WMI (Windows Management Instrumentation)
- Description
-
Microsoft’s implementation of the Web-Based Enterprise Management (WBEM) and Common Information Model (CIM) standards. WMI provides an infrastructure for overseeing remote systems and delivering management data. While it’s a critical component of Windows operating systems, malicious actors can exploit it, posing a security risk.
You can collect WMI logs via Windows Event Log or ETW (Event Tracing for Windows). Before Windows Vista and Windows Server 2008, WMI also logged events to a file. NXLog Agent supports collecting WMI events using the Event Log for Windows and Event Tracing for Windows input modules.
- Also known as
-
Windows WMI, Microsoft WMI, WMI server
- See also
-
Windows Management Instrumentation (WMI)
Understanding and auditing WMI