Embed Management Information and Events

Windows exposes a great deal of system information through WMI (Windows Management Instrumentation). The 70-536 exam measures your capabilities to query WMI, subscribe to events, etc. Not the names of different WMI types (although I have seen test questions about those, but they could be figured out by pure logic).

To access WMI, you’ll need to set a reference on the System.Management namespace, and include a using directive for it. Then the following steps:

  1. Define the management scope.
    1. Create a ManagementScope object, and use the following path: \localhostrootcimv2. Don’t ask why, just use it. Then call the connect method of the ManagementScope instance.
    2. Create a query. Use the ObjectQuery class ‘s constructor to define a SQL-like query.
    3. Create a ManagementObjectSearcher instance, and pass the scope and query instances to the constructor.
    4. Create a ManagementObjectCollection class and assign it to the ManagementObjectSearcher’s Get method.
    5. Iterate over the ManagementObjectCollection by retrieving its properties.

An example:

ManagementScope scope = new ManagementScope(@”\localhostrootcimv2”);
ObjectQuery query = new ObjectQuery(“SELECT * FROM Win32_LogicalDisk”);
ManagementObjectSearcher mso = new ManagementObjectSearcher(scope, query);
ManagementObjectCollection coll = mso.Get();
foreach(ManagementObject obj in coll)

I hope you get it. You can subscribe to WMI events two ways, asynchronously and synchronously. Both approaches use the same classes, let’s see them:

  1. Create an instance of WqlEventQuery by passing the event class name, a timespan and a condition.
  2. Initialize a new ManagementEventWatcher and pass the query to it.
  3. Create a ManagementBaseObject and call the ManagementEventWatcher’s WaitForNextEvent method.
  4. Wait until the event triggers, then examine the properties of ManagementBaseObject.

When you are working with asynchronous methods, simply register a method (object sender, EventArrivedEventArgs e) to the EventArrived event of the ManagemnetEventWatcher, and call its Start method. Something like this:

ManagementEventWatcehr mwe = new ManagementEventWatcher(myWqlQuery);
mwe.EventArrived += new EventArrivedEventHandler(mwe_EventArrived);

EventArrivedEventArgs define a ManagementBaseObject through the NewEvent property.

Further Readings

Windows Management Information
ManagementObjectSearcher Class

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s