- 13 Nov 2023
- 1 Minute to read
- Print
- DarkLight
- PDF
WMI Class Reference
- Updated on 13 Nov 2023
- 1 Minute to read
- Print
- DarkLight
- PDF
This is the list of WMI classes Netreo uses to poll Windows devices for performance data.
Where not specified, the namespace is always root/cimv2.
See also Windows PowerShell Commands for antivirus welcome list.
Device Types
Windows Server (Device Type)
Used for polling statistics. See also Windows Server - Standard (Device Type) and Windows Server - Detailed (Device Type)
• Win32_OperatingSystem
• Win32_LogicalDisk
• Win32_PerfFormattedData_PerfOS_System
• Win32_PerfRawData_PerfDisk_PhysicalDisk
• Win32_PerfRawData_PerfDisk_LogicalDisk
• Win32_PerfRawData_PerfOS_Memory
• Win32_PerfRawData_PerfOS_Processor
• Win32_PerfRawData_PerfProc_Process
• Win32_PerfRawData_PerfProc_Thread
• Win32_PerfRawData_Tcpip_NetworkInterface
Device Subtypes
Active Directory (Subtype)
See also Active Directory (Device Subtype)
• Win32_PerfRawData_DirectoryServices_DirectoryServices
Statistics collected using this class
• AB Client Sessions
• DS Notify Queue Size
• LDAP Active Threads
• LDAP Bind Time
• LDAP Client Sessions
• DS Client Binds
• DS Server Binds
• Directory Reads
• Directory Writes
• Kerberos Authentications
• LDAP Searches
• LDAP UDP Operations
• LDAP Writes
• Replication (Total) Objects In - DRA Inbound Objects Persec
• Replication (Total) Objects Out - DRA Outbound Objects Persec
• Replication Traffic In - DRA Inbound Bytes Total Persec
• Replication Traffic Out - DRA Outbound Bytes Total Persec
• Win32_PerfRawData_DNS_DNS
Statistics collected using this class
• Caching Memory
• Database Node Memory
• Secure Updates Received Persec
• TCP Message Memory
• TCP Query Received Persec
• TCP Response Sent Persec
• Total Query Received Persec
• Total Response Sent Persec
• UDP Message Memory
• UDP Query Received Persec
• UDP Response Sent Persec
• Nbstat Memory
• Record Flow Memory
• Dynamic Update No Operation Persec
• Dynamic Update Received Persec
• Dynamic Update Written to Database Persec
• Recursive Queries Persec
• Recursive Query Failure Persec
• Recursive Time Out Persec
DHCP Server (Subtype)
See also DHCP Server (Device Subtype)
• Win32_PerfRawData_DHCPServer_DHCPServer
Statistics collected using this class
• DiscoversPersec
• OffersPersec
• RequestsPersec
• InformsPersec
• AcksPersec
• NacksPersec
• ReleasesPersec
Exchange 2010 Server (Subtype)
See also Exchange 2010 Server (Device Subtype)
• Win32_PerfRawData_MSExchangeIS_MSExchangeIS
• Win32_PerfRawData_MSExchangeIS_MSExchangeISMailbox
• Win32_PerfRawData_MSExchangeIS_MSExchangeISPublic
• Win32_PerfRawData_MSExchangeTransportQueues_MSExchangeTransportQueues
•Win32_PerfRawData_MSExchangeTransportSMTPSend_MSExchangeTransportSMTPSend
•Win32_PerfRawData_MSExchangeTransportSMTPReceive_MSExchangeTransportSMTPReceive
• Win32_PerfRawData_MSExchangeActiveSync_MSExchangeActiveSync
• Win32_PerfRawData_MSExchangeRpcClientAccess_MSExchangeRpcClientAccess
• Win32_PerfRawData_W3SVC_WebService
• Win32_Process
• Win32_PerfRawData_ESE_MSExchangeDatabase
• Win32_PerfRawData_MSExchangeOWA_MSExchangeOWA
Microsoft IIS Server (Subtype)
See also Microsoft IIS Server (Device Subtype)
• Win32_PerfRawData_PerfOS_Memory
• Win32_PerfRawData_ASPNET_ASPNET
• Win32_PerfRawData_W3SVC_WebService
Microsoft SQL Server Module (Subtype)
See also Microsoft SQL Server Module (Device Subtype)
The following classes are all in root/cimv2
• Win32_PerfRawData_MSSQLSERVER_SQLServerAccessMethods
• Win32_PerfRawData_MSSQLSERVER_SQLServerBufferNode
• Win32_PerfRawData_MSSQLSERVER_SQLServerBufferManager
• Win32_PerfRawData_MSSQLSERVER_SQLServerMemoryManager
• Win32_PerfRawData_MSSQLSERVER_SQLServerLocks
• Win32_PerfRawData_MSSQLSERVER_SQLServerDatabases
• Win32_PerfRawData_MSSQLSERVER_SQLServerSQLStatistics
• Win32_PerfRawData_MSSQLSERVER_SQLServerGeneralStatistics
• Win32_PerfRawData_MSSQLSERVER_SQLServerDatabaseMirroring
• Win32_PerfRawData_MSSQLSERVER_SQLServerDatabaseReplica
• Win32_PerfRawData_MSSQLSERVER_SQLServerAvailabilityReplica
• Win32_PerfRawData_SQLServerAgent_SQLAgentJobs
SQL Server 2005:
root/Microsoft/SqlServer/ComputerManagement
SQL Server 2008/2008 R2:
root/Microsoft/SqlServer/ComputerManagement10
SQL Server 2012:
root/Microsoft/SqlServer/ComputerManagement11
SQL Server 2014:
root/Microsoft/SqlServer/ComputerManagement12
Windows Mounted Volume (Subtype)
See also Windows Mounted Volume (Device Subtype)
• Win32_Volume
Service Checks
Used with service checks to monitor Windows services. See also Check Windows Service Status (Service Check) and Check Stopped Windows Service Status (Service Check)
• Win32_Process
• Win32_Service
• Win32_Directory
• Win32_UTCTime
• Win32_OperatingSystem