A modern Windows desktop application for exploring and managing Windows Management Instrumentation (WMI) namespaces, classes, instances, properties, and methods. Built with WPF and .NET 8.0.

Note: This project replaces wmie2. Please use this repository for the latest version.

• Namespace Browser: Navigate through WMI namespaces in a tree view - see Connecting to a WMI Namespace and Exploring Namespaces and Classes
• Class Explorer: Browse WMI classes with their properties, methods, and qualifiers - see Exploring Namespaces and Classes
• Instance Viewer: View and filter WMI instances with detailed property information - see Exploring Instances
• Instance Management: Create, edit, and delete WMI instances with a dedicated property editor dialog - see Managing WMI Instances
• Method Execution: Execute WMI methods (both static and instance methods) with parameter input and output display - see Executing WMI Methods
• WQL Query Editor: Execute WQL queries (SELECT, ASSOCIATORS OF, REFERENCES OF) with syntax highlighting and result display - see Executing WQL Queries
• Event Watcher: Monitor WMI events in real-time - see Monitoring WMI Events
• Search: Search for classes, properties, and methods across namespaces - see Searching WMI
• Script Generator: Generate PowerShell scripts for WMI operations (classes, instances, methods) - see Generating PowerShell Scripts
• Property Grid: Detailed property editor with support for WMI-specific types - see Property Grid
• Logging: Built-in logging with configurable log levels - see Viewing Logs
• Theme Support: Dark and Light themes with customizable accent colors - see Menu Options
• Auto-updates: Check for updates from GitHub releases - see Menu Options
• Configuration Manager (ConfigMgr) Support: Specialized support for Microsoft Configuration Manager namespaces and client actions - see Configuration Manager Support

• Windows 10/11 or Windows Server 2016+
• .NET 8.0 Runtime (if running published binaries)
• Administrator privileges (recommended for full WMI access)

Download the latest release from GitHub. Extract and run WmiExplorer.exe.

💡 NOTE: If prompted, download and install the required .NET runtime, and then launch WmiExplorer.exe again.

WMI Explorer supports command-line arguments for automation and debugging. See Command-Line Options for complete documentation.

Quick Reference:

• -debug - Enable debug logging to console
• -computername <name> - Auto-connect to specified computer
• -username <name> - Specify username for auto-connection

Example:

WmiExplorer.exe -computername SERVER01 -username DOMAIN\User

1. In the Options panel at the top, enter in the Computer Name field:

   • Computer Name: Local computer (., localhost) or remote computer name/IP
   • Namespace Path: You can also enter a namespace path directly:
     • Full path: \\computer\root\cimv2 (for remote computer)
     • Namespace only: root\cimv2 (assumes local computer)

2. Click Connect to establish the connection using your current Windows credentials

   • For advanced connection options (username, password, authentication, impersonation), click the dropdown arrow next to the Connect button and select Connection Options

3. Once connected, the namespace tree will populate in the left panel. Browse the tree to select the specific namespace you want to explore (e.g., root\cimv2)

For automatic connection via command-line, see Command-Line Options or detailed documentation.

Understanding how to navigate and explore WMI objects is essential for efficient use.

Single Click Actions:

• Namespaces (left tree view): Expands the namespace to show child namespaces and selects it
• Classes (Classes tab): Loads properties and methods for the class and displays them in the Properties and Methods sub-tabs
• Instances (Instances tab): Selects the instance and shows its properties in the Property Grid
• Search Results (Search tab): Selects the result and shows its details in the Property Grid

Double Click Actions:

• Namespaces (left tree view): Loads and displays classes for that namespace in the Classes tab
• Classes (Classes tab): Loads and displays instances for that class in the Instances tab
• Search Results (Search tab): Navigates to the class containing the search result

Caching Behavior:

💡 Use single-click to quickly navigate and view cached data. Use double-click when you need to explicitly refresh data from WMI.

• Once classes are loaded for a namespace, they are cached in memory. Single-clicking the namespace will display the cached classes (indicated by a green status indicator).
• Once instances are loaded for a class, they are cached in memory. Single-clicking the class will display the cached instances (indicated by a green status indicator).
• Double-clicking always reloads data from WMI, refreshing the cache with the latest information.

For more information about caching, see Settings and Caching.

The circular status indicator in the status bar uses the following colors to represent application state:

• Green: Ready or Success state
• Blue: Busy state (operation in progress, with pulsing animation)
• Orange: Warning state
• Tan/Beige: Partial Success state.
  • For Namespaces, indicates that Namespace metadata is loaded, but Classes are not.
  • For Classes, indicates that Class metadata is loaded, but Instances are not.
• Red: Error state
• Gray: Unknown state

1. Expand a Namespace: Single click on a namespace in the left tree view to expand it and see child namespaces
2. Load Classes: Double click on a namespace to load and display all classes in the Classes tab
3. View Class Details: Single click on a class to load and view:
   • Properties: Class properties with types, qualifiers, and values (shown in Properties sub-tab)
   • Methods: Available methods with parameters and return types (shown in Methods sub-tab)
4. Load Instances: Double click on a class to load all instances of that class

Long-running operations can be cancelled to stop enumeration and view partial results:

• Cancelling Instance Loading: While instances are loading for a class, right-click on the class in the Classes tab and select Cancel loading from the context menu. Partial results (instances loaded so far) will be displayed.
• Cancelling Query Execution: While a query is executing in the Query tab, click the Cancel button to stop the query. Partial results will be shown.
• Cancelling Search: While a search is running in the Search tab, click the Cancel button to stop the search. Partial results will be displayed.

Note: When an operation is cancelled, any data that was successfully loaded before cancellation will be displayed. This allows you to view partial results even if the full operation was interrupted.

1. After double-clicking a class, navigate to the Instances tab (sub-tab under Classes)
2. View all instances of the selected class
3. Use the filter/search box to find specific instances
4. Click on an instance to view its properties in the Property Grid (right panel)

The Property Grid (right panel) displays detailed information about selected items. The Property Grid is read-only - it shows property values but does not allow direct editing.

What It Displays:

The Property Grid shows different information depending on what is selected:

• WMI Classes: Shows class qualifiers, properties, and methods
• WMI Instances: Shows all properties with their current values
• WMI Properties: Shows property qualifiers, type, and value
• WMI Methods: Shows method parameters and return types
• Event Watchers: Shows watcher configuration and status

Supported Data Types:

The Property Grid supports displaying:

• Standard data types (string, int, bool, etc.)
• Arrays and collections
• WMI-specific types (CIM types, datetime, etc.)
• Custom property editors for complex types

The Property Grid uses specialized editors for WMI-specific types to provide a better user experience when viewing complex data structures.

Create, edit, and delete WMI instances directly from the application:

1. Load instances of a class (double-click the class to load instances)
2. Navigate to the Instances sub-tab
3. Right-click on an instance
4. Select Edit Properties... from the context menu
   • This option is always available for instances
5. In the Property Editor Dialog:
   • View and edit properties of the instance
   • Properties are displayed with their types, descriptions, and current values
   • Required properties are marked and must be filled in
   • Read-only properties are hidden by default in writable mode
   • Edit Read-Only Properties: Enable this toggle (shown in red when enabled) to show and attempt editing read-only properties
     • Warning: WMI providers may or may not support editing read-only properties - behavior depends on provider implementation
     • Key properties remain read-only regardless of this setting
     • When enabled, read-only properties become visible and editable (subject to provider support)
     • When disabled, read-only properties are hidden
6. Click OK to save your changes
7. The instance will be updated in WMI and refreshed in the application

Read-Only Property Determination:

Important Note: WMI does not provide a single, reliable read-only indicator. The WMI specification lacks a definitive "read-only" qualifier, and many properties don't explicitly set the Write qualifier. This makes determining writeability challenging and often requires interpretation of multiple qualifiers and provider behavior.

The application determines if a property is read-only using a multi-step evaluation process based on WMI qualifiers following the WMI standard qualifiers specification. The logic uses the following precedence:

• Key properties are always read-only (cannot be changed) - highest priority
• Write qualifier: If present, Write=true means writeable, Write=false means read-only. However, many properties don't have this qualifier explicitly set.
• WriteAtUpdate qualifier: If WriteAtUpdate=true, the property is writeable during instance updates
• Dynamic/Provider heuristic (configurable): If TreatDynamicProviderAsWritable setting is enabled, properties in classes with both Dynamic and Provider qualifiers are treated as writable. By default, this setting is disabled (per WMI specification, class-level qualifiers don't determine property writeability). This heuristic exists because some providers may allow writing to dynamic properties even without explicit qualifiers.
• Read qualifier (configurable, checked last): If TreatReadQualifierAsReadOnly setting is enabled, properties with read=true are considered read-only. By default, this setting is disabled. The read qualifier indicates readability, not writeability, so it's checked last.
• Default: If no write-related qualifiers are present, properties default to read-only (per WMI spec where Write defaults to FALSE)

Why Configurable Settings? Because WMI lacks a reliable read-only indicator, different providers may behave differently. The configurable settings allow you to adjust the behavior based on your specific use case or provider requirements. The default behavior follows the WMI specification strictly, but you can enable additional heuristics if needed for compatibility with specific providers.

Note: The Property Grid itself is read-only and does not allow direct editing. All editing must be done through the dedicated Edit Properties dialog. The Property Grid automatically updates to reflect changes after you save them.

1. Load a class (double-click a namespace to load classes)
2. Navigate to the Classes tab
3. Right-click on a class
4. Select Create instance from the context menu
5. In the Property Editor Dialog:
   • A new template instance is created with default values
   • Fill in the required properties (marked as required)
   • Optionally set optional writable properties
   • Read-only properties are displayed but cannot be modified
6. Click OK to create the instance
7. The new instance will be saved to WMI and added to the instances list

Note: Not all WMI classes support instance creation. Some classes are abstract or read-only, and creating instances may not be supported by the WMI provider.

1. Load instances of a class (double-click the class to load instances)
2. Navigate to the Instances sub-tab
3. Right-click on an instance
4. Select Delete Instance... from the context menu
5. Confirm the deletion in the confirmation dialog
6. The instance will be permanently deleted from WMI and removed from the instances list

Warning: Deleting instances is permanent and cannot be undone. Make sure you want to delete the instance before confirming.

Availability:

• Editing: The Edit Properties... menu option is always available for instances. Use the "Allow Editing Read-Only Properties" toggle in the Property Editor Dialog to attempt editing read-only properties (with the understanding that WMI providers may or may not support this)
• Creating: The Create instance option is always available in the context menu. If the class doesn't support instance creation, an error message will be displayed when attempting to create the instance
• Deleting: The Delete Instance... option is always available. If the instance cannot be deleted (e.g., protected by the WMI provider), an error message will be displayed when attempting to delete

1. Navigate to the Query tab
2. Enter a WQL query in the editor (syntax highlighting is provided)
3. Select query options:
   • Direct Read: Bypass class provider
   • Use Amended Qualifiers: Include amended qualifiers in results
4. Click Execute or press F5 to run the query
5. While the query is executing, you can click Cancel to stop the query and view partial results
6. Results appear in a grid below the query editor
7. Click on a result to view details in the Property Grid

Example Queries:

SELECT Queries:

More info: WQL (SQL for WMI)

-- Get all processes
SELECT * FROM Win32_Process

-- Get processes using more than 100MB memory
SELECT Name, ProcessId, WorkingSetSize FROM Win32_Process WHERE WorkingSetSize > 104857600

-- Get all services
SELECT * FROM Win32_Service

Association Queries (ASSOCIATORS OF):

More info: ASSOCIATORS OF Statement

-- Find all logical disks associated with the computer system
-- Note: Replace "COMPUTERNAME" with your actual computer name
ASSOCIATORS OF {Win32_ComputerSystem.Name="COMPUTERNAME"} WHERE ResultClass=Win32_LogicalDisk

-- Find all network adapters associated with the computer system
ASSOCIATORS OF {Win32_ComputerSystem.Name="COMPUTERNAME"} WHERE ResultClass=Win32_NetworkAdapter

-- Find all services associated with a specific process
ASSOCIATORS OF {Win32_Process.ProcessId=1234} WHERE ResultClass=Win32_Service

Reference Queries (REFERENCES OF):

More info: REFERENCES OF Statement

-- Find what references a specific service (e.g., association classes)
REFERENCES OF {Win32_Service.Name="WinRM"} WHERE ResultClass=Win32_SystemServices

1. Navigate to the Watcher tab
2. Select a WMI event class (e.g., __InstanceCreationEvent, __InstanceDeletionEvent)
3. Select a target class to monitor (e.g., Win32_Process)
4. Optionally, select Target Class Property and specify the value to monitor for the property. For example, Target Class Property = Caption, and Target Class Property Value = wbemtest.exe will monitor for process creation events for wbemtest.exe only.
5. Click Add Watcher to start monitoring
6. Events will appear in real-time as they occur
7. Use Start/Stop buttons to control individual watchers
8. Click Remove to stop and remove a watcher

Common Event Queries:

• Monitor process creation: __InstanceCreationEvent with target Win32_Process
• Monitor service state changes: __InstanceModificationEvent with target Win32_Service
• Monitor file system changes: __InstanceCreationEvent with target Win32_LogicalDisk

1. Navigate to the Search tab.

   Note that the search scope is limited to the selected namespace. To search entire WMI, select the root namespace, but note that searching root namespace recursively would take a long time.

2. Select what to search for using the radio buttons:
   • Classes: Search for WMI class names
   • Methods: Search for method names
   • Properties: Search for property names
3. Enter a search term in the search box
4. Configure search options:
   • Recursive: Search all child namespaces recursively (can take a long time)
   • Exclude LDAP: Exclude the root\directory\LDAP namespace from recursive searches (only shown when applicable)
5. Click Search or press Enter to find matching items
6. While the search is running, you can click Cancel to stop the search and view partial results
7. Results show the namespace, class, and matching item with descriptions
8. Click on a result to view details in the Property Grid
9. Right-click a result and select Go to Class to navigate to that class.

1. Navigate to the Log tab
2. View application logs with different severity levels:
   • Debug: Detailed diagnostic information
   • Information: General application events
   • Warning: Warning messages
   • Error: Error messages and exceptions
3. Use filters to show only specific log levels
4. Logs are also saved to a file in the application directory

For more information about log files and storage, see Settings and Caching.

File Menu:

• Run as Administrator: Restart the application with elevated privileges
• Exit: Close the application (Ctrl+Q)

Options Menu:

• Check for Updates on Startup: Enable/disable automatic update checks
• Reset Theme: Reset theme colors to defaults (preserves accent colors)

Start Menu:

• Wbemtest.exe: Launch Windows WMI Tester
• WmiMgmt.msc: Launch Windows WMI Management Console
• DCOMCnfg.exe: Launch Windows Component Services

Help Menu:

• About WmiExplorer: Show application information
• Check for Updates: Manually check for updates

Theme Toggle:

• Click the theme name in the menu bar to toggle between Dark and Light themes

Execute WMI methods (both static class methods and instance methods) directly from the application:

1. For Static Methods (class-level methods):

   • Navigate to the Methods sub-tab under the Classes tab
   • Right-click on a static method (indicated by a "C" icon)
   • Select Execute Method... from the context menu
   • Alternatively, right-click on the class in the Classes tab and select Execute Static Methods...

2. For Instance Methods (instance-level methods):

   • Load instances of a class (double-click the class)
   • Navigate to the Instances sub-tab
   • Right-click on an instance
   • Select Execute Methods... from the context menu
   • Choose the method you want to execute

3. In the Method Execution Dialog:

   • Review the method information displayed in the header (method name, class name, instance name if applicable)
   • Review the method description if available
   • Input Parameters Tab:
     • Each parameter is displayed with a checkbox to include or exclude it from the execution
     • Parameters show their type, description, and default values
     • Check the box next to parameters you want to include in the method call
     • Enter values for each selected parameter based on the parameter type:
       • Simple types (string, int, bool, etc.): Enter values directly in the text box
       • Complex types (objects, arrays): Use the specialized editors provided
       • Reference types: Use the reference value editor to select or create referenced objects
     • Unchecked parameters will not be included in the method call (will use default/null values)
   • Click Execute to run the method
   • During Execution:
     • The Cancel button becomes available to stop the execution if needed
     • Status messages show the execution progress
   • Output Parameters Tab: After execution completes, switch to the Output tab to view:
     • Return value (if the method returns a value)
     • Output parameters and their values
     • Execution status and any error messages
   • Generate Script: Click the Generate Script button to create a PowerShell script for this method. The script generator will pre-populate with the parameter values you've entered in the dialog, allowing you to test method parameters first, then generate a script with those exact values.

   Tip: You can test different parameter combinations by unchecking parameters you don't need and adjusting values. Only checked parameters with values will be included in the method execution.

Method Types:

• Static Methods (Class methods): Execute on the class itself, not requiring a specific instance
• Instance Methods: Execute on a specific instance of a class

Example Use Cases:

• Start or stop Windows services using Win32_Service methods
• Create or delete WMI instances
• Trigger scheduled tasks or operations
• Invoke management operations on system resources

Generate PowerShell scripts for WMI operations directly from the application:

1. Access the Script Generator:

   • Right-click on any WMI item (class, instance, or method) in the application and select Generate Script... from the context menu
   • From Method Execution Dialog: Click the Generate Script button in the Method Execution Dialog
     • When launched from the Method Execution Dialog, the script generator will pre-populate with the parameter values you've already entered
     • Only parameters that you've selected and filled in the dialog will be included in the generated script
     • This allows you to test method parameters first, then generate a script with those exact values

2. Configure script options:

   • PowerShell Module: Choose between Legacy WMI module or CimCmdlets
   • PowerShell Version: Select PowerShell 5.1 or PowerShell 7+ syntax
   • Connection Options: Include computer name and credentials in the script
   • Script Options: Include comments, error handling, and full namespace paths

3. The generated script will appear in the dialog

4. You can:

   • Edit the script (if enabled)
   • Copy the script to clipboard
   • Save the script to a file
   • Execute the script directly and view output

What Gets Generated:

• For Classes: PowerShell script to query all instances of the class
• For Instances: PowerShell script to retrieve the specific instance
• For Methods: PowerShell script to execute the method with parameters

Example Use Cases:

• Generate scripts for automation and deployment
• Create reusable PowerShell scripts for common WMI operations
• Test WMI operations before implementing in larger scripts
• Document WMI operations for team members

Additional documentation is available in the docs/ folder:

• Command-Line Options - Detailed command-line argument reference
• Settings and Caching - Application settings, data storage, and caching strategy
• Configuration Manager Support - ConfigMgr/SCCM namespace support and client actions
• Troubleshooting - Common issues and solutions
• Building from Source - Instructions for building the application from source

The application is divided into several panels:

1. Left Panel: Namespace tree view
2. Center Panel: Main content area with tabs:
   • Classes (with sub-tabs: Instances, Properties, Methods)
   • Search
   • Query
   • Watcher
   • Log
3. Right Panel: Property Grid for detailed item information

All panels can be resized using the splitters between them. The layout is saved and restored on application restart.

See LICENSE file for details.

Contributions are welcome! Please feel free to submit a Pull Request.

For issues, questions, or feature requests, please open an issue on GitHub.

Do keep in mind that this is a hobby project, and I may not always respond immediately.