MSFT_WmiProvider_OperationEvent class
The MSFT_WmiProvider_OperationEvent base class is the root definition of all WMI provider events. A provider operation is defined as some execution on behalf of a client using WMI that results in one or more calls to a provider executable file. The properties of this class define the identity of the provider associated with the operation being executed and is uniquely associated with instances of the class MSFT_Providers. Each instance of __Win32Provider can have an associated operation and be identified using the properties below.
Internally, WMI can contain any number of objects that refer to a particular instance of __Win32Provider because it differentiates each object based on whether the provider supports per user or per locale instantiation and also depending on where the provider is being hosted. Currently, the TransactionIdentifier property is always an empty string.
The following syntax is simplified from Managed Object Format (MOF) code and includes all inherited properties. Properties are listed in alphabetic order, not MOF order.
Syntax
[AMENDMENT]
class MSFT_WmiProvider_OperationEvent : MSFT_WmiSelfEvent
{
uint8 SECURITY_DESCRIPTOR[];
uint64 TIME_CREATED;
string HostingGroup;
uint32 HostingSpecification;
string Locale;
string Namespace;
string Provider;
string TransactionIdentifier;
string User;
String TransactionIdentifer;
};
Members
The MSFT_WmiProvider_OperationEvent class has these types of members:
Properties
The MSFT_WmiProvider_OperationEvent class has these properties.
-
HostingGroup
-
-
Data type: string
-
Access type: Read-only
Second component of the __Win32Provider HostingModel property when the hosting model is one of "LocalSystemHost", "LocalSystemHostOrSelfHost", "NetworkServiceHost", or "LocalServiceHost". The hosting group defines a particular instantiation of a WMI provider host. Providers that share the same hosting model and hosting group share the same surrogate process.
-
-
HostingSpecification
-
-
Data type: uint32
-
Access type: Read-only
The first component of the __Win32Provider HostingModel property. For the possible values of this property, see the HostingSpecification property in the MSFT_Providers class.
-
-
Locale
-
-
Data type: string
-
Access type: Read-only
Particular instantiation of a provider instance when the provider is configured for per local initialization.
-
-
Namespace
-
-
Data type: string
-
Access type: Read-only
Namespace associated with a particular provider instance.
-
-
Provider
-
-
Data type: string
-
Access type: Read-only
Name associated with a particular provider instance. The name is identical to the __Win32Provider property.
-
-
SECURITY_DESCRIPTOR
-
-
Data type: uint8 array
-
Access type: Read-only
Descriptor that the event provider uses to determine which users can receive the event. For more information, see WMI Security Constants.
This property is inherited from __Event.
-
-
TIME_CREATED
-
-
Data type: uint64
-
Access type: Read-only
Unique value that indicates the time the event is generated. This is a 64-bit value that represents the number of 100-nanosecond intervals after January 1, 1601. The information is in the Coordinated Universal Time (UTC) format.
For more information about using uint64 values in scripts, see Scripting in WMI.
This property is inherited from __Event.
-
-
TransactionIdentifer
-
-
Data type: String
-
Access type: Read-only
The TransactionIdentifer property is for internal use, currently always empty.
-
-
TransactionIdentifier
-
-
Data type: string
-
Access type: Read-only
Internal use only. The current value is "{00000000-0000-0000-0000-000000000000}".
-
-
User
-
-
Data type: string
-
Access type: Read-only
Particular provider instance, configured for per user initialization.
-
Requirements
| Minimum supported client |
Windows Vista |
| Minimum supported server |
Windows Server 2008 |
| Namespace |
Root\CIMV2 |
| MOF |
|
| DLL |
|