: uint64
Access type: Read-only

Unique value that indicates the time the event is generated. This is a 64-bit value that represents the number of 100-nanosecond intervals after January 1, 1601. The information is in the Coordinated Universal Time (UTC) format.

For more information about using uint64 values in scripts, see Scripting in WMI.

This property is inherited from __Event.

Data type: String
Access type: Read-only

The TransactionIdentifer property is for internal use, currently always empty.

Data type: string
Access type: Read-only

Internal use only. The current value is "{00000000-0000-0000-0000-000000000000}".

Data type: string
Access type: Read-only

Particular provider instance, configured for per user initialization.


Minimum supported client

Windows Vista

Minimum supported server

Windows Server 2008







See also

Provider Event Troubleshooting Classes
WMI Troubleshooting
WMI Troubleshooting
Receiving a WMI Event