????
Your IP : 13.58.212.163
�f[p Y �s�� � �E�} � �� N � �-� � O8ap� � qq�u � ��� � ��k� � ��o�� E =�v�) � ���� �F � �S[\ � |�� ~ �cE* b z%!/� � $��\5 � �d�Z� ƕ&o� X �&s8 o nDC^� � ȝ��C�A �� � __SystemClass abstract Cl �
_ _ S y s t e m C l a s s ȝ��C�� __SystemClass
����E � __NAMESPACE Name
� = � �� string �
_ _ S y s t e m C l a s s ȝ��C�� __SystemClass �� 1 ����W � __thisNAMESPACE singleton SECURITY_DESCRIPTOR
� P uint8 R �
_ _ S y s t e m C l a s s ȝ��C�� __SystemClass ��
����N � __Provider abstract Name
� F � �� string �� �
_ _ P r o v i d e r ȝ��C�h P __Provider & M T { � � � � � ) i } � � K j � � �
V o � � � � ? Y � � � � �
5 G o � � � W UUU�������������������������� ������������������������������������3 � __Win32Provider ClientLoadableCLSID
� E string CLSID
� s string Concurrency
,
� � sint32 DefaultMachineName
� � string Enabled B
� boolean HostingModel (
� U ] e string Values ImpersonationLevel
� � � � sint32 Values � None InitializationReentrancy
�
sint32 Values - 4 ? CLSID Namespace COM Object InitializationTimeoutInterval e <
� � � � datetime SUBTYPE interval InitializeAsAdminFirst
� � boolean OperationTimeoutInterval e 8
� 9 C L datetime SUBTYPE interval PerLocaleInitialization
$
� � boolean PerUserInitialization "
� � boolean Pure &
� � boolean SecurityDescriptor F
� 7 string SupportsExplicitShutdown 2
� x boolean SupportsExtendedStatus 4
� � boolean SupportsQuotas @
� � boolean SupportsSendStatus 0
� , boolean SupportsShutdown D
� f boolean SupportsThrottling 6
� � boolean UnloadTimeout e
� � � � datetime SUBTYPE interval Version
� + uint32 �
_ _ S y s t e m C l a s s ȝ��C�� __SystemClass �� �" ����Q � __ProviderRegistration abstract f
� A ref:__Provider __ � _ _ P r o v i d e r R e g i s t r a t i o n ȝ��C�B __ProviderRegistration �� ( 9 � � L ^ � � � � � 0 = e { D����� ���� ����� � __ObjectProviderRegistration abstract InteractionType
� e m u sint32 Values � � � Pull Push PushVerify QuerySupportLevels
� � � � string ValueMap $ 5 WQL:UnarySelect WQL:References WQL:Associators WQL:V1ProviderDefined SupportsBatching
� } boolean SupportsDelete
� � boolean SupportsEnumeration
� � boolean SupportsGet
� ' boolean SupportsPut
� \ boolean SupportsTransactions
� � boolean � _ _ O b j e c t P r o v i d e r R e g i s t r a t i o n
ȝ��C�� 4 & __ObjectProviderRegistration 3 | � �� � �
F d � � � � ��WU���� ���� ����������������������������� � __ClassProviderRegistration CacheRefreshInterval e
(
� _ i r datetime SUBTYPE interval PerUserSchema ,
� � boolean f@ � �� ReferencedSetQueries
� string ResultSetQueries
� > string ReSynchroniseOnNamespaceOpen .
� � boolean UnsupportedQueries $
� � string Version
� � uint32 � _ _ O b j e c t P r o v i d e r R e g i s t r a t i o n ȝ��C�� & __ObjectProviderRegistration � ����� ���� ����= � __InstanceProviderRegistration f@ � �� � _ _ P r o v i d e r R e g i s t r a t i o n ȝ��C� __ProviderRegistration � = J r ���� � � __PropertyProviderRegistration f@ � �� SupportsGet
� i boolean SupportsPut
� � boolean vi � _ _ P r o v i d e r R e g i s t r a t i o n
ȝ��C�� __ProviderRegistration � ����; � __MethodProviderRegistration f@ � �� Pr � _ _ P r o v i d e r R e g i s t r a t i o n ȝ��C�� __ProviderRegistration - �T ��������q � __EventProviderRegistration EventQueryList
� L string f@ � �� � _ _ P r o v i d e r R e g i s t r a t i o n ȝ��C�� __ProviderRegistration % 9 �` ��������} � __EventConsumerProviderRegistration ConsumerClassNames
� X string f@ � �� at � ȝ��C�� �� & ����M � __NotifyStatus abstract StatusCode
� E uint32 � _ _ N o t i f y S t a t u s ȝ��C�J __NotifyStatus F Q x � � � W���������������������� � __ExtendedStatus Description
� > string Operation
� p string ParameterInfo
� � string ProviderName
� � string � ȝ��C�J �� " � __SecurityRelatedClass abstract Cl � _ _ S e c u r i t y R e l a t e d C l a s s ȝ��C�o __SecurityRelatedClass @ G n t � � � � Q������ ������������� � __NTLMUser9X Authority
� 8 string Flags
� f sint32 Mask
� � sint32 Name
� � string Type
� � sint32 . �
_ _ S y s t e m C l a s s ȝ��C�Z __SystemClass �� � __IndicationRelated abstract la � _ _ I n d i c a t i o n R e l a t e d ȝ��C��
__IndicationRelated �� ( N \ ������������� � __Event abstract SECURITY_DESCRIPTOR
� G uint8 TIME_CREATED
� { uint64 � ȝ��C�@ �� � __PARAMETERS abstract ET � _ _ E v e n t ȝ��C�I
__Event ������������ � __ExtrinsicEvent � _ _ E v e n t ȝ��C�� __Event , ����������������_ � __NamespaceOperationEvent TargetNamespace
� K object:__Namespace � /�"� � �DoQ � 3a � �� � P�ʇ� � V�H^ � �� � �
�� � 0�IϠ � ߀!M � K��c� � Tw�� c GS � <�<9
�&F
� �[Z�� ! ���� � �<�� � ��k ���V� � �=��t �f�ډ / w�_� �p�� ~ ��hE Z _ _ N a m e s p a c e O p e r a t i o n E v e n t ȝ��C�g # __NamespaceOperationEvent ?���������������� � __NamespaceCreationEvent � _ _ N a m e s p a c e O p e r a t i o n E v e n t ȝ��C�g # __NamespaceOperationEvent ?���������������� � __NamespaceDeletionEvent � _ _ N a m e s p a c e O p e r a t i o n E v e n t ȝ��C�� # __NamespaceOperationEvent 1 ��������������������d � __NamespaceModificationEvent PreviousNamespace
� P object:__Namespace � _ _ E v e n t ȝ��C�� __Event $ ����������������K � __ClassOperationEvent TargetClass
� C object � _ _ C l a s s O p e r a t i o n E v e n t ȝ��C�_ __ClassOperationEvent ?���������������� � __ClassCreationEvent � _ _ C l a s s O p e r a t i o n E v e n t ȝ��C�_ __ClassOperationEvent ?���������������� � __ClassDeletionEvent � _ _ C l a s s O p e r a t i o n E v e n t ȝ��C�� __ClassOperationEvent ) ��������������������P � __ClassModificationEvent PreviousClass
� H object � _ _ E v e n t ȝ��C�� __Event * ����������������Q � __InstanceOperationEvent TargetInstance
� I object � _ _ I n s t a n c e O p e r a t i o n E v e n t !ȝ��C�e " __InstanceOperationEvent ?���������������� � __InstanceCreationEvent � _ _ I n s t a n c e O p e r a t i o n E v e n t "ȝ��C�e " __InstanceOperationEvent ?���������������� � __InstanceDeletionEvent � _ _ I n s t a n c e O p e r a t i o n E v e n t #ȝ��C�� " __InstanceOperationEvent / ��������������������V � __InstanceModificationEvent PreviousInstance
� N object � _ _ I n s t a n c e O p e r a t i o n E v e n t $ȝ��C� " __InstanceOperationEvent ! H T { � ���������������������������� � __MethodInvocationEvent Method
� @ string Parameters
� s object PreCall
� � boolean � _ _ E v e n t %ȝ��C�� __Event A J _��������������������q � __TimerEvent NumFirings
� 9 uint32 TimerId
� i string � _ _ I n d i c a t i o n R e l a t e d &ȝ��C�� __IndicationRelated " I Y ��������� � __AggregateEvent NumberOfEvents
� A uint32 Representative
� x object � _ _ I n d i c a t i o n R e l a t e d 'ȝ��C�V
__IndicationRelated �� ' X e � � ��������� � � __EventConsumer abstract CreatorSID
� Q � �� uint8 MachineName
� � string MaximumQueueSize
� � � � uint32 units bytes � _ _ I n d i c a t i o n R e l a t e d (ȝ��C�� __IndicationRelated L Y � � � � � � , Q�����S ����������������c � __EventFilter CreatorSID
� E � �� uint8 EventAccess
� x string EventNamespace
� � string Name
� � � �� string Query
� string QueryLanguage
� K string � _ _ I n d i c a t i o n R e l a t e d )ȝ��C�� __IndicationRelated �� ( 2 q } � � 5 = z � � � ������������� � � __FilterToConsumerBinding Association Consumer f
� \ � �� ref:__EventConsumer CreatorSID
� � � �� uint8 DeliverSynchronously
� � � �� boolean not_null DeliveryQoS
� - uint32 Filter f
� g � �� ref:__EventFilter MaintainSecurityContext
� � boolean SlowDownProviders
� � boolean � _ _ I n d i c a t i o n R e l a t e d *ȝ��C�] __IndicationRelated �� � __EventGenerator abstract � _ _ E v e n t G e n e r a t o r +ȝ��C�� __EventGenerator �� , T ] ���� � � __TimerInstruction abstract SkipIfPassed
� K boolean TimerId
� � � �� string as � _ _ T i m e r I n s t r u c t i o n ,ȝ��C�� __TimerInstruction + ���� ����i � __AbsoluteTimerInstruction EventDateTime e
� U _ �� datetime not_null � _ _ T i m e r I n s t r u c t i o n -ȝ��C�� __TimerInstruction 3 ���� ����� � __IntervalTimerInstruction IntervalBetweenEvents )
� j r ��| � uint32 not_null units milliseconds er � _ _ I n d i c a t i o n R e l a t e d .ȝ��C��
__IndicationRelated ' c l ������������� � __TimerNextFiring NextEvent64BitTime
� Q Y �� sint64 not_null TimerId
� � � �� string � C I M _ E r r o r 0ȝ��C�� G CIM_Error � � w � � � ���������������������������������������������������������������������E � MSFT_WmiError Description A Windows error object that encapsulates what is in CIM_Error as well as includes error code, errorCategory, errorMessage and errorType. error_Category 8
� � � � uint16 Description Error Category. error_Code 4 )
� K S ��] j uint32 Required Description Error code. error_Type :
� � � � string Description Error Type. error_WindowsErrorMessage >
� - string Description Windows error message. �
M S F T _ W m i E r r o r 1ȝ��C�L K MSFT_WmiError " � � ��������������������������������������������������������������������������� � MSFT_ExtendedStatus Description A Windows error object that encapsulates what is in CIM_Error as well as includes original_error. original_error
B
� � object � _ _ S e c u r i t y R e l a t e d C l a s s Bȝ��C� __SecurityRelatedClass �� . U [ � � � � O ] U������������������������������ � __SecurityDescriptor abstract ControlFlags
� M uint32 DACL
� � � �� object:__ACE Group
� � � �� object:__ACE Owner
� � �� object:__ACE SACL
� A � �� object:__ACE TIME_CREATED
� | uint64 � 2B /ȝ��C�B 8 A �� ( ��3 C Q ^ V e � � [ h � � 6 ? � ! �! �! # # �$ �$ �% �% �& ' �, �, �? �? j@ ~@ UUU����������������������������������������������������A � CIM_Error Indication Version 2.22.1 Exception UMLPackagePath CIM::Interop Description CIM_Error is a specialized class that contains information about the severity, cause, recommended actions and other data related to the failure of a CIM Operation. Instances of this type MAY be included as part of the response to a CIM Operation. CIMStatusCode
, R
� � � � 4
<
" , ' k � uint32 Description The CIM status code that characterizes this instance.
This property defines the status codes that MAY be return by a conforming CIM Server or Listener. Note that not all status codes are valid for each operation. The specification for each operation SHOULD define the status codes that may be returned by that operation.
The following values for CIM status code are defined:
1 - CIM_ERR_FAILED. A general error occurred that is not covered by a more specific error code.
2 - CIM_ERR_ACCESS_DENIED. Access to a CIM resource was not available to the client.
3 - CIM_ERR_INVALID_NAMESPACE. The target namespace does not exist.
4 - CIM_ERR_INVALID_PARAMETER. One or more parameter values passed to the method were invalid.
5 - CIM_ERR_INVALID_CLASS. The specified Class does not exist.
6 - CIM_ERR_NOT_FOUND. The requested object could not be found.
7 - CIM_ERR_NOT_SUPPORTED. The requested operation is not supported.
8 - CIM_ERR_CLASS_HAS_CHILDREN. Operation cannot be carried out on this class since it has instances.
9 - CIM_ERR_CLASS_HAS_INSTANCES. Operation cannot be carried out on this class since it has instances.
10 - CIM_ERR_INVALID_SUPERCLASS. Operation cannot be carried out since the specified superclass does not exist.
11 - CIM_ERR_ALREADY_EXISTS. Operation cannot be carried out because an object already exists.
12 - CIM_ERR_NO_SUCH_PROPERTY. The specified Property does not exist.
13 - CIM_ERR_TYPE_MISMATCH. The value supplied is incompatible with the type.
14 - CIM_ERR_QUERY_LANGUAGE_NOT_SUPPORTED. The query language is not recognized or supported.
15 - CIM_ERR_INVALID_QUERY. The query is not valid for the specified query language.
16 - CIM_ERR_METHOD_NOT_AVAILABLE. The extrinsic Method could not be executed.
17 - CIM_ERR_METHOD_NOT_FOUND. The specified extrinsic Method does not exist.
18 - CIM_ERR_UNEXPECTED_RESPONSE. The returned response to the asynchronous operation was not expected.
19 - CIM_ERR_INVALID_RESPONSE_DESTINATION. The specified destination for the asynchronous response is not valid.
20 - CIM_ERR_NAMESPACE_NOT_EMPTY. The specified Namespace is not empty.
21 - CIM_ERR_INVALID_ENUMERATION_CONTEXT. The enumeration context supplied is not valid.
22 - CIM_ERR_INVALID_OPERATION_TIMEOUT. The specified Namespace is not empty.
23 - CIM_ERR_PULL_HAS_BEEN_ABANDONED. The specified Namespace is not empty.
24 - CIM_ERR_PULL_CANNOT_BE_ABANDONED. The attempt to abandon a pull operation has failed.
25 - CIM_ERR_FILTERED_ENUMERATION_NOT_SUPPORTED. Filtered Enumeratrions are not supported.
26 - CIM_ERR_CONTINUATION_ON_ERROR_NOT_SUPPORTED. Continue on error is not supported.
27 - CIM_ERR_SERVER_LIMITS_EXCEEDED. The WBEM Server limits have been exceeded (e.g. memory, connections, ...).
28 - CIM_ERR_SERVER_IS_SHUTTING_DOWN. The WBEM Server is shutting down.
29 - CIM_ERR_QUERY_FEATURE_NOT_SUPPORTED. The specified Query Feature is not supported. Values �
�
�
�
, ? V r � � � � � 1 O i � � � � 2 T � � � � CIM_ERR_FAILED CIM_ERR_ACCESS_DENIED CIM_ERR_INVALID_NAMESPACE CIM_ERR_INVALID_PARAMETER CIM_ERR_INVALID_CLASS CIM_ERR_NOT_FOUND CIM_ERR_NOT_SUPPORTED CIM_ERR_CLASS_HAS_CHILDREN CIM_ERR_CLASS_HAS_INSTANCES CIM_ERR_INVALID_SUPERCLASS CIM_ERR_ALREADY_EXISTS CIM_ERR_NO_SUCH_PROPERTY CIM_ERR_TYPE_MISMATCH CIM_ERR_QUERY_LANGUAGE_NOT_SUPPORTED CIM_ERR_INVALID_QUERY CIM_ERR_METHOD_NOT_AVAILABLE CIM_ERR_METHOD_NOT_FOUND CIM_ERR_UNEXPECTED_RESPONSE CIM_ERR_INVALID_RESPONSE_DESTINATION CIM_ERR_NAMESPACE_NOT_EMPTY CIM_ERR_INVALID_ENUMERATION_CONTEXT CIM_ERR_INVALID_OPERATION_TIMEOUT CIM_ERR_PULL_HAS_BEEN_ABANDONED CIM_ERR_PULL_CANNOT_BE_ABANDONED CIM_ERR_FILTERED_ENUMERATION_NOT_SUPPORTED CIM_ERR_CONTINUATION_ON_ERROR_NOT_SUPPORTED CIM_ERR_SERVER_LIMITS_EXCEEDED CIM_ERR_SERVER_IS_SHUTTING_DOWN CIM_ERR_QUERY_FEATURE_NOT_SUPPORTED DMTF Reserved ValueMap � � � � � � � � � � � � � � � � � � � � � � � � � 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 .. MappingStrings 3 P DSP0201.DMTF|ERROR.CODE|2.3 DSP0200.DMTF|CIMError|1.3 ModelCorrespondence � CIM_Error.CIMStatusCodeDescription CIMStatusCodeDescription 0 8
� ! � � % : string Description A free-form string containing a human-readable description of CIMStatusCode. This description MAY extend, but MUST be consistent with, the definition of CIMStatusCode. MappingStrings �
DSP0201.DMTF|ERROR.DESCRIPTION|2.3 DSP0200.DMTF|CIMError|1.3 ModelCorrespondence B CIM_Error.CIMStatusCode ErrorSource
" +
� � � � F [ string Description The identifying information of the entity (i.e., the instance) generating the error. If this entity is modeled in the CIM Schema, this property contains the path of the instance encoded as a string parameter. If not modeled, the property contains some identifying string that names the entity that generated the error. The path or identifying string is formatted per the ErrorSourceFormat property. ModelCorrespondence c CIM_Error.ErrorSourceFormat ErrorSourceFormat & E
� � � � 4 I � � � � uint16 Description An array containing the dynamic content of the message. ModelCorrespondence U l CIM_Error.ErrorSource CIM_Error.OtherErrorSourceFormat ValueMap � � � � 0 1 2 .. Values � � � � Unknown Other CIMObjectPath DMTF Reserved ErrorType E
� a i v z � � � � uint16 Description Primary classification of the error. The following values are defined:
2 - Communications Error. Errors of this type are principally associated with the procedures and/or processes required to convey information from one point to another.
3 - Quality of Service Error. Errors of this type are principally associated with failures that result in reduced functionality or performance.
4 - Software Error. Error of this type are principally associated with a software or processing fault.
5 - Hardware Error. Errors of this type are principally associated with an equipment or hardware failure.
6 - Environmental Error. Errors of this type are principally associated with a failure condition relating the to facility, or other environmental considerations.
7 - Security Error. Errors of this type are associated with security violations, detection of viruses, and similar issues.
8 - Oversubscription Error. Errors of this type are principally associated with the failure to allocate sufficient resources to complete the operation.
9 - Unavailable Resource Error. Errors of this type are principally associated with the failure to access a required resource.
10 -Unsupported Operation Error. Errors of this type are principally associated with requests that are not supported. ValueMap � � � � � � � � � � � � 0 1 2 3 4 5 6 7 8 9 10 .. Values # * @ Z j z � � � � � Unknown Other Communications Error Quality of Service Error Software Error Hardware Error Environmental Error Security Error Oversubscription Error Unavailable Resource Error Unsupported Operation Error DMTF Reserved ModelCorrespondence CIM_Error.OtherErrorType Message +
� x � � � � string Description The formatted message. This message is constructed by combining some or all of the dynamic elements specified in the MessageArguments property with the static elements uniquely identified by the MessageID in a message registry or other catalog associated with the OwningEntity. ModelCorrespondence � � CIM_Error.MessageID CIM_Error.MessageArguments MessageArguments +
� A! I! V! �! �! string Description An array containing the dynamic content of the message. ModelCorrespondence �! �! CIM_Error.MessageID CIM_Error.Message MessageID
6
� '" /" ��9" F" �" �" string Required Description An opaque string that uniquely identifies, within the scope of the OwningEntity, the format of the Message. ModelCorrespondence �" �" CIM_Error.Message CIM_Error.MessageArguments OtherErrorSourceFormat ( +
� T# \# i# _$ t$ string Description A string defining "Other" values for ErrorSourceFormat. This value MUST be set to a non NULL value when ErrorSourceFormat is set to a value of 1 ("Other"). For all other values of ErrorSourceFormat, the value of this string must be set to NULL. ModelCorrespondence |$ CIM_Error.ErrorSourceFormat OtherErrorType +
� �$ �$ �$ T% i% string Description A free-form string describing the ErrorType when 1, "Other", is specified as the ErrorType. ModelCorrespondence q% CIM_Error.ErrorType OwningEntity
� �% �% �% string Description A string that uniquely identifies the entity that owns the definition of the format of the Message described in this instance. OwningEntity MUST include a copyrighted, trademarked or otherwise unique name that is owned by the business entity or standards body defining the format. PerceivedSeverity E
� U' ]' j' �+ �+ �+ �+ o, , uint16 Description An enumerated value that describes the severity of the Indication from the notifier's point of view:
0 - the Perceived Severity of the indication is unknown or indeterminate.
1 - Other, by CIM convention, is used to indicate that the Severity's value can be found in the OtherSeverity property.
2 - Information should be used when providing an informative response.
3 - Degraded/Warning should be used when its appropriate to let the user decide if action is needed.
4 - Minor should be used to indicate action is needed, but the situation is not serious at this time.
5 - Major should be used to indicate action is needed NOW.
6 - Critical should be used to indicate action is needed NOW and the scope is broad (perhaps an imminent outage to a critical resource will result).
7 - Fatal/NonRecoverable should be used to indicate an error occurred, but it's too late to take remedial action.
2 and 0 - Information and Unknown (respectively) follow common usage. Literally, the Error is purely informational or its severity is simply unknown. ValueMap �+ �+ �+ �+ �+ �+ �+ �+ �+ 0 1 2 3 4 5 6 7 .. Values , , , , 2, 9, @, J, `, Unknown Other Information Degraded/Warning Minor Major Critical Fatal/NonRecoverable DMTF Reserved MappingStrings �, Recommendation.ITU|X733.Perceived severity ProbableCause R
� "- *- 7- |- �- �- . @. J. �2 �2 uint16 Description An enumerated value that describes the probable cause of the error. MappingStrings �- �- �- Recommendation.ITU|X733.Probable cause Recommendation.ITU|M3100.probableCause ITU-IANA-ALARM-TC ModelCorrespondence . CIM_Error.ProbableCauseDescription ValueMap � ^0 a0 d0 g0 j0 m0 p0 s0 v0 y0 |0 �0 �0 �0 �0 �0 �0 �0 �0 �0 �0 �0 �0 �0 �0 �0 �0 �0 �0 �0 �0 �0 �0 �0 �0 �0 �0 �0 �0 �0 �0 �0 �0 1 1 1 1 1 1 1 1 1 $1 (1 ,1 01 41 81 <1 @1 D1 H1 L1 P1 T1 X1 \1 `1 d1 h1 l1 p1 t1 x1 |1 �1 �1 �1 �1 �1 �1 �1 �1 �1 �1 �1 �1 �1 �1 �1 �1 �1 �1 �1 �1 �1 �1 �1 �1 �1 �1 �1 �1 �1 �1 �1 2 2 2 2 2 2 2 %2 *2 /2 42 92 >2 C2 H2 M2 R2 W2 \2 a2 f2 k2 p2 u2 z2 2 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 .. Values � �4 �4 �4 �4 �4 �4 5 45 V5 y5 �5 �5 �5 �5 �5 �5 6 6 .6 A6 P6 `6 o6 }6 �6 �6 �6 �6 �6 �6 7 7 77 L7 [7 p7 �7 �7 �7 �7 �7 �7 8 8 >8 _8 x8 �8 �8 �8 �8 9 /9 B9 R9 g9 y9 �9 �9 �9 �9 �9 : %: A: _: t: �: �: �: �: �: �: �: ; ; 6; P; a; t; �; �; �; �; �; �; < < ;< O< e< }< �< �< �< �< �< �< �< = = "= -= <= H= U= \= m= �= �= �= �= �= �= �= > 5> M> e> �> �> �> �> �> �> ? ? ,? C? S? e? }? Unknown Other Adapter/Card Error Application Subsystem Failure Bandwidth Reduced Connection Establishment Error Communications Protocol Error Communications Subsystem Failure Configuration/Customization Error Congestion Corrupt Data CPU Cycles Limit Exceeded Dataset/Modem Error Degraded Signal DTE-DCE Interface Error Enclosure Door Open Equipment Malfunction Excessive Vibration File Format Error Fire Detected Flood Detected Framing Error HVAC Problem Humidity Unacceptable I/O Device Error Input Device Error LAN Error Non-Toxic Leak Detected Local Node Transmission Error Loss of Frame Loss of Signal Material Supply Exhausted Multiplexer Problem Out of Memory Output Device Error Performance Degraded Power Problem Pressure Unacceptable Processor Problem (Internal Machine Error) Pump Failure Queue Size Exceeded Receive Failure Receiver Failure Remote Node Transmission Error Resource at or Nearing Capacity Response Time Excessive Retransmission Rate Excessive Software Error Software Program Abnormally Terminated Software Program Error (Incorrect Results) Storage Capacity Problem Temperature Unacceptable Threshold Crossed Timing Problem Toxic Leak Detected Transmit Failure Transmitter Failure Underlying Resource Unavailable Version Mismatch Previous Alert Cleared Login Attempts Failed Software Virus Detected Hardware Security Breached Denial of Service Detected Security Credential Mismatch Unauthorized Access Alarm Received Loss of Pointer Payload Mismatch Transmission Error Excessive Error Rate Trace Problem Element Unavailable Element Missing Loss of Multi Frame Broadcast Channel Failure Invalid Message Received Routing Failure Backplane Failure Identifier Duplication Protection Path Failure Sync Loss or Mismatch Terminal Problem Real Time Clock Failure Antenna Failure Battery Charging Failure Disk Failure Frequency Hopping Failure Loss of Redundancy Power Supply Failure Signal Quality Problem Battery Discharging Battery Failure Commercial Power Problem Fan Failure Engine Failure Sensor Failure Fuse Failure Generator Failure Low Battery Low Fuel Low Water Explosive Gas High Winds Ice Buildup Smoke Memory Mismatch Out of CPU Cycles Software Environment Problem Software Download Failure Element Reinitialized Timeout Logging Problems Leak Detected Protection Mechanism Failure Protecting Resource Failure Database Inconsistency Authentication Failure Breach of Confidentiality Cable Tamper Delayed Information Duplicate Information Information Missing Information Modification Information Out of Sequence Key Expired Non-Repudiation Failure Out of Hours Activity Out of Service Procedural Error Unexpected Information DMTF Reserved ProbableCauseDescription +
� �? �? �? 4@ I@ string Description A free-form string describing the probable cause of the error. ModelCorrespondence Q@ CIM_Error.ProbableCause RecommendedActions
� �@ �@ �@ string Description A free-form string describing recommended actions to take to resolve the error. 8 �F47709ECAB1D7F037756AC8CE7.0.283919791.209 CD_47A1D2A8BCF5F91E1526321DD0154B4FC3C4CAC8A7D6DF2C21F3DBE6A8700273.0.1549489123.154 CD_524EAE20B913314A702A0EBDD5A10C21EED93FAAED87245845E0CDD9834CDE3F.1.2498533858.180 CD_57E5F3ADD9E242C4E9F9EDF79AA97F79E7911C5A8B902EC150D6442E3B85A5AA.0.4012709882.1940 CD_5F36D1944A2418B5A351C20BD9C1B5E3BF64E7FA512D227A09AA6978A5B805AC.0.1526490322.287 CD_612461B1AECF14916F6F139FD9951F2BD0CB766E0BB9EF5DA8A04D9DEB890739.1.571387695.177 CD_64659AB9F8F1C4B568DB6438BAE11B26EE8F93CB5F8195E21E8C383D6C44CC41.0.266171299.180 CD_664AF66B21C2039DE71ED4563B6D82F78FB404975A3235A5DEEC63FCFAD8513C.0.1558297380.140 CD_6B87A2FD09C6892F4F975A26E2D24DFF27E8D9BD67B9DB050A7E8D7BE4DA7F6F.0.248476017.902 CD_7010B213179D98B16AF38723EE1D750E86F808F341EE215AD8783D29EA117262.0.10792735.200 CD_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD.0.2843138877.197 CD_74BDAD13EFC25BDDDA03231B2D3B39ABD8B91202277E5C78F927E74B85FE75B7.1.3893168863.186 CD_849BB872FA48C9D9F0979EF051B133EED262AD47FF263C164F3A538EED0B65F3.1.1193085724.230 CD_8CFD3BDCF459E28A190CCF46FF43F533DE3394389F988133FD28EA5A0AEA1616.0.419879804.382 CD_956218CB3B130B9E0F4C99989C08F085EB3D3D40CE439ED3E9C6DD8BE7E440E8.1.1219683414.161 CD_A5134EAE65D9DD02F6CE0E924C84D387C2BC76C9409B3E6C9F586619D35EA1DA.0.3580883092.325 CD_A906A7709427F12DDE6D6641BDCB16CA4F2938A2A88AC6967D518CEE727A69AC.1.3152192527.231 CD_B8B1FAB8A4F90C512F053D1AD5C7061AC5CC502A1FC989312218B5B68AB25BBF.0.709190551.98 CD_C6289081C8AB688F844FF931CF917B4DD7080FB5ABF4C1BADA0FD2591FE183FD.1.3477714736.173 CD_CFF41370C70E26A169C5F7CC5594050646C5B9BC0F0D1F0FC4733FA2AA35939C.0.337397494.275 CD_D0463C61C5FB59AFB14652F5029984454DBCBB9EA71D7BD37E6D26E78285BA33.1.4118238233.355 CD_D3AFCBAF22653374F26FE8337CBE6005C90DBCA84C064E5B13CA4595121B7209.1.1676464971.246 CD_D5B792B23BC4AFF33F84619861154DB6F0B75D6C62833CE80A0CA636DA5E664B.0.1864799686.88 CD_D628E03D0677752FF789EA97E9BA34C4E2A9B6A38484A7C74F4BA213CAD47E8C.0.1931911146.111 CD_D890AC6A929040B86C73ED707F71F3BF5A8D5C24B862ABCFD812E1937C8FB0BB.0.4275837426.762 CD_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C.0.1809036519.239 CD_F31884BFB479ECDC8FA0C6525BD2E05B732CCD07D844062B2D8F0B23B81A2F45.1.2278220624.161 CD_FCBAF5A1255D45B1176570C0B63AA60199749700C79A11D5811D54A83A1F4EFD.0.1533458966.89 CD_FE3818270093A67B72B546EA3ACF6E4265D33BD8A3B28562DCE0CFA8C720DE41.1.562093846.173 CR_19C500FDB2411645397763142D9A3522EA74E9619B1C45A89DC1DCDB49E04CDD C_0899307408A32040A6DA19C0B1EC2745A3D604BAA9DFFE8EE4B75C3D91E16109 C_6B87A2FD09C6892F4F975A26E2D24DFF27E8D9BD67B9DB050A7E8D7BE4DA7F6F C_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD CD_410D7099EDD88BE50D962D5B670D3AC5CA5FD46428D3FEEB55DA5CF9C0146EC2.1.1007671612.269 CD_2277447C6063BFBAC05CE459DB8B2E90B2D0D7BB283ED825F0C1EAA1C62A123A.1.2132027049.404 CD_47C79E62C2227EDD0FF29BF44D87F2FAF9FEDF60A18D9F82597602BD95E20BD3.1.3143261092.545 CD_0A7ABE63F36E2B2920FEDAFAE849823AF9429CC0EA373FFEE1507EDB21FD9170.1.347773314.725 CD_E367B12CF12DEB20E317AE3B028692F15635A4C17B759C34D4B8D5D615A27793.1.3474078866.155 CD_503E99E1F76A9D46449F32E9069632CBB392B8A00D8C4838939B6A5881D7193A.1.110158277.284 CD_CC8D8F676137BCD5D5531414C0F461E5894D404FA15D384607EF32C9D2D87E32.1.1456396766.237 CD_FCA81D040FC95DE948FEF608A6C792CE7659D295F84C50D931F9A2E52513B2BA.1.3285270006.277 CD_41CA8C613150E784C004C908CB24132353B7EC2401C8DD6755B2ABBEB98C39B0.1.3672336088.303 �% 2ȝ��C��% $ A �� ��& / 7 G S ` ~ � � � V l F V � � � � � � } � UU�����������������������������������$ � CIM_Indication Indication Abstract Version 2.24.0 UMLPackagePath CIM::Event Description CIM_Indication is the abstract root class for all notifications about changes in schema, objects and their data, and about events detected by providers and instrumentation. Subclasses represent specific types of notifications.
To receive an Indication, a consumer (or subscriber) must create an instance of CIM_IndicationFilter describing the criteria of the notification, an instance of CIM_ListenerDestination describing the delivery of the notification, and an instance of CIM_IndicationSubscription associating the Filter and Handler. CorrelatedIndications 8
� � � � P ` � � string Description A list of IndicationIdentifiers whose notifications are correlated with (related to) this one. MappingStrings h Recommendation.ITU|X733.Correlated notifications ModelCorrespondence � CIM_Indication.IndicationIdentifier IndicationFilterName +
� + 3 @ 3 string Description An identifier for the indication filter that selects this indication and causes it to be sent. This property is to be filled out by the indication sending service. The value shall be correlatable with the Name property of the instance of CIM_IndicationFilter describing the criteria of the indication. The value of the IndicationFilterName should be formatted using the following algorithm: < OrgID > : < LocalID >, where < OrgID > and < LocalID > are separated by a colon (:) and < OrgID > shall include a copyrighted, trademarked, or otherwise unique name that is owned by the business entity that is creating or defining the value or that is a registered ID assigned to the business entity by a recognized global authority. In addition, to ensure uniqueness, < OrgID > shall not contain a colon (:).When using this algorithm, the first colon to appear in the value shall appear between < OrgID > and < LocalID >. < LocalID > is chosen by the business entity and shall be used uniquely. ModelCorrespondence ; CIM_IndicationFilter.Name IndicationIdentifier +
� � � � �
string Description An identifier for the Indication. This property is similar to a key value in that it can be used for identification, when correlating Indications (see the CorrelatedIndications array). Its value SHOULD be unique as long as correlations are reported, but MAY be reused or left NULL if no future Indications will reference it in their CorrelatedIndications array.To ensure uniqueness, the value of IndicationIdentifier should be constructed using the following "preferred" algorithm:
<OrgID>:<LocalID>
Where <OrgID> and <LocalID> are separated by a colon (:), and where <OrgID> must include a copyrighted, trademarked, or otherwise unique name that is owned by the business entity that is creating or defining the IndicationIdentifier or that is a recognized ID that is assigned to the business entity by a recognized global authority. (This requirement is similar to the <Schema Name>_<Class Name> structure of Schema class names.) In addition, to ensure uniqueness <OrgID> must not contain a colon (:). When using this algorithm, the first colon to appear in IndicationIdentifier must appear between <OrgID> and <LocalID>.
<LocalID> is chosen by the business entity and should not be re-used to identify different underlying (real-world) elements.
If the above "preferred" algorithm is not used, the defining entity should assure that the resulting IndicationIdentifier is not re-used across any IndicationIdentifiers that are produced by this or other providers for the NameSpace of this instance.
For DMTF-defined instances, the "preferred" algorithm should be used with the <OrgID> set to CIM. MappingStrings Recommendation.ITU|X733.Notification identifier IndicationTime e
� � � � datetime Description The time and date of creation of the Indication. The property may be set to NULL if the entity creating the Indication is not capable of determining this information. Note that IndicationTime may be the same for two Indications that are generated in rapid succession. OtherSeverity +
� � � ` u string Description Holds the value of the user defined severity value when 'PerceivedSeverity' is 1 ("Other"). ModelCorrespondence } CIM_AlertIndication.PerceivedSeverity PerceivedSeverity E
�
� � � � � uint16 Description An enumerated value that describes the severity of the Indication from the notifier's point of view:
1 - Other, by CIM convention, is used to indicate that the Severity's value can be found in the OtherSeverity property.
3 - Degraded/Warning should be used when its appropriate to let the user decide if action is needed.
4 - Minor should be used to indicate action is needed, but the situation is not serious at this time.
5 - Major should be used to indicate action is needed NOW.
6 - Critical should be used to indicate action is needed NOW and the scope is broad (perhaps an imminent outage to a critical resource will result).
7 - Fatal/NonRecoverable should be used to indicate an error occurred, but it's too late to take remedial action.
2 and 0 - Information and Unknown (respectively) follow common usage. Literally, the Indication is purely informational or its severity is simply unknown. ValueMap � � � � � � � � � 0 1 2 3 4 5 6 7 .. Values * 3 : G Y ` g q � Unknown Other Information Degraded/Warning Minor Major Critical Fatal/NonRecoverable DMTF Reserved MappingStrings � Recommendation.ITU|X733.Perceived severity SequenceContext +
� $ , 9 A V string Description The sequence context portion of a sequence identifier for the indication. The sequence number portion of the sequence identifier is provided by the SequenceNumber property. The combination of both property values represents the sequence identifier for the indication.
The sequence identifier for the indication enables a CIM listener to identify duplicate indications when the CIM service attempts the delivery retry of indications, to reorder indications that arrive out-of-order, and to detect lost indications.
If a CIM service does not support sequence identifiers for indications, this property shall be NULL.
If a CIM service supports sequence identifiers for indications, this property shall be maintained by the CIM service for each registered listener destination, and its value shall uniquely identify the CIM service and the indication service within the CIM service such that restarts of the CIM service and deregistration of listener destinations to the CIM service cause the value to change, without reusing earlier values for a sufficiently long time.
When retrying the delivery of an indication, this property shall have the same value as in the original delivery.
To guarantee this uniqueness, the property value should be constructed using the following format (defined in ABNF): sequence-context = indication-service-name "#" cim-service-start-id "#" listener-destination-creation-time
Where: indication-service-name is the value of the Name property of the CIM_IndicationService instance responsible for delivering the indication. cim-service-start-id is an identifier that uniquely identifies the CIM service start, for example via a timestamp of the start time, or via a counter that increases for each start or restart. listener-destination-creation-time is a timestamp of the creation time of the CIM_ListenerDestination instance representing the listener destination.
Since this format is only a recommendation, CIM clients shall treat the value as an opaque identifier for the sequence context and shall not rely on this format. ModelCorrespondence ^ CIM_Indication.SequenceNumber SequenceNumber +
� � � � �$ �$ sint64 Description The sequence number portion of a sequence identifier for the indication. The sequence context portion of the sequence identifier is provided by the SequenceContext property. The combination of both property values represents the sequence identifier for the indication.
The sequence identifier for the indication enables a CIM listener to identify duplicate indications when the CIM service attempts the delivery retry of indications, to reorder indications that arrive out-of-order, and to detect lost indications.
If a CIM service does not support sequence identifiers for indications, this property shall be NULL.
If a CIM service supports sequence identifiers for indications, this property shall be maintained by the CIM service for each registered listener destination, and its value shall uniquely identify the indication within the sequence context provided by SequenceContext. It shall start at 0 whenever the sequence context string changes. Otherwise, it shall be increased by 1 for every new indication to that listener destination, and it shall wrap to 0 when the value range is exceeded.
When retrying the delivery of an indication, this property shall have the same value as in the original delivery. ModelCorrespondence �$ CIM_Indication.SequenceContext st � C_7010B213179D98B16AF38723EE1D750E86F808F341EE215AD8783D29EA117262 CR_7010B213179D98B16AF38723EE1D750E86F808F341EE215AD8783D29EA117262 C_57E5F3ADD9E242C4E9F9EDF79AA97F79E7911C5A8B902EC150D6442E3B85A5AA C_19C500FDB2411645397763142D9A3522EA74E9619B1C45A89DC1DCDB49E04CDD R_19C500FDB2411645397763142D9A3522EA74E9619B1C45A89DC1DCDB49E04CDD CR_19C500FDB2411645397763142D9A3522EA74E9619B1C45A89DC1DCDB49E04CDD R_6B87A2FD09C6892F4F975A26E2D24DFF27E8D9BD67B9DB050A7E8D7BE4DA7F6F CR_6B87A2FD09C6892F4F975A26E2D24DFF27E8D9BD67B9DB050A7E8D7BE4DA7F6F C_D890AC6A929040B86C73ED707F71F3BF5A8D5C24B862ABCFD812E1937C8FB0BB R_D890AC6A929040B86C73ED707F71F3BF5A8D5C24B862ABCFD812E1937C8FB0BB C_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C R_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C R_A5134EAE65D9DD02F6CE0E924C84D387C2BC76C9409B3E6C9F586619D35EA1DA R_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD R_0899307408A32040A6DA19C0B1EC2745A3D604BAA9DFFE8EE4B75C3D91E16109 C_CFF41370C70E26A169C5F7CC5594050646C5B9BC0F0D1F0FC4733FA2AA35939C R_CFF41370C70E26A169C5F7CC5594050646C5B9BC0F0D1F0FC4733FA2AA35939C C_47A1D2A8BCF5F91E1526321DD0154B4FC3C4CAC8A7D6DF2C21F3DBE6A8700273 CR_47A1D2A8BCF5F91E1526321DD0154B4FC3C4CAC8A7D6DF2C21F3DBE6A8700273 C_8CFD3BDCF459E28A190CCF46FF43F533DE3394389F988133FD28EA5A0AEA1616 C_B8B1FAB8A4F90C512F053D1AD5C7061AC5CC502A1FC989312218B5B68AB25BBF CR_B8B1FAB8A4F90C512F053D1AD5C7061AC5CC502A1FC989312218B5B68AB25BBF C_1D9A9343F720B6D89833DCA8A7B92F53169B46316C0AEF3756FA68AE0584CC8D C_664AF66B21C2039DE71ED4563B6D82F78FB404975A3235A5DEEC63FCFAD8513C CR_664AF66B21C2039DE71ED4563B6D82F78FB404975A3235A5DEEC63FCFAD8513C C_5F36D1944A2418B5A351C20BD9C1B5E3BF64E7FA512D227A09AA6978A5B805AC C_D5B792B23BC4AFF33F84619861154DB6F0B75D6C62833CE80A0CA636DA5E664B CR_5F36D1944A2418B5A351C20BD9C1B5E3BF64E7FA512D227A09AA6978A5B805AC C_D628E03D0677752FF789EA97E9BA34C4E2A9B6A38484A7C74F4BA213CAD47E8C C_2C912D30C6F2C9872585F2917A9F51466121BD73DCC0AA6A9A6D8C6362427472 CR_2C912D30C6F2C9872585F2917A9F51466121BD73DCC0AA6A9A6D8C6362427472 C_612461B1AECF14916F6F139FD9951F2BD0CB766E0BB9EF5DA8A04D9DEB890739 C_349E3A31D1133135695017907CF38FA6787B7F880BB1D36773A1D88E19A7CE09 C_342D3B3E95C15CE5558C1B7C7C427B6C66E4F69853BB4D1A94056D76079B0240 C_524EAE20B913314A702A0EBDD5A10C21EED93FAAED87245845E0CDD9834CDE3F CR_524EAE20B913314A702A0EBDD5A10C21EED93FAAED87245845E0CDD9834CDE3F C_F31884BFB479ECDC8FA0C6525BD2E05B732CCD07D844062B2D8F0B23B81A2F45 C_956218CB3B130B9E0F4C99989C08F085EB3D3D40CE439ED3E9C6DD8BE7E440E8 C_A906A7709427F12DDE6D6641BDCB16CA4F2938A2A88AC6967D518CEE727A69AC C_74BDAD13EFC25BDDDA03231B2D3B39ABD8B91202277E5C78F927E74B85FE75B7 CR_74BDAD13EFC25BDDDA03231B2D3B39ABD8B91202277E5C78F927E74B85FE75B7 C_C6289081C8AB688F844FF931CF917B4DD7080FB5ABF4C1BADA0FD2591FE183FD C_FE3818270093A67B72B546EA3ACF6E4265D33BD8A3B28562DCE0CFA8C720DE41 C_D3AFCBAF22653374F26FE8337CBE6005C90DBCA84C064E5B13CA4595121B7209 C_D0463C61C5FB59AFB14652F5029984454DBCBB9EA71D7BD37E6D26E78285BA33 C_849BB872FA48C9D9F0979EF051B133EED262AD47FF263C164F3A538EED0B65F3 C_410D7099EDD88BE50D962D5B670D3AC5CA5FD46428D3FEEB55DA5CF9C0146EC2 C_2277447C6063BFBAC05CE459DB8B2E90B2D0D7BB283ED825F0C1EAA1C62A123A C_47C79E62C2227EDD0FF29BF44D87F2FAF9FEDF60A18D9F82597602BD95E20BD3 C_0A7ABE63F36E2B2920FEDAFAE849823AF9429CC0EA373FFEE1507EDB21FD9170 CR_2277447C6063BFBAC05CE459DB8B2E90B2D0D7BB283ED825F0C1EAA1C62A123A R_0A7ABE63F36E2B2920FEDAFAE849823AF9429CC0EA373FFEE1507EDB21FD9170 CR_47C79E62C2227EDD0FF29BF44D87F2FAF9FEDF60A18D9F82597602BD95E20BD3 C_E367B12CF12DEB20E317AE3B028692F15635A4C17B759C34D4B8D5D615A27793 CR_E367B12CF12DEB20E317AE3B028692F15635A4C17B759C34D4B8D5D615A27793 C_503E99E1F76A9D46449F32E9069632CBB392B8A00D8C4838939B6A5881D7193A CR_503E99E1F76A9D46449F32E9069632CBB392B8A00D8C4838939B6A5881D7193A C_CC8D8F676137BCD5D5531414C0F461E5894D404FA15D384607EF32C9D2D87E32 C_FCA81D040FC95DE948FEF608A6C792CE7659D295F84C50D931F9A2E52513B2BA C_41CA8C613150E784C004C908CB24132353B7EC2401C8DD6755B2ABBEB98C39B0 C_7E8FAF5FFDD42234424D10D1B6504179D220FC453A0ED3C78C0356F01FFA929D
�� u ��H�� & ;wm� �F��!
g O/ > :��� v h��< � C I M _ C o o l i n g D e v i c e �ȝ��C�� T CIM_CoolingDevice ) ? �� I W � � ������������������������������������������������������������������������������������� � CIM_Fan Locale UUID {0A59C856-E3D4-11d2-8601-0000F8102E5F} Abstract DesiredSpeed F
� � � �� uint64 VariableSpeed D
� � � �� boolean �
� � SetSpeed ae442007200009F ROOT\CIMV2 ���� � �� �� * � ��������� � __PARAMETERS abstract DesiredSpeed uint64
� 8 IN
� 8 _ �� ID )
� � _ ��� uint64 __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � C I M _ L o g i c a l D e v i c e �ȝ��C�� G CIM_LogicalDevice ) �� $ �����������������������������������������������������������������������L � CIM_Sensor Abstract Locale UUID {9565979B-7D80-11D2-AAD3-006008C78BC7} �
C I M _ S e n s o r �ȝ��C�� � CIM_Sensor ) �� % + S ] � � � � & X m � � � � + 8 j z � � � � & 2 d o � � � 2 M ����UUU�������������������������������������������������������������������������������������������������������������������������������� � CIM_NumericSensor Abstract Locale UUID {9565979C-7D80-11D2-AAD3-006008C78BC7} Accuracy b
� � � �� sint32 CurrentReading B
� � � �� sint32 IsLinear f
� � �� boolean LowerThresholdCritical p
� P � �� sint32 LowerThresholdFatal ! x
� � � �� sint32 LowerThresholdNonCritical h
� � � �� sint32 MaxReadable R
� # � �� sint32 MinReadable V
� b � �� sint32 NominalReading F
� � � �� sint32 NormalMax J
� � � �� sint32 NormalMin N
� � �� sint32 Resolution Z
� \ � �� uint32 Tolerance ^
� � � �� sint32 UpperThresholdCritical t
� � � �� sint32 UpperThresholdFatal " |
� * � �� sint32 UpperThresholdNonCritical l
� w � �� sint32 � C I M _ N u m e r i c S e n s o r �ȝ��C�- � CIM_NumericSensor ) ��! ) / W a � � � m � ( C � � � � D T � � � � @ L � � � � Q f
'
����UUW���������������������������������������������������������������������������������������������������������������������������������
� CIM_TemperatureSensor Abstract Locale UUID {9565979D-7D80-11D2-AAD3-006008C78BC7} Accuracy @ b 6
� � � ��� � � � sint32 Override Accuracy MappingStrings � MIF.DMTF|Temperature Probe|001.19 CurrentReading @ B 6
� P � ��X b r � sint32 Override CurrentReading MappingStrings � MIF.DMTF|Temperature Probe|001.5 LowerThresholdCritical @ p 6
� � �� 2 B sint32 Override LowerThresholdCritical MappingStrings J MIF.DMTF|Temperature Probe|001.13 LowerThresholdFatal @ ! x 6
� � � ��� � � � sint32 Override LowerThresholdFatal MappingStrings MIF.DMTF|Temperature Probe|001.15 LowerThresholdNonCritical @ h 6
� � � ��� � � � sint32 Override LowerThresholdNonCritical MappingStrings � MIF.DMTF|Temperature Probe|001.11 MaxReadable @ R 6
� @ � ��H R _ o sint32 Override MaxReadable MappingStrings w MIF.DMTF|Temperature Probe|001.9 MinReadable @ V 6
� � � ��� � sint32 Override MinReadable MappingStrings ! MIF.DMTF|Temperature Probe|001.10 NominalReading @ F 6
� � � ��� � � � sint32 Override NominalReading MappingStrings � MIF.DMTF|Temperature Probe|001.6 NormalMax @ J 6
� C � ��K U ` p sint32 Override NormalMax MappingStrings x MIF.DMTF|Temperature Probe|001.7 NormalMin @ N 6
� � � ��� � sint32 Override NormalMin MappingStrings MIF.DMTF|Temperature Probe|001.8 Resolution @ Z 6
� � � ��� � � � uint32 Override Resolution MappingStrings � MIF.DMTF|Temperature Probe|001.17 Tolerance @ ^ 6
� 8 � ��@ J U e sint32 Override Tolerance MappingStrings m MIF.DMTF|Temperature Probe|001.18 UpperThresholdCritical @ t 6
� � � ��� � & sint32 Override UpperThresholdCritical MappingStrings . MIF.DMTF|Temperature Probe|001.14 UpperThresholdFatal @ " | 6
� � � ��� � � � sint32 Override UpperThresholdFatal MappingStrings � MIF.DMTF|Temperature Probe|001.16 UpperThresholdNonCritical @ l 6
� k
� ��s
}
�
�
sint32 Override UpperThresholdNonCritical MappingStrings �
MIF.DMTF|Temperature Probe|001.12 an � C I M _ L o g i c a l D e v i c e �ȝ��C� R CIM_LogicalDevice ) �� " ( P e � � �
���������������������������������������������������������������������������������A � CIM_Controller Abstract Locale UUID {8502C531-5FBB-11D2-AAC1-006008C78BC7} MaxNumberControlled B )
� � � � � �� uint32 MappingStrings � MIF.DMTF|Bus Port|001.9 ProtocolSupported F 6
� , � ��4 > � � uint16 ValueMap / �
! % ) - 1 5 9 = A E I M Q U Y ] a e i m q u y } � � � � � � � � � � � � 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 MappingStrings � � MIF.DMTF|Bus Port|001.2 MIF.DMTF|Disks|003.3 TimeOfLastReset e H
� 7 � �� datetime � C I M _ P h y s i c a l C o m p o n e n t �ȝ��C�4 G CIM_PhysicalComponent )
�� " J V ����������������������������������������������������������������������� � CIM_Chip abstract Locale UUID {FAF76B7A-798C-11D2-AAD1-006008C78BC7} FormFactor @
� � � �� uint16 �6 4 6 5 9 A B 9 F 8 F 1 C 4 B 5 6 8 D B 6 4 3 8 B A E 1 1 B 2 6 E E 8 F 9 3 C B 5 F 8 1 9 5 E 2 1 E 8 C 3 8 3 D 6 C 4 4 C C 4 1 &tR|�C�ȝ��C�,
� __NAMESPACE ms_409 �1 Cȝ��C�E �� � __SystemSecurity singleton L1 it ngl " � � � � � � � � � � W n � D " " )" �& �+ �+ �+ �+ �0 � GetSD �� Static � ���� � �� �� * c � � ��������3 � __PARAMETERS abstract ReturnValue uint32
� 7 out
� 7 ^ �� SD uint8
� � out
� � � �� ID )
� � � ��� � GetSecurityDescriptor �� Static � ���� � �� �� � * c ��������Y � __PARAMETERS abstract ReturnValue uint32
� 7 out
� 7 ^ ��
Descriptor object
� � out
� � � �� ID
)
� < � �� object:__SecurityDescriptor � Get9XUserList � �� Static � ���� � �� �� * c � � ��������I � __PARAMETERS abstract ReturnValue uint32
� 7 out
� 7 ^ ��
ul object
� � out
� � � �� ID
)
� 4 � ��� object:__ntlmuser9x � SetSD � �� Static � ���� � �^ �� * � ����� � __PARAMETERS abstract SD uint8
� . in
� . T �� ID )
� . T ��� � � ���� � �� �� * c ����� � __PARAMETERS abstract ReturnValue uint32
� 7 out
� 7 ^ �� � SetSecurityDescriptor } �� Static � ���� � �� �� * � ����� � __PARAMETERS abstract
Descriptor object
� 6 in
� 6 ] �� ID
)
� � ] ��� object:__SecurityDescriptor � � ���� � �� �� * c ����� � __PARAMETERS abstract ReturnValue uint32
� 7 out
� 7 ^ �� � Set9XUserList !" �� Static � ���� � �` �� * � ����� � __PARAMETERS abstract
ul object
� . in
� . U �� ID
)
� � U ��� object:__ntlmuser9x � � ���� � �� �� * c ����� � __PARAMETERS abstract ReturnValue uint32
� 7 out
� 7 ^ �� � GetCallerAccessRights �+ �� Static � ���� � �� �� * c � ��������8 � __PARAMETERS abstract ReturnValue uint32
� 7 out
� 7 ^ �� rights sint32
� � out
� � � �� ID )
� � � ��� � DA03231B2D3B39ABD8B91202277E5C78F927E74B85FE75B7 CR_74BDAD13EFC25BDDDA03231B2D3B39ABD8B91202277E5C78F927E74B85FE75B7 C_C6289081C8AB688F844FF931CF917B4DD7080FB5ABF4C1BADA0FD2591FE183FD C_FE3818270093A67B72B546EA3ACF6E4265D33BD8A3B28562DCE0CFA8C720DE41 C_D3AFCBAF22653374F26FE8337CBE6005C90DBCA84C064E5B13CA4595121B7209 C_D0463C61C5FB59AFB14652F5029984454DBCBB9EA71D7BD37E6D26E78285BA33 C_849BB872FA48C9D9F0979EF051B133EED262AD47FF263C164F3A538EED0B65F3 C_410D7099EDD88BE50D962D5B670D3AC5CA5FD46428D3FEEB55DA5CF9C0146EC2 C_2277447C6063BFBAC05CE459DB8B2E90B2D0D7BB283ED825F0C1EAA1C62A123A C_47C79E62C2227EDD0FF29BF44D87F2FAF9FEDF60A18D9F82597602BD95E20BD3 C_0A7ABE63F36E2B2920FEDAFAE849823AF9429CC0EA373FFEE1507EDB21FD9170 CR_2277447C6063BFBAC05CE459DB8B2E90B2D0D7BB283ED825F0C1EAA1C62A123A R_0A7ABE63F36E2B2920FEDAFAE849823AF9429CC0EA373FFEE1507EDB21FD9170 CR_47C79E62C2227EDD0FF29BF44D87F2FAF9FEDF60A18D9F82597602BD95E20BD3 C_E367B12CF12DEB20E317AE3B028692F15635A4C17B759C34D4B8D5D615A27793 CR_E367B12CF12DEB20E317AE3B028692F15635A4C17B759C34D4B8D5D615A27793 C_503E99E1F76A9D46449F32E9069632CBB392B8A00D8C4838939B6A5881D7193A CR_503E99E1F76A9D46449F32E9069632CBB392B8A00D8C4838939B6A5881D7193A C_CC8D8F676137BCD5D5531414C0F461E5894D404FA15D384607EF32C9D2D87E32 C_FCA81D040FC95DE948FEF608A6C792CE7659D295F84C50D931F9A2E52513B2BA C_41CA8C613150E784C004C908CB24132353B7EC2401C8DD6755B2ABBEB98C39B0 C_7E8FAF5FFDD42234424D10D1B6504179D220FC453A0ED3C78C0356F01FFA929D CR_7E8FAF5FFDD42234424D10D1B6504179D220FC453A0ED3C78C0356F01FFA929D C_D36EEB4FA019E601112818DDC069B750B95BF09F1ACA992BF14D32259D2DE75F CR_D36EEB4FA019E601112818DDC069B750B95BF09F1ACA992BF14D32259D2DE75F C_B4204F4CD845FAF261673483B3D9C407E18AF7773A24D7B43C66C3052F5D6AAB C_0783FC4315F6719B07F6F7780EAC7B73D0B0471C3E21E23BC45CB6B44FFECA8E CR_353ED06D06D3F543C1F82745622C061EF12A64D07607F4A41BBE9C01357C9257 C_918165F99F828C6B53BA10EEE3979256F3A73E636E22656D27D129A14FA67468 C_37F745714D456922ABC6A6C3392453CACBCC48856287D98BA28B9B6BD50EA75C C_FEA174838505F017ED6B4301AAC1DD5D141215A4B6A1F43D4092C1E5AC1A3F37 CR_6DECEA152EB68C3B8F3895F0BFE2B8D722298B02602F918D61267E0DFA61213B C_13091E3C3054BC345002416FA26EA86BA000D8B72D69780944E68B3A51252A0B C_57AD49AAA93A9DB4C747A5522BD17E886017CE9B2B40450392A8012CE5FE8334 C_3CFCAB1516C75164A42E3401D0ADF64A4765F50E4818FC30D95B8671DE07D069 CR_D628E03D0677752FF789EA97E9BA34C4E2A9B6A38484A7C74F4BA213CAD47E8C C_79CE5C3FFCFDB2E387AFB15F738C96DF562D23EEC0B9CE854EFF2796A5403198 CR_79CE5C3FFCFDB2E387AFB15F738C96DF562D23EEC0B9CE854EFF2796A5403198 C_58EBCE462A5C99EEA826226A8DAA39BB4E44016ACD1726174C7DBA9B5E2879BE R_58EBCE462A5C99EEA826226A8DAA39BB4E44016ACD1726174C7DBA9B5E2879BE CR_58EBCE462A5C99EEA826226A8DAA39BB4E44016ACD1726174C7DBA9B5E2879BE C_390D5ED0BE7821A9A41296EE6280A1479152221DCE5D93BE2F8AC7791409FDC4 R_390D5ED0BE7821A9A41296EE6280A1479152221DCE5D93BE2F8AC7791409FDC4 C_9D477AC3DF7741E8993375CB7B6EC3870626780031363A4F5096C4CACA7F4F5E R_9D477AC3DF7741E8993375CB7B6EC3870626780031363A4F5096C4CACA7F4F5E C_3FDA9FF251C6BD5841FB280A37A767A97FBDE0A3950C58F141AF2BCE7A64366D R_3FDA9FF251C6BD5841FB280A37A767A97FBDE0A3950C58F141AF2BCE7A64366D C_7A72389BB1759518065C4AF4001515EC91E03811075FE8C84FE22087E293F0F4 C_16C3460778AD17C374A21EA3EAA4769942B4820B8F8AA76B353EDCE060C07C55 9 C I M _ M a n a g e d E l e m e n t �wR|�C��8 2 CIM_ManagedElement 6 ' ��# +
3 H � � � < I � � �" # �. / Z2 b2 W6 k6 �UU������������������������������������������������7 � CIM_ManagedSystemElement Description CIM_ManagedSystemElement is the base class for the System Element hierarchy. Any distinguishable component of a System is a candidate for inclusion in this class. Examples of system components include:
- software components such as application servers, databases, and applications
- operating system components such as files, processes, and threads
- device components such as disk drives, controllers, processors, and printers
- physical components such as chips and cards. Version 2.22.0 AMENDMENT LOCALE MS_409 CommunicationStatus
& +
� � � � d l uint16 Description CommunicationStatus indicates the ability of the instrumentation to communicate with the underlying ManagedElement. CommunicationStatus consists of one of the following values: Unknown, None, Communication OK, Lost Communication, or No Contact.
A Null return indicates the implementation (provider) does not implement this property.
"Unknown" indicates the implementation is in general capable of returning this property, but is unable to do so at this time.
"Not Available" indicates that the implementation (provider) is capable of returning a value for this property, but not ever for this particular piece of hardware/software or the property is intentionally not used because it adds no meaningful information (as in the case of a property that is intended to add additional info to another property).
"Communication OK " indicates communication is established with the element, but does not convey any quality of service.
"No Contact" indicates that the monitoring system has knowledge of this element, but has never been able to establish communications with it.
"Lost Communication" indicates that the Managed Element is known to exist and has been contacted successfully in the past, but is currently unreachable. Values � � � � � � � Unknown Not Available Communication OK Lost Communication No Contact DMTF Reserved Vendor Reserved DetailedStatus ( +
� ? G T & . uint16 Description DetailedStatus compliments PrimaryStatus with additional status detail. It consists of one of the following values: Not Available, No Additional Information, Stressed, Predictive Failure, Error, Non-Recoverable Error, SupportingEntityInError. Detailed status is used to expand upon the PrimaryStatus of the element.
A Null return indicates the implementation (provider) does not implement this property.
"Not Available" indicates that the implementation (provider) is capable of returning a value for this property, but not ever for this particular piece of hardware/software or the property is intentionally not used because it adds no meaningful information (as in the case of a property that is intended to add additional info to another property).
"No Additional Information" indicates that the element is functioning normally as indicated by PrimaryStatus = "OK".
"Stressed" indicates that the element is functioning, but needs attention. Examples of "Stressed" states are overload, overheated, and so on.
"Predictive Failure" indicates that an element is functioning normally but a failure is predicted in the near future.
"Non-Recoverable Error " indicates that this element is in an error condition that requires human intervention.
"Supporting Entity in Error" indicates that this element might be "OK" but that another element, on which it is dependent, is in error. An example is a network service or endpoint that cannot function due to lower-layer networking problems. Values R a | � � � � � Not Available No Additional Information Stressed Predictive Failure Non-Recoverable Error Supporting Entity in Error DMTF Reserved Vendor Reserved HealthState $ +
� 3 ; H � � uint16 Description Indicates the current health of the element. This attribute expresses the health of this element but not necessarily that of its subcomponents. The possible values are 0 to 30, where 5 means the element is entirely healthy and 30 means the element is completely non-functional. The following continuum is defined:
"Non-recoverable Error" (30) - The element has completely failed, and recovery is not possible. All functionality provided by this element has been lost.
"Critical Failure" (25) - The element is non-functional and recovery might not be possible.
"Major Failure" (20) - The element is failing. It is possible that some or all of the functionality of this component is degraded or not working.
"Minor Failure" (15) - All functionality is available but some might be degraded.
"Degraded/Warning" (10) - The element is in working order and all functionality is provided. However, the element is not working to the best of its abilities. For example, the element might not be operating at optimal performance or it might be reporting recoverable errors.
"OK" (5) - The element is fully functional and is operating within normal operational parameters and without error.
"Unknown" (0) - The implementation cannot report on HealthState at this time.
DMTF has reserved the unused portion of the continuum for additional HealthStates in the future. Values � � � � � - Unknown OK Degraded/Warning Minor failure Major failure Critical failure Non-recoverable error DMTF Reserved InstallDate e
� u � datetime Description A datetime value that indicates when the object was installed. Lack of a value does not indicate that the object is not installed. Name
� B J W string Description The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property. OperatingStatus * +
� / 7 D �! �! uint16 Description OperatingStatus provides a current status value for the operational condition of the element and can be used for providing more detail with respect to the value of EnabledState. It can also provide the transitional states when an element is transitioning from one state to another, such as when an element is transitioning between EnabledState and RequestedState, as well as other transitional conditions.
OperatingStatus consists of one of the following values: Unknown, Not Available, In Service, Starting, Stopping, Stopped, Aborted, Dormant, Completed, Migrating, Emmigrating, Immigrating, Snapshotting. Shutting Down, In Test
A Null return indicates the implementation (provider) does not implement this property.
"Unknown" indicates the implementation is in general capable of returning this property, but is unable to do so at this time.
"None" indicates that the implementation (provider) is capable of returning a value for this property, but not ever for this particular piece of hardware/software or the property is intentionally not used because it adds no meaningful information (as in the case of a property that is intended to add additional info to another property).
"Servicing" describes an element being configured, maintained, cleaned, or otherwise administered.
"Starting" describes an element being initialized.
"Stopping" describes an element being brought to an orderly stop.
"Stopped" and "Aborted" are similar, although the former implies a clean and orderly stop, while the latter implies an abrupt stop where the state and configuration of the element might need to be updated.
"Dormant" indicates that the element is inactive or quiesced.
"Completed" indicates that the element has completed its operation. This value should be combined with either OK, Error, or Degraded in the PrimaryStatus so that a client can tell if the complete operation Completed with OK (passed), Completed wgi>x� � ���� � �c��k � ��Q�h � oG�J � bAYD � O�# ;�tJ% � �Z�� � �TI%
� 7r��
� �1��� � �I��
� �H�3� � \g�; �q!�R � �M��
� _�a:� p 3ގq1 � ��F�� � Dg�ܢ p M�� � O�NV� � u �>� p _ _ C a c h e C o n t r o l Eȝ��C�� __CacheControl �� ) 5 ����~ � __ObjectProviderCacheControl singleton ClearAfter e
� a k t datetime SUBTYPE interval �7 9 8 2 F 1 0 1 7 5 3 8 F C A 6 3 9 8 7 4 8 4 1 D 6 8 F A D 4 E 2 4 8 6 6 6 7 1 A 5 C D E 2 C 6 C B 4 C 1 6 9 C 8 5 9 2 0 3 D 9 Fȝ��C�Eȝ��C�P 9 � __ObjectProviderCacheControl 00000000000030.000000:000 _ _ C a c h e C o n t r o l Gȝ��C�� __CacheControl �� + 7 !����� � __PropertyProviderCacheControl singleton ClearAfter e
� c m v datetime SUBTYPE interval �A 2 F 0 F 7 3 1 7 8 9 B 8 B D 6 2 9 4 8 8 6 F F B A 9 5 B 7 4 C E A 7 B 8 6 0 7 2 9 8 8 F 1 0 1 A C F 5 3 F D 6 E 8 4 0 B 3 5 A Hȝ��C�Gȝ��C�R ; � __PropertyProviderCacheControl 00000000000030.000000:000 _ _ C a c h e C o n t r o l Iȝ��C�� __CacheControl �� ( 4 ����} � __EventProviderCacheControl singleton ClearAfter e
� ` j s datetime SUBTYPE interval �C 9 3 7 F F 2 9 6 0 3 6 6 D 3 6 7 9 A B 8 F 2 3 C 7 A 6 B 5 0 8 B 4 1 E 3 5 2 2 6 B 8 C 5 F D 6 7 A C 4 5 1 6 3 D 3 C 6 4 3 5 0 Jȝ��C�Iȝ��C�O 8 � __EventProviderCacheControl 00000000000030.000000:000 _ _ C a c h e C o n t r o l Kȝ��C�� __CacheControl % �� 0 < %����� � __EventConsumerProviderCacheControl singleton ClearAfter e
� h r { datetime SUBTYPE interval �2 0 F 2 6 C 6 2 3 6 C 8 2 5 2 E 1 F C B B 5 0 8 B 5 F 5 7 8 1 4 4 9 3 0 4 B F B C 2 7 6 C 5 E 3 D D 7 4 7 A 3 A 2 6 9 8 9 7 4 6 Lȝ��C�Kȝ��C�W % @ � __EventConsumerProviderCacheControl 00000000000030.000000:000 _ _ C a c h e C o n t r o l Mȝ��C�� __CacheControl �� $ 0 ����y � __EventSinkCacheControl singleton ClearAfter e
� \ f o datetime SUBTYPE interval �4 4 7 7 C A 6 6 9 7 9 E B 3 6 A 4 8 1 2 E B 8 4 0 6 4 B 5 7 F C F 1 0 A 1 7 5 9 5 E 6 D 4 3 3 2 0 B 7 0 1 2 B E 2 E E B F 1 2 B Nȝ��C�Mȝ��C�K 4 � __EventSinkCacheControl 00000000000015.000000:000
_ _ S y s t e m C l a s s Oȝ��C�� __SystemClass " �� - = d t � � � � U�����������������������������E � __ProviderHostQuotaConfiguration singleton HandlesPerHost
� \ uint32 MemoryAllHosts
� � uint64 MemoryPerHost
� � uint64 ProcessLimitAllHosts
� uint32 ThreadsPerHost
� = uint32 �B B C B 5 0 A 3 E 3 5 B B 9 6 7 2 B 8 B 4 5 8 A 1 6 D D 2 4 2 D D D D E A 6 B E D 4 8 E 2 5 A B A 8 E E F 2 B 0 E 4 9 A 9 B 3 E Pȝ��C�Oȝ��C�R @ " � __ProviderHostQuotaConfiguration
_ _ S y s t e m C l a s s Qȝ��C�� __SystemClass �� * 6 ����] � __ListOfEventActiveNamespaces singleton Namespaces
� U string pa �
_ _ S y s t e m C l a s s Rȝ��C�{ Z __SystemClass �� & ? f } � � � . J q � � � � * ; b z � � � � 4 [ x � � � � + R d � � � � UUUUU�������������������������������������������������������������������������������������> � __ArbitratorConfiguration singleton OutstandingTasksPerUser
� ^ uint32 OutstandingTasksTotal
� � uint32 PermanentSubscriptionsPerUser 8
� � uint32 PermanentSubscriptionsTotal H
� & uint32 PollingInstructionsPerUser <
� i uint32 PollingInstructionsTotal L
� � uint32 PollingMemoryPerUser @
� � uint32 PollingMemoryTotal P
� " uint32 QuotaRetryCount
� Z uint32 QuotaRetryWaitInterval
� � uint32 TaskThreadsPerUser
� � uint32 TaskThreadsTotal
�
uint32 TemporarySubscriptionsPerUser
4
� S uint32 TemporarySubscriptionsTotal D
� � uint32 TotalCacheDisk 0
� � uint32 TotalCacheDiskPerTask
(
� uint32 TotalCacheDiskPerUser ,
� J uint32 TotalCacheMemory $
� � uint32 TotalCacheMemoryPerTask
� � uint32 TotalCacheMemoryPerUser
� uint32 TotalUsers
� 6 uint32 �6 E D C A D 2 4 9 3 C B 9 C 9 A E 0 6 6 E 7 7 6 4 2 8 1 8 C 8 D 9 B 9 B C 3 1 2 C 7 B 4 C 3 A 7 6 A 0 7 8 7 1 F 0 E 6 0 F E B 1 Sȝ��C�Rȝ��C�� �
�: 2 ( 2� d� � � � @KL ' ' ' ��� � __ArbitratorConfiguration
_ _ S y s t e m C l a s s Tȝ��C�� __SystemClass �� " 1 X q � � � � E�������� ���� � __CIMOMIdentification singleton SetupDateTime
� P string VersionCurrentlyRunning
� � string VersionUsedToCreateDB
� � string WorkingDirectory
� string 10.0.20348.1 �F D 1 C 1 D 4 1 4 B 7 1 B 5 0 8 2 C 2 6 6 A 6 5 0 E 3 1 E F 6 D 5 0 1 9 3 8 2 7 2 4 2 4 4 B 6 8 5 F 2 1 7 C 0 A A E 0 0 A 9 2 1 Uȝ��C�Cȝ��C�$ � __SystemSecurity 4 1 C 5 3 E 6 D B 1 A C F 2 4 5 3 C E F D 4 1 3 9 8 1 9 8 E 6 1 3 F 1 0 D F F 4 7 7 0 9 E C A B 1 D 7 F 0 3 7 7 5 6 A C 8 C E 7 Wȝ��C�ȝ��C�� � � __thisNAMESPACE � �� � � ? 6 4 6 5 9 A B 9 F 8 F 1 C 4 B 5 6 8 D B 6 4 3 8 B A E 1 1 B 2 6 E E 8 F 9 3 C B 5 F 8 1 9 5 E 2 1 E 8 C 3 8 3 D 6 C 4 4 C C 4 1 Xȝ��C�ȝ��C�-
� __NAMESPACE DEFAULT F D 1 C 1 D 4 1 4 B 7 1 B 5 0 8 2 C 2 6 6 A 6 5 0 E 3 1 E F 6 D 5 0 1 9 3 8 2 7 2 4 2 4 4 B 6 8 5 F 2 1 7 C 0 A A E 0 0 A 9 2 1 Yȝ��C�Cȝ��C�$ � __SystemSecurity 4 1 C 5 3 E 6 D B 1 A C F 2 4 5 3 C E F D 4 1 3 9 8 1 9 8 E 6 1 3 F 1 0 D F F 4 7 7 0 9 E C A B 1 D 7 F 0 3 7 7 5 6 A C 8 C E 7 [ȝ��C�ȝ��C�� � � __thisNAMESPACE � �� � � ? 6 4 6 5 9 A B 9 F 8 F 1 C 4 B 5 6 8 D B 6 4 3 8 B A E 1 1 B 2 6 E E 8 F 9 3 C B 5 F 8 1 9 5 E 2 1 E 8 C 3 8 3 D 6 C 4 4 C C 4 1 \ȝ��C�ȝ��C�.
� __NAMESPACE SECURITY F D 1 C 1 D 4 1 4 B 7 1 B 5 0 8 2 C 2 6 6 A 6 5 0 E 3 1 E F 6 D 5 0 1 9 3 8 2 7 2 4 2 4 4 B 6 8 5 F 2 1 7 C 0 A A E 0 0 A 9 2 1 ]ȝ��C�Cȝ��C�$ � __SystemSecurity 4 1 C 5 3 E 6 D B 1 A C F 2 4 5 3 C E F D 4 1 3 9 8 1 9 8 E 6 1 3 F 1 0 D F F 4 7 7 0 9 E C A B 1 D 7 F 0 3 7 7 5 6 A C 8 C E 7 _ȝ��C�ȝ��C�� � � __thisNAMESPACE � �� � � ? �w;pP ] ĥX� (�H�
g ���' � -̝��C�E
�� ( 1 m { � � ������������� � CIM_CollectionOfMSEs Locale Abstract Caption
� ] e @ string MaxLen CollectionID
� � � string MaxLen Description
� � string � C I M _ N u m e r i c S e n s o r TtR|�C�� t CIM_NumericSensor ) $ � ��� � � , D � � & � � � K [ � � # | � � � I a � � ( C ���WUU�������������������������������������������������������������������������������������������������������������� � CIM_TemperatureSensor Description This class exists for backward compatibility to earlier CIM Schema definitions. With additions to Sensor and NumericSensor in V2.2, it is no longer necessary. A TempertatureSensor can be defined by setting the SensorType property, inherited from Sensor, to 2 ("Temperature"). Other properties of this class are hard-coded to constant values to correspond to definitions in the sensor hierarchy. AMENDMENT LOCALE CurrentReading @ 2
� � sint32 Units tenths of degrees centigrade LowerThresholdCritical @ 8
� p x sint32 Units tenths of degrees centigrade LowerThresholdFatal @ <
� � � � sint32 Units tenths of degrees centigrade LowerThresholdNonCritical @ @
� R Z a sint32 Units tenths of degrees centigrade MaxReadable @ D
� � � � sint32 Units tenths of degrees centigrade MinReadable @ H
� & - sint32 Units tenths of degrees centigrade NominalReading @ L
� � � � sint32 Units tenths of degrees centigrade NormalMax @ P
� � � � sint32 Units tenths of degrees centigrade NormalMin @ T
� O W ^ sint32 Units tenths of degrees centigrade Resolution @ X
� � � � uint32 Units hundredths of degrees centigrade Tolerance @ \
� $ + sint32 Units tenths of degrees centigrade UpperThresholdCritical @ `
� � � � sint32 Units tenths of degrees centigrade UpperThresholdFatal @ d
� �
sint32 Units tenths of degrees centigrade UpperThresholdNonCritical @ h
� o w ~ sint32 Units tenths of degrees centigrade �
C I M _ S e n s o r ZtR|�C�; t CIM_Sensor ) � ��� � � [ k � � a y � � 8 S @ M � � � S
^
� � � � & � � � ���_UUU�������������������������������������������������������������������������������������������������������������� � CIM_NumericSensor Description A numeric sensor is capable of returning numeric readings and optionally supports thresholds settings. AMENDMENT LOCALE Accuracy . +
� � � � = D sint32 Description Indicates the accuracy of the sensor for the measured property. Its value is recorded as plus/minus hundredths of a percent. Accuracy, along with resolution and tolerance, is used to calculate the actual value of the measured physical property. Accuracy may vary depending on whether the device is linear over its dynamic range. Units hundredths of percent CurrentReading 2
� � � � sint32 Description The current value indicated by the sensor. IsLinear 6
� $ boolean Description Indicates that the sensor is linear over its dynamic range. LowerThresholdCritical 8
� � � � sint32 Description The Sensor's threshold values specify the ranges (min and max values) for determining whether the Sensor is operating under Normal, NonCritical, Critical or Fatal conditions. If the CurrentReading is between LowerThresholdCritical and LowerThresholdFatal, then the CurrentState is Critical. LowerThresholdFatal <
� ' 4 sint32 Description The sensor's threshold values specify the ranges (min and max values) for determining whether the Sensor is operating under Normal, NonCritical, Critical or Fatal conditions. If the CurrentReading is below LowerThresholdFatal, then the CurrentState is Fatal. LowerThresholdNonCritical @
� � � sint32 Description The sensor's threshold values specify the ranges (min and max values) for determining whether the Sensor is operating under Normal, NonCritical, Critical or Fatal conditions. If CurrentReading is between LowerThresholdNonCritical and UpperThresholdNonCritical, then the Sensor is reporting a normal value. If CurrentReading is between LowerThresholdNonCritical and LowerThresholdCritical, then the CurrentState is NonCritical. MaxReadable D
� y � � sint32 Description MaxReadable indicates the largest value of the measured property that can be read by the numeric sensor. MinReadable H
� 1 9 F sint32 Description MinReadable indicates the smallest value of the measured property that can be read by the numeric sensor. NominalReading L
� � �
sint32 Description NominalReading indicates the 'normal' or expected value for the numeric sensor. NormalMax P
� �
�
�
sint32 Description NormalMax provides guidance for the user as to the normal maximum range for the numeric sensor. NormalMin T
� 7 ? L sint32 Description NormalMin provides guidance for the user as to the normal minimum range for the numeric sensor. Resolution X
� � � � uint32 Description Resolution indicates the ability of the sensor to resolve differences in the measured property. This value may vary depending on whether the device is linear over its dynamic range. Tolerance \
� � � � sint32 Description Indicates the tolerance of the sensor for the measured property. Tolerance, along with resolution and accuracy, is used to calculate the actual value of the measured physical property. Tolerance may vary depending on whether the device is linear over its dynamic range. UpperThresholdCritical `
� R Z g sint32 Description The sensor's threshold values specify the ranges (min and max values) for determining whether the Sensor is operating under Normal, NonCritical, Critical or Fatal conditions. If the CurrentReading is between UpperThresholdCritical and UpperThresholdFatal, then the CurrentState is Critical. UpperThresholdFatal d
� � � � sint32 Description The sensor's threshold values specify the ranges (min and max values) for determining whether the Sensor is operating under Normal, NonCritical, Critical or Fatal conditions. If the CurrentReading is above UpperThresholdFatal, then the CurrentState is Fatal. UpperThresholdNonCritical h
� , 4 A sint32 Description The sensor's threshold values specify the ranges (min and max values) for determining whether the Sensor is operating under Normal, NonCritical, Critical or Fatal conditions. If the CurrentReading is between LowerThresholdNonCritical and UpperThresholdNonCritical, then the Sensor is reporting a normal value. If the CurrentReading is between UpperThresholdNonCritical and UpperThresholdCritical, then the CurrentState is NonCritical. �6 4 6 5 9 A B 9 F 8 F 1 C 4 B 5 6 8 D B 6 4 3 8 B A E 1 1 B 2 6 E E 8 F 9 3 C B 5 F 8 1 9 5 E 2 1 E 8 C 3 8 3 D 6 C 4 4 C C 4 1 �wR|�C�ȝ��C�,
� __NAMESPACE MS_409 ���'� � �+�rp � 5��D � D,Qk> � >��D
b�F�8 � � ��1 �n3 � ��� � 1�!� � �K0� � ܯ�� � K�k?� � �j�LV � C I M _ P h y s i c a l C o n n e c t o r �ȝ��C�> i CIM_PhysicalConnector )
�� " J Y � 3 B t � � � / C � � B S � � ! � � ����UU�������������������������������������������������������������������������������������������������� � CIM_Slot abstract Locale UUID {FAF76B86-798C-11D2-AAD1-006008C78BC7} ConnectorType ` > 6
� � � ��� � � � uint16 Override ConnectorType MappingStrings � MIF.DMTF|System Slot|004.2 HeightAllowed D
� + � �� real32 LengthAllowed H
� l � �� real32 MaxDataWidth L )
� � � � � �� uint16 MappingStrings � MIF.DMTF|System Slot|004.3 Number `
� ' � �� uint16 PurposeDescription \ )
� z � � � �� string ModelCorrespondence � CIM_Slot.SpecialPurpose SpecialPurpose Z )
� � � �� boolean ModelCorrespondence % CIM_Slot.PurposeDescription SupportsHotPlug B
� } � �� boolean ThermalRating V )
� � � � � �� uint32 MappingStrings � MIF.DMTF|System Slot|004.11 VccMixedVoltageSupport N )
� X ` p � �� uint16 MappingStrings x MIF.DMTF|System Slot|004.9 VppMixedVoltageSupport R )
� � � � � �� uint16 MappingStrings MIF.DMTF|System Slot|004.10 � C I M _ C o n n e c t e d T o �ȝ��C�� CIM_ConnectedTo ) �� " ( P \ � � U��������. � CIM_SlotInSlot Abstract Locale UUID {FAF76B87-798C-11D2-AAD1-006008C78BC7} Antecedent f@ )
� � � ��� � ref:CIM_Slot Override Antecedent Dependent f@ 6
� � �� ) ref:CIM_Slot Override Dependent Max � � �ȝ��C�� 4 �� ��* 2 8 ` v � � � � ' . U��������������f � CIM_AdjacentSlots Abstract Association Locale UUID {FAF76B88-798C-11D2-AAD1-006008C78BC7} DistanceBetweenSlots
� � � �� real32 SharedSlots
� � � �� boolean SlotA f
� � �� ref:CIM_Slot SlotB f
� X � �� ref:CIM_Slot � C I M _ D e p e n d e n c y �ȝ��C�� CIM_Dependency ) �� % + S _ � � U��������< � CIM_PackageInSlot Abstract Locale UUID {FAF76B89-798C-11D2-AAD1-006008C78BC7} Antecedent f@ )
� � � ��� � ref:CIM_Slot Override Antecedent Dependent f@ 6
� � ��" , 7 ref:CIM_PhysicalPackage Override Dependent Max :C � C I M _ P a c k a g e I n S l o t �ȝ��C�� CIM_PackageInSlot 6 �� * N V \ � � � � U��������b � CIM_CardInSlot Abstract MappingStrings 2 MIF.DMTF|System Slot|004.4 Locale UUID {FAF76B8A-798C-11D2-AAD1-006008C78BC7} Antecedent f@ )
� � � ��� � ref:CIM_Slot Override Antecedent Dependent f@ 6
� : � ��H M W ref:CIM_Card Max Override Dependent � �
C I M _ C o m p o n e n t �ȝ��C�� CIM_Component ) �� ( . V f � � e��������Y � CIM_LinkHasConnector Abstract Locale UUID {FAF76B8B-798C-11D2-AAD1-006008C78BC7} GroupComponent f@ 6
� � � ��� � � ref:CIM_PhysicalLink Override GroupComponent Max PartComponent f@ )
� % � ��@ J ref:CIM_PhysicalConnector Override PartComponent � �
C I M _ C o n t a i n e r �ȝ��C��
CIM_Container ) ��" * 0 X h � � u������������^ � CIM_ConnectorOnPackage Abstract Locale UUID {FAF76B8C-798C-11D2-AAD1-006008C78BC7} GroupComponent f@ 6
� � � ��� � � ref:CIM_PhysicalPackage Max Override GroupComponent PartComponent f@ )
� * � ��E O ref:CIM_PhysicalConnector Override PartComponent t � C I M _ D e p e n d e n c y �ȝ��C�� CIM_Dependency ) ��% - 3 [ g � � U��������C � CIM_ComputerSystemPackage Abstract Locale UUID {FAF76B8D-798C-11D2-AAD1-006008C78BC7} Antecedent f@ )
� � � ��� � ref:CIM_PhysicalPackage Override Antecedent Dependent f@ )
� � ��. 8 ref:CIM_UnitaryComputerSystem Override Dependent en � C I M _ D e p e n d e n c y �ȝ��C�� CIM_Dependency ) �� & , T ` � � U��������4 � CIM_PackageCooling Abstract Locale UUID {FAF76B8E-798C-11D2-AAD1-006008C78BC7} Antecedent f@ )
� � � ��� � ref:CIM_CoolingDevice Override Antecedent Dependent f@ )
� � �� ) ref:CIM_PhysicalPackage Override Dependent D � C I M _ D e p e n d e n c y �ȝ��C�� CIM_Dependency 4 ��! ��. 6 < d p � � U��������H � CIM_PackageTempSensor Abstract Aggregation Locale UUID {FAF76B8F-798C-11D2-AAD1-006008C78BC7} Antecedent f@ )
� � � ��� � ref:CIM_TemperatureSensor Override Antecedent Dependent f@ )
� � ��3 = ref:CIM_PhysicalPackage Override Dependent A � C I M _ D e p e n d e n c y �ȝ��C�� CIM_Dependency 4 �� ��) 1 7 _ k � � U��������= � CIM_PackageAlarm Abstract Aggregation Locale UUID {FAF76B90-798C-11D2-AAD1-006008C78BC7} Antecedent f@ )
� � � ��� � ref:CIM_AlarmDevice Override Antecedent Dependent f@ )
� � ��( 2 ref:CIM_PhysicalPackage Override Dependent � ɝ��C�� 4 �� ��( 0 6 ^ e � � � � U����������1 � CIM_ActsAsSpare Abstract Association Locale UUID {64C1726E-DB21-11d2-85FC-0000F8102E5F} Group f
� � � �� ref:CIM_SpareGroup HotStandby
� � � �� BOOLEAN Spare f
� � �� ref:CIM_ManagedSystemElement UI � ɝ��C��
4 ��! ) / W �� d ~ � � � U������������B � CIM_CompatibleProduct Abstract Locale UUID {2F648FBA-DB22-11d2-85FC-0000F8102E5F} Association CompatibilityDescription
� � � �� STRING CompatibleProduct f
� � � �� ref:CIM_Product Product f
� 1 � �� ref:CIM_Product bs � W i n 3 2 _ P n P D e v i c e P r o p e r t y ʝ��C�� ! Win32_PnPDeviceProperty % ����������������������W � Win32_PnPDevicePropertySint32 Data
� O � �� Sint32 � se� �
ͻ��h � ��g�! �
K� � p �T��E T ���K� �}�� ( 2���� � ���7� 0 �6��� R %~�{( . b؝��C�� 6 " ) � �� � 1 ? � Msft_MiStreamTasks ClassVersion 1.0.1 locale mistreamprov
? 8 C � C � � p �
oca �
. 2 � � Collect # ��0 �� implemented static ae442007200009F ROOT\InventoryLogging ���� � �� �� * � ����� � __PARAMETERS abstract Filename string
� 4 In
� 4 [ �� ID )
� � [ ��� string __ �> ae442007200009F ROOT\InventoryLogging ���� � �� �� * � � ��������� � __PARAMETERS abstract
Results object
� 3 Out
� 3 Z �� Stream
'
� 3 Z ��� �� EmbeddedObject
2
� 3 Z ��� ��� �� ID
?
� g Z ��� ��� �� object ReturnValue uint32
� � uint32 out
� � � �� __ � Push � ��� �� implemented static � ae442007200009F ROOT\InventoryLogging ���� � �T �� � P * � ������� � __PARAMETERS abstract Filename string
� 4 In
� 4 [ �� ID )
� � [ ��� string CheckCollectionHistory boolean
� � In
� � �� ID )
� � ��L boolean __ �� ae442007200009F ROOT\InventoryLogging ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � Flush ��& �� implemented static � ae442007200009F ROOT\InventoryLogging ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ �6 4 6 5 9 A B 9 F 8 F 1 C 4 B 5 6 8 D B 6 4 3 8 B A E 1 1 B 2 6 E E 8 F 9 3 C B 5 F 8 1 9 5 E 2 1 E 8 C 3 8 3 D 6 C 4 4 C C 4 1 c؝��C�ȝ��C�)
� __NAMESPACE Dns F D 1 C 1 D 4 1 4 B 7 1 B 5 0 8 2 C 2 6 6 A 6 5 0 E 3 1 E F 6 D 5 0 1 9 3 8 2 7 2 4 2 4 4 B 6 8 5 F 2 1 7 C 0 A A E 0 0 A 9 2 1 d؝��C�Cȝ��C�$ � __SystemSecurity 4 1 C 5 3 E 6 D B 1 A C F 2 4 5 3 C E F D 4 1 3 9 8 1 9 8 E 6 1 3 F 1 0 D F F 4 7 7 0 9 E C A B 1 D 7 F 0 3 7 7 5 6 A C 8 C E 7 f؝��C�ȝ��C�� � � __thisNAMESPACE � �� � � ? 5 7 E 5 F 3 A D D 9 E 2 4 2 C 4 E 9 F 9 E D F 7 9 A A 9 7 F 7 9 E 7 9 1 1 C 5 A 8 B 9 0 2 E C 1 5 0 D 6 4 4 2 E 3 B 8 5 A 5 A A g؝��C�ȝ��C�� �����M @ 9 b � __Win32Provider {ED4B1828-CD88-460F-AEFF-3D63FC8BBF68} NetworkServiceHost DnsClientPSProvider 7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D h؝��C�
ȝ��C�� i � __MethodProviderRegistration \\.\root\Microsoft\Windows\Dns:__Win32Provider.Name="DnsClientPSProvider" R O O T \ M i c r o s o f t \ W i n d o w s \ D n s _ _ M e t h o d P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 2 0 0 7 7 C 6 1 A E 9 5 9 B 1 A 6 3 1 C A 3 A 6 4 4 9 3 D 2 4 C B F 9 A A D B 0 D 6 1 5 F 6 3 F 6 1 9 D 6 D 6 1 9 F 5 B B 4 9 5 \ K I _ 7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D \ I _ F 6 9 3 A 7 0 3 3 B B 3 3 D 7 4 0 5 B F B 9 8 C 5 A 3 4 1 5 9 2 3 C C 9 F 4 E C 8 A C 3 3 0 A F F 5 4 5 C F 2 1 B B 4 1 9 0 5 F a � i؝��C��
6 # * � �� � 2 G _ � � � U������������I � DnsClientNrptGlobal ClassVersion 1.0.0 locale DnsClientPSProvider EnableDAForAllNetworks 4
� � � �� � ��� � string ValueMap � � � � Disable EnableOnNetworkId EnableDA DisableDA QueryPolicy 4
� G � �� � ��O Y string ValueMap i r � Disable QueryIPv6Only QueryBoth SecureNameQueryFallback 4
� � � �� � ��� � string ValueMap
& 8 Disable FallbackSecure FallbackUnsecure FallbackPrivate � � R O O T \ M i c r o s o f t \ W i n d o w s \ S t o r a g e _ _ M e t h o d P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 2 E E E F 6 0 8 6 B 5 A A 3 1 4 8 D E 8 D C 3 E 7 A 7 2 6 3 A 4 1 7 E E 8 4 9 A 2 7 6 B D B 3 5 7 8 7 4 F D E B 8 A D E D 3 1 8 \ K I _ 7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D \ I _ 6 1 4 F E B 5 1 9 8 D B 6 3 5 6 C 7 D 4 E 7 0 E 5 8 F 0 6 3 4 9 3 6 B C 6 D E 5 3 0 A A 5 F D 9 5 2 2 0 7 E 5 6 B 5 A 8 9 D 3 F . 0 ,B0 8 9 9 3 0 7 4 0 8 A 3 2 0 4 0 A 6 D A 1 9 C 0 B 1 E C 2 7 4 5 A 3 D 6 0 4 B A A 9 D F F E 8 E E 4 B 7 5 C 3 D 9 1 E 1 6 1 0 9 q؝��C�ȝ��C�� a � � __EventProviderRegistration = c � � � 4 select * from MSFT_HealthActionEvent select * from MSFT_StorageAlertEvent select * from MSFT_StorageArrivalEvent select * from MSFT_StorageDepartureEvent select * from MSFT_StorageFaultEvent select * from MSFT_StorageHealthStatusChangeEvent select * from MSFT_StorageModificationEvent \\.\root\Microsoft\Windows\Storage:__Win32Provider.Name="StorageWMI" R O O T \ M i c r o s o f t \ W i n d o w s \ S t o r a g e _ _ E v e n t P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 2 E E E F 6 0 8 6 B 5 A A 3 1 4 8 D E 8 D C 3 E 7 A 7 2 6 3 A 4 1 7 E E 8 4 9 A 2 7 6 B D B 3 5 7 8 7 4 F D E B 8 A D E D 3 1 8 \ K I _ 0 8 9 9 3 0 7 4 0 8 A 3 2 0 4 0 A 6 D A 1 9 C 0 B 1 E C 2 7 4 5 A 3 D 6 0 4 B A A 9 D F F E 8 E E 4 B 7 5 C 3 D 9 1 E 1 6 1 0 9 \ I _ 6 1 4 F E B 5 1 9 8 D B 6 3 5 6 C 7 D 4 E 7 0 E 5 8 F 0 6 3 4 9 3 6 B C 6 D E 5 3 0 A A 5 F D 9 5 2 2 0 7 E 5 6 B 5 A 8 9 D 3 F �[�yp u ����� ��,_� в�� � 5 h ��:} N 5 7 E 5 F 3 A D D 9 E 2 4 2 C 4 E 9 F 9 E D F 7 9 A A 9 7 F 7 9 E 7 9 1 1 C 5 A 8 B 9 0 2 E C 1 5 0 D 6 4 4 2 E 3 B 8 5 A 5 A A ͝��C�ȝ��C�� ������r 9 a � � __Win32Provider {B0A2AB46-F612-4469-BEC4-7AB038BC476C} {B0A2AB46-F612-4469-BEC4-7AB038BC476C} LocalSystemHost HiPerfCooker_v1 E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C ͝��C� ȝ��C�� �� �� �� U � __InstanceProviderRegistration \\.\root\wmi:__Win32Provider.Name="HiPerfCooker_v1" R O O T \ W M I _ _ I n s t a n c e P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 3 F B D C B 0 8 E C D 3 3 F B E F 0 2 8 D 2 D B 3 E F 0 5 8 F 8 C E 9 5 9 7 7 9 B 9 4 3 F 4 3 A B 3 D B 3 E C 3 4 A C A 1 4 7 D \ K I _ E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C \ I _ B 4 B E 7 9 6 E 4 9 B D 9 4 0 E F 3 2 3 3 A A 1 E 2 0 E 0 2 F 7 4 C 4 9 D 5 8 8 0 3 E F B 7 D C 7 A 8 B F 1 9 6 5 7 D 6 8 5 4 C � C I M _ M a n a g e d E l e m e n t �̝��C�� ) CIM_ManagedElement ) $ ! ��, 4 O � � � g � C S � � 3 �U��������������������������������������� � CIM_RegisteredProfile Description A RegisteredProfile describes a set of CIM Schema classes with required properties and/or methods, necessary to manage a real-world entity or to support a usage scenario, in an interoperable fashion. RegisteredProfiles can be defined by the DMTF or other standards organizations. Note that this class should not be confused with CIM_Profile, which collects SettingData instances, to be applied as a 'configuration profile' for an element.
A RegisteredProfile is a named 'standard' for CIM-based management of a particular System, subsystem, Service or other entity, for a specified set of uses. It is a complete, standalone definition, as opposed to the subclass RegisteredSubProfile, which requires a scoping profile for context.
The uses for a RegisteredProfile or SubProfile MUST be specified in the document that defines the profile. Examples of Profiles are to manage various aspects of an Operating System, Storage Array, or Database. The name of the profile is defined and scoped by its authoring organization. AMENDMENT LOCALE AdvertiseTypeDescriptions "
� { � � string Description A free-form string providing additional information related to the AdvertiseType. A description MUST be provided when the AdvertiseType is 1, "Other". An entry in this array corresponds to the entry in the AdvertiseTypes array at the same index. It is not expected that additional descriptions are needed if the Type is set to "Not Advertised" or "SLP". However, as the SLP template expands, or as other advertisement mechanisms are defined, support for additional descriptions may be needed. This array is defined to support this. AdvertiseTypes 8
� � � � � � uint16 Description This property signifies the advertisement for the profile information. It is used by the advertising services of the WBEM infrastructure to determine what should be advertised, via what mechanisms. The property is an array so that the profile MAY be advertised using several mechanisms. Note: If this property is null/uninitialized, this is equivalent to specifying the value 2, "Not Advertised". ValueMap � � � 1 2 3 Values � � � Other Not Advertised SLP InstanceID @ )
� 8 @ M � �� string Description Within the scope of the instantiating Namespace, InstanceID opaquely and uniquely identifies an instance of this class. In order to ensure uniqueness within the NameSpace, the value of InstanceID SHOULD be constructed using the following 'preferred' algorithm:
<OrgID>:<LocalID>
Where <OrgID> and <LocalID> are separated by a colon ':', and where <OrgID> MUST include a copyrighted, trademarked or otherwise unique name that is owned by the business entity creating/defining the InstanceID, or is a registered ID that is assigned to the business entity by a recognized global authority. (This is similar to the <Schema Name>_<Class Name> structure of Schema class names.) In addition, to ensure uniqueness, <OrgID> MUST NOT contain a colon (':'). When using this algorithm, the first colon to appear in InstanceID MUST appear between <OrgID> and <LocalID>.
<LocalID> is chosen by the organizational entity and SHOULD not be re-used to identify different underlying (real-world) elements. If the above 'preferred' algorithm is not used, the defining entity MUST assure that the resultant InstanceID is not re-used across any InstanceIDs produced by this or other providers for this instance's NameSpace.
For DMTF defined instances, the 'preferred' algorithm MUST be used with the <OrgID> set to 'CIM'. OtherRegisteredOrganization
� � � � string Description A free-form string providing a description of the organization when 1, "Other", is specified for the RegisteredOrganization. RegisteredName
� � � string Description The name of this registered profile. Since multiple versions can exist for the same RegisteredName, the combination of RegisteredName, RegisteredOrganization, and RegisteredVersion MUST uniquely identify the registered profile within the scope of the organization. RegisteredOrganization 8
� � > H � � uint16 Description The organization that defines this profile. ValueMap � � � � � � � � � � � � � � � � � � � � � 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 .. Values K R X a � � � � � � � � � � � � � Other DMTF CompTIA Consortium for Service Innovation FAST GGF INTAP itSMF NAC Northwest Energy Efficiency Alliance SNIA TM Forum The Open Group ANSI IEEE IETF INCITS ISO W3C OGF DMTF Reserved RegisteredVersion
� _ g t string Description The version of this profile. The string representing the version MUST be in the form:
M + "." + N + "." + U
Where:
M - The major version (in numeric form) describing the profile's creation or last modification.
N - The minor version (in numeric form) describing the profile's creation or last modification.
U - The update (e.g. errata, patch, ..., in numeric form) describing the profile's creation or last modification. � �̝��C�P ) � ��� � � H S ���������� � CIM_Dependency Description CIM_Dependency is a generic association used to establish dependency relationships between ManagedElements. AMENDMENT LOCALE Antecedent f )
� � � ��� ref:CIM_ManagedElement Description Antecedent represents the independent object in this association. Dependent f )
� � � ��� � ref:CIM_ManagedElement Description Dependent represents the object that is dependent on the Antecedent. io � C I M _ D e p e n d e n c y �̝��C� CIM_Dependency ) $ ` ��k s " ���������� � CIM_ReferencedProfile Description A profile that is referenced by another RegisteredProfile. AMENDMENT LOCALE Antecedent f@
� � � � ref:CIM_RegisteredProfile Description The RegisteredProfile that is referenced by the Dependent Profile. Dependent f@
� N i v ref:CIM_RegisteredProfile Description A RegisteredProfile that references other profiles. � io � �� �j�� t� �m� � Q #�V� � ��
C
�U=�S ��j{k >��s � C I M _ M a n a g e d S y s t e m E l e m e n t sȝ��C�� " CIM_ManagedSystemElement ) �� & , ����������������������T � CIM_LogicalElement Abstract Locale UUID {8502C518-5FBB-11D2-AAC1-006008C78BC7} � C I M _ L o g i c a l E l e m e n t tȝ��C�� CIM_LogicalElement ) �� & , ����������������������T � CIM_SystemResource Abstract Locale UUID {8502C519-5FBB-11D2-AAC1-006008C78BC7} � C I M _ S y s t e m R e s o u r c e uȝ��C� 0 CIM_SystemResource ) �� ! I W n � % � � 3 > � � o | �WU���������������������������������������������K � CIM_IRQ Abstract Locale UUID {8502C51A-5FBB-11D2-AAC1-006008C78BC7} Availability $ 6
� � � ��� � � � uint16 ValueMap � � � � � 1 2 3 4 5 MappingStrings � MIF.DMTF|IRQ|001.2 CreationClassName 4
� U � ��] ��f string CIM_Key MaxLen CSCreationClassName A
� � � ��� � �� string Propagated CIM_ComputerSystem.CreationClassName CIM_Key MaxLen CSName A
� t � ��| � � ��� string Propagated CIM_ComputerSystem.Name CIM_Key MaxLen IRQNumber 4
� � � �� � �� uint32 MappingStrings MIF.DMTF|IRQ|001.1 Shareable * )
� u � ��~ � boolean MappingStrings � MIF.DMTF|IRQ|001.4 TriggerLevel ( 6
� � � �� . > uint16 ValueMap " % ( + 1 2 3 4 MappingStrings F MIF.DMTF|System Resource IRQ Info|001.3 TriggerType
& 6
� � � ��� � � uint16 ValueMap � � � � 1 2 3 4 MappingStrings " MIF.DMTF|IRQ|001.3 MIF.DMTF|System Resource IRQ Info|001.2 � C I M _ S y s t e m R e s o u r c e vȝ��C�� 3 CIM_SystemResource ) �� & , T g � � q y � � �W�������������������������������������������������, � CIM_MemoryMappedIO Abstract Locale UUID {8502C51B-5FBB-11D2-AAC1-006008C78BC7} CreationClassName 4
� � � ��� � �� string MaxLen CIM_Key CSCreationClassName A
� & � ��. : ` ��i string Propagated CIM_ComputerSystem.CreationClassName CIM_Key MaxLen CSName A
� � � ��� � � � �� string Propagated CIM_ComputerSystem.Name MaxLen CIM_Key EndingAddress ( )
� L � ��T d uint64 MappingStrings l MIF.DMTF|Memory Mapped I/O|001.2 StartingAddress 4
� � � ��� ��� uint64 CIM_Key MappingStrings
MIF.DMTF|Memory Mapped I/O|001.1 � C I M _ S y s t e m R e s o u r c e wȝ��C�
? CIM_SystemResource ) �� !
I V % � � E O � � H ] � � � � � � y � E O �WUU����������������������������������������������������������� � CIM_DMA Abstract Locale UUID {8502C523-5FBB-11D2-AAC1-006008C78BC7} AddressSize , 6
� � � ��� � � � uint16 ValueMap � � � � � 0 8 16 32 64 MappingStrings � MIF.DMTF|System Resource DMA Info|001.3 Availability $ 6
� i � ��q { � � uint16 ValueMap � � � � � 1 2 3 4 5 MappingStrings � MIF.DMTF|DMA|001.2 BurstMode
& )
� � �� ) boolean MappingStrings 1 MIF.DMTF|DMA|001.3 ByteMode 2 6
� � � ��� � � � uint16 ValueMap � � � � 1 2 3 4 MappingStrings � MIF.DMTF|System Resource DMA Info|001.7 ChannelTiming 6 6
� Y � ��a k � � uint16 ValueMap � � � � � � 1 2 3 4 5 6 MappingStrings � MIF.DMTF|System Resource DMA Info|001.9 CreationClassName 4
� / � ��7 ? �� string MaxLen CIM_Key CSCreationClassName A
� � � ��� � � � �� string Propagated CIM_ComputerSystem.CreationClassName MaxLen CIM_Key CSName A
� N � ��V b { ��� string Propagated CIM_ComputerSystem.Name CIM_Key MaxLen DMAChannel 4
� � � �� � ��� � uint32 MappingStrings � MIF.DMTF|DMA|001.1 MaxTransferSize
. )
� V � ��^ n uint32 MappingStrings v MIF.DMTF|System Resource DMA Info|001.4 TransferWidths ( 6
� � � ��� < F uint16 MappingStrings MIF.DMTF|System Resource DMA Info|001.2 ValueMap b e h l p t 0 8 16 32 64 128 TypeCTiming 8 6
� � � ��� � uint16 ValueMap � � � � 1 2 3 4 5 MappingStrings MIF.DMTF|System Resource DMA Info|001.10 WordMode 4 6
� � � ��� � � � uint16 ValueMap � � � � 1 2 3 4 MappingStrings � MIF.DMTF|System Resource DMA Info|001.8 � C I M _ L o g i c a l E l e m e n t xȝ��C�� + CIM_LogicalElement ) �� $ L _ � � C X � � � � W�����������������������������������������' � CIM_System Abstract Locale UUID {8502C524-5FBB-11D2-AAC1-006008C78BC7} CreationClassName '
� � � �� � �� string CIM_Key Name @ 4
� � � ��� � � �� string Override Name NameFormat
� ; � �� string PrimaryOwnerContact
� � � �� string PrimaryOwnerName )
� � � @ � �� string MaxLen Roles $ '
� � �� � �� string �
C I M _ S y s t e m yȝ��C�� + CIM_System ) �� & , T ` ������������������������������������������W � CIM_ComputerSystem Abstract Locale UUID {8502C525-5FBB-11D2-AAC1-006008C78BC7} NameFormat @ 6
� � � ��� � � � string Override NameFormat ValueMap ! & , 1 6 ; B G P IP Dial HID NWA HWA X25 ISDN IPX DCC ICD E.164 SNA OID/OSI Other � C I M _ U s e r D e v i c e �ȝ��C�� S CIM_UserDevice ) �� & , T ` � � � � � � �����U������������������������������������������������������������������������������ � CIM_PointingDevice Abstract Locale UUID {8502C535-5FBB-11D2-AAC1-006008C78BC7} Handedness D
� � � �� uint16 NumberOfButtons F
� � � �� uint8 PointingType G 6
� & � ��. 8 { � uint16 ValueMap ` c f i l o r u x 1 2 3 4 5 6 7 8 9 MappingStrings � MIF.DMTF|Pointing Device|001.1 Resolution I
� � � �� uint32 � �N � Ɠ�|� 6 �I�� / H�Q' x �Q� n ��+Q� ' ���%
� mخI� E ���� �L; � �u�i� L oZ[ � Y}�� x )u�|� [ ���L� � C I M _ L o g i c a l E l e m e n t /ɝ��C�w " CIM_LogicalElement ) �� & , T g � � [ g �W��������������������������������� � CIM_JobDestination Abstract Locale UUID {673E0A2C-E3D0-11d2-8601-0000F8102E5F} CreationClassName 4
� � � �� � ��� STRING MaxLen SystemCreationClassName A
� ! � �� � ��) 1 = STRING MaxLen Propagated CIM_System.CreationClassName SystemName A
� � � �� � ��� � � STRING MaxLen Propagated CIM_System.Name � C I M _ C o n t r o l l e r 0ɝ��C� R CIM_Controller ) ��$ , 2 ����������������������������������������������������������������������������������Z � CIM_ManagementController Abstract Locale UUID {7250D62E-E3D0-11d2-8601-0000F8102E5F} � C I M _ C o n t r o l l e r 1ɝ��C�� R CIM_Controller ) �� % + ����������������������������������������������������������������������������������S � CIM_PCIController Abstract Locale UUID {7BB67AE8-E3D0-11d2-8601-0000F8102E5F} � C I M _ M e d i a A c c e s s D e v i c e 2ɝ��C�6 � CIM_MediaAccessDevice ) ��# + 1 ��������������������������������������������������������������������������������������������������������������������������������Y � CIM_MagnetoOpticalDrive Abstract Locale UUID {F62037D8-E3D0-11d2-8601-0000F8102E5F} � C I M _ M e d i a A c c e s s D e v i c e 3ɝ��C�, � CIM_MediaAccessDevice ) �� ! ' ��������������������������������������������������������������������������������������������������������������������������������O � CIM_WORMDrive Abstract Locale UUID {FFB58B9A-E3D0-11d2-8601-0000F8102E5F} � C I M _ L o g i c a l D e v i c e 4ɝ��C�� G CIM_LogicalDevice )
�� % �����������������������������������������������������������������������M � CIM_Scanner Abstract Locale UUID {07F12A62-E3D1-11d2-8601-0000F8102E5F} �
C I M _ S e n s o r 5ɝ��C�Z T CIM_Sensor ) �� $ * R b � � � � 7 M ����������������������������������������������������������������������������������� � CIM_BinarySensor Abstract Locale UUID {11140D44-E3D1-11d2-8601-0000F8102E5F} CurrentReading B
� � � �� BOOLEAN ExpectedReading D
� � � �� BOOLEAN InterpretationOfFalse F )
� ' � ��/ @ STRING MaxLen InterpretationOfTrue J )
� � � ��� @ STRING MaxLen �
C I M _ S e n s o r 6ɝ��C� T CIM_Sensor ) �� & , T f � � �����������������������������������������������������������������������������������[ � CIM_DiscreteSensor Abstract Locale UUID {1BF00330-E3D1-11d2-8601-0000F8102E5F} AcceptableValues B )
� � � ��� @ STRING MaxLen CurrentReading F )
� � � ��� @ STRING MaxLen PossibleValues J )
� K � ��S @ STRING MaxLen �
C I M _ S e n s o r 7ɝ��C�� G CIM_Sensor ) �� ( . �����������������������������������������������������������������������V � CIM_MultiStateSensor Abstract Locale UUID {237D964E-E3D1-11d2-8601-0000F8102E5F} � C I M _ N u m e r i c S e n s o r 8ɝ��C�� � CIM_NumericSensor ) �� " ( P ` � � 2 G � � $ 1 � � � � S ^ � � r } � � J _ � � ����U�W��������������������������������������������������������������������������������������������������������������������������������< � CIM_Tachometer Abstract Locale UUID {237D964F-E3D1-11d2-8601-0000F8102E5F} CurrentReading @ B )
� � � ��� � sint32 Override CurrentReading LowerThresholdCritical @ p )
� � �� sint32 Override LowerThresholdCritical LowerThresholdFatal @ ! x )
� ~ � ��� � sint32 Override LowerThresholdFatal LowerThresholdNonCritical @ h )
� � � ��� sint32 Override LowerThresholdNonCritical MaxReadable @ R )
� h � ��p z sint32 Override MaxReadable MinReadable @ V )
� � � ��� � sint32 Override MinReadable NominalReading @ F )
� 1 � ��9 C sint32 Override NominalReading NormalMax @ J )
� � � ��� � sint32 Override NormalMax NormalMin @ N )
� � � ��� sint32 Override NormalMin Resolution @ Z )
� T � ��\ f uint32 Override Resolution Tolerance @ ^ )
� � � ��� � sint32 Override Tolerance UpperThresholdCritical @ t )
� � ��( 2 sint32 Override UpperThresholdCritical UpperThresholdFatal @ " | )
� � � ��� � sint32 Override UpperThresholdFatal UpperThresholdNonCritical @ l )
� � �� ! sint32 Override UpperThresholdNonCritical � C I M _ S t o r a g e E x t e n t 9ɝ��C� b CIM_StorageExtent ) ��! ) / ��������������������������������������������������������������������������������������������������W � CIM_AggregatePSExtent Abstract Locale UUID {2D0E255C-E3D1-11d2-8601-0000F8102E5F} � C I M _ S t o r a g e E x t e n t :ɝ��C�� k CIM_StorageExtent ) ��$ , 2 Z o ������������������������������������������������������������������������������������������������������������ � CIM_ProtectedSpaceExtent Abstract Locale UUID {35E25AA4-E3D1-11d2-8601-0000F8102E5F} UserDataStripeDepth \ )
� � � ��� � UINT64 MappingStrings � MIF.DMTF|Protected Space Extent|001.6 � C I M _ S t o r a g e E x t e n t ;ɝ��C�> s CIM_StorageExtent ) �� ! ' O h � � �������������������������������������������������������������������������������������������������������������������b � CIM_VolumeSet Abstract Locale UUID {35E25AA5-E3D1-11d2-8601-0000F8102E5F} PSExtentInterleaveDepth \ )
� � � ��� � UINT64 MappingStrings � MIF.DMTF|Volume Set|001.5 PSExtentStripeLength d )
� ' � ��/ ? UINT64 MappingStrings G MIF.DMTF|Volume Set|001.4 � C I M _ L o g i c a l F i l e <ɝ��C�% ~ CIM_LogicalFile ) �� " ( ������������������������������������������������������������������������������������������������������������������������������P � CIM_DeviceFile Abstract Locale UUID {4333BD60-E3D1-11d2-8601-0000F8102E5F} � W i n 3 2 _ P n P D e v i c e P r o p e r t y ʝ��C�� ! Win32_PnPDeviceProperty % ����������������������W � Win32_PnPDevicePropertyString Data
� O � �� string � ��C� 8
��D�
_ � &G � 'y�� � y� x � �L��Z q �R��� �]� H ��3 � �1�j � C I M _ C o n t r o l l e r �ȝ��C�
� CIM_Controller ) �� ' - U n � � � ; X � � ' � � , � � O j � � . � � , ^ o V f �����_UUU���������������������������������������������������������������������������������������������������������������������������������������������� � CIM_VideoController Abstract Locale UUID {1008CCE5-7BFF-11D2-AAD2-006008C78BC7} AcceleratorCapabilities Z )
� � � ��� � uint16 ModelCorrespondence � CIM_VideoController.CapabilityDescriptions CapabilityDescriptions ^ 6
� R � ��Z e n � string ArrayType Indexed ModelCorrespondence � CIM_VideoController.AcceleratorCapabilities CurrentBitsPerPixel b )
� � �� uint32 MappingStrings $ MIF.DMTF|Video|003.12 CurrentHorizontalResolution f )
� � � ��� � uint32 MappingStrings � MIF.DMTF|Video|003.11 CurrentNumberOfColors # |
� � �� uint64 CurrentNumberOfColumns % � )
� ^ � ��f v uint32 MappingStrings ~ MIF.DMTF|Video|003.14 CurrentNumberOfRows $ � )
� � � ��� � uint32 MappingStrings MIF.DMTF|Video|003.13 CurrentRefreshRate ! v )
� c � ��k { uint32 MappingStrings � MIF.DMTF|Video|003.15 CurrentScanMode " z 6
� � � ��� ! 1 uint16 ValueMap 1 2 3 4 MappingStrings 9 MIF.DMTF|Video|003.8 CurrentVerticalResolution j )
� � � ��� � uint32 MappingStrings � MIF.DMTF|Video|003.10 MaxMemorySupported V
� � �� uint32 MaxRefreshRate n )
� e � ��m } uint32 MappingStrings � MIF.DMTF|Video|003.5 MinRefreshRate r )
� � � ��� � uint32 MappingStrings MIF.DMTF|Video|003.4 NumberOfVideoPages R
� V � �� uint32 VideoMemoryType P 6
� � � ��� � ( 8 uint16 ValueMap
� $ 1 2 3 4 5 6 7 8 9 10 11 12 13 MappingStrings @ MIF.DMTF|Video|003.6 VideoProcessor L
� � � �� string � C I M _ V i d e o C o n t r o l l e r �ȝ��C�! � CIM_VideoController ) ��! ) / W l � � � � ���������_��������������������������������������������������������������������������������������������������������������������������������������������������� � CIM_PCVideoController Abstract Locale UUID {1008CCE6-7BFF-11D2-AAD2-006008C78BC7} NumberOfColorPlanes ( �
� � � �� uint16 VideoArchitecture & � 6
� � � ��� k { uint16 ValueMap
? B E H K N Q T W Z ^ b f 1 2 3 4 5 6 7 8 9 10 11 12 160 MappingStrings � MIF.DMTF|Video|003.2 VideoMode ' � )
� � � ��� � uint16 MappingStrings � MIF.DMTF|Video|003.3 � C I M _ C o n t r o l l e r �ȝ��C�f V CIM_Controller ) �� ( . V d �������������������������������������������������������������������������������������� � CIM_PCMCIAController Abstract Locale UUID {FAF76B5A-798C-11D2-AAD1-006008C78BC7} Manufacturer L )
� � � ��� � string Schema Win32 � C I M _ C o n t r o l l e r �ȝ��C�c V CIM_Controller ) �� % + S a �������������������������������������������������������������������������������������� � CIM_USBController Abstract Locale UUID {FAF76B5B-798C-11D2-AAD1-006008C78BC7} Manufacturer L )
� � � ��� � string Schema Win32 � C I M _ L o g i c a l D e v i c e �ȝ��C�� b CIM_LogicalDevice ) �� & , T _ � � � � u � # ����U��������������������������������������������������������������������������������������������� � CIM_NetworkAdapter Abstract Locale UUID {8502C532-5FBB-11D2-AAC1-006008C78BC7} AutoSense Z
� � � �� boolean MaxSpeed R
� � � �� uint64 NetworkAddresses F 6
� $ � ��, @ 4 D string MaxLen MappingStrings L MIF.DMTF|Network Adapter 802 Port|001.3 PermanentAddress B 6
� � � ��� @ � � string MaxLen MappingStrings � MIF.DMTF|Network Adapter 802 Port|001.2 Speed J )
� Z � ��b r uint64 MappingStrings ~ � MIB.IETF|RFC1213-MIB.ifSpeed MIF.DMTF|Network Adapter 802 Port|001.5 � C I M _ L o g i c a l D e v i c e �ȝ��C�7 I CIM_LogicalDevice ) �� " ( P Z ������������������������������������������������������������������������� � CIM_UserDevice Abstract Locale UUID {8502C533-5FBB-11D2-AAC1-006008C78BC7} IsLocked B
� � � �� boolean � C I M _ U s e r D e v i c e �ȝ��C�� I CIM_UserDevice )
�� % �������������������������������������������������������������������������M � CIM_Display Abstract Locale UUID {1008CCE7-7BFF-11D2-AAD2-006008C78BC7} � C I M _ D i s p l a y �ȝ��C� X CIM_Display
) �� & , T _ � � � � �����U����������������������������������������������������������������������������������O � CIM_DesktopMonitor Abstract Locale UUID {1008CCE8-7BFF-11D2-AAD2-006008C78BC7} Bandwidth F
� � � �� uint32 DisplayType D
� � � �� uint16 ScreenHeight J
� � �� uint32 ScreenWidth N
� G � �� uint32 � C I M _ D i s p l a y �ȝ��C�� [ CIM_Display
) �� ! ' O \ � � � � Q ` � � �����U�������������������������������������������������������������������������������������� � CIM_FlatPanel Abstract Locale UUID {1008CCE9-7BFF-11D2-AAD2-006008C78BC7} DisplayType N
� � � �� uint16 HorizontalResolution D
� � � �� uint32 LightSource P
�
� �� uint16 ScanMode L
� I � �� uint16 SupportsColor R
� � � �� boolean VerticalResolution H
� � � �� uint32 � C I M _ U s e r D e v i c e �ȝ��C�X R CIM_UserDevice ) �� & N V � � � � ���������������������������������������������������������������������������������� � CIM_Keyboard Abstract Locale UUID {8502C534-5FBB-11D2-AAC1-006008C78BC7} Layout D
� � � �� string NumberOfFunctionKeys H
� � � �� uint16 Password J 6
� � ��& 0 W g uint16 ValueMap H K N Q T 1 2 3 4 5 MappingStrings o MIF.DMTF|System Hardware Security|001.2 � bw�� � �UȦT � VZ�� � Q��b� � F5ˑ� � Q,c%4 � �R�� � \H0t ^ � ~� � �.�$u 8 �3 �� <5�>� �
C I M _ M e m o r y �ȝ��C�X � CIM_Memory ) �� # ) Q ` ( 3 � � f m & 0 � � k ~ F S ���������_U������������������������������������������������������������������������������������������������������������������������������������������������������������������������������� � CIM_CacheMemory abstract Locale UUID {FAF76B65-798C-11D2-AAD1-006008C78BC7} Associativity - � 6
� � � � � � �� uint16 ValueMap � � � � � � � � 1 2 3 4 5 6 7 8 MappingStrings
MIF.DMTF|System Cache|003.15 CacheType ( � 6
� w � � � � �� uint16 ValueMap � � � � � 1 2 3 4 5 MappingStrings � MIF.DMTF|System Cache|003.9 FlushTimer , � )
� ( 0 @ � �� uint32 MappingStrings H MIF.DMTF|System Cache|003.14 Level & � 6
� � � � � � �� uint16 ValueMap � � � � � � 1 2 3 4 5 6 MappingStrings MIF.DMTF|System Cache|003.2 LineSize ) � )
� g o � �� uint32 MappingStrings � MIF.DMTF|System Cache|003.10 ReadPolicy + � 6
� � � 5 E � �� uint16 ValueMap # & ) , / 2 1 2 3 4 5 6 MappingStrings M MIF.DMTF|System Cache|003.13 ReplacementPolicy * � 6
� � � � � �� uint16 ValueMap � � �
1 2 3 4 5 6 7 8 MappingStrings ( MIF.DMTF|System Cache|003.12 WritePolicy ' � 6
� � � � � � � �� uint16 ValueMap � � � � � � 1 2 3 4 5 6 MappingStrings � MIF.DMTF|System Cache|003.5 � C I M _ L o g i c a l D e v i c e �ȝ��C�� N CIM_LogicalDevice ) �� # ) Q _ � � � � ����������������������������������������������������������������������������� � CIM_AlarmDevice Abstract Locale UUID {FAF76B66-798C-11D2-AAD1-006008C78BC7} AudibleAlarm B
� � � �� boolean Urgency F
� � � �� uint16 VisibleAlarm D
� � �� boolean � & � � SetUrgency ae442007200009F ROOT\CIMV2 ���� � �� �� * � ��� � __PARAMETERS abstract RequestedUrgency uint16
� < IN
� < c �� ID )
� � c ��� uint16 __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � �ȝ��C��
) �� & N W � � � U������������Z � CIM_Location Abstract Locale UUID {FAF76B67-798C-11D2-AAD1-006008C78BC7} Address )
� � � ��� string MaxLen Name 4
� � � �� � ��� string MaxLen PhysicalPosition 4
� J � �� � ��R string MaxLen � �ȝ��C�| 4 ��' ��4 < B j s � � e�������� � CIM_PhysicalElementLocation Abstract Association Locale UUID {FAF76B68-798C-11D2-AAD1-006008C78BC7} Element f
� � � �� ref:CIM_PhysicalElement PhysicalLocation f )
� � � �� ref:CIM_Location Max � �ȝ��C��
) �� ( . V _ � � � � U������������2 � CIM_PhysicalCapacity Abstract Locale UUID {FAF76B69-798C-11D2-AAD1-006008C78BC7} Caption )
� � � ��� @ string MaxLen Description
� � � �� string Name )
� " � ��* string MaxLen � �ȝ��C�t 4 �� ��, 4 : b l � � e�������� � CIM_ElementCapacity Abstract Association Locale UUID {FAF76B6A-798C-11D2-AAD1-006008C78BC7} Capacity f
� � � �� ref:CIM_PhysicalCapacity Element f )
� � � �� ref:CIM_PhysicalElement Min � � C I M _ P h y s i c a l C a p a c i t y �ȝ��C�t CIM_PhysicalCapacity ) �� & , T k � � / F x ~ }�������������������������������� � CIM_MemoryCapacity Abstract Locale UUID {FAF76B6B-798C-11D2-AAD1-006008C78BC7} MaximumMemoryCapacity
� � � �� uint64 MemoryType 4
� � � �� � ��� uint16 ModelCorrespondence CIM_PhysicalMemory.MemoryType MinimumMemoryCapacity
� p � �� uint64 Name @ 4
� � � ��� � � �� string Override Name � �ȝ��C�F ) �� & , T a � � U��������� � CIM_ReplacementSet Abstract Locale UUID {FAF76B6C-798C-11D2-AAD1-006008C78BC7} Description
� � � �� string Name 4
� � � �� � ��� string MaxLen � �ȝ��C�� ? ��! ��. ��; C I q z � � u�������� � CIM_ParticipatesInSet Abstract Association Aggregation Locale UUID {FAF76B6D-798C-11D2-AAD1-006008C78BC7} Element f
� � � �� ref:CIM_PhysicalElement Set f '
� � �� � �� ref:CIM_ReplacementSet Aggregate so �
C I M _ C o n t a i n e r �ȝ��C� CIM_Container ) �� " ( P ` � � * u����������������� � CIM_CardOnCard Abstract Locale UUID {FAF76B77-798C-11D2-AAD1-006008C78BC7} GroupComponent f@ 6
� � � ��� � � ref:CIM_Card Max Override GroupComponent MountOrSlotDescription
� � �� string PartComponent f@ )
� a � ��o y ref:CIM_Card Override PartComponent � C I M _ P h y s i c a l E l e m e n t �ȝ��C�� E CIM_PhysicalElement ) ��! ) / W e � � � � �������������������������������������������������������������������� � CIM_PhysicalComponent abstract Locale UUID {FAF76B78-798C-11D2-AAD1-006008C78BC7} HotSwappable >
� � � �� boolean Removable :
� � � �� boolean Replaceable <
�
� �� boolean � W i n 3 2 _ P n P D e v i c e P r o p e r t y ʝ��C�� ! Win32_PnPDeviceProperty % ��������������������W � Win32_PnPDevicePropertySint16 Data
� O � �� Sint16 � n��� � �4��t J o�)�� � ə�ϋ � ��kY � y �. - ��[ � -�1Q ) ��q)z C I M _ P h y s i c a l E l e m e n t �ȝ��C�� V CIM_PhysicalElement ) �� ' - U \ � � � � G T � � � � ���U���������������������������������������������������������������������������������� � CIM_PhysicalPackage abstract Locale UUID {FAF76B6E-798C-11D2-AAD1-006008C78BC7} Depth D
� � � �� real32 Height @
� � � �� real32 HotSwappable >
� � �� boolean Removable :
� > � �� boolean Replaceable <
� ~ � �� boolean Weight L
� � � �� real32 Width H
� � � �� real32 � � � IsCompatible ae442007200009F ROOT\CIMV2 ���� � �� �� * � ����� � __PARAMETERS abstract f ElementToCheck ref f
� : IN f
� : ^ �� ID f )
� � ^ ��� ref:CIM_PhysicalElement __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ �
C I M _ C o m p o n e n t �ȝ��C�
CIM_Component ) �� ! ' O _ � � & 5 U������������� � CIM_Container Abstract Locale UUID {FAF76B6F-798C-11D2-AAD1-006008C78BC7} GroupComponent f@ 6
� � � ��� � � ref:CIM_PhysicalPackage Override GroupComponent Max LocationWithinContainer
� � �� string PartComponent f@ )
� l � ��� � ref:CIM_PhysicalElement Override PartComponent � C I M _ P h y s i c a l P a c k a g e �ȝ��C�� p CIM_PhysicalPackage ) �� % + S a � � % > p } � � � � � � C Q �����_U���������������������������������������������������������������������������������������������������������� � CIM_PhysicalFrame abstract Locale UUID {FAF76B70-798C-11D2-AAD1-006008C78BC7} AudibleAlarm ^
� � � �� boolean BreachDescription d )
� � � � � �� string ModelCorrespondence CIM_PhysicalFrame.SecurityBreach CableManagementStrategy P
� h � �� string LockPresent \
� � � �� boolean SecurityBreach b C
� # J Z � � � �� uint16 ValueMap ; > A D G 1 2 3 4 5 MappingStrings b MIF.DMTF|Physical Container Global Table|002.12 ModelCorrespondence � CIM_PhysicalFrame.BreachDescription ServiceDescriptions X 6
� . 6 A J _ � �� string ArrayType Indexed ModelCorrespondence g CIM_PhysicalFrame.ServicePhilosophy ServicePhilosophy T 6
� � � � � � �� uint16 ArrayType Indexed ModelCorrespondence CIM_PhysicalFrame.ServiceDescriptions VisibleAlarm `
� { � �� boolean � C I M _ P h y s i c a l F r a m e �ȝ��C�� v CIM_PhysicalFrame )
�� " J ^ � � ( 4 ������_��������������������������������������������������������������������������������������������������������������� � CIM_Rack Abstract Locale UUID {FAF76B71-798C-11D2-AAD1-006008C78BC7} CountryDesignation j )
� � � � � �� string ModelCorrespondence � CIM_Rack.TypeOfRack Height @ @ )
� � �� real32 Override Height TypeOfRack h )
� k s � � �� uint16 ModelCorrespondence � CIM_Rack.CountryDesignation � C I M _ P h y s i c a l F r a m e �ȝ��C�� CIM_PhysicalFrame )
�� % M [ 8 j z � � � �������_����������������������������������������������������������������������������������������������������������������������� � CIM_Chassis abstract Locale UUID {FAF76B72-798C-11D2-AAD1-006008C78BC7} ChassisTypes ! n P
� � � � � � � � � � � �� uint16 ArrayType Indexed ValueMap C F I L O R U X [ ^ b f j n r v z ~ � � � � � � 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 MappingStrings � MIF.DMTF|Physical Container Global Table|002.1 ModelCorrespondence � CIM_Chassis.TypeDescriptions CurrentRequiredOrProduced j
� b � �� sint16 HeatGeneration l
� � � �� uint16 NumberOfPowerCords h
� � � �� uint16 TypeDescriptions " r 6
� H P [ d y � �� string ArrayType Indexed ModelCorrespondence � CIM_Chassis.ChassisTypes �
C I M _ C o n t a i n e r �ȝ��C�� CIM_Container ) �� % + S \ � � u�������������� � CIM_ChassisInRack Abstract Locale UUID {FAF76B73-798C-11D2-AAD1-006008C78BC7} BottomU
� � � �� uint16 GroupComponent f@ 6
� � � ��� � � ref:CIM_Rack Max Override GroupComponent PartComponent f@ )
� U � ��f p ref:CIM_Chassis Override PartComponent �
C I M _ C o n t a i n e r �ȝ��C��
CIM_Container ) �� ( . V f � � u������������R � CIM_PackageInChassis Abstract Locale UUID {FAF76B74-798C-11D2-AAD1-006008C78BC7} GroupComponent f@ 6
� � � ��� � � ref:CIM_Chassis Max Override GroupComponent PartComponent f@ )
� � ��9 C ref:CIM_PhysicalPackage Override PartComponent C7 � C I M _ D e p e n d e n c y �ȝ��C�� CIM_Dependency 6 �� & M U [ � � �
U��������y � CIM_Docked Abstract MappingStrings . MIF.DMTF|Dynamic States|001.2 Locale UUID {FAF76B75-798C-11D2-AAD1-006008C78BC7} Antecedent f@ 6
� � � ��� � � ref:CIM_Chassis Override Antecedent Max Dependent f@ 6
� N � ��_ i t ref:CIM_Chassis Override Dependent Max �
C I M _ C o n t a i n e r �ȝ��C��
CIM_Container ) ��! ) / W g � � u������������] � CIM_PackagedComponent Abstract Locale UUID {FAF76B79-798C-11D2-AAD1-006008C78BC7} GroupComponent f@ 6
� � � ��� � � ref:CIM_PhysicalPackage Max Override GroupComponent PartComponent f@ )
� ) � ��D N ref:CIM_PhysicalComponent Override PartComponent f �em\ActivationBroker\Plugins\{8ED392B6-23C2-4C3C-9126-D12D6BE621FD} \�?@" " ]�?@ �@AppointmentDetailsAɞ��� � ��+d [i��o � _��MK � "�q;�
! K3�,� } u�HEk � "��; � �H r ���� � ��*�` � H.cq? � � �8 � C I M _ S t o r a g e E x t e n t �ȝ��C�J { CIM_StorageExtent ) �� & , T _ � � � = O � � ��������������������������������������������������������������������������������������������������������������������������N � CIM_PhysicalExtent Abstract Locale UUID {9565979E-7D80-11D2-AAD3-006008C78BC7} BlockSize @ D 6
� � � ��� � � � uint64 MappingStrings � MIF.DMTF|Physical Extent|001.4 Override BlockSize NumberOfBlocks @ P 6
� L T d � ��� � uint64 MappingStrings l MIF.DMTF|Physical Extent|001.3 Override NumberOfBlocks UnitsBeforeCheckDataInterleave \ )
� � � �� uint64 MappingStrings MIF.DMTF|Physical Extent|001.6 UnitsOfCheckData d )
� � � ��� � uint64 MappingStrings � MIF.DMTF|Physical Extent|001.7 UnitsOfUserData l )
� � �� & uint64 MappingStrings . MIF.DMTF|Physical Extent|001.8 � C I M _ S t o r a g e E x t e n t �ȝ��C�� b CIM_StorageExtent ) �� ( . V f ������������������������������������������������������������������������������������������������� � CIM_AggregatePExtent Abstract Locale UUID {9565979F-7D80-11D2-AAD3-006008C78BC7} NumberOfBlocks @ P 6
� � � � � ��� � uint64 MappingStrings � MIF.DMTF|Aggregate Physical Extent|001.2 Override NumberOfBlocks � C I M _ S t o r a g e E x t e n t �ȝ��C�� s CIM_StorageExtent ) �� # ) Q \ � � �������������������������������������������������������������������������������������������������������������������� � CIM_LogicalDisk Abstract Locale UUID {8502C539-5FBB-11D2-AAC1-006008C78BC7} FreeSpace \
� � � �� uint64 Size d
� � � �� uint64 � �ȝ��C�j 4 �� ��' / 5 ] i � � U�������� � CIM_Dependency Association Abstract Locale UUID {8502C53A-5FBB-11D2-AAC1-006008C78BC7} Antecedent f
� � � �� ref:CIM_ManagedSystemElement Dependent f
� � � �� ref:CIM_ManagedSystemElement 1- � C I M _ D e p e n d e n c y �ȝ��C�� CIM_Dependency ) ��( 0 6 ^ j � � 0 B U����������t � CIM_ServiceServiceDependency Abstract Locale UUID {8502C53B-5FBB-11D2-AAC1-006008C78BC7} Antecedent f@ )
� � � ��� � ref:CIM_Service Override Antecedent Dependent f@ )
�
� �� % ref:CIM_Service Override Dependent TypeOfDependency
� l � �� uint16 � C I M _ D e p e n d e n c y �ȝ��C�I CIM_Dependency ) �� ( . V b � � 4 I { � U��������������������� � CIM_DeviceConnection Abstract Locale UUID {8502C53C-5FBB-11D2-AAC1-006008C78BC7} Antecedent f@ )
� � � ��� � ref:CIM_LogicalDevice Override Antecedent Dependent f@ )
� � �� ) ref:CIM_LogicalDevice Override Dependent NegotiatedDataWidth
� s � �� uint32 NegotiatedSpeed
� � � �� uint64 � C I M _ D e p e n d e n c y �ȝ��C�� CIM_Dependency ) �� ( . V b � � U��������- � CIM_AssociatedSensor Abstract Locale UUID {956597A0-7D80-11D2-AAD3-006008C78BC7} Antecedent f@ )
� � � ��� � ref:CIM_Sensor Override Antecedent Dependent f@ )
� � �� " ref:CIM_LogicalDevice Override Dependent � C I M _ D e v i c e C o n n e c t i o n �ȝ��C�� CIM_DeviceConnection ) �� $ * R _ � � � l � � � �������������������������������� � CIM_ControlledBy Abstract Locale UUID {8502C53D-5FBB-11D2-AAC1-006008C78BC7} AccessState
� � � �� uint16 Antecedent f@ )
� � � ��� � ref:CIM_Controller Override Antecedent Dependent f@ )
� @ � ��W a ref:CIM_LogicalDevice Override Dependent NumberOfHardResets
� � � �� uint32 NumberOfSoftResets
� � � �� uint32 � C I M _ D e p e n d e n c y �ȝ��C�> CIM_Dependency )
�� % M Y � � + : l } U������������������������� � CIM_BasedOn Abstract Locale UUID {8502C53E-5FBB-11D2-AAC1-006008C78BC7} Antecedent f@ )
� � � ��� � ref:CIM_StorageExtent Override Antecedent Dependent f@ )
� � � �� ref:CIM_StorageExtent Override Dependent EndingAddress
� d � �� uint64 StartingAddress
� � � �� uint64 � C I M _ D e p e n d e n c y �ȝ��C�� CIM_Dependency ) �� $ * R ^ � � U��������4 � CIM_MediaPresent Abstract Locale UUID {8502C540-5FBB-11D2-AAC1-006008C78BC7} Antecedent f@ )
� � � ��� � ref:CIM_MediaAccessDevice Override Antecedent Dependent f@ )
� � �� ) ref:CIM_StorageExtent Override Dependent ep � C I M _ S t o r a g e E x t e n t �ȝ��C�� g CIM_StorageExtent ) �� % + S ] � � �������������������������������������������������������������������������������������������������������� � CIM_DiskPartition Abstract Locale UUID {8502C541-5FBB-11D2-AAC1-006008C78BC7} Bootable \
� � � �� boolean PrimaryPartition ^
� � � �� boolean � C I M _ B a s e d O n �ȝ��C�� CIM_BasedOn
) ! ��+ 3 9 a m � � �������������������������O � CIM_LogicalDiskBasedOnPartition Abstract Locale UUID {8502C53F-5FBB-11D2-AAC1-006008C78BC7} Antecedent f@ 6
� � � ��� � � ref:CIM_DiskPartition Override Antecedent Max Dependent f@ )
� % � ��: D ref:CIM_LogicalDisk Override Dependent � C I M _ D e p e n d e n c y �ȝ��C�m CIM_Dependency C # � �� � = G O U } � � � + 6 | � � � S a U������������������������������ � CIM_ProcessExecutable Privileges + SeDebugPrivilege CIMWin32 Locale UUID {8502C542-5FBB-11D2-AAC1-006008C78BC7} Antecedent f@ '
� � � �� � �� ref:CIM_DataFile BaseAddress )
� � �� $ uint64 Schema Win32 Dependent f@ '
� k � �� � �� ref:CIM_Process GlobalProcessCount )
� � � ��� � uint32 Schema Win32 ModuleInstance 4
� 0 8 �� � ��D L uint32 DEPRECATED Schema Win32 ProcessCount )
� � � ��� � uint32 Schema Win32 � WX C I M _ L o g i c a l E l e m e n t �ȝ��C�s ~ CIM_LogicalElement N ��! + ; �� � E O W ] � � _ h � � % W j � � � � � o � � � . @ r } � � G Q � � � � q y � � D P � � � � f l � �
`
k
WUUUUU�����������������������������������������������������������������������������������������������������������������������
� CIM_LogicalFile SupportsDelete DeleteBy DeleteInstance Abstract CIMWin32 Locale UUID {8502C559-5FBB-11D2-AAC1-006008C78BC7} AccessMask r 6
� � � ��� � � � uint32 Schema Win32 BitMap 0 3 6 9 < ? B E H K O S W [ 0 1 2 3 4 5 6 7 8 16 17 18 19 20 Archive )
� � � ��� � boolean Schema Win32 Compressed & )
� � � �� boolean Schema Win32 CompressionMethod Z
� O � �� string CreationClassName
( '
� � � �� � �� string CIM_Key CreationDate e ,
� � � �� datetime CSCreationClassName 4
� I Q ] � �� � �� string Propagated CIM_FileSystem.CSCreationClassName CIM_Key CSName " 4
� � � � � �� � �� string Propagated CIM_FileSystem.CSName CIM_Key Drive b 4
� Q Y �� � ��` h string Fixed Schema Win32 EightDotThreeFileName V )
� � � ��� � string Schema Win32 Encrypted 0 )
� ' � �� boolean Schema Win32 EncryptionMethod ^
� j � �� string Extension n 4
� � � �� � ��� � string Fixed Schema Win32 FileName j 4
� ) 1 �� � ��8 @ string Fixed Schema Win32 FileSize D
� { � �� uint64 FileType R )
� � � ��� � string Schema Win32 FSCreationClassName
2 4
� 2 : F h �� � �� string Propagated CIM_FileSystem.CreationClassName CIM_Key FSName 6 4
� � � � � �� � �� string Propagated CIM_FileSystem.Name CIM_Key Hidden N )
� , � ��5 = boolean Schema Win32 InUseCount
� z � �� uint64 LastAccessed e :
� � � �� datetime LastModified e >
� � � �� datetime Name @ 4
� N � ��V ` � �� string Override Name Path f 4
� � � �� � ��� � string Fixed Schema Win32 Readable B
�
� �� boolean System P )
� H
� ��Q
Y
boolean Schema Win32 Writeable L
� �
� �� boolean �K � � G b � h n % %
� � a a � � � � 5 ? � � w � : > � � � � � � � �% �( �( l) .
1 1 �1 �3 �6 �6 �7 �: �= �= �> �A �D �D ;E �H XJ � TakeOwnerShip ) 8 ��E O � � Implemented ValueMap
� � � � � � � � � � � � � 0 2 8 9 10 11 12 13 14 15 16 17 21 Schema Win32 y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � ChangeSecurityPermissions ) � ��� �
Implemented ValueMap
� � � � � � � � � � � 0 2 8 9 10 11 12 13 14 15 16 17 21 Schema Win32 � ae442007200009F ROOT\CIMV2 ���� � �{ �� � * � ��������
� __PARAMETERS abstract
SecurityDescriptor object
� > In
� > e �� ID
)
� � e ��� object:Win32_SecurityDescriptor Option uint32
� In
� 0 �� r u x { 0 1 2 3 BitMap )
� 0 ��~ ^ ID 6
� 0 ��~ ^ � uint32 __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � Copy ) � ��� � Implemented ValueMap
� � � � � � � �
0 2 8 9 10 11 12 13 14 15 16 17 21 Schema Win32 � ae442007200009F ROOT\CIMV2 ���� � �� �� * � ����� � __PARAMETERS abstract FileName string
� 4 In
� 4 [ �� ID )
� � [ ��� string __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � Rename ) � ��� � R Z Implemented ValueMap
" % ( + . 2 6 : > B F J N 0 2 8 9 10 11 12 13 14 15 16 17 21 Schema Win32 � ae442007200009F ROOT\CIMV2 ���� � �� �� * � ����� � __PARAMETERS abstract FileName string
� 4 In
� 4 [ �� ID )
� � [ ��� string __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � Delete 4 ��& ��3 = � � Destructor Implemented ValueMap
u x { ~ � � � � � � � � � 0 2 8 9 10 11 12 13 14 15 16 17 21 Schema Win32 y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � Compress ) h ��u } � � Implemented Schema Win32 ValueMap
� � � � � � � � � � � � � 0 2 8 9 10 11 12 13 14 15 16 17 21 y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � Uncompress ) � ��� � + 3 Implemented ValueMap
� � # ' 0 2 8 9 10 11 12 13 14 15 16 17 21 Schema Win32 y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � TakeOwnerShipEx ) � �� t | Implemented ValueMap
D G J M P T X \ ` d h l p 0 2 8 9 10 11 12 13 14 15 16 17 21 Schema Win32 + ae442007200009F ROOT\CIMV2 ���� � �� �� - � * � ������ � __PARAMETERS abstract StartFileName string
� 9 In
� 9 ` �� optional '
� 9 ` ��� �� ID 4
� ` ��� ��� string Recursive boolean
� 8 In
� 8 ` �� optional '
� 8 ` ��� �� ID 4
� ` ��� ��� boolean __ �� ae442007200009F ROOT\CIMV2 ���� � �� �� � $ * � ��������N � __PARAMETERS abstract StopFileName string
� 8 Out
� 8 _ �� ID )
� � _ ��� string ReturnValue uint32
� uint32 out
� �� __ � ChangeSecurityPermissionsEx ) � ��
r z Implemented ValueMap
B E H K N R V Z ^ b f j n 0 2 8 9 10 11 12 13 14 15 16 17 21 Schema Win32 - ae442007200009F ROOT\CIMV2 ���� � �� �� � " � * � � U�������������� � __PARAMETERS abstract
SecurityDescriptor object
� > in
� > e �� ID
)
� � e ��� object:Win32_SecurityDescriptor Option uint32
� In
� 0 �� r u x { 0 1 2 3 BitMap )
� 0 ��~ ^ ID 6
� 0 ��~ ^ � uint32 StartFileName string
� . In
� . U �� optional '
� . U ��� �� ID 4
� U ��� ��� string Recursive boolean
� - In
� - U �� optional '
� - U ��� �� ID 4
� U ��� ��� boolean __ �� ae442007200009F ROOT\CIMV2 ���� � �� �� � $ * � ��������N � __PARAMETERS abstract StopFileName string
� 8 Out
� 8 _ �� ID )
� � _ ��� string ReturnValue uint32
� uint32 out
� �� __ � CopyEx ) �( ���( �( ]) e) Implemented ValueMap
-) 0) 3) 6) 9) =) A) E) I) M) Q) U) Y) 0 2 8 9 10 11 12 13 14 15 16 17 21 Schema Win32 � ae442007200009F ROOT\CIMV2 ���� � �L �� * � � � � � ����������� � __PARAMETERS abstract FileName string
� 4 In
� 4 [ �� ID )
� � [ ��� string StartFileName string
� � In
� � �� optional '
� � ��B �� ID 4
� � ��B ��� string Recursive boolean
� � In
� � �� optional '
� � ��B �� ID 4
� � ��B ��� boolean __ �� ae442007200009F ROOT\CIMV2 ���� � �� �� � $ * � ��������N � __PARAMETERS abstract StopFileName string
� 8 Out
� 8 _ �� ID )
� � _ ��� string ReturnValue uint32
� uint32 out
� �� __ � DeleteEx ) =1 ��J1 T1 �1 �1 Implemented ValueMap
�1 �1 �1 �1 �1 �1 �1 �1 �1 �1 �1 �1 �1 0 2 8 9 10 11 12 13 14 15 16 17 21 Schema Win32 ae442007200009F ROOT\CIMV2 ���� � �� �� * � ���� � __PARAMETERS abstract StartFileName string
� 9 In
� 9 ` �� optional '
� 9 ` ��� �� ID 4
� ` ��� ��� string __ �� ae442007200009F ROOT\CIMV2 ���� � �� �� � $ * � ��������N � __PARAMETERS abstract StopFileName string
� 8 Out
� 8 _ �� ID )
� � _ ��� string ReturnValue uint32
� uint32 out
� �� __ � CompressEx ) 7 ��7 %7 �7 �7 Implemented ValueMap
]7 `7 c7 f7 i7 m7 q7 u7 y7 }7 �7 �7 �7 0 2 8 9 10 11 12 13 14 15 16 17 21 Schema Win32 + ae442007200009F ROOT\CIMV2 ���� � �� �� - � * � ������ � __PARAMETERS abstract StartFileName string
� 9 In
� 9 ` �� optional '
� 9 ` ��� �� ID 4
� ` ��� ��� string Recursive boolean
� 8 In
� 8 ` �� optional '
� 8 ` ��� �� ID 4
� ` ��� ��� boolean __ �� ae442007200009F ROOT\CIMV2 ���� � �� �� � $ * � ��������N � __PARAMETERS abstract StopFileName string
� 8 Out
� 8 _ �� ID )
� � _ ��� string ReturnValue uint32
� uint32 out
� �� __ � UncompressEx ) �= ��
> > |> �> Implemented ValueMap
L> O> R> U> X> \> `> d> h> l> p> t> x> 0 2 8 9 10 11 12 13 14 15 16 17 21 Schema Win32 + ae442007200009F ROOT\CIMV2 ���� � �� �� - � * � ������ � __PARAMETERS abstract StartFileName string
� 9 In
� 9 ` �� optional '
� 9 ` ��� �� ID 4
� ` ��� ��� string Recursive boolean
� 8 In
� 8 ` �� optional '
� 8 ` ��� �� ID 4
� ` ��� ��� boolean __ �� ae442007200009F ROOT\CIMV2 ���� � �� �� � $ * � ��������N � __PARAMETERS abstract StopFileName string
� 8 Out
� 8 _ �� ID )
� � _ ��� string ReturnValue uint32
� uint32 out
� �� __ � GetEffectivePermission ) �D E E ��,E 4E Privileges
E SeSecurityPrivilege Implemented Schema Win32 � ae442007200009F ROOT\CIMV2 ���� � �G �� * : ����� � __PARAMETERS abstract Permissions uint32
� 7 In
� 7 ^ �� � � � � � � � � � � � � � � 0 1 2 3 4 5 6 7 8 16 17 18 19 20 BitMap )
� 7 ^ ��� � ID 6
� ~ ^ ��� � 6 uint32 __ �{ ae442007200009F ROOT\CIMV2 ���� � �( �� * m ��� � __PARAMETERS abstract ReturnValue boolean
� _ boolean out
� _ h �� __ � SetSecurityDescriptor } �� Static � ���� � �� �� * � ����� � __PARAMETERS abstract
Descriptor object
� 6 in
� 6 ] �� ID
)
� � ] ��� object:__SecurityDescriptor � � ���� � �� �� * c ����� � __PARAMETERS abstract ReturnValue uint32
� 7 out
� 7 ^ �� � 9(��� ¥��� yu� � �ɔ�� � ��6� � G�[��
� QP�0� X9��
0�^� � �b�e D .<DЩ S�M(� z�Q�� � C I M _ D e p e n d e n c y sɝ��C�� CIM_Dependency ) & . 4 \ �� f r � � U��������o � CIM_SoftwareFeatureSAPImplementation Locale UUID {7EFCC186-DB37-11d2-85FC-0000F8102E5F} Abstract Antecedent f@ 6
� � � ��� � � ref:CIM_SoftwareFeature Min Override Antecedent Dependent f@ 6
� 9 � ��U Z d ref:CIM_ServiceAccessPoint Min Override Dependent � C I M _ D e p e n d e n c y tɝ��C�� CIM_Dependency ) * 2 8 ` �� j v � � U��������h � CIM_SoftwareFeatureServiceImplementation Locale UUID {8AC984F4-DB37-11d2-85FC-0000F8102E5F} Abstract Antecedent f@ 6
� � � ��� � � ref:CIM_SoftwareFeature Min Override Antecedent Dependent f@ 6
� = � ��N S ] ref:CIM_Service Min Override Dependent � C I M _ D e p e n d e n c y uɝ��C�� CIM_Dependency ) $ L �� V b � � U��������> � CIM_SAPSAPDependency Locale UUID {422D175A-E3D5-11d2-8601-0000F8102E5F} Abstract Antecedent f@ )
� � � ��� � ref:CIM_ServiceAccessPoint Override Antecedent Dependent f@ )
�
� ��) 3 ref:CIM_ServiceAccessPoint Override Dependent t � C I M _ S e r v i c e A c c e s s B y S A P vɝ��C�� CIM_ServiceAccessBySAP ) $ * R �� \ h � � U��������2 � CIM_BootServiceAccessBySAP Locale UUID {6EDF1DD2-DB35-11d2-85FC-0000F8102E5F} Abstract Antecedent f@ )
� � � ��� � ref:CIM_BootService Override Antecedent Dependent f@ )
� � �� ' ref:CIM_BootSAP Override Dependent re � C I M _ S e r v i c e A c c e s s B y S A P wɝ��C�� CIM_ServiceAccessBySAP ) ' - U �� _ k � � U��������A � CIM_ClusterServiceAccessBySAP Locale UUID {88F073D8-DB35-11d2-85FC-0000F8102E5F} Abstract Antecedent f@ )
� � � ��� � ref:CIM_ClusteringService Override Antecedent Dependent f@ )
� � ��, 6 ref:CIM_ClusteringSAP Override Dependent Ov � C I M _ D e p e n d e n c y xɝ��C�� CIM_Dependency ) " ( P �� Z f � � U��������7 � CIM_ServiceSAPDependency Locale UUID {652E2D58-DB37-11d2-85FC-0000F8102E5F} Abstract Antecedent f@ )
� � � ��� � ref:CIM_ServiceAccessPoint Override Antecedent Dependent f@ )
� � ��" , ref:CIM_Service Override Dependent ri � C I M _ S e r v i c e A c c e s s P o i n t yɝ��C�� ' CIM_ServiceAccessPoint )
C �� ���������������������������������������M � CIM_BootSAP Locale UUID {F6FEF20A-E3D2-11d2-8601-0000F8102E5F} Abstract � C I M _ S o f t w a r e F e a t u r e zɝ��C�� / CIM_SoftwareFeature ) G �� Q m T e ����������������������������������������������2 � CIM_BIOSFeature Locale UUID {7D33100E-E3D3-11d2-8601-0000F8102E5F} Abstract CharacteristicDescriptions $ C
� � � � � � + � �� STRING ArrayType Indexed MappingStrings � MIF.DMTF|BIOS Characteristic|003.4 ModelCorrespondence 3 CIM_BIOSFeature.Characteristics Characteristics
( P
� � � � � � 0 d n � �� UINT16 ArrayType Indexed MappingStrings � MIF.DMTF|BIOS Characteristic|003.3 ModelCorrespondence 8 CIM_BIOSFeature.CharacteristicDescriptions ValueMap � � � � � � � � � � � � �
! % ) - 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 160 � C I M _ S o f t w a r e F e a t u r e {ɝ��C�f / CIM_SoftwareFeature ) $ L �� V r d u ����������������������������������������������� � CIM_VideoBIOSFeature Locale UUID {BAE20634-E3D4-11d2-8601-0000F8102E5F} Abstract CharacteristicDescriptions $ C
� � � � � � ! 6 � �� STRING ArrayType Indexed MappingStrings � MIF.DMTF|Video BIOS Characteristic|001.4 ModelCorrespondence > CIM_VideoBIOSFeature.Characteristics Characteristics
( P
� � � � � � 1 F � � �� UINT16 ArrayType Indexed MappingStrings MIF.DMTF|Video BIOS Characteristic|001.3 ModelCorrespondence N CIM_VideoBIOSFeature.CharacteristicDescriptions ValueMap � � � � � � � � � 1 2 3 4 5 6 7 8 9 � C I M _ L o g i c a l E l e m e n t �ɝ��C� % CIM_LogicalElement C � �� � + N V \ � � # � � & � � W�����������������������������������G � Win32_PageFileUsage CIMWin32 Privileges 3 SeCreatePagefilePrivilege Locale UUID {9B3AC16A-EEE5-11d2-B13B-00105A1F77A1} AllocatedBaseSize )
� � � ��� � uint32 MappingStrings � Win32API|MEMORYSTATUS|dwTotalPageFile CurrentUsage )
� Z � ��b r uint32 MappingStrings z Win32API|MEMORYSTATUS Name @ A
� � � �� � ��� � � string Override Name MappingStrings WMI PeakUsage )
� ] � ��e u uint32 MappingStrings } WMI TempPageFile )
� � � ��� � boolean MappingStrings � Win32Registry|System\CurrentControlSet\Control\Session Manager\Memory Management|TempPageFile � C I M _ S e t t i n g �ɝ��C�� CIM_Setting
~ � �� � ! - P X ^ � ��� � � ��� � � �� � � � � � � �������������������������� � Win32_PageFileSetting CIMWin32 Privileges 5 SeCreatePagefilePrivilege Locale UUID {514A9270-C856-11D2-B364-00105A1f77A1} SupportsCreate CreateBy PutInstance SupportsDelete DeleteBy DeleteInstance SupportsUpdate InitialSize 4
� 6 � �� � ��> N uint32 MappingStrings V Win32Registry|System\CurrentControlSet\Control\Session Manager\Memory Management|PagingFiles MaximumSize 4
� � �� � �� uint32 MappingStrings # Win32Registry|System\CurrentControlSet\Control\Session Manager\Memory Management|PagingFiles Name ?
� � � �� � �� � ��� � string MappingStrings � WMI � W i n 3 2 _ P n P D e v i c e P r o p e r t y ʝ��C�� ! Win32_PnPDeviceProperty + 1 ����������������������| � Win32_PnPDevicePropertySecurityDescriptor Data
� [ � �� object:Win32_SecurityDescriptor � W i n 3 2 _ P n P D e v i c e P r o p e r t y
ʝ��C�� ! Win32_PnPDeviceProperty % ����������������������V � Win32_PnPDevicePropertyBinary Data
� O � �� Uint8 � ai�� & �ctp� � |!�� � w��e� � 6z�s
� X-�* } ���D� �
�P�. �̴6 � C��� � C I M _ S e t t i n g �ȝ��C�� % CIM_Setting
) ��! ) / W m C S , � � � � � ` t }U�����������������������������������H � CIM_MonitorResolution Abstract Locale UUID {1008CCEC-7BFF-11D2-AAD2-006008C78BC7} HorizontalResolution 6
� � � ��� � uint32 ModelCorrespondence � CIM_VideoController.CurrentHorizontalResolution MappingStrings MIF.DMTF|Monitor Resolutions|002.2 MaxRefreshRate 6
� � � ��� � � � uint32 ModelCorrespondence � CIM_VideoController.MaxRefreshRate MappingStrings � MIF.DMTF|Monitor Resolutions|002.7 MinRefreshRate 6
� p � ��x � � � uint32 ModelCorrespondence � CIM_VideoController.MinRefreshRate MappingStrings � MIF.DMTF|Monitor Resolutions|002.6 RefreshRate 6
� F � ��N c � � uint32 ModelCorrespondence k CIM_VideoController.CurrentRefreshRate MappingStrings � MIF.DMTF|Monitor Resolutions|002.4 ScanMode C
� * � ��2 < c x � � uint16 ValueMap T W Z ] ` 1 2 3 4 5 ModelCorrespondence � CIM_VideoController.CurrentScanMode MappingStrings � MIF.DMTF|Monitor Resolutions|002.5 SettingID @ A
� ; � ��C K U � �� string MaxLen Override SettingID VerticalResolution 6
� � � ��� � uint32 ModelCorrespondence � CIM_VideoController.CurrentVerticalResolution MappingStrings $ MIF.DMTF|Monitor Resolutions|002.3 � C I M _ E l e m e n t S e t t i n g �ȝ��C�� CIM_ElementSetting ) �� & , T ] � � e��������C � CIM_MonitorSetting Abstract Locale UUID {1008CCED-7BFF-11D2-AAD2-006008C78BC7} Element f@ 4
� � � �� � ��� � ref:CIM_DesktopMonitor Override Element Setting f@ 4
� � �� � ��0 : ref:CIM_MonitorResolution Override Setting S � C I M _ D e p e n d e n c y �ȝ��C�� CIM_Dependency ) ��! ) / W c � � U��������/ � CIM_AssociatedBattery Abstract Locale UUID {8502C578-5FBB-11D2-AAC1-006008C78BC7} Antecedent f@ )
� � � ��� � ref:CIM_Battery Override Antecedent Dependent f@ )
� � �� $ ref:CIM_LogicalDevice Override Dependent � C I M _ D e p e n d e n c y �ȝ��C�� CIM_Dependency ) ��! ) / W c � � U��������6 � CIM_AllocatedResource Abstract Locale UUID {8502C579-5FBB-11D2-AAC1-006008C78BC7} Antecedent f@ )
� � � ��� � ref:CIM_SystemResource Override Antecedent Dependent f@ )
�
� ��! + ref:CIM_LogicalDevice Override Dependent ed � �ȝ��C��
) ��& . 4 \ e � � � � U������������8 � CIM_StatisticalInformation Abstract Locale UUID {956597A1-7D80-11D2-AAD3-006008C78BC7} Caption )
� � � ��� @ string MaxLen Description
� � � �� string Name )
� ( � ��0 string MaxLen U � �ȝ��C�e 4 �� ��' / 5 ] f � � U��������� � CIM_Statistics Abstract Association Locale UUID {956597A3-7D80-11D2-AAD3-006008C78BC7} Element f
� � � �� ref:CIM_ManagedSystemElement Stats f
� � � �� ref:CIM_StatisticalInformation 3- � C I M _ S t a t i s t i c a l I n f o r m a t i o n �ȝ��C�� G $ CIM_StatisticalInformation ) ��! ) /
W k � � � � 7 i z � 6 < � � c o }UU��������������������������������������������������������������������� � CIM_DeviceErrorCounts Abstract Locale UUID {117FDB8C-D025-11d2-85F5-0000F8102E5F} CriticalErrorCount $ )
� � � ��� � uint64 MappingStrings � MIF.DMTF|Operational State|003.7 DeviceCreationClassName A
� L � ��T ` � ��� string Propagated CIM_LogicalDevice.CreationClassName MaxLen DeviceID A
� � � ��� � � �� @ string Propagated CIM_LogicalDevice.DeviceID MaxLen IndeterminateErrorCount
� a � �� uint64 MajorErrorCount , )
� � � ��� � uint64 MappingStrings � MIF.DMTF|Operational State|003.8 MinorErrorCount
4
� . � �� uint64 Name @ A
� � � ��� � � � �� string MaxLen Override Name SystemCreationClassName A
� � �� ' R ��[ string Propagated CIM_LogicalDevice.SystemCreationClassName CIM_Key MaxLen SystemName A
� � � ��� � � ��� string Propagated CIM_LogicalDevice.SystemName CIM_Key MaxLen WarningCount < )
� F � ��N ^ uint64 MappingStrings f MIF.DMTF|Operational State|003.9 � % � � ResetCounter ae442007200009F ROOT\CIMV2 ���� � �� �� * � ��� � __PARAMETERS abstract SelectedCounter uint16
� ; IN
� ; b �� ID )
� � b ��� uint16 __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � C I M _ S t a t i s t i c s �ȝ��C�� CIM_Statistics ) ��& . 4 \ e � � U��������e � CIM_ErrorCountersForDevice Abstract Locale UUID {2D79F3A0-D025-11d2-85F5-0000F8102E5F} Element f@ C
� � � ��� � � � ref:CIM_LogicalDevice Override Element Min Max Stats f@ 4
� 3 � ��N X _ �� ref:CIM_DeviceErrorCounts Override Stats Weak � �ȝ��C�s 4 ��! ��. 6 < d r � � e��������
� CIM_RelatedStatistics Abstract Association Locale UUID {956597A4-7D80-11D2-AAD3-006008C78BC7} RelatedStats f
� � � �� ref:CIM_StatisticalInformation Stats f
� � � �� ref:CIM_StatisticalInformation AA � W i n 3 2 _ P n P D e v i c e P r o p e r t y ʝ��C�� ! Win32_PnPDeviceProperty $ �������������������U � Win32_PnPDevicePropertySint8 Data
� N � �� Sint8 � �6�]P ] jvǭ J ��� " P�w3 � ���C�p ) � �� � $ . � MSFT_DtcNetworkSettingTask locale MsDtcWmi � 4 1 * kSe ? n �
Dtc �
�
� � Get ��, �� implemented static � ae442007200009F ROOT\msdtc ���� � �� �� * � ����� � __PARAMETERS abstract DtcName string
� 3 in
� 3 Z �� ID )
� � Z ��� string __ �� ae442007200009F ROOT\msdtc ���� � �� �� * � b � ��������� � __PARAMETERS abstract
cmdletOutput object
� 8 DtcNetworkSettings EmbeddedInstance
� 8 s _ out
)
� 8 s _ � �� ID
6
� 5 s _ � ��� object:DtcNetworkSettings ReturnValue uint32
� � uint32 out
� � � �� __ � SetByDisableNetwork Y ��f �� implemented static � ae442007200009F ROOT\msdtc ���� � �N �� � M * � ������� � __PARAMETERS abstract DtcName string
� 3 in
� 3 Z �� ID )
� � Z ��� string DisableNetworkAccess boolean
� � in
� � �� ID )
� � ��I boolean __ �y ae442007200009F ROOT\msdtc ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � SetByNetworkSettings �
���
�� implemented static 7 ae442007200009F ROOT\msdtc ���� � �� �� � � * � � S � 8 � 5 � n � u UU��������������������7 � __PARAMETERS abstract DtcName string
� 3 in
� 3 Z �� ID )
� � Z ��� string InboundTransactionsEnabled boolean
� � in
� � ! �� ID )
� � ! ��O boolean OutboundTransactionsEnabled boolean
� � in
� � � �� ID )
� S � �� boolean RemoteClientAccessEnabled boolean
� � in
� � � �� ID )
� � ��� boolean
RemoteAdministrationAccessEnabled boolean
� X in
� X � �� ID
)
� � � ��� boolean XATransactionsEnabled boolean
� in
� C �� ID )
� � C ��q boolean LUTransactionsEnabled boolean
� � in
� � �� ID )
� o ��4 boolean AuthenticationLevel string
� � in
� � � �� ID )
� / � ��� string __ �y ae442007200009F ROOT\msdtc ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � M S F T _ D S C C o n f i g u r a t i o n O u t p u t ܝ��C��
% MSFT_DSCConfigurationOutput ( 6 = E M ������������� � MSFT_DSCConfigurationOutputWriteObject ClassVersion 1.0.0 locale Object
� w �� object EmbeddedObject Co � ܝ��C�
) " / V ��a i p � � f p � � � U�������������� � MSFC_NPIVLUNMappingInformationEx Description Extended LUN to virtual port mapping. AMENDMENT LOCALE OSBus
� � � � uint8 Description The SCSI Path ID associated with this LUN, matching the SCSI_ADDRESS OSLUN
� ) 0 = uint8 Description The SCSI LUN, matching the SCSI_ADDRESS OSTarget
� � � � uint8 Description The SCSI Target ID associated with this LUN, matching the SCSI_ADDRESS PortNumber
� 0 7 D uint8 Description The SCSI Port ID associated with this LUN, matching the SCSI_ADDRESS WWPNPhysicalPort
� � � � uint8 Description The world wide port name of the physical port WWPNVirtualPort
� H O \ uint8 Description The world wide port name of the virtual port �6 4 6 5 9 A B 9 F 8 F 1 C 4 B 5 6 8 D B 6 4 3 8 B A E 1 1 B 2 6 E E 8 F 9 3 C B 5 F 8 1 9 5 E 2 1 E 8 C 3 8 3 D 6 C 4 4 C C 4 1 �wR|�C�ȝ��C�,
� __NAMESPACE MS_409 ��\� � �h�� � j�Fݕ �.�� � ���B � ���w
�
-1� � e,��Y
� u�4 d �&��� � �zQ& � Nr>(� b ���6 6 C I M _ D e p e n d e n c y "ɝ��C�� CIM_Dependency ) ��" * 0 X d � � U��������? � CIM_JobDestinationJobs Abstract Locale UUID {8D079BEE-DB36-11d2-85FC-0000F8102E5F} Antecedent f@ 6
� � � ��� � � ref:CIM_JobDestination Max Override Antecedent Dependent f@ )
� � ��* 4 ref:CIM_Job Override Dependent * � C I M _ D e p e n d e n c y #ɝ��C�� CIM_Dependency ) �� ' - U a � � U��������0 � CIM_ResidesOnExtent Abstract Locale UUID {10458E26-DB37-11d2-85FC-0000F8102E5F} Antecedent f@ )
� � � ��� � ref:CIM_StorageExtent Override Antecedent Dependent f@ )
� � �� % ref:CIM_FileSystem Override Dependent An � C I M _ D e p e n d e n c y $ɝ��C�� CIM_Dependency ) �� ! ' O [ � � U��������f � CIM_RunningOS Abstract Locale UUID {1F2EA300-DB37-11d2-85FC-0000F8102E5F} Antecedent f@ 6
� � � ��� � � ref:CIM_OperatingSystem Max Override Antecedent Dependent f@ C
� / � ��G L Q [ ref:CIM_ComputerSystem Max Min Override Dependent � %ɝ��C�� ? ��! ��. ��; C I q z � � u�������� � CIM_DependencyContext Abstract Aggregation Association Locale UUID {A228E208-DB22-11d2-85FC-0000F8102E5F} Context f '
� � � ��� �� ref:CIM_Configuration Aggregate Dependency f
� � �� ref:CIM_Dependency Co � &ɝ��C�� 4 ��* 2 8 ` �� m � � e��������] � CIM_DirectorySpecificationFile Abstract Locale UUID {BCD64CCE-DB29-11d2-85FC-0000F8102E5F} Association DirectorySpecification f 6
� � � ��� � ref:CIM_DirectorySpecification Max Min FileSpecification f )
� = � ��X ref:CIM_FileSpecification Min UI � 'ɝ��C�n 4 ��$ , 2 Z �� g v � � e�������� � CIM_ElementConfiguration Abstract Locale UUID {FC049DCE-DB29-11d2-85FC-0000F8102E5F} Association Configuration f
� � � �� ref:CIM_Configuration Element f
� � � �� ref:CIM_ManagedSystemElement 00 � (ɝ��C�� 4 ��# + 1 Y �� f p � � e��������8 � CIM_FromDirectoryAction Abstract Locale UUID {55D5B446-DB2A-11d2-85FC-0000F8102E5F} Association FileName f )
� � � ��� ref:CIM_FileAction Min SourceDirectory f 6
� � ��. 3 ref:CIM_DirectoryAction Max Min ou � )ɝ��C�� 4 ��* 2 8 ` �� m w � � e��������F � CIM_FromDirectorySpecification Abstract Locale UUID {6715375E-DB2A-11d2-85FC-0000F8102E5F} Association FileName f )
� � � ��� ref:CIM_FileAction Min SourceDirectory f 6
� � ��< A ref:CIM_DirectorySpecification Max Min re � *ɝ��C�L ) �� ! I R � � � � E K � � ! ) U����������������������������� � CIM_FRU Abstract Locale UUID {778C74EE-DB2A-11d2-85FC-0000F8102E5F} Caption )
� � � ��� @ STRING MaxLen Description )
� � � ��� � STRING MappingStrings � MIF.DMTF|FRU|002.3 FRUNumber A
� k � �� � ��s � � @ STRING MappingStrings � MIF.DMTF|FRU|002.6 MaxLen IdentifyingNumber A
� � �� � �� ! = @ STRING MappingStrings ) MIF.DMTF|FRU|002.7 MaxLen Name )
� � � ��� STRING MaxLen RevisionLevel 6
� � � ��� � @ STRING MappingStrings MIF.DMTF|FRU|002.8 MaxLen Vendor A
� x � �� � ��� � � STRING MappingStrings � MIF.DMTF|FRU|002.4 MaxLen � +ɝ��C�� ? ��" * 0 X ��e �� r } � � u�������� � CIM_FRUIncludesProduct Abstract Locale UUID {87FEEDCA-DB2A-11d2-85FC-0000F8102E5F} Aggregation Association Component f
� � � �� ref:CIM_Product FRU f 4
� � � �� �� ref:CIM_FRU Aggregate Max � ,ɝ��C�� ? ��# + 1 Y ��f �� s ~ � � u��������% � CIM_FRUPhysicalElements Abstract Locale UUID {977E36CA-DB2A-11d2-85FC-0000F8102E5F} Aggregation Association Component f
� � � �� ref:CIM_PhysicalElement FRU f 4
� � �� �� ref:CIM_FRU Aggregate Max � � C I M _ L o g i c a l E l e m e n t -ɝ��C�& W CIM_LogicalElement ) �� " ( P ` � � P _ � � � � Q d � � \ d � � k { � � � � | � �WUU���������������������������������������������������������������������������������� � CIM_FileSystem Abstract Locale UUID {4DA18760-E3D0-11d2-8601-0000F8102E5F} AvailableSpace )
� � � ��� � UINT64 MappingStrings � MIF.DMTF|Partition|002.4 BlockSize
� � �� UINT64 CasePreserved $
� G � �� BOOLEAN CaseSensitive &
� � � �� BOOLEAN CodeSet (
� � � �� UINT16 CompressionMethod
, )
� � �� / STRING MappingStrings 7 MIF.DMTF|Partition|002.7 CreationClassName 0 4
� � � �� � ��� STRING MaxLen CSCreationClassName 4 A
� � �� � ��" * 6 STRING MaxLen Propagated CIM_ComputerSystem.CreationClassName CSName
8 A
� � � �� � ��� � � STRING MaxLen Propagated CIM_ComputerSystem.Name EncryptionMethod < )
� 1 � ��9 I STRING MappingStrings Q MIF.DMTF|Partition|002.8 FileSystemSize @
� � � �� UINT64 MaxFileNameLength H
� � � �� UINT32 ReadOnly L )
� 3 � ��< L BOOLEAN MappingStrings T MIB.IETF|HOST-RESOURCES-MIB.hrFSAccess Root N )
� � � ��� � STRING MappingStrings � MIB.IETF|HOST-RESOURCES-MIB.hrFSMountPoint � C I M _ F i l e S y s t e m .ɝ��C� W CIM_FileSystem ) �� ' - ���������������������������������������������������������������������������������������U � CIM_LocalFileSystem Abstract Locale UUID {5B6C820A-E3D0-11d2-8601-0000F8102E5F} � I�B�` [ �#�!� �9�y� E p&g � }� խ � C I M _ L o g i c a l E l e m e n t �ȝ��C� @ CIM_LogicalElement ) �� ' - U b � M a �
� � > D � � U c � � P f � � � � WUU������������������������������������������������������������% � CIM_SoftwareElement abstract Locale UUID {8502C561-5FBB-11D2-AAC1-006008C78BC7} BuildNumber ( 6
� � � ��� @ � � string Maxlen Mappingstrings � MIF.DMTF|Software Component Information|002.4 CodeSet
0 )
� = � ��E @ string Maxlen IdentificationCode 4 6
� � � ��� @ � � string Maxlen Mappingstrings � MIF.DMTF|Software Component Information|002.7 LanguageEdition 8 6
� Q � ��Y a q string Maxlen Mappingstrings y MIF.DMTF|Software Component Information|002.6 Manufacturer
$ 6
� � � ��
string Maxlen Mappingstrings " MIF.DMTF|ComponentID|001.1 Name @ A
� � � �� � ��� � � string maxlen override Name OtherTargetOS 6
� � �� @ + string Maxlen ModelCorrespondence CIM_OperatingSystem.OtherTypeDescription SerialNumber , 6
� � � ��� @ � � string Maxlen Mappingstrings � MIF.DMTF|ComponentID|001.4 SoftwareElementID 4
� @ � �� � ��H string maxlen SoftwareElementState '
� � � �� � �� uint16 TargetOperatingSystem A
� � �� � �� ! X m uint16 Mappingstrings ) MIF.DMTF|Software Component Information|002.5 ModelCorrespondence CIM_OperatingSystem.OSType Version A
� � � �� � ��� @ � string Maxlen Mappingstrings MIF.DMTF|ComponentID|001.3 � C I M _ S o f t w a r e E l e m e n t �ȝ��C�� C CIM_SoftwareElement ) �� # ) Q _ � x � ������������������������������������������������������������������ � CIM_BIOSElement abstract Locale UUID {8502C562-5FBB-11D2-AAC1-006008C78BC7} Manufacturer @
$ 6
� � � ��� � � � string Mappingstrings � MIF.DMTF|System BIOS|001.2 Override Manufacturer PrimaryBIOS < )
� ; � ��D T boolean MappingStrings \ MIF.DMTF|System BIOS|001.9 Version @ 6
� � � ��� � string Mappingstrings � MIF.DMTF|System BIOS|001.3 Override Version � C I M _ L o g i c a l E l e m e n t �ȝ��C� 8 CIM_LogicalElement ) �� ! I V � � � � : D v � � � � �WU�����������������������������������������������������7 � CIM_Job Abstract Locale UUID {8502C564-5FBB-11D2-AAC1-006008C78BC7} ElapsedTime e
� � � �� datetime JobStatus
(
� � � �� string Notify
� � � �� string Owner
� 2 � �� string Priority
� n � �� uint32 StartTime e $
� � � �� datetime TimeSubmitted e ,
� � � �� datetime UntilTime e 0
� - � �� datetime � C I M _ L o g i c a l E l e m e n t �ȝ��C� � CIM_LogicalElement ) �� ' - U h � � r z J W � � � � f y � � � � � � H ^ � � � � . A � � [ c � � � � # 7 i � � � �
WUUUU��������������������������������������������������������������������������������������������������������������������������������������~
� CIM_OperatingSystem Abstract Locale UUID {8502C565-5FBB-11D2-AAC1-006008C78BC7} CreationClassName 4
� � � �� � ��� string CIM_Key MaxLen CSCreationClassName A
� ' / ; a �� � ��j string Propagated CIM_ComputerSystem.CreationClassName CIM_Key MaxLen CSName A
� � � � � �� � ��� string Propagated CIM_ComputerSystem.Name CIM_Key MaxLen CurrentTimeZone H
� B � �� sint16 Distributed
� � � �� boolean FreePhysicalMemory "
� � � �� uint64 FreeSpaceInPagingFiles R )
� � ��' 7 uint64 MappingStrings ? MIF.DMTF|System Memory Settings|001.4 FreeVirtualMemory
*
� � � �� uint64 LastBootUpTime e Z
� � � �� datetime LocalDateTime e D )
� 5 � ��? O datetime MappingStrings [ � MIB.IETF|HOST-RESOURCES-MIB.hrSystemDate MIF.DMTF|General Information|001.6 MaxNumberOfProcesses ^ )
� � � � �� uint32 MappingStrings MIB.IETF|HOST-RESOURCES-MIB.hrSystemMaxProcesses MaxProcessMemorySize 2
� � � �� uint64 Name @ )
� � � ��� � string Override Name NumberOfLicensedUsers b
� & � �� uint32 NumberOfProcesses f )
� x � � � �� uint32 MappingStrings � MIB.IETF|HOST-RESOURCES-MIB.hrSystemProcesses NumberOfUsers j )
�
% � �� uint32 MappingStrings - MIB.IETF|HOST-RESOURCES-MIB.hrSystemNumUsers OSType : )
� � � ��� � uint16 ModelCorrespondence � CIM_OperatingSystem.OtherTypeDescription OtherTypeDescription
< 6
� C � ��K @ S h string MaxLen ModelCorrespondence p CIM_OperatingSystem.OSType SizeStoredInPagingFiles J )
� � � ��� � uint64 MappingStrings � MIF.DMTF|System Memory Settings|001.3 TotalSwapSpaceSize n
� a � �� uint64 TotalVirtualMemorySize v
� � � �� uint64 TotalVisibleMemorySize ~
� � � �� uint64 Version @ )
� =
� ��E
U
string MappingStrings ]
MIF.DMTF|Operating System|001.3 X � � � � � Reboot y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � Shutdown y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � W i n 3 2 _ P n P D e v i c e P r o p e r t y �ɝ��C�� ! Win32_PnPDeviceProperty % ��������������������������W � Win32_PnPDevicePropertyUint64 Data
� O � �� Uint64 � � bW�=0 f �o� ` C I M _ L o g i c a l D e v i c e �ȝ��C�, � CIM_LogicalDevice )
�� % M a � � � � z � w � � � � � O g � � y � E V } � J \ � � �
�
W m � J ^ ' � � � � $ � � 5 J ^ m 6 G { � ����UUUUUUU���������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������� � CIM_Printer Abstract Locale UUID {8502C54A-5FBB-11D2-AAC1-006008C78BC7} AvailableJobSheets 1 � )
� � � ��� � string ModelCorrespondence � CIM_PrintJob.RequiredJobSheets Capabilities " v 6
� / � ��7 B K ` uint16 ArrayType Indexed ModelCorrespondence p � � CIM_Printer.CapabilityDescriptions CIM_PrintJob.Finishing CIM_PrintService.Capabilities CapabilityDescriptions # z 6
� ' � ��/ : C X string ArrayType Indexed ModelCorrespondence ` CIM_Printer.Capabilities CharSetsSupported , � C
� � � ��� � � - = string ArrayType Indexed ModelCorrespondence CIM_PrintJob.CharSet MappingStrings E MIB.IETF|Printer-MIB.prtLocalizationCharacterSet CurrentCapabilities % � )
� � � ��� � uint16 ModelCorrespondence � CIM_Printer.Capabilities CurrentCharSet - � )
� I � ��Q f string ModelCorrespondence n CIM_Printer.CharSetsSupported CurrentLanguage b 6
� � � ��� � g | uint16 ValueMap / � � � � � � � � � � � � � � � � � � � � � � # ' + / 3 7 ; ? C G K O S W [ _ c 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 ModelCorrespondence � � CIM_Printer.LanguagesSupported CIM_Printer.CurrentMimeType CurrentMimeType d )
�
� �� * string ModelCorrespondence 2 CIM_Printer.CurrentLanguage CurrentNaturalLanguage / � )
� � � ��� � string ModelCorrespondence � CIM_Printer.NaturalLanguagesSupported CurrentPaperType V )
� 3 � ��; P string ModelCorrespondence X CIM_Printer.PaperTypesAvailable DefaultCapabilities $ ~ )
� � � ��� � uint16 ModelCorrespondence � CIM_Printer.Capabilities DefaultCopies ' �
� = � �� uint32 DefaultLanguage h 6
� � � ��� � 4 uint16 ValueMap / l
o
r
u
x
{
~
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 ModelCorrespondence @ ` CIM_Printer.LanguagesSupported CIM_Printer.DefaultMimeType DefaultMimeType j )
� � � ��� � string ModelCorrespondence � CIM_Printer.DefaultLanguage DefaultNumberUp ) �
� B � �� uint32 DefaultPaperType R )
� � � ��� � string ModelCorrespondence � CIM_Printer.PaperTypesAvailable DetectedErrorState D 6
� 1
� ��9
N
t
�
uint16 ModelCorrespondence V
CIM_Printer.ErrorInformation MappingStrings �
MIB.IETF|Printer-MIB.hrPrinterDetectedErrorState ErrorInformation F 4
� � �� � �� / string ModelCorrespondence 7 CIM_Printer.DetectedErrorState HorizontalResolution * � )
� � � ��� � uint32 ModelCorrespondence � CIM_PrintJob.HorizontalResolution JobCountSinceLastReset n '
� 9 � ��A �� uint32 Counter LanguagesSupported Z C
� � � ��� � L \ � � uint16 ValueMap 2 � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � $ ( , 0 4 8 < @ D H 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 MappingStrings d MIB.IETF|Printer-MIB.prtInterpreterLangFamily ModelCorrespondence � � � CIM_Printer.MimeTypesSupported CIM_PrintJob.Language CIM_PrintService.LanguagesSupported MarkingTechnology 2 � 6
� k � ��s } P ` uint16 ValueMap � � � � � � � $ ( , 0 4 8 < @ D H L 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 MappingStrings h MIB.IETF|Printer-MIB.prtMarkerMarkTech MaxCopies & � )
� � � ��� � uint32 ModelCorrespondence � CIM_PrintJob.Copies MaxNumberUp ( � )
� P � ��X m uint32 ModelCorrespondence u CIM_PrintJob.NumberUp MaxSizeSupported 0 � )
� � � ��� � uint32 ModelCorrespondence � CIM_PrintJob.JobSize MimeTypesSupported ^ )
� [ � ��c x string ModelCorrespondence � � � CIM_Printer.LanguagesSupported CIM_PrintJob.MimeTypes CIM_PrintService.MimeTypesSupported NaturalLanguagesSupported . � C
� Q � ��Y d m } � � string ArrayType Indexed MappingStrings � MIB.IETF|Printer-MIB.prtLocalizationLanguage ModelCorrespondence � CIM_PrintJob.NaturalLanguage PaperSizesSupported J
� - � �� uint16 PaperTypesAvailable N C
� � � ��� � � � . string ArrayType Indexed ModelCorrespondence � � CIM_PrintJob.RequiredPaperType CIM_PrintService.PaperTypesAvailable MappingStrings 6 MIB.IETF|Printer-MIB.prtInputMediaName PrinterStatus B 6
� � � ��� � � uint16 ValueMap � � � � � � � 1 2 3 4 5 6 7 MappingStrings MIB.IETF|Printer-MIB.hrPrinterStatus TimeOfLastReset e ! r
� q � �� datetime VerticalResolution + � )
� � � ��� � uint32 ModelCorrespondence � CIM_PrintJob.HorizontalResolution � C I M _ P h y s i c a l P a c k a g e �ȝ��C�" e CIM_PhysicalPackage )
�� " J X � � 5 h t � � �����_����������������������������������������������������������������������������������������������: � CIM_Card abstract Locale UUID {FAF76B76-798C-11D2-AAD1-006008C78BC7} HostingBoard P
� � � �� boolean RequirementsDescription Z )
� � � � � �� string ModelCorrespondence CIM_Card.SpecialRequirements RequiresDaughterBoard V
� _ � �� boolean SlotLayout R
� � � �� string SpecialRequirements X )
� � � � �� boolean ModelCorrespondence CIM_Card.RequirementsDescription � j � n�� ���. � ���* D ��n
w � � x ğ�] � ��K ]��dg T � �ڻ U ~:F � � �� : ���B m ���� n 7iQ $ R S O P _ S e c u r i t y S e t t i n g s B l o c k e d �ҝ��C�� / & RSOP_SecuritySettingsBlocked � � � � � ������ � � � ������������������������0 � RSOP_RegistryKeyBlocked Mode $
� K S [ uint32 Values k t | Inherit Ignore Overwrite Path
� � � �� string precedence @
� � � �� uint32 SDDLString
(
� ( string �
E v e n t T r a c e �ҝ��C�� EventTrace 6 � ��
/ 5 ] e o v m����� � WinLogon Description Windows Winlogon Trace guid {d451642c-63a6-11d7-9720-00b0d03e0347} locale MS\0x409 Flags E
� � � � � � h v { � uint32 Description Enable Flags ValueDescriptions S ^ j z � � � � � � � � � � 1 C W Core Flag Setup Flag DataStore Flag Machine Flag Session Flag User Flag WMsg Flag Sas Flag StateTrace Flag Job Flag Timeout Flag Power Flag Logon Flag Logoff Flag Lock Flag Unlock Flag ChangePassword Flag ScreenSaver Flag Accessibility Flag SLActivate Flag DefineValues � � � � � � � & - 5 ; C S ` o Core Setup DataStore Machine Session User WMsg Sas StateTrace Job Timeout Power Logon Logoff Lock Unlock ChangePassword ScreenSaver Accessibility SLActivate Values � � � � �
# , 3 : B H P ` m | Core Setup DataStore Machine Session User WMsg Sas StateTrace Job Timeout Power Logon Logoff Lock Unlock ChangePassword ScreenSaver Accessibility SLActivate �
E v e n t T r a c e �ҝ��C�� EventTrace 6 � �� # 1 7 _ g q � Bid2Etw_MSDADIAG_ETW Description MSDADIAG.ETW Guid {8B98D3F2-3CC6-0B9C-6651-9649CCE5C752} locale MS\0x409 B � B i d 2 E t w _ M S D A D I A G _ E T W �ҝ��C� Bid2Etw_MSDADIAG_ETW C � �� ) 7 = e r | � � � Bid2Etw_MSDADIAG_ETW_Trace Description MSDADIAG.ETW Guid {8B98D3F3-3CC6-0B9C-6651-9649CCE5C752} DisplayName msdadiag locale MS\0x409 � B i d 2 E t w _ M S D A D I A G _ E T W _ T r a c e �ҝ��C�+ $ Bid2Etw_MSDADIAG_ETW_Trace C � ��" / R ] l s { � � � ���������� � Bid2Etw_MSDADIAG_ETW_Trace_TextA Description MSDADIAG.ETW formatted output (A) EventType EventTypeName TextA locale MS\0x409 ModID 6
� � � � � � �� uint32 WmiDataId Description Module ID msgStr
C
� T \ g t � � � �� object WmiDataId Description Text StringA extension RString � B i d 2 E t w _ M S D A D I A G _ E T W _ T r a c e �ҝ��C�, $ Bid2Etw_MSDADIAG_ETW_Trace C � ��" / R ] l s { � � � ���������� � Bid2Etw_MSDADIAG_ETW_Trace_TextW Description MSDADIAG.ETW formatted output (W) EventType EventTypeName TextW locale MS\0x409 ModID 6
� � � � � � �� uint32 WmiDataId Description Module ID msgStr
C
� T \ g t � � � �� object WmiDataId Description Text StringW extension RWString Mo �
E v e n t T r a c e �ҝ��C�� EventTrace 6 � �� # ) Q Y c � Bid2Etw_BCP_1 Description BCP.1 Guid {24722B88-DF97-4FF6-E395-DB533AC42A1E} locale MS\0x409 B �
B i d 2 E t w _ B C P _ 1 �ҝ��C�� Bid2Etw_BCP_1 C � �� " ) / W d i q { � Bid2Etw_BCP_1_Trace Description BCP.1 Guid {24722B89-DF97-4FF6-E395-DB533AC42A1E} DisplayName BCP locale MS\0x409 � B i d 2 E t w _ B C P _ 1 _ T r a c e �ҝ��C� Bid2Etw_BCP_1_Trace C � �� ( D O ^ e m w ~ � � u��������� � Bid2Etw_BCP_1_Trace_TextA Description BCP.1 formatted output (A) EventType EventTypeName TextA locale MS\0x409 ModID 6
� � � � � � �� uint32 WmiDataId Description Module ID msgStr
C
� F N Y f t � �� object WmiDataId Description Text StringA extension RString � B i d 2 E t w _ B C P _ 1 _ T r a c e �ҝ��C� Bid2Etw_BCP_1_Trace C � �� ( D O ^ e m w ~ � � u��������� � Bid2Etw_BCP_1_Trace_TextW Description BCP.1 formatted output (W) EventType EventTypeName TextW locale MS\0x409 ModID 6
� � � � � � �� uint32 WmiDataId Description Module ID msgStr
C
� F N Y f t � �� object WmiDataId Description Text StringW extension RWString � �
E v e n t T r a c e �ҝ��C�� EventTrace 6 � �� ! - 3 [ c m � Bid2Etw_DBNETLIB_1 Description DBNETLIB.1 Guid {BD568F20-FCCD-B948-054E-DB3421115D61} locale MS\0x409 B � B i d 2 E t w _ D B N E T L I B _ 1 �ҝ��C�� Bid2Etw_DBNETLIB_1 C � �� ' 3 9 a n x � � � Bid2Etw_DBNETLIB_1_Trace Description DBNETLIB.1 Guid {BD568F21-FCCD-B948-054E-DB3421115D61} DisplayName DBNETLIB locale MS\0x409 � B i d 2 E t w _ D B N E T L I B _ 1 _ T r a c e �ҝ��C�% " Bid2Etw_DBNETLIB_1_Trace C � �� - N Y h o w � � � � ���������� � Bid2Etw_DBNETLIB_1_Trace_TextA Description DBNETLIB.1 formatted output (A) EventType EventTypeName TextA locale MS\0x409 ModID 6
� � � � � � �� uint32 WmiDataId Description Module ID msgStr
C
� P X c p ~ � � �� object WmiDataId Description Text StringA extension RString le � B i d 2 E t w _ D B N E T L I B _ 1 _ T r a c e �ҝ��C�& " Bid2Etw_DBNETLIB_1_Trace C � �� - N Y h o w � � � � ���������� � Bid2Etw_DBNETLIB_1_Trace_TextW Description DBNETLIB.1 formatted output (W) EventType EventTypeName TextW locale MS\0x409 ModID 6
� � � � � � �� uint32 WmiDataId Description Module ID msgStr
C
� P X c p ~ � � �� object WmiDataId Description Text StringW extension RWString I �
E v e n t T r a c e �ҝ��C�� EventTrace
�� $ I����� � WinLogon AMENDMENT LOCALE Flags
� P X b uint32 ValueMap � � � � � � �
" . : F R ^ j v � � � 0x00000001 0x00000002 0x00000004 0x00000008 0x00000010 0x00000020 0x00000040 0x00000080 0x00000100 0x00000200 0x00000400 0x00000800 0x00001000 0x00002000 0x00004000 0x00008000 0x00010000 0x00020000 0x00040000 0x00080000 � I � Y]W � �~> ��24 �g \ � � �� ��%Y I ��
" �{�9 ,B�-M � ��I�: � ���7 ) �P�t` � (u\ � �lд� � �s�:� A �3�� �
C I M _ C o m p o n e n t ɝ��C�� CIM_Component ) $ ��. 6 < d t � � e��������V � CIM_OperatingSystemSoftwareFeature Abstract Locale UUID {96B4C734-DB36-11d2-85FC-0000F8102E5F} GroupComponent f@ )
� � � ��� � ref:CIM_OperatingSystem Override GroupComponent PartComponent f@ )
� $ � ��= G ref:CIM_SoftwareFeature Override PartComponent IM �
C I M _ C o m p o n e n t ɝ��C�� CIM_Component ) �� ! ' O _ � � e��������n � CIM_OSProcess Abstract Locale UUID {A361A7AE-DB36-11d2-85FC-0000F8102E5F} GroupComponent f@ C
� � � ��� � � � ref:CIM_OperatingSystem Max Min Override GroupComponent PartComponent f@ 4
� > � ��O Y h �� ref:CIM_Process Override PartComponent Weak �
C I M _ C o m p o n e n t ɝ��C�� CIM_Component ) �� % + S c � � e��������i � CIM_ProcessThread Abstract Locale UUID {B7E6042C-DB36-11d2-85FC-0000F8102E5F} GroupComponent f@ C
� � � ��� � � � ref:CIM_Process Max Min Override GroupComponent PartComponent f@ 4
� : � ��J T c �� ref:CIM_Thread Override PartComponent Weak �
C I M _ C o m p o n e n t ɝ��C�� CIM_Component ) ��# + 1 Y i � � e��������* � CIM_RedundancyComponent Abstract Locale UUID {FB9D6E62-DB36-11d2-85FC-0000F8102E5F} GroupComponent f@ )
� � � ��� � ref:CIM_RedundancyGroup Override GroupComponent PartComponent f@
� � �� ref:CIM_ManagedSystemElement -8 � C I M _ R e d u n d a n c y C o m p o n e n t ɝ��C�� ! CIM_RedundancyComponent ) " ��, 4 : b r � � e��������\ � CIM_AggregateRedundancyComponent Abstract Locale UUID {154E66D8-DB35-11d2-85FC-0000F8102E5F} GroupComponent f@ )
� � � ��� � ref:CIM_StorageRedundancyGroup Override GroupComponent PartComponent f@ )
� ) � ��C M ref:CIM_AggregatePExtent Override PartComponent to � C I M _ R e d u n d a n c y C o m p o n e n t ɝ��C�� ! CIM_RedundancyComponent ) ��* 2 8 ` p � � e��������X � CIM_PExtentRedundancyComponent Abstract Locale UUID {AD3C1FA2-DB36-11d2-85FC-0000F8102E5F} GroupComponent f@ )
� � � ��� � ref:CIM_StorageRedundancyGroup Override GroupComponent PartComponent f@ )
� ' � ��? I ref:CIM_PhysicalExtent Override PartComponent _S � C I M _ S y s t e m C o m p o n e n t
ɝ��C�� CIM_SystemComponent ) ��& . 4 \ l � e��������p � CIM_ComputerSystemResource Abstract Locale UUID {9B81340A-E3D3-11d2-8601-0000F8102E5F} GroupComponent f@ C
� � � ��� � � � ref:CIM_ComputerSystem Max Min Override GroupComponent PartComponent f@ )
� ? � ��W a ref:CIM_SystemResource Override PartComponent � C I M _ C o m p u t e r S y s t e m R e s o u r c e ɝ��C�� $ CIM_ComputerSystemResource ) ��! ) / W g � � e��������M � CIM_ComputerSystemDMA Abstract Locale UUID {9B81340B-E3D3-11d2-8601-0000F8102E5F} GroupComponent f@ )
� � � ��� � ref:CIM_ComputerSystem Override GroupComponent PartComponent f@ 4
� ! � ��. 8 G �� ref:CIM_DMA Override PartComponent Weak � C I M _ C o m p u t e r S y s t e m R e s o u r c e ɝ��C�� $ CIM_ComputerSystemResource ) ��! ) / W g � � e��������& � CIM_ComputerSystemIRQ Abstract Locale UUID {A2EFC896-E3D3-11d2-8601-0000F8102E5F} GroupComponent f@
� � � �� ref:CIM_ComputerSystem PartComponent f@ 4
� � � �� �� ref:CIM_IRQ Override PartComponent Weak � C I M _ C o m p u t e r S y s t e m R e s o u r c e
ɝ��C�� $ CIM_ComputerSystemResource ) ��& . 4 \ l � � e��������6 � CIM_ComputerSystemMappedIO Abstract Locale UUID {A2EFC897-E3D3-11d2-8601-0000F8102E5F} GroupComponent f@
� � � �� ref:CIM_ComputerSystem PartComponent f@ 4
� � � �� ! 0 �� ref:CIM_MemoryMappedIO Override PartComponent Weak � C I M _ S y s t e m C o m p o n e n t ɝ��C�� CIM_SystemComponent ) �� ( . V f � e��������w � CIM_HostedFileSystem Abstract Locale UUID {A2EFC898-E3D3-11d2-8601-0000F8102E5F} GroupComponent f@ C
� � � ��� � � � ref:CIM_ComputerSystem Max Min Override GroupComponent PartComponent f@ 4
� D � ��X b q �� ref:CIM_FileSystem Override PartComponent Weak � ɝ��C��
) �� % + S \ � � � � U������������: � CIM_Configuration Abstract Locale UUID {4C51D7AE-DB22-11d2-85FC-0000F8102E5F} Caption )
� � � ��� @ STRING MaxLen Description
� � � �� STRING Name 4
� * � �� � ��2 STRING MaxLen 5F � C I M _ D e p e n d e n c y ɝ��C�� CIM_Dependency ) �� ' - U a � � U��������1 � CIM_AssociatedAlarm Abstract Locale UUID {2280CB02-DB35-11d2-85FC-0000F8102E5F} Antecedent f@ )
� � � ��� � ref:CIM_AlarmDevice Override Antecedent Dependent f@ )
� � �� & ref:CIM_LogicalDevice Override Dependent ce � C I M _ D e p e n d e n c y ɝ��C�� CIM_Dependency ) ��! ) / W c � � U��������5 � CIM_AssociatedCooling Abstract Locale UUID {306F88F2-DB35-11d2-85FC-0000F8102E5F} Antecedent f@ )
� � � ��� � ref:CIM_CoolingDevice Override Antecedent Dependent f@ )
� � �� * ref:CIM_LogicalDevice Override Dependent ce � C I M _ A s s o c i a t e d S e n s o r ɝ��C� CIM_AssociatedSensor ) # ��- 5 ; c o � � ? P U����������� � CIM_AssociatedSupplyCurrentSensor Abstract Locale UUID {29B273F2-E3D3-11d2-8601-0000F8102E5F} Antecedent f@ )
� � � ��� � ref:CIM_CurrentSensor Override Antecedent Dependent f@ )
� � ��* 4 ref:CIM_PowerSupply Override Dependent MonitoringRange
� z � �� UINT16 � W i n 3 2 _ P n P D e v i c e P r o p e r t y ʝ��C�� ! Win32_PnPDeviceProperty % ��������������������������W � Win32_PnPDevicePropertySint64 Data
� O � �� Sint64 � ��9 �
��w�U � V�w�9 � �7�� ov�c� � ~��� 2 �CCJ�
C I M _ L o g i c a l D e v i c e �ȝ��C��
l CIM_LogicalDevice ) �� ! ' O ] � � P X � � M \ � � l r � � * \ k ����UU�����������������������������������������������������������������������������������������������������~ � CIM_Processor Abstract Locale UUID {8502C54B-5FBB-11D2-AAC1-006008C78BC7} AddressWidth B
� � � �� uint16 CurrentClockSpeed D )
� � � � � �� uint32 MappingStrings � MIF.DMTF|Processor|006.6 DataWidth H
� H � �� uint16 Family J C
� � � ��� � D T v � uint16 ValueMap l o r u x { ~ � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � �
" & * . 2 6 : > B F J N R V Z ^ c h m r w | � � � � � � � � � � � � � � � � � � � � � � � � � �
! & + 0 5 : ? 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 48 49 50 51 52 53 54 55 64 65 66 67 68 69 80 81 82 83 84 85 86 87 88 96 97 98 99 100 101 112 120 121 122 128 130 131 132 144 145 146 147 148 149 150 160 176 177 178 179 180 181 182 183 184 185 190 200 201 202 203 204 250 251 260 261 280 281 300 301 302 320 350 500 MappingStrings \ MIF.DMTF|Processor|014.3 ModelCorrespondence � CIM_Processor.OtherFamilyDescription LoadPercentage P )
� � �� uint16 MappingStrings MIB.IETF|HOST-RESOURCES-MIB.hrProcessorLoad MaxClockSpeed R )
� � � � � �� uint32 MappingStrings � MIF.DMTF|Processor|006.5 OtherFamilyDescription L 6
� ) � ��1 @ 9 N string MaxLen ModelCorrespondence V CIM_Processor.Family Role V
� � � �� string Stepping \ )
� � � � �� string ModelCorrespondence
CIM_Processor.Family UniqueId `
� T � �� string UpgradeMethod Z 6
� � � ��� � L \ uint16 ValueMap
" % ( , 0 4 8 < @ D H 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 MappingStrings d MIF.DMTF|Processor|006.7 � C I M _ P o w e r S u p p l y �ȝ��C�� � CIM_PowerSupply ) ��* 2 8 ` z � � r � � b z � � R k # �����}}������������������������������������������������������������������������������������������������������������������������� � CIM_UninterruptiblePowerSupply Abstract Locale UUID {8502C54F-5FBB-11D2-AAC1-006008C78BC7} EstimatedChargeRemaining " v )
� � � ��� � uint16 MappingStrings � MIF.DMTF|UPS Battery|001.4 EstimatedRunTime ! r )
� 6 � ��> N uint32 MappingStrings V MIF.DMTF|UPS Battery|001.3 Range1InputVoltageHigh @ N )
� � � ��� � uint32 Override Range1InputVoltageHigh Range1InputVoltageLow @ R )
� 9 � ��A K uint32 Override Range1InputVoltageLow Range2InputVoltageHigh @ ^ )
� � � ��� � uint32 Override Range2InputVoltageHigh Range2InputVoltageLow @ b )
� ) � ��1 ; uint32 Override Range2InputVoltageLow RemainingCapacityStatus l 6
� � � ��� � � � uint16 ValueMap � � � � 1 2 3 4 MappingStrings � MIF.DMTF|UPS Battery|001.1 TimeOnBackup n )
� Z � ��b r uint32 MappingStrings z MIF.DMTF|UPS Battery|001.2 � C I M _ C o n t r o l l e r �ȝ��C�^ ] CIM_Controller ) ��" * 0 X f V n �����_���������������������������������������������������������������������������������������� � CIM_ParallelController Abstract Locale UUID {8502C552-5FBB-11D2-AAC1-006008C78BC7} Capabilities L C
� � � ��� � � �
uint16 ArrayType Indexed MappingStrings � MIF.DMTF|Parallel Ports|003.8 ModelCorrespondence ' CIM_ParallelController.CapabilityDescriptions CapabilityDescriptions P 6
� � � ��� � � � string ArrayType Indexed ModelCorrespondence � CIM_ParallelController.Capabilities DMASupport T )
� S � ��\ l boolean MappingStrings t MIF.DMTF|Parallel Ports|003.7 � C I M _ C o n t r o l l e r �ȝ��C�� e CIM_Controller ) �� & , T h � � � � 3 �����_������������������������������������������������������������������������������������������������ � CIM_SCSIController Abstract Locale UUID {8502C553-5FBB-11D2-AAC1-006008C78BC7} ControllerTimeouts L
� � � �� uint32 MaxDataWidth P
� � � �� uint32 MaxTransferRate T
� � �� uint64 ProtectionManagement \ 6
� w � �� � � � uint16 ValueMap � � � � � � 1 2 3 4 5 6 MappingStrings � MIF.DMTF|Storage Controller|001.3 � C I M _ C o n t r o l l e r �ȝ��C�� _ CIM_Controller ) �� ( . V d � � _ l �����_������������������������������������������������������������������������������������������ � CIM_SerialController Abstract Locale UUID {8502C554-5FBB-11D2-AAC1-006008C78BC7} Capabilities L P
� � � ��� � � � ( 8 ] r uint16 ArrayType Indexed ValueMap # 1 2 3 4 5 6 160 161 MappingStrings @ MIF.DMTF|Serial Ports|004.7 ModelCorrespondence z CIM_SerialController.CapabilityDescriptions CapabilityDescriptions P 6
� � �� 4 string ArrayType Indexed ModelCorrespondence < CIM_SerialController.Capabilities MaxBaudRate T )
� � � � � �� uint32 MappingStrings � MIF.DMTF|Serial Ports|004.6 � C I M _ L o g i c a l F i l e �ȝ��C�� � CIM_LogicalFile 6 � �� � & N \ � � �������������������������������������������������������������������������������������������������������������������������������������� � CIM_DataFile CIMWin32 Locale UUID {8502C55A-5FBB-11D2-AAC1-006008C78BC7} Manufacturer z )
� � � ��� � string Schema Win32 Version v )
� � � ��� � string Schema Win32 �
C I M _ C o m p o n e n t ɝ��C�� CIM_Component ) ��# + 1 Y i � � e��������m � CIM_CollectionOfSensors Abstract Locale UUID {A2ABF536-DB35-11d2-85FC-0000F8102E5F} GroupComponent f@ 6
� � � ��� � � ref:CIM_MultiStateSensor Max Override GroupComponent PartComponent f@ 6
� 9 � ��O T ^ ref:CIM_BinarySensor Min Override PartComponent � �R�H� � -��V � U���' ] H"�c� � I�8�
� ��{�� � �y � 7J� I � C I M _ M a n a g e d S y s t e m E l e m e n t �ȝ��C�~ > " CIM_ManagedSystemElement ) �� ' -
U h � � f | � � ? M � � � � @ I �WU����������������������������������������������������������� � CIM_PhysicalElement Abstract Locale UUID {FAF76B61-798C-11D2-AAD1-006008C78BC7} CreationClassName 4
� � � �� � ��� string CIM_Key MaxLen Manufacturer )
� � �� string MaxLen Model )
� V � ��^ @ string MaxLen OtherIdentifyingInfo
4
� � � �� string PartNumber 0 )
� � � ��� string MaxLen PoweredOn 8
� 6 � �� boolean SerialNumber $ )
� � � ��� @ string MaxLen SKU )
� � � ��� @ string MaxLen Tag
( 4
� ' / �� � ��8 string CIM_Key MaxLen Version , )
� � � ��� @ string MaxLen � C I M _ D e p e n d e n c y �ȝ��C�� CIM_Dependency ) �� & N Z � � U��������. � CIM_Realizes Abstract Locale UUID {FAF76B62-798C-11D2-AAD1-006008C78BC7} Antecedent f@ )
� � � ��� � ref:CIM_PhysicalElement Override Antecedent Dependent f@ )
� � �� # ref:CIM_LogicalDevice Override Dependent en � �ȝ��C�E )
�� % M V � � � � � � & m u U����������������������������� � CIM_Product abstract Locale UUID {FAF76B63-798C-11D2-AAD1-006008C78BC7} Caption )
� � � ��� @ string MaxLen Description
� � � �� string IdentifyingNumber A
� > � �� � ��F @ N ^ string MaxLen MappingStrings f MIF.DMTF|ComponentID|001.4 Name A
� � � �� � ��� � � string MaxLen MappingStrings � MIF.DMTF|ComponentID|001.2 SKUNumber )
� ] � ��e @ string MaxLen Vendor A
� � � �� � ��� � � string CIM_Key MaxLen MappingStrings � MIF.DMTF|ComponentID|001.1 Version A
� i � �� � ��q @ y � string MaxLen MappingStrings � MIF.DMTF|ComponentID|001.3 � C I M _ S t o r a g e E x t e n t �ȝ��C�O � CIM_StorageExtent ) �� $ L a % � � � � y � K V ) 9 k v � � � � N Y � � A X � � �
�
������UUU������������������������������������������������������������������������������������������������������������������������������������������������������������
� CIM_Memory Abstract Locale UUID {FAF76B64-798C-11D2-AAD1-006008C78BC7} AdditionalErrorData % � 6
� � � � � �� @ uint8 MappingStrings � � MIF.DMTF|Memory Device|002.18 MIF.DMTF|Physical Memory Array|001.13 MAX CorrectableError r )
� \ e u � �� boolean MappingStrings � � MIF.DMTF|Memory Device|002.12 MIF.DMTF|Physical Memory Array|001.8 EndingAddress d )
� $ � �� uint64 MappingStrings 0 ^ MIF.DMTF|Memory Array Mapped Addresses|001.4 MIF.DMTF|Memory Device Mapped Addresses|001.5 ErrorAccess x 6
� � � � ' � �� uint16 ValueMap 1 2 3 4 5 MappingStrings 3 R MIF.DMTF|Memory Device|002.15 MIF.DMTF|Physical Memory Array|001.10 ErrorAddress " � )
� � � � � �� uint64 MappingStrings � $ MIF.DMTF|Memory Device|002.19 MIF.DMTF|Memory Device|002.20 MIF.DMTF|Physical Memory Array|001.14 ErrorData ~ C
� � � � � � � ��$ @ uint8 ArrayType Indexed MappingStrings � � MIF.DMTF|Memory Device|002.17 MIF.DMTF|Physical Memory Array|001.12 MAX ErrorDataOrder ! �
� c � �� uint16 ErrorInfo l C
� � � � D T � � � �� uint16 ValueMap ! $ ' * - 0 4 8 < @ 1 2 3 4 5 6 7 8 9 10 11 12 13 14 MappingStrings ` MIF.DMTF|Memory Device|002.12 MIF.DMTF|Physical Memory Array|001.8 ModelCorrespondence � CIM_Memory.OtherErrorDescription ErrorMethodology @ L 6
� : � ��B L ^ n string Override ErrorMethodology MappingStrings v MIF.DMTF|Physical Memory Array|001.7 ErrorResolution $ � )
� � � � � �� uint64 MappingStrings ' MIF.DMTF|Memory Device|002.21 MIF.DMTF|Physical Memory Array|001.15 ErrorTime e t
� � � �� datetime ErrorTransferSize z )
� � � � � �� uint32 MappingStrings � MIF.DMTF|Memory Device|002.16 MIF.DMTF|Physical Memory Array|001.11 OtherErrorDescription n )
� � � � � �� string ModelCorrespondence � CIM_Memory.ErrorInfo StartingAddress \ )
�
*
� �� uint64 MappingStrings 6
d
MIF.DMTF|Memory Array Mapped Addresses|001.3 MIF.DMTF|Memory Device Mapped Addresses|001.4 SystemLevelAddress # �
� �
� �� boolean �
C I M _ M e m o r y �ȝ��C�� � CIM_Memory ) ��" * 0 X e ���������������������������������������������������������������������������������������������������������������������������������������������������������������������� � CIM_NonVolatileStorage Abstract Locale UUID {18074AFA-F0FE-11d2-8617-0000F8102E5F} IsWriteable & �
� � � �� boolean �
C I M _ M e m o r y �ȝ��C�| � CIM_Memory ) �� ' - U ` � � ���������_��������������������������������������������������������������������������������������������������������������������������������������������������������������r � CIM_VolatileStorage Abstract Locale UUID {36851DFE-F0FE-11d2-8617-0000F8102E5F} Cacheable & � )
� � � ��� � boolean MappingStrings � MIF.DMTF|System Resource Memory Info|001.5 CacheType ' � )
� & � ��. > uint16 MappingStrings F MIF.DMTF|System Resource Memory Info|001.6 � C I M _ D e p e n d e n c y �ȝ��C�� CIM_Dependency ) �� ( . V b � � U��������- � CIM_AssociatedMemory abstract Locale UUID {464FFAB0-946F-11d2-AAE2-006008C78BC7} Antecedent f@ )
� � � ��� � ref:CIM_Memory Override Antecedent Dependent f@ )
� � �� " ref:CIM_LogicalDevice Override Dependent � C I M _ H o s t e d S e r v i c e !ɝ��C�e CIM_HostedService ) ��! ) / W c � � U��������� � CIM_HostedBootService Abstract Locale UUID {6DAE7092-DB36-11d2-85FC-0000F8102E5F} Antecedent f@
� � ref:CIM_System Dependent f@
� � � � ref:CIM_BootService Override Dependent CI � g�3� A e��$1 � �f�& � p��W$ | �u_�� � ���r � W[~ \
� x�1� � ����� � S4u� HJ��� �E�A� � a'�m�
�T � � C I M _ A s s o c i a t e d S e n s o r ɝ��C� CIM_AssociatedSensor ) # ��- 5 ; c o � � ? P U����������� � CIM_AssociatedSupplyVoltageSensor Abstract Locale UUID {327ABD78-E3D3-11d2-8601-0000F8102E5F} Antecedent f@ )
� � � ��� � ref:CIM_VoltageSensor Override Antecedent Dependent f@ )
� � ��* 4 ref:CIM_PowerSupply Override Dependent MonitoringRange
� z � �� UINT16 � C I M _ B a s e d O n ɝ��C�� CIM_BasedOn
) ! ��+ 3 9 a m � � �������������������������K � CIM_LogicalDiskBasedOnVolumeSet Abstract Locale UUID {3A608798-E3D3-11d2-8601-0000F8102E5F} Antecedent f@ 6
� � � ��� � � ref:CIM_VolumeSet Max Override Antecedent Dependent f@ )
� ! � ��6 @ ref:CIM_LogicalDisk Override Dependent � C I M _ B a s e d O n ɝ��C�� CIM_BasedOn
) ��& . 4 \ h � � �������������������������T � CIM_PSExtentBasedOnPExtent Abstract Locale UUID {451FE14C-E3D3-11d2-8601-0000F8102E5F} Antecedent f@ 6
� � � ��� � � ref:CIM_PhysicalExtent Max Override Antecedent Dependent f@ )
� ! � ��? I ref:CIM_ProtectedSpaceExtent Override Dependent � C I M _ D e p e n d e n c y ɝ��C�H CIM_Dependency ) �� & , T ` � � 5 D v � U������������������������� � CIM_BIOSLoadedInNV Abstract Locale UUID {524ED194-DB35-11d2-85FC-0000F8102E5F} Antecedent f@ )
� � � ��� � ref:CIM_NonVolatileStorage Override Antecedent Dependent f@ )
� � �� * ref:CIM_BIOSElement Override Dependent EndingAddress
� n � �� UINT64 StartingAddress
� � � �� UINT64 � C I M _ D e p e n d e n c y ɝ��C�� CIM_Dependency ) �� $ * R ^ � � U��������/ � CIM_BootOSFromFS Abstract Locale UUID {5F5B101E-DB35-11d2-85FC-0000F8102E5F} Antecedent f@ )
� � � ��� � ref:CIM_FileSystem Override Antecedent Dependent f@ )
� � �� $ ref:CIM_OperatingSystem Override Dependent � C I M _ D e p e n d e n c y ɝ��C�� CIM_Dependency ) ��$ , 2 Z f � � U��������G � CIM_DeviceAccessedByFile Abstract Locale UUID {05D1FFF2-DB36-11d2-85FC-0000F8102E5F} Antecedent f@ )
� � � ��� � ref:CIM_DeviceFile Override Antecedent Dependent f@ 6
� � ��- 2 < ref:CIM_LogicalDevice Max Override Dependent � C I M _ C o n t r o l l e d B y ɝ��C�R ) CIM_ControlledBy ) �� % + S _ � � 2 ? q ����������������������������������������� � CIM_SCSIInterface Abstract Locale UUID {7CE7448E-E3D4-11d2-8601-0000F8102E5F} Antecedent f@ )
� � � ��� � ref:CIM_SCSIController Override Antecedent Dependent f@ )
� � �� ' ref:CIM_LogicalDevice Override Dependent SCSIRetries
� i � �� UINT32 SCSITimeouts "
� � � �� UINT32 � C I M _ C o n t r o l l e d B y ɝ��C�� ' CIM_ControlledBy ) �� ' - U a � � 6 G y � � � ��������������������������������������� � CIM_SerialInterface Abstract Locale UUID {8B309BDA-E3D4-11d2-8601-0000F8102E5F} Antecedent f@ )
� � � ��� � ref:CIM_SerialController Override Antecedent Dependent f@ )
�
� ��! + ref:CIM_LogicalDevice Override Dependent FlowControlInfo
� q � �� UINT16 NumberOfStopBits
� � � �� UINT16 ParityInfo "
� � � �� UINT16 � C I M _ D e p e n d e n c y ɝ��C�� CIM_Dependency ) ! ��+ 3 9 a m � � U��������9 � CIM_DeviceServiceImplementation Abstract Locale UUID {290FC242-DB36-11d2-85FC-0000F8102E5F} Antecedent f@ )
� � � ��� � ref:CIM_LogicalDevice Override Antecedent Dependent f@ )
� � ��$ . ref:CIM_Service Override Dependent De � C I M _ D e p e n d e n c y ɝ��C�� CIM_Dependency ) �� & , T ` � � 4 = � � U��������������L � CIM_DeviceSoftware Abstract Locale UUID {36363AAA-DB36-11d2-85FC-0000F8102E5F} Antecedent f@ )
� � � ��� � ref:CIM_SoftwareElement Override Antecedent Dependent f@ )
� � �� ) ref:CIM_LogicalDevice Override Dependent Purpose )
� t � ��| � UINT16 ModelCorrespondence � CIM_DeviceSoftware.PurposeDescription PurposeDescription
)
� � �� ( STRING ModelCorrespondence 0 CIM_DeviceSoftware.Purpose IM � C I M _ D e p e n d e n c y ɝ��C�� CIM_Dependency ) ��! ) / W c � � U��������h � CIM_HostedAccessPoint Abstract Locale UUID {576C3C56-DB36-11d2-85FC-0000F8102E5F} Antecedent f@ C
� � � ��� � � � ref:CIM_System Override Antecedent Max Min Dependent f@ 4
� 1 � ��M W b �� ref:CIM_ServiceAccessPoint Override Dependent Weak � C I M _ H o s t e d A c c e s s P o i n t ɝ��C�� CIM_HostedAccessPoint ) �� % + S _ � � U��������3 � CIM_HostedBootSAP Abstract Locale UUID {625B4512-DB36-11d2-85FC-0000F8102E5F} Antecedent f@ )
� � � ��� � ref:CIM_UnitaryComputerSystem Override Antecedent Dependent f@ )
�
� �� ( ref:CIM_BootSAP Override Dependent st � C I M _ D e p e n d e n c y ɝ��C�� CIM_Dependency ) ��$ , 2 Z f � � U��������g � CIM_HostedJobDestination Abstract Locale UUID {7880DD16-DB36-11d2-85FC-0000F8102E5F} Antecedent f@ C
� � � ��� � � � ref:CIM_System Max Min Override Antecedent Dependent f@ 4
� 4 � ��L V a �� ref:CIM_JobDestination Override Dependent Weak � C I M _ D e p e n d e n c y ɝ��C�� CIM_Dependency ) �� % + S _ � � U��������Y � CIM_HostedService Abstract Locale UUID {83B2A7AA-DB36-11d2-85FC-0000F8102E5F} Antecedent f@ C
� � � ��� � � � ref:CIM_System Max Min Override Antecedent Dependent f@ 4
� - � ��> H S �� ref:CIM_Service Override Dependent Weak � o�[� ���c� T��� H �z K � ��4&" 6 -���X ; � � � i� L� L ���T� � �+��� � �%>�n � ��H ��J�W � C I M _ C h i p �ȝ��C�� g CIM_Chip
) �� & , T _ � � h s � � � � & 2 � � < C u � ����_U������������������������������������������������������������������������������������������������� � CIM_PhysicalMemory abstract Locale UUID {FAF76B7B-798C-11D2-AAD1-006008C78BC7} BankLabel T 6
� � � @ � � � �� string MaxLen MappingStrings � MIF.DMTF|Memory Device|002.4 Capacity L )
� * 2 B � �� uint64 MappingStrings J MIF.DMTF|Memory Device|002.5 DataWidth F )
� � � � � �� uint16 MappingStrings � MIF.DMTF|Memory Device|002.8 FormFactor @ @ 6
� 8 � ��@ J V f uint16 Override FormFactor MappingStrings n MIF.DMTF|Memory Device|002.6 InterleavePosition \ )
� � � � � �� uint32 MappingStrings � MIF.DMTF|Memory Device Mapped Addresses|001.7 MemoryType B )
� i q � � �� uint16 MappingStrings � MIF.DMTF|Memory Device|002.9 PositionInRow X )
� � � � �� uint32 MappingStrings
MIF.DMTF|Memory Device Mapped Addresses|001.6 Speed H
� m � �� uint32 TotalWidth D )
� � � � � �� uint16 MappingStrings � MIF.DMTF|Memory Device|002.7 � C I M _ P a c k a g e d C o m p o n e n t �ȝ��C��
CIM_PackagedComponent ) �� $ * R b � � u������������J � CIM_MemoryOnCard Abstract Locale UUID {FAF76B7C-798C-11D2-AAD1-006008C78BC7} GroupComponent f@ 6
� � � ��� � � ref:CIM_Card Max Override GroupComponent PartComponent f@ )
� � ��1 ; ref:CIM_PhysicalMemory Override PartComponent � C I M _ P h y s i c a l C o m p o n e n t �ȝ��C� X CIM_PhysicalComponent ) �� % + S ] � � � � [ f � � ����_����������������������������������������������������������������������������������) � CIM_PhysicalMedia Abstract Locale UUID {FAF76B7D-798C-11D2-AAD1-006008C78BC7} Capacity @
� � � �� uint64 CleanerMedia P
� � � �� boolean MediaDescription J )
� ! 6 � �� string ModelCorrespondence > CIM_PhysicalMedia.MediaType MediaType H )
� � � � � �� uint16 ModelCorrespondence � CIM_PhysicalMedia.MediaDescription WriteProtectOn N
� � �� boolean � C I M _ D e p e n d e n c y �ȝ��C�� CIM_Dependency ) �� ' - U a � � U��������4 � CIM_MemoryWithMedia Abstract Locale UUID {FAF76B7E-798C-11D2-AAD1-006008C78BC7} Antecedent f@ )
� � � ��� � ref:CIM_PhysicalMemory Override Antecedent Dependent f@ )
� � �� ) ref:CIM_PhysicalMedia Override Dependent en � C I M _ R e a l i z e s �ȝ��C� CIM_Realizes ) �� ' - U a � � F W U����������������� � CIM_RealizesPExtent Abstract Locale UUID {FAF76B7F-798C-11D2-AAD1-006008C78BC7} Antecedent f@ 6
� � � ��� � � ref:CIM_PhysicalMedia Override Antecedent Max Dependent f@ )
� � ��1 ; ref:CIM_PhysicalExtent Override Dependent StartingAddress
� � � �� uint64 � C I M _ R e a l i z e s �ȝ��C� CIM_Realizes ) ��% - 3 [ g � � K \ U����������������� � CIM_RealizesDiskPartition Abstract Locale UUID {FAF76B80-798C-11D2-AAD1-006008C78BC7} Antecedent f@ 6
� � � ��� � � ref:CIM_PhysicalMedia Override Antecedent Max Dependent f@ )
� � ��6 @ ref:CIM_DiskPartition Override Dependent StartingAddress
� � � �� uint64 � C I M _ R e a l i z e s �ȝ��C�� CIM_Realizes ) ��( 0 6 ^ j � � U��������Q � CIM_RealizesAggregatePExtent Abstract Locale UUID {FAF76B81-798C-11D2-AAD1-006008C78BC7} Antecedent f@ 6
� � � ��� � � ref:CIM_PhysicalMedia Override Antecedent Max Dependent f@ )
� " � ��< F ref:CIM_AggregatePExtent Override Dependent � C I M _ P h y s i c a l E l e m e n t �ȝ��C� S CIM_PhysicalElement ) �� $ * R Z � � � �
���������������������������������������������������������������������������������@ � CIM_PhysicalLink Abstract Locale UUID {FAF76B82-798C-11D2-AAD1-006008C78BC7} Length B
� � � �� real64 MaxLength :
� � � �� real64 MediaType L
� � � �� uint16 Wired J
� 7 � �� boolean � C I M _ D e p e n d e n c y �ȝ��C�� CIM_Dependency ) �� & , T ` � � U��������3 � CIM_ElementsLinked Abstract Locale UUID {FAF76B83-798C-11D2-AAD1-006008C78BC7} Antecedent f@ )
� � � ��� � ref:CIM_PhysicalLink Override Antecedent Dependent f@ )
� � �� ( ref:CIM_PhysicalElement Override Dependent � C I M _ P h y s i c a l E l e m e n t �ȝ��C�� G CIM_PhysicalElement ) ��! ) / W h � � ����������������������������������������������������������������������� � CIM_PhysicalConnector abstract Locale UUID {FAF76B84-798C-11D2-AAD1-006008C78BC7} ConnectorPinout :
� � � �� string ConnectorType >
� � � �� uint16 � C I M _ D e p e n d e n c y �ȝ��C�� CIM_Dependency ) �� # ) Q ] � � U��������7 � CIM_ConnectedTo Abstract Locale UUID {FAF76B85-798C-11D2-AAD1-006008C78BC7} Antecedent f@ )
� � � ��� � ref:CIM_PhysicalConnector Override Antecedent Dependent f@ )
� � ��" , ref:CIM_PhysicalConnector Override Dependent f@ �
C I M _ C o m p o n e n t ɝ��C�� CIM_Component ) �� # ) Q a � � e��������o � CIM_FileStorage Abstract Locale UUID {4A626026-DB36-11d2-85FC-0000F8102E5F} GroupComponent f@ C
� � � ��� � � � ref:CIM_FileSystem Max Min Override GroupComponent PartComponent f@ 4
� ; � ��P Z i �� ref:CIM_LogicalFile Override PartComponent Weak �
C I M _ A c t i o n dɝ��C�r ) CIM_Action ) " J �� T a � � ����������������������������������������� � CIM_ExecuteProgram Locale UUID {149ADDEE-DB2A-11d2-85FC-0000F8102E5F} Abstract CommandLine
� � � �� STRING ProgramPath
" )
� � � � �� STRING maxlen � �3�H � h�r�� \ A���< yhj5A � �OG�� � �Tv� Ek�ƞ m ��X� � l.~r� � ?(]�[ � ��+ m ���a� � ԼǨ3 � H�@ N��3 � ���� � �� � C I M _ L o g i c a l E l e m e n t =ɝ��C�� CIM_LogicalElement ) �� ' - U h � � ���������������������������� � CIM_RedundancyGroup Abstract Locale UUID {4C3A040A-E3D1-11d2-8601-0000F8102E5F} CreationClassName 4
� � � �� � ��� STRING MaxLen RedundancyStatus
� � � �� UINT16 � C I M _ R e d u n d a n c y G r o u p >ɝ��C� CIM_RedundancyGroup ) ��" * 0 X i �������������������������������� � CIM_ExtraCapacityGroup Abstract Locale UUID {570ED2E8-E3D1-11d2-8601-0000F8102E5F} MinNumberNeeded
� � � �� UINT32 � C I M _ R e d u n d a n c y G r o u p ?ɝ��C�� CIM_RedundancyGroup ) �� " ( ����������������������������P � CIM_SpareGroup Abstract Locale UUID {64B86CA6-E3D1-11d2-8601-0000F8102E5F} � C I M _ R e d u n d a n c y G r o u p @ɝ��C�f CIM_RedundancyGroup ) ��& . 4 \ m ������������������������������ � CIM_StorageRedundancyGroup Abstract Locale UUID {6D477DBC-E3D1-11d2-8601-0000F8102E5F} TypeOfAlgorithm )
� � � ��� � UINT16 MappingStrings � MIF.DMTF|Redundancy Group|001.2 � C I M _ S o f t w a r e E l e m e n t Aɝ��C�{ C CIM_SoftwareElement ) �� ( . V b �������������������������������������������������������������������� � CIM_VideoBIOSElement Abstract Locale UUID {76148BF6-E3D1-11d2-8601-0000F8102E5F} IsShadowed < )
� � � ��� � BOOLEAN MappingStrings � MIF.DMTF|Video BIOS|001.5 �
C I M _ S y s t e m Bɝ��C�� + CIM_System ) ��! ) / �������������������������������������������W � CIM_ApplicationSystem Abstract Locale UUID {120BB700-DB2B-11d2-85FC-0000F8102E5F} � Cɝ��C�U 4 �� " ( P �� ] b � � U��������� � CIM_ProductFRU Abstract Locale UUID {EB98A1B2-DB36-11d2-85FC-0000F8102E5F} Association FRU f
� � � �� ref:CIM_FRU Product f )
� � � ��� ref:CIM_Product Max � Dɝ��C�~ ? ��" * 0 X ��e �� r y � � u��������
� CIM_ProductParentChild Abstract Locale UUID {3E24D5A6-DB2B-11d2-85FC-0000F8102E5F} Aggregation Association Child f
� � � �� ref:CIM_Product Parent f '
� � � �� �� ref:CIM_Product Aggregate � Eɝ��C�� ? ��' / 5 ] ��j �� w � � � u��������1 � CIM_ProductPhysicalElements Abstract Locale UUID {502F00A0-DB2B-11d2-85FC-0000F8102E5F} Aggregation Association Component f
� � � �� ref:CIM_PhysicalElement Product f 4
� � ��! ��, ref:CIM_Product Aggregate Max � � Fɝ��C�� 4 ��( 0 6 ^ �� k } � � U����������H � CIM_ProductProductDependency Abstract Locale UUID {65878E68-DB2B-11d2-85FC-0000F8102E5F} Association DependentProduct f
� � � �� ref:CIM_Product RequiredProduct f
� � � �� ref:CIM_Product TypeOfDependency
� @ � �� UINT16 ct � Gɝ��C�U 4 �� & , T �� a j � � e��������� � CIM_ProductSupport Abstract Locale UUID {8D6D6880-DB2B-11d2-85FC-0000F8102E5F} Association Product f
� � � �� ref:CIM_Product Support f
� � � �� ref:CIM_SupportAccess 2- � Hɝ��C�� ? �� & , T ��a �� n w � � e�������� � CIM_SettingContext Abstract Locale UUID {F0B752E8-DB30-11d2-85FC-0000F8102E5F} Aggregation Association Context f '
� � � ��� �� ref:CIM_Configuration Aggregate Setting f
� � �� ref:CIM_Setting in � Iɝ��C�� ? �� % + S ��` �� m t � � e��������H � CIM_StorageDefect Abstract Locale UUID {5CC70817-DB31-11d2-85FC-0000F8102E5F} Aggregation Association Error f '
� � � ��� �� ref:CIM_StorageError Weak Extent f A
� � ��3 ��> C ref:CIM_StorageExtent Aggregate Max Min ge � Jɝ��C�� " ) �� $ * R k � � � � � 4 � � U���������������������������������_ � CIM_StorageError Abstract Locale UUID {71312AB6-DB31-11d2-85FC-0000F8102E5F} DeviceCreationClassName A
� � � �� � ��� � � STRING MaxLen Propagated CIM_StorageExtent.CreationClassName DeviceID A
� T � �� � ��\ @ d p STRING MaxLen Propagated CIM_StorageExtent.DeviceID EndingAddress
� � � �� UINT64 StartingAddress '
� � �� � �� UINT64 SystemCreationClassName A
� � � �� � ��� � � STRING MaxLen Propagated CIM_StorageExtent.SystemCreationClassName SystemName A
� % � �� � ��- 5 A STRING MaxLen Propagated CIM_StorageExtent.SystemName � Kɝ��C�� ) �� % + S f � � � � < D � � U�������������������+ � CIM_SupportAccess Abstract Locale UUID {80321714-DB31-11d2-85FC-0000F8102E5F} CommunicationInfo )
� � � ��� � STRING MappingStrings � � MIF.DMTF|FRU|002.11 MIF.DMTF|FRU|002.12 CommunicationMode 6
� B � ��J Z z � UINT16 MappingStrings b MIF.DMTF|Support|001.5 ValueMap � � � � � � � � 1 2 3 4 5 6 7 8 Description )
� � �� STRING MappingStrings $ MIF.DMTF|Support|001.3 Locale
6
� � � ��� � � @ STRING MappingStrings � MIF.DMTF|Support|001.2 MaxLen SupportAccessId 4
� � �� � ��# STRING MaxLen � Lɝ��C�� 4 ��! ) / W �� d z � � e��������? � CIM_ToDirectoryAction Abstract Locale UUID {B58D172E-DB31-11d2-85FC-0000F8102E5F} Association DestinationDirectory f 6
� � � ��� � ref:CIM_DirectoryAction Max Min FileName f )
� " � ��: ref:CIM_CopyFileAction Min � W i n 3 2 _ P n P D e v i c e P r o p e r t y ʝ��C�� ! Win32_PnPDeviceProperty & ��������������������Y � Win32_PnPDevicePropertyBoolean Data
� P � �� boolean � l/ � � R0��� � GE��[ � �a�- 7 ̖p}d � w�?eE
� 0�@ � �h�O# � �~�� � ǿ6� � �J ]j � Mɝ��C�� 4 ��( 0 6 ^ �� k � � � e��������M � CIM_ToDirectorySpecification Abstract Locale UUID {C3E25A3C-DB31-11d2-85FC-0000F8102E5F} Association DestinationDirectory f 6
� � � ��� � ref:CIM_DirectorySpecification Max Min FileName f )
� 0 � ��H ref:CIM_CopyFileAction Min e � C I M _ D e p e n d e n c y Nɝ��C�� CIM_Dependency ) �� # K W � � U��������- � CIM_Mount Abstract Locale UUID {75BCF4F6-DB46-11D2-B4C8-80080C7B6371} Antecedent f@ 6
� � � ��� � � ref:CIM_Directory Max Override Antecedent Dependent f@ )
� � �� " ref:CIM_NFS Override Dependent " � Oɝ��C��
4 �� ��# + 1 Y d � � � � U������������H � CIM_Export Abstract Association Locale UUID {75BCF4F8-DB46-11D2-B4C8-80080C7B6371} Directory f
� � � �� ref:CIM_Directory ExportedDirectoryName
� � � �� STRING LocalFS f )
� * C � �� ref:CIM_LocalFileSystem Max � C I M _ F i l e S y s t e m Pɝ��C� W CIM_FileSystem ) �� ( . ���������������������������������������������������������������������������������������V � CIM_RemoteFileSystem Abstract Locale UUID {75BCF4F9-DB46-11D2-B4C8-80080C7B6371} � C I M _ R e m o t e F i l e S y s t e m Qɝ��C�� � CIM_RemoteFileSystem ) �� ! I [ � � � 8 \ � � � � ( 3 f q � � � � - E w � � � ����UUU�������������������������������������������������������������������������������������������������������������������������������N � CIM_NFS Abstract Locale UUID {75BCF4FB-DB46-11D2-B4C8-80080C7B6371} AttributeCaching R
� � � �� BOOLEAN AttributeCachingForDirectoriesMax T
� � � �� UINT16 AttributeCachingForDirectoriesMin V
� 0 � �� UINT16 AttributeCachingForRegularFilesMax X
� � � �� UINT16 AttributeCachingForRegularFilesMin Z
� � � �� UINT16 ForegroundMount \
� � �� BOOLEAN HardMount ^
� ] � �� BOOLEAN Interrupt `
� � � �� BOOLEAN MountFailureRetries b
� � � �� UINT16 ReadBufferSize d
� % � �� UINT64 RetransmissionAttempts l
� o � �� UINT16 RetransmissionTimeout n
� � � �� UINT32 ServerCommunicationPort r
� � �� UINT32 WriteBufferSize v
� F � �� UINT64 � C I M _ S e r v i c e Rɝ��C�� ) CIM_Service
) �� # ) �����������������������������������������Q � CIM_BootService Abstract Locale UUID {75BCF4FE-DB46-11D2-B4C8-80080C7B6371} � C I M _ L o g i c a l E l e m e n t Sɝ��C�� ' CIM_LogicalElement ) # K �� U h / 5 � � k s 8 A W�������������������������������������� � CIM_SoftwareFeature Locale UUID {E527D7F2-E3D4-11d2-8601-0000F8102E5F} abstract IdentifyingNumber N
� � � � � ��� @ � ��� string Propagated CIM_Product.IdentifyingNumber Maxlen MappingStrings DMTF|ComponentID|001.4 Name @ A
� � � �� � ��� � � string override Name Maxlen ProductName N
�
! � ��3 � ��; K string Propagated CIM_Product.Name Maxlen MappingStrings S DMTF|ComponentID|001.2 Vendor N
� � � � � �� � �� string Propagated CIM_Product.Vendor CIM_Key Maxlen MappingStrings DMTF|ComponentID|001.1 Version N
� � � � � ��� @ � � � �� string Propagated CIM_Product.Version Maxlen MappingStrings � DMTF|ComponentID|001.3 � Tɝ��C�� ! ) A �� K T � � � 4 A s y � � T k I R UU�������������������������������$ � CIM_Check Locale UUID {7A9135CA-DB21-11d2-85FC-0000F8102E5F} Abstract Caption )
� � � @ � �� string Maxlen CheckID 4
� � � ��� � �� string maxlen CheckMode
� + � �� boolean Description
� k � �� string Name A
� � � � � ��� � �� string Propagated CIM_SoftwareElement.Name CIM_key maxlen SoftwareElementID
A
� i q } � ��� � �� string Propagated CIM_SoftwareElement.SoftwareElementID CIM_key maxlen SoftwareElementState 4
�
! K �� � �� uint16 Propagated CIM_SoftwareElement.SoftwareElementState CIM_key TargetOperatingSystem A
� � � � � �� � �� uint16 Propagated CIM_SoftwareElement.TargetOperatingSystem CIM_key Mappingstrings MIF.DMTF|Software Component Information|002.5 Version N
� � � � � ��� @ � ��� string Propagated CIM_SoftwareElement.Version CIM_key Maxlen Mappingstrings MIF.DMTF|ComponentID|001.3 � � � Invoke y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � C I M _ C h e c k Uɝ��C�� ' CIM_Check ) $ * R �� \ k � � ��������������������������������������1 � CIM_DirectorySpecification Locale UUID {A524EE6E-DB29-11d2-85FC-0000F8102E5F} abstract DirectoryPath
)
� � � � �� string Maxlen DirectoryType )
� � � �� uint16 Mappingstrings MIF.DMTF|Location|001.2 � C I M _ D e p e n d e n c y cɝ��C�� CIM_Dependency ) & N �� X d � � U��������5 � CIM_ServiceAccessBySAP Locale UUID {714C00BA-DB37-11d2-85FC-0000F8102E5F} Abstract Antecedent f@ )
� � � ��� � ref:CIM_Service Override Antecedent Dependent f@ )
� � �� * ref:CIM_ServiceAccessPoint Override Dependent en � W i n 3 2 _ P n P D e v i c e P r o p e r t y ʝ��C�� ! Win32_PnPDeviceProperty % ����������������������W � Win32_PnPDevicePropertyReal32 Data
� O � �� real32 � D8(� � &���� � �|m� � �> � 7qߚ� � LYv�[ D
� � ���9 � Mh��� � hx��j � �7�!P ) ܁+�y = ˾|�� 0 � �� � �� �� �
C I M _ A c t i o n eɝ��C�y 4 CIM_Action ) ! ' O �� Y e � � � � ' 1 x � ��W�������������������������������������������������� � CIM_ModifySettingAction Locale UUID {ECDE0B90-DB2A-11d2-85FC-0000F8102E5F} Abstract ActionType
� � � �� UINT16 EntryName
)
� � � � �� STRING Maxlen EntryValue $
� � �� STRING FileName ( )
� h p � �� STRING Maxlen SectionKey
, )
� � � � �� STRING Maxlen �
C I M _ A c t i o n fɝ��C�� ! CIM_Action ) H �� ���������������������������������R � CIM_RebootAction Locale UUID {AB08D884-DB30-11d2-85FC-0000F8102E5F} Abstract � gɝ��C�� 4 �� ��+ 3 9 a g � � e��������* � CIM_ActionSequence Abstract Association Locale UUID {F127E50E-E3E0-11d2-8601-0000F8102E5F} Next f 6
� � � � � �� ref:CIM_Action Max Min Prior f 6
� % � �� ref:CIM_Action Max Min
� C I M _ C h e c k hɝ��C�f ) CIM_Check ) " J �� T h ������������������������������������������ � CIM_DiskSpaceCheck Locale UUID {D3B1178A-DB29-11d2-85FC-0000F8102E5F} Abstract AvailableDiskSpace )
� � � ��� � UINT64 ModelCorrespondence � CIM_FileSystem.AvailableSpace � C I M _ C h e c k iɝ��C�c ) CIM_Check ) G �� Q ] ������������������������������������������ � CIM_MemoryCheck Locale UUID {DC0E96FE-DB2A-11d2-85FC-0000F8102E5F} Abstract MemorySize )
� � � � � �� UINT64 ModelCorrespondence � CIM_OperatingSystem.FreePhysicalMemory � C I M _ C h e c k jɝ��C� ) CIM_Check ) " J �� T d � ����������������������������������������� � CIM_OSVersionCheck Locale UUID {FEE8368A-DB2A-11d2-85FC-0000F8102E5F} Abstract MaximumVersion 6
� � � @ � � � �� STRING maxlen ModelCorrespondence � CIM_OperatingSystem.Version MinimumVersion
" 6
� F N @ V k � �� STRING maxlen ModelCorrespondence s CIM_OperatingSystem.Version � C I M _ C h e c k kɝ��C�p 4 CIM_Check ) H �� R ] � � � � ) p | ��W�������������������������������������������������� � CIM_SettingCheck Locale UUID {DC1D8140-DB30-11d2-85FC-0000F8102E5F} Abstract CheckType
� � � �� UINT16 EntryName
)
� � � � �� STRING Maxlen EntryValue $
� � �� STRING FileName ( )
� ` h � �� STRING Maxlen SectionKey
, )
� � � � �� STRING Maxlen � C I M _ C h e c k lɝ��C�t 2 CIM_Check ) ! ) / W �� a ~ ! � � d � ; ��W������������������������������������������������ � CIM_SoftwareElementVersionCheck Locale UUID {4D23FBD0-DB31-11d2-85FC-0000F8102E5F} Abstract LowerSoftwareElementVersion 6
� � � @ � � � �� STRING maxlen ModelCorrespondence � CIM_SoftwareElement.Version SoftwareElementName
" 6
� e m u � � �� STRING maxlen ModelCorrespondence � CIM_SoftwareElement.Name SoftwareElementStateDesired & 6
�
@ 2 � �� UINT16 maxlen ModelCorrespondence : CIM_SoftwareElement.SoftwareElementState TargetOperatingSystemDesired ( 6
� � � @ � � � �� UINT16 maxlen ModelCorrespondence � CIM_SoftwareElement.TargetOperatingSystem UpperSoftwareElementVersion
* 6
� � @ � � � �� STRING maxlen ModelCorrespondence � CIM_SoftwareElement.Version � C I M _ C h e c k mɝ��C�i ) CIM_Check ) " J �� T c ������������������������������������������ � CIM_SwapSpaceCheck Locale UUID {A5AE701E-DB31-11d2-85FC-0000F8102E5F} Abstract SwapSpaceSize )
� � � � � �� UINT64 ModelCorrespondence � CIM_OperatingSystem.TotalSwapSpaceSize � C I M _ C h e c k nɝ��C�� ' CIM_Check ) ' - U �� _ q � � � � ��W������������������������������������, � CIM_VersionCompatibilityCheck Locale UUID {D368CA4A-DB31-11d2-85FC-0000F8102E5F} Abstract AllowDownVersion
� � � �� BOOLEAN AllowMultipleVersions
� � � �� BOOLEAN Reinstall "
� # � �� BOOLEAN �# C I M _ S o f t w a r e F e a t u r e S o f t w a r e E l e m e n t s oɝ��C�� - CIM_SoftwareFeatureSoftwareElements % ) % + S �� ] m � � e��������G � CIM_BIOSFeatureBIOSElements Locale UUID {42B2EC5C-DB35-11d2-85FC-0000F8102E5F} Abstract GroupComponent f@ )
� � � ��� � ref:CIM_BIOSFeature Override GroupComponent PartComponent f@ )
� � ��. 8 ref:CIM_BIOSElement Override PartComponent �# C I M _ S o f t w a r e F e a t u r e S o f t w a r e E l e m e n t s pɝ��C�� - CIM_SoftwareFeatureSoftwareElements % ) ' / 5 ] �� g w � � e��������[ � CIM_VideoBIOSFeatureVideoBIOSElements Locale UUID {B3F86390-DB37-11d2-85FC-0000F8102E5F} Abstract GroupComponent f@ )
� � � ��� � ref:CIM_VideoBIOSFeature Override GroupComponent PartComponent f@ )
� ( � ��B L ref:CIM_VideoBIOSElement Override PartComponent � � C I M _ S y s t e m C o m p o n e n t qɝ��C�� CIM_SystemComponent ) & . 4 \ �� f v � e��������~ � CIM_ApplicationSystemSoftwareFeature Locale UUID {0E17B9EA-E3D3-11d2-8601-0000F8102E5F} Abstract GroupComponent f@ 6
� � � ��� � � ref:CIM_ApplicationSystem Min Override GroupComponent PartComponent f@ 6
� G � ��` e o ref:CIM_SoftwareFeature Min Override PartComponent � C I M _ D e p e n d e n c y rɝ��C�� CIM_Dependency ) % + S �� ] i � � U��������@ � CIM_DeviceSAPImplementation Locale UUID {1BE949DA-DB36-11d2-85FC-0000F8102E5F} Abstract Antecedent f@ )
� � � ��� � ref:CIM_LogicalDevice Override Antecedent Dependent f@ )
� � ��+ 5 ref:CIM_ServiceAccessPoint Override Dependent nt � W i n 3 2 _ P n P D e v i c e P r o p e r t y ʝ��C�� ! Win32_PnPDeviceProperty ! ' ����������������������[ � Win32_PnPDevicePropertyDateTime Data e
� Q � �� datetime � ӝ�[� �1�Y � �C>�� V =�� �
�1g�� c 1���a � ��ͫP �c��X Z � d� � ��?� � A*�� � �f�ї � �a��[ : �?t6� � C I M _ C h e c k Vɝ��C�� > CIM_Check ) % M �� W a � � [ a � � 2 < n { � � ��W����������������������������������������������������������! � CIM_FileSpecification Locale UUID {41F377B0-DB2A-11d2-85FC-0000F8102E5F} abstract CheckSum * )
� � � � � �� uint32 Mappingstrings � MIF.DMTF|Software Signature|002.4 CRC1 . )
� 0 � �� uint32 Mappingstrings 8 MIF.DMTF|Software Signature|002.5 CRC2
2 )
� � � � � �� uint32 Mappingstrings � MIF.DMTF|Software Signature|002.6 CreateTimeStamp e '
� ! + �� � �� datetime Fixed FileSize
"
� f � �� uint64 MD5Checksum 6 )
� � � � �� string maxlen Name @ 4
�
� �� �� string maxlen Fixed � Wɝ��C�� ! ) B �� L V � � � 7 B t z � � U l J S UU�������������������������������% � CIM_Action Locale UUID {2F156260-DB21-11d2-85FC-0000F8102E5F} Abstract ActionID 4
� � � ��� � �� string maxlen Caption )
� � � @ � �� string maxlen Description
� / � �� string Direction
� l � �� uint16 Name A
� � � � � �� � �� string Propagated CIM_SoftwareElement.Name CIM_key maxlen SoftwareElementID
A
� j r ~ � ��� � �� string Propagated CIM_SoftwareElement.SoftwareElementID CIM_key maxlen SoftwareElementState 4
� " L �� � �� uint16 Propagated CIM_SoftwareElement.SoftwareElementState CIM_key TargetOperatingSystem A
� � � � � �� � �� uint16 Propagated CIM_SoftwareElement.TargetOperatingSystem CIM_key Mappingstrings MIF.DMTF|Software Component Information|002.5 Version N
� � � � � ��� @ � ��� string Propagated CIM_SoftwareElement.Version CIM_key Maxlen Mappingstrings MIF.DMTF|ComponentID|001.3 � � � Invoke y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ �
C I M _ A c t i o n Xɝ��C�* % CIM_Action ) # K �� U d �������������������������������������� � CIM_DirectoryAction Locale UUID {8875A39E-DB29-11d2-85FC-0000F8102E5F} Abstract DirectoryName )
� � � � �� string maxlen � C I M _ D i r e c t o r y A c t i o n Yɝ��C�� % CIM_DirectoryAction ) # ) Q �� �������������������������������������[ � CIM_CreateDirectoryAction Locale UUID {87946AAC-DB22-11d2-85FC-0000F8102E5F} abstract � C I M _ D i r e c t o r y A c t i o n Zɝ��C�% ' CIM_DirectoryAction ) # ��- 3 [ h ��������������������������������������� � CIM_RemoveDirectoryAction Locale Abstract UUID {B272D2EA-DB22-11d2-85FC-0000F8102E5F} MustBeEmpty
"
� � � �� boolean �
C I M _ A c t i o n [ɝ��C�� ! CIM_Action ) F �� ���������������������������������P � CIM_FileAction Locale UUID {2B590C72-DB2A-11d2-85FC-0000F8102E5F} Abstract � C I M _ F i l e A c t i o n \ɝ��C�� + CIM_FileAction ) " J �� T e � � � � ��W����������������������������������������; � CIM_CopyFileAction Locale UUID {73553260-DB22-11d2-85FC-0000F8102E5F} abstract DeleteAfterCopy &
� � � �� boolean Destination
" )
� � � � �� string maxlen Source )
� + 3 � �� string maxlen � C I M _ F i l e A c t i o n ]ɝ��C�& % CIM_FileAction ) $ L �� V \ �������������������������������������� � CIM_RemoveFileAction Locale UUID {C75D89F8-DB30-11d2-85FC-0000F8102E5F} abstract File )
� � � � �� string maxlen � ^ɝ��C�� ? $ * R ��_ ��l �� v ~ � � u��������q � CIM_SoftwareElementActions Locale UUID {4B82D255-E3CD-11d2-8601-0000F8102E5F} Association Aggregation Abstract Action f ?
� � � � � �� � �� ref:CIM_Action Min Max Weak Element f A
� C \ a f �� � �� ref:CIM_SoftwareElement Min Max Aggregate �
C I M _ C o m p o n e n t _ɝ��C�� CIM_Component ) % - 3 [ �� e u � � e��������N � CIM_SoftwareFeatureSoftwareElements Locale UUID {A91081E2-DB37-11d2-85FC-0000F8102E5F} Abstract GroupComponent f@ 4
� � � ��� � ref:CIM_SoftwareFeature Min Max PartComponent f@ 4
� + � ��D I ref:CIM_SoftwareElement Min Max � `ɝ��C�� ? % + S ��` ��m �� w � � u��������t � CIM_ProductSoftwareFeatures Locale UUID {7C39D12A-DB2B-11d2-85FC-0000F8102E5F} Association Aggregation Abstract Component f ?
� � � � � �� � �� ref:CIM_SoftwareFeature Min Max Weak Product f ?
� N _ d i �� � �� ref:CIM_Product Min Max Aggregate � aɝ��C�� 4 & , T ��a �� k u � � e��������F � CIM_InstalledSoftwareElement Locale UUID {A7B05028-DB2A-11d2-85FC-0000F8102E5F} Association Abstract Software f 4
� � � � � �� ref:CIM_SoftwareElement Min Max System f 4
� $ < A � �� ref:CIM_ComputerSystem Min Max � bɝ��C�" ? # ) Q ��^ ��k �� u | � � n u U����������� � CIM_SoftwareElementChecks Locale UUID {24783E8A-DB31-11d2-85FC-0000F8102E5F} Association Aggregation Abstract Check f ?
� � � � � �� � �� ref:CIM_Check Min Max Weak Element f A
� @ Y ^ c �� � �� ref:CIM_SoftwareElement Min Max Aggregate Phase
� � � �� uint16 � W i n 3 2 _ P n P D e v i c e P r o p e r t y ʝ��C�� ! Win32_PnPDeviceProperty % ��������������������������W � Win32_PnPDevicePropertyReal64 Data
� O � �� real64 � ,oʲ� � Ū� ^ ��!� ��F� � �R� �=�o� � P�r � ߠo�� � H�� � C I M _ L o g i c a l E l e m e n t �ɝ��C�� " CIM_LogicalElement A � �� � ��* 2 8 ` m � � J X W��������������������������������� � Win32_Registry CIMWin32 SupportsUpdate Locale UUID {8502C4D7-5FBB-11D2-AAC1-006008C78BC7} CurrentSize )
� � � ��� � uint32 MappingStrings � Win32API|NTDLL.DLL|NtQuerySystemInformation|SystemRegistryQuotaInformation MaximumSize )
� T � ��\ l uint32 MappingStrings t Win32Registry|SYSTEM\CurrentControlSet\Control|RegistrySizeLimit Name @ A
� � �� � �� # 3 string Override Name MappingStrings ; Win32Registry ProposedSize 4
� � � �� � ��� � uint32 MappingStrings � Win32Registry|SYSTEM\CurrentControlSet\Control|RegistrySizeLimit � W i n 3 2 _ B a s e S e r v i c e �ɝ��C�� e Win32_BaseService A � �� � ��) 1 7 _ k �
� � V ` �����_������������������������������������������������������������������������������������������������ � Win32_Service CIMWin32 SupportsUpdate Locale UUID {8502C4D9-5FBB-11D2-AAC1-006008C78BC7} CheckPoint P )
� � � ��� � uint32 MappingStrings � Win32API|Service Structures|SERVICE_STATUS|dwCheckPoint DelayedAutoStart \ )
� D � ��M ] boolean MappingStrings e Win32API|Service Structures|SERVICE_DELAYED_AUTO_START_INFO|fDelayedAutostart ProcessId X )
� � � ��� uint32 MappingStrings Win32API|Service Structures|SERVICE_STATUS_PROCESS|dwProcessId WaitHint T )
� � � ��� � uint32 MappingStrings � Win32API|Service Structures|SERVICE_STATUS|dwWaitHint L � � � � � � � GetSecurityDescriptor ) @ ��M W � � implemented ValueMap s v y | � 0 2 8 9 21 .. Privileges � SeSecurityPrivilege % ae442007200009F ROOT\CIMV2 ���� � �� �� * � � ; ��������e � __PARAMETERS abstract
Descriptor object
� 6 out
� 6 ] �� ID
)
� � ] ��� object:Win32_SecurityDescriptor ReturnValue uint32
� . uint32 out
� . 6 �� __ � SetSecurityDescriptor ) ��* 4 d p implemented ValueMap P S V Y \ ` 0 2 8 9 21 .. Privileges x SeSecurityPrivilege ae442007200009F ROOT\CIMV2 ���� � �� �� * � ����� � __PARAMETERS abstract
Descriptor object
� 6 in
� 6 ] �� ID
)
� � ] ��� object:Win32_SecurityDescriptor __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � �ɝ��C�� A �� � �� � % / 7 = e l � � e��������w � Win32_ShareToDirectory Association CIMWin32 Locale UUID {8502C511-5FBB-11D2-AAC1-006008C78BC7} Share f 4
� � � �� � ��� � ref:Win32_Share MappingStrings � WMI|Win32_Share SharedElement f 4
� 9 � �� � ��L \ ref:CIM_Directory MappingStrings d CIM|CIM_Directory e � C I M _ A s s o c i a t e d P r o c e s s o r M e m o r y �ɝ��C�X
' CIM_AssociatedProcessorMemory 6 � �� � ! + 3 9 a m # u������������� � Win32_AssociatedProcessorMemory CIMWin32 Locale UUID {074737F0-ACBC-11d2-ABF6-00805F538618} Antecedent f@ A
� � � �� � ��� � � � ref:Win32_CacheMemory Override Antecedent MappingStrings WMI|Win32_CacheMemory Dependent f@ A
� r � �� � ��� � � � ref:Win32_Processor Override Dependent MappingStrings � WMI|Win32_Processor � C I M _ C a r d �ɝ��C�� n CIM_Card
6 � �� � # ) Q ` � � \ a ������������������������������������������������������������������������������������������������������������� � Win32_BaseBoard CIMWin32 Locale UUID {FAF76B95-798C-11D2-AAD1-006008C78BC7} ConfigOptions b )
� � � ��� � string MappingStrings � SMBIOS|Type 12|Configuration Options Strings Product ^ )
� % � ��- = string MappingStrings E SMBIOS|Type 2|Product Tag @
( N
� � � ��� � ��� � � � string MaxLen Override Tag MappingStrings � WMI � C I M _ P r o d u c t �ɝ��C�X " CIM_Product
6 � �� � ' / 5 ] c ���������������������������������� � Win32_ComputerSystemProduct CIMWin32 Locale UUID {FAF76B96-798C-11D2-AAD1-006008C78BC7} UUID )
� � � ��� � String MappingStrings � SMBIOS|Type 1|UUID � C I M _ S e r v i c e S e r v i c e D e p e n d e n c y �ɝ��C�P & CIM_ServiceServiceDependency 6 � �� � " * 0 X d u����������� � Win32_DependentService CIMWin32 Locale UUID {8502C4FA-5FBB-11D2-AAC1-006008C78BC7} Antecedent f@ A
� � � �� � ��� � � � ref:Win32_BaseService Override Antecedent MappingStrings � WMI|Win32_BaseService Dependent f@ A
� i � �� � ��� � � � ref:Win32_BaseService Override Dependent MappingStrings � WMI|Win32_BaseService � C I M _ D M A �ɝ��C�� C CIM_DMA 6 � �� � $ * R X ������������������������������������������������������������������� � Win32_DMAChannel CIMWin32 Locale UUID {8502C4D1-5FBB-11D2-AAC1-006008C78BC7} Port : )
� � � ��� � uint32 MappingStrings � Win32API|System Structures|CM_PARTIAL_RESOURCE_DESCRIPTOR|Dma|Port � W i n 3 2 _ P n P D e v i c e P r o p e r t y ʝ��C�� ! Win32_PnPDeviceProperty $ * ����������������������\ � Win32_PnPDevicePropertyUint16Array Data
� T � �� Uint16 � 7 C I M _ U n i t a r y C o m p u t e r S y s t e m �ɝ��C�
" � # CIM_UnitaryComputerSystem A � �� � ��0 8 > 0 f { + � � k � � � } � % � � & � � q � �
� � > K � � | � N
i
�
�
K ^ � � + C � � p
w
�
� � 8 L � � V f � � A R � � � � L c �
� � s � � 6 G � � � � � � � � " � � � 7 C � � ����UUUUUUUUUUUU���������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������8 � Win32_ComputerSystem CIMWin32 SupportsUpdate Locale UUID {8502C4B0-5FBB-11D2-AAC1-006008C78BC7} AdminPasswordStatus - � )
� � � ��� � uint16 MappingStrings � SMBIOS|Type 24|Hardware Security Settings|AdminPasswordStatus AutomaticManagedPagefile < 4
� m � �� � ��v � boolean MappingStrings � WMI AutomaticResetBootOption : 4
� � � �� � ��� boolean MappingStrings Win32Registry|HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl|AutoReboot AutomaticResetCapability > )
� � � ��� � boolean MappingStrings � WMI BootOptionOnLimit & { )
� , � ��4 D uint16 MappingStrings L SMBIOS|Type 23|Capabilites|Boot Option on Limit BootOptionOnWatchDog ' } )
� � � ��� � uint16 MappingStrings � SMBIOS|Type 23|Capabilities|Boot Option BootROMSupported @ )
� \ � ��e u boolean MappingStrings } WMI BootStatus > � )
� � � ��� � uint16 MappingStrings � SMBIOS|Type 32|System Boot Information|Boot Status BootupState B )
� ] � ��e u string MappingStrings } Win32API|GetSystemMetrics|SM_CLEANBOOT ChassisBootupState / � 6
� � � �� 9 C uint16 MappingStrings SMBIOS|Type 3|Bootup State ValueMap _ b e h k n 1 2 3 4 5 6 ChassisSKUNumber = � )
� � � ��� � string MappingStrings � SMBIOS|Type 3|Chassis|SKU Number CurrentTimeZone F 4
� O � �� � ��W g sint16 MappingStrings o Win32API|Time Structures|TIME_ZONE_INFORMATION|Bias DaylightInEffect 2 � )
� � � ��� boolean MappingStrings Win32API|Time Functions|GetTimeZoneInformation DNSHostName H )
� � � ��� � string MappingStrings � Win32API|GetComputerNameEx|ComputerNameDnsHostname Domain L )
� � �� - string MappingStrings 5 Win32API|Network Management Structures|WKSTA_INFO_100|wki100_langroup DomainRole # s )
� � � ��� � uint16 MappingStrings � Win32API|Directory Service (Ds) Structures| DSROLE_PRIMARY_DOMAIN_INFO_BASIC|DSROLE_MACHINE_ROLE| MachineRole EnableDaylightSavingsTime 3 �
� �
� �� boolean FrontPanelResetStatus . � )
� �
� ���
uint16 MappingStrings
SMBIOS|Type 24|Hardware Security Settings|FrontPanelResetStatus HypervisorPresent ? � )
� � � ��� � boolean MappingStrings � WMI InfraredSupported P )
� � �� boolean MappingStrings & WMI KeyboardPasswordStatus , � )
� z � ��� � uint16 MappingStrings � SMBIOS|Type 24|Hardware Security Settings|KeyboardPasswordStatus Manufacturer R )
� !
� ��)
9
string MappingStrings A
SMBIOS|Type 1|System Information|Manufacturer Model V )
� �
� ���
�
string MappingStrings �
SMBIOS|Type 1|System Information|Product Name NetworkServerModeEnabled Z )
� N � ��W g boolean MappingStrings o Win32API|Network Management Structures|SERVER_INFO_101|sv101_type|SV_TYPE_SERVER NumberOfLogicalProcessors 5 � )
� � �� + uint32 MappingStrings 3 WMI NumberOfProcessors 4 � )
� � � ��� � uint32 MappingStrings � Win32API|System Information Structures|SYSTEM_INFO|dwNumberOfProcessors OEMLogoBitmap \ )
� 2 � ��9 I uint8 MappingStrings Q WMI OEMStringArray % w )
� � � ��� � string MappingStrings � SMBIOS|Type 11|OEM Strings PartOfDomain 7 � )
� � ��' 7 boolean MappingStrings ? PauseAfterReset * � )
� � � ��� � sint64 MappingStrings � SMBIOS|Type 23|Timeout PCSystemType 8 � 6
� � �� + 5 ? uint16 MappingStrings 3 ValueMap g j m p s v y | 0 1 2 3 4 5 6 7 8 PCSystemTypeEx 9 � 6
� � � ��� � � uint16 MappingStrings � ValueMap
. 1 4 7 : = @ C F I 0 1 2 3 4 5 6 7 8 9 PowerOnPasswordStatus + � )
� � � ��� � uint16 MappingStrings � SMBIOS|Type 24|Hardware Security Settings|PowerOnPasswordStatus PowerSupplyState 0 � 6
� Q � ��Y i � � uint16 MappingStrings q SMBIOS|Type 3|System Enclosure or Chassis|Power Supply State ValueMap � � � � � � 1 2 3 4 5 6 ResetCount ( )
� * � ��2 B sint16 MappingStrings J SMBIOS|Type 23|System Reset|Reset Count ResetLimit ) � )
� � � ��� � sint16 MappingStrings � SMBIOS|Type 23|System Reset| Reset Limit SupportContactDescription ` )
� R � ��Z j string MappingStrings r Win32API|GetPrivateProfileString|Support Information SystemFamily < � )
� � � ��� string MappingStrings
SMBIOS|Type 1|System Information|Family SystemSKUNumber ; � )
� ~ � ��� � string MappingStrings � SMBIOS|Type 1|System Information|SKU Number SystemStartupDelay d L
� 9 A �� � �� � ��M Y � uint16 DEPRECATED Privileges a SeSystemEnvironmentPrivilege MappingStrings � Win32API|GetPrivateProfileInt|Boot Loader|timeout SystemStartupOptions f L
� : B �� � �� � ��N Z � � string DEPRECATED Privileges b SeSystemEnvironmentPrivilege MappingStrings � Win32API|GetPrivateProfileSection|Operating Systems SystemStartupSetting j L
� = D �� � �� � ��P \ � � uint8 DEPRECATED Privileges d SeSystemEnvironmentPrivilege MappingStrings � WMI SystemType ! k 6
� � � ��� Z d string MappingStrings Win32API|System Information Structures|SYSTEM_INFO|wProcessorArchitecture ValueMap
� � � � � � � � � X86-based PC MIPS-based PC Alpha-based PC Power PC SH-x PC StrongARM PC 64-bit Intel PC x64-based PC Unknown X86-Nec98 PC ThermalState 1 � 6
� f � ��n ~ � � uint16 MappingStrings � SMBIOS|Type 3|System Enclosure or Chassis|Thermal State ValueMap � �) C I M _ L o g i c a l E l e m e n t �ɝ��C�� ) CIM_LogicalElement f � �� �
% M ��] g o �� � � � � � � � I O � � W���������������������������������������� � Win32_Share CIMWin32 Locale UUID {8502C4D6-5FBB-11D2-AAC1-006008C78BC7} SupportsCreate CreateBy Create SupportsDelete DeleteBy DeleteInstance AccessMask " '
� � � ��� �� uint32 DEPRECATED AllowMaximum )
� 3 � ��< L boolean MappingStrings T Win32API|Network Management Structures|SHARE_INFO_502|shi502_max_uses MaximumAllowed )
� � � ��� � uint32 MappingStrings Win32API|Network Management Structures|SHARE_INFO_502|shi502_max_uses Name @ A
� � � �� � ��� � � � string Override Name MappingStrings � Win32API|Network Management Structures|SHARE_INFO_1|shi1_netname Path )
� M � ��U e string MappingStrings m Win32API|Network Management Structures|SHARE_INFO_502|shi502_path Type 6
� � � �� ] g uint32 MappingStrings Win32API|Network Management Structures|SHARE_INFO_502|shi502_type ValueMap � � � � � � � � 0 1 2 3 2147483648 2147483649 2147483650 2147483651 �# � � g u � � P _ � � ^! f! �! �! r# � Create 2 : ��G ��O ��\ l Constructor Static Implemented MappingStrings t Win32API|Network Management Functions|NetShareAdd ? ae442007200009F ROOT\CIMV2 ���� � �� �� 3
� _ y i q � * � � U�����������������������������
� __PARAMETERS abstract Path string
� 0 In
� 0 W �� � Win32API|Network Management Structures|SHARE_INFO_502|shi502_path MappingStrings )
� 0 W ��� � ID 6
� _ W ��� � string Name string
� In
� � �� � Win32API|Network Management Structures|SHARE_INFO_1|shi1_netname MappingStrings )
� � �� � ID 6
� � � �� � e string Type uint32
� � In
� � � �� * Win32API|Network Management Structures|SHARE_INFO_502|shi502_type MappingStrings )
� � � ��m " ID 6
� � � ��m " � uint32 MaximumAllowed uint32
� & In
� & M �� Optional '
� & M ��{ �� � Win32API|Network Management Structures|SHARE_INFO_502|shi502_max_uses MappingStrings 4
� & M ��{ �� � ID A
� � M ��{ �� � [ uint32 Description string
� � In
� � � �� Optional '
� � � ��* �� q Win32API|Network Management Structures|SHARE_INFO_1|shi1_remark MappingStrings 4
� � � ��* ��� i ID A
� W � ��* ��� i string Password string
� { In
� { � �� Optional '
� { � ��� �� Win32API|Network Management Structures|SHARE_INFO_502|shi502_passwd MappingStrings 4
� { � ��� ��\ ID A
� � ��� ��\ � string
Access object
� # In
� # J �� Optional
'
� # J ��x �� � WMI|Win32_SecurityDescriptor MappingStrings
4
� # J ��x ��� � ID
A
� �
J ��x ��� � /
object:Win32_SecurityDescriptor __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � SetShareInfo � ��� � Implemented MappingStrings � Win32API|Network Management Functions|NetShareSetInfo � ae442007200009F ROOT\CIMV2 ���� � ��
�� � � � * s ������������
� __PARAMETERS abstract MaximumAllowed uint32
� : In
� : a �� Optional '
� : a ��� �� � Win32API|Network Management Structures|SHARE_INFO_502|shi502_max_uses MappingStrings 4
� : a ��� �� � ID A
� � a ��� �� � o uint32 Description string
� � In
� � �� Optional '
� � ��> �� � Win32API|Network Management Structures|SHARE_INFO_1|shi1_remark MappingStrings 4
� � ��> �7F� Q �� � �o��� = ~Z: ���&J � x># L .m��l � C�� T v�l � P'�+ : I�U: � R S O P _ P o l i c y S e t t i n g ���C� � RSOP_PolicySetting % , S ] � � � � � < I p � � � � : X � � � � F J | � � �
D [ � � � � G b � � � � H T � � � � � 3 L s � � � � 2 @ g � � � � � �NUUUUUUUU���������� � � ���� �������������������������������������������������������������������������������������������������������������� � RSOP_IEAKPolicySetting Locale categories j
� K sint32 channels f
� | sint32 customFavorites Z
� � sint32 customizeAnimatedBitmaps *
� � boolean customizeLogoBitmaps <
� 3 boolean customLinks ^
� h sint32 deleteAdminCreatedFavoritesOnly X
� � boolean deleteExistingChannels b
� � boolean deleteExistingFavorites V
� 1 boolean deleteExistingToolbarButtons N
� w boolean enableDesktopChannelBarByDefault d
� � boolean enableTrustedPublisherLockdown ' �
� boolean homePageURL n
� > string id @
� t � �� string importAuthenticodeSecurityInfo & �
� � boolean importContentRatingsSettings % �
� boolean importedZoneCount $ |
� < uint32 importProgramSettings ( �
� z boolean importSecurityZoneSettings # z
� � boolean largeAnimatedBitmapName ,
� � string largeAnimatedBitmapPath
0
� ? string largeCustomLogoBitmapName >
� � string largeCustomLogoBitmapPath B
� � string onlineHelpPageURL " v
� � string placeFavoritesAtTopOfList T
� ? boolean precedence @
� ~ � �� uint32 preferenceMode
� � boolean searchBarURL ! r
� � string smallAnimatedBitmapName 4
� + string smallAnimatedBitmapPath 8
� k string smallCustomLogoBitmapName F
� � string smallCustomLogoBitmapPath J
� � string titleBarCustomText
� * string titleBarText
� _ string toolbarBackgroundBitmapPath
&
� � string toolbarButtons P
� � sint32 userAgentText "
� string � ���C�� * f s � � � H R � � � �
" UU������������������������������J � RSOP_IEToolbarButton Locale actionPath
� T \ �� string required buttonOrder '
� � � ��� �� sint32 required caption
� � � �� string required hotIconPath
� 6 > �� string required iconPath
� | � �� string required rsopID
� � � �� string rsopPrecedence
� � �� uint32 showOnToolbarByDefault
� A boolean � ���C�% " �� / > � � %��������� � RSOP_IEToolbarButtonLink Locale Association policySetting f
� h � �� ref:RSOP_IEAKPolicySetting toolbarButton f
� � � �� ref:RSOP_IEToolbarButton � ���C�� '
+ S c � � � � � 2 : l | � � � � ! / UU�������������������������������������W � RSOP_IEProxySettings Locale enableProxy
� J boolean ftpProxyServer
� � string gopherProxyServer
� � string httpProxyServer
� � string proxyOverride
� * string rsopID
� d � �� string rsopPrecedence
� � � �� uint32 secureProxyServer
� � string socksProxyServer
� string useSameProxy
� N boolean � R S O P _ I E P r o x y S e t t i n g s ���C�� I RSOP_IEProxySettings # 5 ] m � � � � H V } � � � ; H n � ��_UU��������������������������������������������������������������������� � RSOP_IEConnectionSettings Locale autoConfigEnable 4
� T boolean autoConfigTime
.
� � sint32 autoConfigURL
$
� � string autoConfigUseLocal (
� � boolean autoDetectConfigSettings 2
� ? boolean autoProxyURL *
� u string defaultDialUpConnection :
� � string deleteExistingConnSettings 8
� � boolean dialUpConnections ?
� 3 string dialUpState >
� g uint8 importCurrentConnSettings 6
� � boolean � ���C�4 ' �� 4 H � � 5��������� � RSOP_IEConnectionSettingsLink Locale Association connectionSettings f
� r � �� ref:RSOP_IEConnectionSettings policySetting f
� � � �� ref:RSOP_IEAKPolicySetting � ���C�� ��% - 7 ^ t � � � � � � U�������������������# � RSOP_IEFavoriteOrLinkItem abstract Locale iconPath
� V string makeAvailableOffline
� � boolean name
� � string order
� � sint32 url
� string � R S O P _ I E F a v o r i t e O r L i n k I t e m ���C�
' # RSOP_IEFavoriteOrLinkItem ) Q W � � � � � 8 C �W�������������������������������������j � RSOP_IEFavoriteItem Locale folderItem
� H boolean name @
� � � �� string parentPath
� � string rsopID
� � � �� string rsopPrecedence
� 0 � �� uint32 shortName
� b string � R S O P _ I E F a v o r i t e O r L i n k I t e m ���C�J # RSOP_IEFavoriteOrLinkItem Q Y � � ���������������������������� � RSOP_IELinkItem Locale name @
� I � �� string rsopID
� � � �� string rsopPrecedence
� � � �� uint32 � ���C�" ! �� . < � %��������� � RSOP_IEFavoriteItemLink Locale Association favoriteItem f
� f � �� ref:RSOP_IEFavoriteItem policySetting f
� � � �� ref:RSOP_IEAKPolicySetting �6 4 6 5 9 A B 9 F 8 F 1 C 4 B 5 6 8 D B 6 4 3 8 B A E 1 1 B 2 6 E E 8 F 9 3 C B 5 F 8 1 9 5 E 2 1 E 8 C 3 8 3 D 6 C 4 4 C C 4 1 �uR|�C�ȝ��C�,
� __NAMESPACE ms_409 � � � � � 1 2 3 4 5 6 TotalPhysicalMemory 6 � )
� C � ��K [ uint64 MappingStrings c Win32API|Memory Management Structures|MEMORYSTATUS|dwTotalPhys UserName " o )
� � � ��� � string MappingStrings Win32API|System Information Functions|GetUserName WakeUpType $ u )
� z � ��� � uint16 MappingStrings � SMBIOS|Type 1|System Information|Wake-up Type Workgroup : � 4
� � �� � �� . string MappingStrings 6 � N J � � $
� � � � | � Rename $ ��1 ; Implemented ValueMap G J 0 .. � ae442007200009F ROOT\CIMV2 ���� � ��
�� * � � = � � ������������0 � __PARAMETERS abstract Name string
� 0 In
� 0 W �� ID )
� � W ��� string Password string
� � In
� � �� ID )
� t ��9 string UserName string
� � In
� � � �� ID )
� ( � ��� string __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � JoinDomainOrWorkgroup � �� Implemented ValueMap 0 .. � ae442007200009F ROOT\CIMV2 ���� � �� �� B � � � * � � = � � U����������������� - � __PARAMETERS abstract Name string
� 0 In
� 0 W �� ID )
� � W ��� string Password string
� � In
� � �� ID )
� t ��9 string UserName string
� � In
� � � �� ID )
� ( � ��� string AccountOU string
� M In
� M t �� ID )
� � t ��� string FJoinOptions uint32
� In
� , �� � � � � � � � � � 0 1 2 4 5 6 7 8 18 BitMap )
� , ��� Z ID 6
� % , ��� Z � uint32 __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � UnjoinDomainOrWorkgroup � ��� � Implemented ValueMap � � 0 .. ae442007200009F ROOT\CIMV2 ���� � ��
�� � E * � � A �������� � � __PARAMETERS abstract Password string
� 4 In
� 4 [ �� ID )
� � [ ��� string UserName string
� � In
� � �� ID )
� x ��= string FUnjoinOptions uint32
� � In
� � � �� � 2 BitMap )
� � � �� � ID 6
� � � �� � A uint32 __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ �588C79311912D65E76D5871EF0ACC7C841B0E3373 L� ` � ��'6
� ��c� B
,�Q*; � 1��� � C I M _ B I O S E l e m e n t �ɝ��C�� j CIM_BIOSElement 6 � �� � $ L a � � , � � T t � � - a t � � m � � o � � � ����WUU��������������������������������������������������������������������������������������������������Z � Win32_BIOS CIMWin32 Locale UUID {8502C4E1-5FBB-11D2-AAC1-006008C78BC7} BiosCharacteristics B )
� � � ��� � uint16 MappingStrings � SMBIOS|Type 0|BIOS Characteristics BIOSVersion Z
� � �� string CurrentLanguage L )
� c � ��k { string MappingStrings � SMBIOS|Type 13|Current Language EmbeddedControllerMajorVersion ` )
� � � �� uint8 MappingStrings SMBIOS|Type 0|Embedded Controller Firmware Major Release EmbeddedControllerMinorVersion a )
� � � ��� � uint8 MappingStrings � SMBIOS|Type 0|Embedded Controller Firmware Minor Release InstallableLanguages F )
� Q � ��Y i uint16 MappingStrings q SMBIOS|Type 13|Installable Languages ListOfLanguages H )
� � � ��� � string MappingStrings � SMBIOS|Type 13|Language Strings ReleaseDate e >
� W � �� datetime SMBIOSBIOSVersion V )
� � � ��� � string MappingStrings � SMBIOS|Type 0|BIOS Version SMBIOSMajorVersion R )
� 2 � ��: J uint16 MappingStrings R SMBIOS|CSMBios|GetVersion SMBIOSMinorVersion T )
� � � ��� � uint16 MappingStrings � SMBIOS|CSMBios|GetVersion SMBIOSPresent P )
� 9 � ��B R boolean MappingStrings Z SMBIOS|CSMBios|Init SystemBiosMajorVersion ^ )
� � � ��� � uint8 MappingStrings � SMBIOS|Type 0|System BIOS Major Release SystemBiosMinorVersion _ )
� U � ��\ l uint8 MappingStrings t SMBIOS|Type 0|System BIOS Minor Release Version @ 6
� � � ��� G Q string Mappingstrings
Win32Registry|HARDWARE\Description\System|SystemBiosVersion Override Version � C I M _ S e t t i n g �ɝ��C�� ' CIM_Setting
6 � �� � # + 1 Y h � � C I � � S b U�������������������������������������� � Win32_BootConfiguration CIMWin32 Locale UUID {8502C4E2-5FBB-11D2-AAC1-006008C78BC7} BootDirectory )
� � � ��� � string MappingStrings � Win32API|Process and Thread Functions|GetEnvironmentVariable|WinBootDir ConfigurationPath )
� R � ��Z j string MappingStrings r Win32API|Process and Thread Functions|GetEnvironmentVariable|WinBootDir LastDrive )
� � � �� string MappingStrings Win32API|File Functions|GetDriveType Name A
� � � �� � ��� � � string MaxLen MappingStrings � WMI ScratchDirectory )
� � �� & string MappingStrings . Win32API|File Functions|GetTempPath TempDirectory )
� � � ��� � string MappingStrings � Win32API|File Functions|GetTempPath � C I M _ S e t t i n g �ɝ��C�
L CIM_Setting
C � �� � % A I O w � # / � � T e � � � ; N � � � � 6 < � � 9 L � � � � 9 M � � ~
�
' 7 UUUU������������������������������������������������������������������������ � Win32_Desktop CIMWin32 Privileges - SeRestorePrivilege Locale UUID {8502C4E3-5FBB-11D2-AAC1-006008C78BC7} BorderWidth )
� � � ��� � uint32 MappingStrings � Win32Registry|.DEFAULT\Control Panel\Desktop\WindowMetrics|BorderWidth CoolSwitch )
� f � ��o boolean MappingStrings � Win32Registry|Control Panel\Desktop|CoolSwitch CursorBlinkRate )
� � � �� uint32 MappingStrings Win32Registry|Control Panel\Desktop|CursorBlinkRate DragFullWindows )
� � � ��� � boolean MappingStrings � Win32Registry|Control Panel\Desktop|DragFullWindows GridGranularity )
� : � ��B R uint32 MappingStrings Z Win32Registry|Control Panel\Desktop|GridGranularity IconSpacing )
� � � ��� � uint32 MappingStrings � Win32Registry|.DEFAULT\Control Panel\Desktop\WindowMetrics|IconSpacing IconTitleFaceName )
� � � ��� � string MappingStrings � Win32Registry|.DEFAULT\Control Panel\Desktop\WindowMetrics|IconFont IconTitleSize
$ )
� 0 � ��8 H uint32 MappingStrings P Win32API|Font and Text Structures|LOGFONTW|lfHeight IconTitleWrap ( )
� � � ��� � boolean MappingStrings � Win32Registry|.DEFAULT\Control Panel\Desktop\WindowMetrics|IconTitleWrap Name * 4
� ~ � �� � ��� � string MappingStrings � WMI Pattern
. )
� � � ��� � string MappingStrings Win32Registry|.DEFAULT\Control Panel\Desktop|Pattern ScreenSaverActive 2 )
� � � ��� � boolean MappingStrings � Win32Registry|.DEFAULT\Control Panel\Desktop|ScreenSaveActive ScreenSaverExecutable 4 )
� 1 � ��9 I string MappingStrings Q Win32Registry|.DEFAULT\Control Panel\Desktop|SCRNSAVE.EXE ScreenSaverSecure 8 )
� � � ��� � boolean MappingStrings � Win32Registry|.DEFAULT\Control Panel\Desktop|ScreenSaverIsSecure ScreenSaverTimeout : )
� � � ��� � uint32 MappingStrings � Win32Registry|.DEFAULT\Control Panel\Desktop|ScreenSaveTimeOut Wallpaper > )
� &
� ��.
>
string MappingStrings F
Win32Registry|.DEFAULT\Control Panel\Desktop|Wallpaper WallpaperStretched D )
� �
� ���
�
boolean MappingStrings �
Win32Registry|.DEFAULT\Control Panel\Desktop|WallpaperStyle WallpaperTiled B )
� n � ��w � boolean MappingStrings � Win32Registry|.DEFAULT\Control Panel\Desktop|TileWallpaper � C I M _ S y s t e m D e v i c e �ɝ��C�U CIM_SystemDevice 6 � �� � ' - U e ) e��������� � Win32_SystemDevices CIMWin32 Locale UUID {8502C4F4-5FBB-11D2-AAC1-006008C78BC7} GroupComponent f@ A
� � � �� � ��� � � � ref:Win32_ComputerSystem Override GroupComponent MappingStrings WMI|Win32_ComputerSystem PartComponent f@ A
� x � �� � ��� � � � ref:CIM_LogicalDevice Override PartComponent MappingStrings � CIM|CIM_LogicalDevice � W i n 3 2 _ P n P D e v i c e P r o p e r t y ʝ��C�� ! Win32_PnPDeviceProperty $ * ����������������������\ � Win32_PnPDevicePropertyUint32Array Data
� T � �� Uint32 � dp C I M _ S e r v i c e �ɝ��C�O V CIM_Service
f ��# - 5 ��E O _ �� � i s { �
� � k w " 3 � � � � � � ( 2 � � � � � � � � ( / i
p
��_UU��������������������������������������������������������������������������������� � Win32_BaseService SupportsCreate CreateBy Create SupportsDelete DeleteBy DeleteInstance Abstract CIMWin32 Locale UUID {8502C4C4-5FBB-11D2-AAC1-006008C78BC7} AcceptPause
& )
� � � ��� boolean MappingStrings Win32API|Service Structures|SERVICE_STATUS|dwControlsAccepted|SERVICE_ACCEPT_PAUSE_CONTINUE AcceptStop ( )
� � � ��� � boolean MappingStrings � Win32API|Service Structures|SERVICE_STATUS|dwControlsAccepted|SERVICE_ACCEPT_STOP DesktopInteract * )
� j � ��s � boolean MappingStrings � Win32API|Service Structures|QUERY_SERVICE_CONFIG|dwServiceType|SERVICE_INTERACTIVE_PROCESS DisplayName
, )
� + � ��3 C string MappingStrings K Win32API|Service Structures|QUERY_SERVICE_CONFIG|lpDisplayName ErrorControl 0 6
� � � ��� � > H string MappingStrings � Win32API|Service Structures|QUERY_SERVICE_CONFIG|dwErrorControl ValueMap ` h p x � Ignore Normal Severe Critical Unknown ExitCode H )
� � � ��� � uint32 MappingStrings � Win32API|Service Structures|SERVICE_STATUS|dwWin32ExitCode PathName 4 )
� i � ��q � string MappingStrings � Win32API|Service Structures|QUERY_SERVICE_CONFIG|lpBinaryPathName ServiceSpecificExitCode L )
� � ��$ 4 uint32 MappingStrings < Win32API|Service Structures|SERVICE_STATUS|dwServiceSpecificExitCode ServiceType 8 6
� � � ��� � 3 = string MappingStrings � Win32API|Service Structures|QUERY_SERVICE_CONFIG|dwServiceType ValueMap ] l � � � � � Kernel Driver File System Driver Adapter Recognizer Driver Own Process Share Process Interactive Process StartMode @ 6
� $ . � ��l v string ValueMap F L T Z b Boot System Auto Manual Disabled Override StartMode StartName < )
� � � ��� � string MappingStrings � Win32API|Service Structures|QUERY_SERVICE_CONFIG|lpServiceStartName State @ A
� ~ � �� � ��� � � � string MappingStrings � Win32API|Service Structures|SERVICE_STATUS|dwCurrentState ValueMap
.
7
I
X
`
Stopped Start Pending Stop Pending Running Continue Pending Pause Pending Paused Unknown TagId D )
� �
� ���
�
uint32 MappingStrings �
Win32API|Service Structures|QUERY_SERVICE_CONFIG|dwTagId �c
~ � � � � + � � ( �
�
- �
�
! 5 � � 1 9 � 7 8 �8 �9 �X &Z 7Z �[ z^ �_ �_ va za �b � StartService 6 D N \ ��i s = M Override StartService Implemented ValueMap � � � � � � � � � � �
! % ) - 1 5 9 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 .. MappingStrings U Win32API|Service Functions|StartService y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � StopService 6 B L Y ��f p : J Override StopService Implemented ValueMap � � � � � � � � � � � �
" & * . 2 6 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 .. MappingStrings R Win32API|Service Functions|ControlService|dwControl|SERVICE_CONTROL_STOP y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � PauseService ) T ��a k 5 E Implemented ValueMap � � � � � � � � � � � � �
! % ) - 1 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 .. MappingStrings M Win32API|Service Functions|ControlService|dwControl|SERVICE_CONTROL_PAUSE y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � ResumeService ) Q ��^ h 2
B
Implemented ValueMap � � � � � � � � � � � � � �
"
&
*
.
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 .. MappingStrings J
Win32API|Service Functions|ControlService|dwControl|SERVICE_CONTROL_CONTINUE y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � InterrogateService ) V ��c m 7
G
Implemented ValueMap � � � � � � � � � � � � �
#
'
+
/
3
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 .. MappingStrings O
Win32API|Service Functions|ControlService|dwControl|SERVICE_CONTROL_INTERROGATE y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � UserControlService ) ^ ��k u ? O Implemented ValueMap � � � � � � � � � � � # ' + / 3 7 ; 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 .. MappingStrings W Win32API|Service Functions|CreateService|dwDesiredAccess|SERVICE_USER_DEFINED_CONTROL ae442007200009F ROOT\CIMV2 ���� � �� �� * �^ � __PARAMETERS abstract ControlCode uint8
� 7 In
� 7 ] �� � Win32API|Service Functions|ControlService|dwControl MappingStrings )
� 7 ] ��� � ID 6
� W ] ��� � uint8 __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � Create ? x ��� ��� ��� � n ~ Constructor Implemented Static ValueMap " % ( + . 2 6 : > B F J N R V Z ^ b f j 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 .. MappingStrings � Win32API|Service Functions|CreateService N! ae442007200009F ROOT\CIMV2 ���� � �� + �� * @
m Y � � ?
: � � * � � � � � = � �
� � � UUU����������������������������������������E � __PARAMETERS abstract Name string
� 0 In
� 0 W �� � Win32API|Service Functions|CreateServicelpServiceName MappingStrings )
� 0 W ��� � ID 6
� S W ��� � string DisplayName string
� z In
� z � �� � Win32API|Service Functions|CreateServicelpDisplayName MappingStrings )
� z � �� � ID 6
� � � �� � U string PathName string
� � In
� � � �� Win32API|Service Structures|QUERY_SERVICE_CONFIG|lpBinaryPathName MappingStrings )
� � � ��b ID 6
� � � ��b � string ServiceType uint8
� In
� > �� t Win32API|Service Structures|QUERY_SERVICE_CONFIG|dwServiceType MappingStrings )
� > ��� l ! $ ' * - 0 1 2 3 4 5 8 BitMap 6
� > ��� l 0 � ID C
� � > ��� l 0 � | uint8
ErrorControl uint8
� � In
� � �� T Win32API|Service Structures|QUERY_SERVICE_CONFIG|dwErrorControl MappingStrings
)
� � ��� L ID
6
� $ ��� L � uint8 StartMode string
� H In
� H o �� � Win32API|Service Structures|QUERY_SERVICE_CONFIG|dwStartType MappingStrings )
� H o ��� � B H P [ c Boot System Automatic Manual Disabled ValueMap 6
� H o ��� � m * ID C
� o ��� � m * � string DesktopInteract boolean
� ; In
� ; c �� � Win32API|Service Structures|QUERY_SERVICE_CONFIG|dwServiceType|SERVICE_INTERACTIVE_PROCESS MappingStrings )
� ; c ��� � ID 6
� �
c ��� � <
boolean StartName string
� �
In
� �
�
�� Win32API|Service Structures|QUERY_SERVICE_CONFIG|lpServiceStartName MappingStrings )
� �
�
��L �
ID 6
� � �
��L �
� string StartPassword string
� In
� + �� a Win32API|Service Functions|CreateService|lpPassword MappingStrings )
� + ��� Y ID 6
� %
+ ��� Y � string LoadOrderGroup string
� O
In
� O
v
�� �
Win32API|Service Structures|QUERY_SERVICE_CONFIG|lpLoadOrderGroup MappingStrings )
� O
v
���
�
ID 6
� ~ v
���
�
6 string
LoadOrderGroupDependencies string
� � In
� � � �� Win32API|Service Structures|QUERY_SERVICE_CONFIG|lpDependencies MappingStrings
)
� � � ��R ID
6
� � � ��R �
string $ ServiceDependencies string $
� In $
� 7 �� m Win32API|Service Structures|QUERY_SERVICE_CONFIG|lpDependencies MappingStrings $ )
� 7 ��� e ID $ 6
� = 7 ��� e � string __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � Change ) �8 ���8 �8 �9 �9 Implemented ValueMap 39 69 99 <9 ?9 B9 E9 H9 K9 N9 Q9 U9 Y9 ]9 a9 e9 i9 m9 q9 u9 y9 }9 �9 �9 �9 �9 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 .. MappingStrings �9 Win32API|Service Functions|ChangeServiceConfig � ae442007200009F ROOT\CIMV2 ���� � �y ' �� � * � � � ]
b } r � � � E � d \
�
� UU������������������������������������
� __PARAMETERS abstract DisplayName string
� 7 In
� 7 ^ �� � Win32API|Service Structures|QUERY_SERVICE_CONFIG|lpDisplayName MappingStrings )
� 7 ^ ��� � ID 6
� c ^ ��� � string PathName string
� � In
� � � �� � Win32API|Service Structures|QUERY_SERVICE_CONFIG|lpBinaryPathName MappingStrings )
� � � ��' � ID 6
� � � ��' � n string ServiceType uint8
� � In
� � �� 9 Win32API|Service Structures|QUERY_SERVICE_CONFIG|dwServiceType MappingStrings )
� � ��y 1 � � � � � � � 0 1 2 3 4 5 8 BitMap 6
� � ��y 1 � � ID C
� � ��y 1 � � A uint8 ErrorControl uint8
� � In
� � � �� Win32API|Service Structures|QUERY_SERVICE_CONFIG|dwErrorControl MappingStrings )
� � � ��Z ID 6
� � � ��Z � uint8
StartMode string
�
In
�
4 �� j Win32API|Service Structures|QUERY_SERVICE_CONFIG|dwStartType MappingStrings
)
�
4 ��� b
( Boot System Automatic Manual Disabled ValueMap
6
�
4 ��� b 2 � ID
C
� � 4 ��� b 2 � � string DesktopInteract boolean
� In
� ( �� ^ Win32API|Service Structures|QUERY_SERVICE_CONFIG|dwServiceType|SERVICE_INTERACTIVE_PROCESS MappingStrings )
� ( ��� V ID 6
� I ( ��� V boolean StartName string
� o In
� o � �� � Win32API|Service Structures|QUERY_SERVICE_CONFIG|lpServiceStartName MappingStrings )
� o � ��
� ID 6
� �
� ��
� X
string StartPassword string
� �
In
� �
�
�� & Win32API|Service Functions|CreateService|lpPassword MappingStrings )
� �
�
��[ ID 6
� � �
��[ � string LoadOrderGroup string
� In
� ; �� q Win32API|Service Structures|QUERY_SERVICE_CONFIG|lpLoadOrderGroup MappingStrings )
� ; ��� i ID 6
� C
; ��� i � string LoadOrderGroupDependencies string
� y
In
� y
�
�� �
Win32API|Service Structures|QUERY_SERVICE_CONFIG|lpDependencies MappingStrings )
� y
�
�� �
ID 6
� � �
�� �
^ string
ServiceDependencies string
� � In
� � � �� 2 Win32API|Service Structures|QUERY_SERVICE_CONFIG|lpDependencies MappingStrings
)
� � � ��s * ID
6
� � ��s * �
string __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � ChangeStartMode ) `Z ��mZ wZ A[ Q[ Implemented ValueMap �Z �Z �Z �Z �Z �Z �Z �Z �Z �Z [ [ [
[ [ [ [ [ ![ %[ )[ -[ 1[ 5[ 9[ =[ 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 .. MappingStrings Y[ Service Functions|ChangeServiceConfig|dwStartType � ae442007200009F ROOT\CIMV2 ���� � �� �� * � \ � __PARAMETERS abstract StartMode string
� 5 Automatic In
� 5 g �� � Win32API|Service Structures|QUERY_SERVICE_CONFIG|dwStartType MappingStrings )
� 5 g ��� � : @ H S [ Boot System Automatic Manual Disabled ValueMap 6
� 5 g ��� � e " ID C
� g ��� � e " � string __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � Delete 4 3` ��?` ��L` V` a 0a Destructor Implemented ValueMap �` �` �` �` �` �` �` �` �` �` �` �` �` �` �` �` �` �` a a a a a a a a 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 .. MappingStrings 8a Win32API|Service Functions|ChangeServiceConfig|DeleteService y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � � � ��������������������������������������� � CIM_SerialInterface Abstract Locale UUID {8B309BDA-E3D4-11d2-8601-0000F8102E5F} Antecedent f@ )
� � � ��� � ref:CIM_SerialController Override Antecedent Dependent f@ )
�
� ��! + ref:CIM_LogicalDevice Override Dependent FlowControlInfo
� q � �� UINT16 NumberOfStopBits
� � � �� UINT16 ParityInfo "
� � � �� UINT16 � C I M _ D e p e n d e n c y ɝ��C�� CIM_Dependency ) ! ��+ 3 9 a m � � U��������9 � CIM_DeviceServiceImplementation Abstract Locale UUID {290FC242-DB36-11d2-85FC-0000F8102E5F} Antecedent f@ )
� � � ��� � ref:CIM_LogicalDevice Override Antecedent Dependent f@ )
� � ��$ . ref:CIM_Service Override Dependent De � C I M _ D e p e n d e n c y ɝ��C�� CIM_Dependency ) �� & , T ` � � 4 = � � U��������������L � CIM_DeviceSoftware Abstract Locale UUID {36363AAA-DB36-11d2-85FC-0000F8102E5F} Antecedent f@ )
� � � ��� � ref:CIM_SoftwareElement Override Antecedent Dependent f@ )
� � �� ) ref:CIM_LogicalDevice Override Dependent Purpose )
� t � ��| � UINT16 ModelCorrespondence � CIM_DeviceSoftware.PurposeDescription PurposeDescription
)
� � �� ( STRING ModelCorrespondence 0 CIM_DeviceSoftware.Purpose IM � C I M _ D e p e n d e n c y ɝ��C�� CIM_Dependency ) ��! ) / W c � � U��������h � CIM_HostedAccessPoint Abstract Locale UUID {576C3C56-DB36-11d2-85FC-0000F8102E5F} Antecedent f@ C
� � � ��� � � � ref:CIM_System Override Antecedent Max Min Dependent f@ 4
� 1 � ��M W b �� ref:CIM_ServiceAccessPoint Override Dependent Weak � C I M _ H o s t e d A c c e s s P o i n t ɝ��C�� CIM_HostedAccessPoint ) �� % + S _ � � U��������3 � CIM_HostedBootSAP Abstract Locale UUID {625B4512-DB36-11d2-85FC-0000F8102E5F} Antecedent f@ )
� � � ��� � ref:CIM_UnitaryComputerSystem Override Antecedent Dependent f@ )
�
� �� ( ref:CIM_BootSAP Override Dependent st � C I M _ D e p e n d e n c y ɝ��C�� CIM_Dependency ) ��$ , 2 Z f � � U��������g � CIM_HostedJobDestination Abstract Locale UUID {7880DD16-DB36-11d2-85FC-0000F8102E5F} Antecedent f@ C
� � � ��� � � � ref:CIM_System Max Min Override Antecedent Dependent f@ 4
� 4 � ��L V a �� ref:CIM_JobDestination Override Dependent Weak � C I M _ D e p e n d e n c y ɝ��C�� CIM_Dependency ) �� % + S _ � � U��������Y � CIM_HostedService Abstract Locale UUID {83B2A7AA-DB36-11d2-85FC-0000F8102E5F} Antecedent f@ C
� � � ��� � � � ref:CIM_System Max Min Override Antecedent Dependent f@ 4
� - � ��> H S �� ref:CIM_Service Override Dependent Weak � <��p � �Ѐ6B � ,,��2 � l�� e ��IJn c �6
I� �
C I M _ P r o c e s s o r �ɝ��C�� � CIM_Processor 6 � �� � # ) Q _
z � � � - 7
� � k x � � > E � � J X � � 4 � � * � � 2
A
w � � � !
.
�
�
% � � � �������_UUUUUU������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������ � Win32_Processor CIMWin32 Locale UUID {8502C4BB-5FBB-11D2-AAC1-006008C78BC7} Architecture $ | 6
� � � ��� � � � uint16 MappingStrings � WMI ValueMap � � � � � � 0 1 2 3 6 9 AssetTag 4 � )
� A � ��I Y string MappingStrings a SMBIOS|Type 4|Asset Tag Characteristics 8 � )
� � � ��� � uint32 MappingStrings � SMBIOS|Type 4|Processor Characteristics CpuStatus ' � )
� M � ��U e uint16 MappingStrings m SMBIOS|Type 4|Processor Information|Status CurrentVoltage ( � )
� � � ��� � uint16 MappingStrings SMBIOS|Type 4|Processor Information|Voltage DeviceID @ A
� � � �� � ��� � � � string Override DeviceId MappingStrings � Win32API|System Information Structures|SYSTEM_INFO|dwNumberOfProcessors ExtClock ) � )
� D � ��L \ uint32 MappingStrings d SMBIOS|Type 4|Processor Information|External Clock L2CacheSize l )
� � � ��� � uint32 MappingStrings � WMI L2CacheSpeed ! p )
� F � ��N ^ uint32 MappingStrings f WMI L3CacheSize " t )
� � � ��� � uint32 MappingStrings � WMI L3CacheSpeed # x )
� � ��! 1 uint32 MappingStrings 9 WMI Level % ~ )
� | � ��� � uint16 MappingStrings � WMI LoadPercentage @ P 6
� � � ���
0 : uint16 MappingStrings Win32API|Performance Data Override LoadPercentage Manufacturer h )
� � � ��� � string MappingStrings � WMI NumberOfCores - � )
� � � �� uint32 MappingStrings WMI NumberOfEnabledCore 6 � )
� k � ��s � uint32 MappingStrings � SMBIOS|Type 4|Core Enabled NumberOfLogicalProcessors , � )
� � � �� uint32 MappingStrings WMI PartNumber 5 � )
� a � ��i y string MappingStrings � SMBIOS|Type 4|Part Number ProcessorId * � )
� � � ��� � string MappingStrings
SMBIOS|Type 4|Processor Information|Processor ID ProcessorType + � 6
� �
� ���
�
�
�
uint16 MappingStrings �
SMBIOS|Type 4|Processor Information|Processor Type ValueMap �
1 2 3 4 5 6 Revision & � )
� R � ��Z j uint16 MappingStrings r WMI SecondLevelAddressTranslationExtensions 1 � )
� � � ��� � boolean MappingStrings � WMI SerialNumber 3 � )
� B � ��J Z string MappingStrings b SMBIOS|Type 4|Serial Number SocketDesignation . � )
� � � ��� � string MappingStrings � SMBIOS|Type 4|Processor Information|Socket Designation ThreadCount 7 � )
� e
� ��m
}
uint32 MappingStrings �
SMBIOS|Type 4|Thread Count Version d )
� �
� ���
�
string MappingStrings WMI VirtualizationFirmwareEnabled 2 � )
� \ � ��e u boolean MappingStrings } WMI VMMonitorModeExtensions 0 � )
� � � ��� � boolean MappingStrings � WMI VoltageCaps / � )
� < � ��D T uint32 MappingStrings \ SMBIOS|Type 4|Processor Information|Voltage � C I M _ D a t a F i l e �ɝ��C�� � CIM_DataFile 6 � �� � & , T \ �������������������������������������������������������������������������������������������������������������������������������������������� � Win32_ShortcutFile CIMWin32 Locale UUID {F25FE466-783E-11d2-90BF-0060081A46FD} Target ! ~ )
� � � ��� � string MappingStrings � Win32API|_beginthreadex � C I M _ D a t a F i l e �ɝ��C�� � CIM_DataFile 6 � �� � # ) Q ^ �������������������������������������������������������������������������������������������������������������������������������������������� � Win32_CodecFile CIMWin32 Locale UUID {8502C4C3-5FBB-11D2-AAC1-006008C78BC7} Description @ )
� � � ��� � string MappingStrings � Win32Registry|System\CurrentControlSet\control\MediaResources\icm|Description Group ! ~ )
� B � ��J Z string MappingStrings b Win32Registry|SOFTWARE\Microsoft\Windows NT\CurrentVersion\drivers.desc � W i n 3 2 _ B a s e S e r v i c e �ɝ��C�+ V Win32_BaseService A � �� � ��. 6 < ��������������������������������������������������������������������������������������d � Win32_SystemDriver CIMWin32 SupportsUpdate Locale UUID {8502C4C5-5FBB-11D2-AAC1-006008C78BC7} �
C I M _ D i r e c t o r y �ɝ��C�1 ~ CIM_Directory 6 � �� � # ) ������������������������������������������������������������������������������������������������������������������������������Q � Win32_Directory CIMWin32 Locale UUID {8502C4C7-5FBB-11D2-AAC1-006008C78BC7} � C I M _ D a t a F i l e �ɝ��C�� � CIM_DataFile � �� � �� � & 2 U ] c � ��� � � ��� � � �� � � � � � � @ F �������W������������������������������������������������������������������������������������������������������������������������������������������% � Win32_PageFile DEPRECATED CIMWin32 Privileges : SeCreatePagefilePrivilege Locale UUID {8502C4C6-5FBB-11D2-AAC1-006008C78BC7} SupportsCreate CreateBy PutInstance SupportsDelete DeleteBy DeleteInstance SupportsUpdate FreeSpace ! ~ 4
� 9 A �� � ��M ] uint32 DEPRECATED MappingStrings e Win32API|Memory Management Structures|MEMORYSTATUS|dwAvailPageFile InitialSize " � 4
� � �� � �� uint32 DEPRECATED MappingStrings $ Win32Regstry|System\CurrentControlSet\Control\Session Manager\Memory Management|PagingFiles MaximumSize # � 4
� � � �� � ��� � uint32 DEPRECATED MappingStrings � Win32API|Memory Management Structures|MEMORYSTATUS|dwTotalPageFile Name @ A
� � � ��� ��� � � � string DEPRECATED Override Name MappingStrings � Win32DLL|NTDLL.DLL|NtQuerySystemInformation|SystemPageFileInformation|PageFileName � ��O T ^ ref:CIM_BinarySensor Min Override PartComponent � 7�M� } C I M _ J o b �ɝ��C� M CIM_Job f � �� � & , T ��d n v ��� � � � 0 = � � n � $ + � � � � > I ���W������������������������������������������������������������������������� � Win32_ScheduledJob CIMWin32 Locale UUID {8502C4E0-5FBB-11D2-AAC1-006008C78BC7} SupportsCreate CreateBy Create SupportsDelete DeleteBy Delete Command 8 )
� � � ��� � string MappingStrings � Win32API|Network Management Structures|AT_INFO|Command DaysOfMonth D )
� t � ��| � uint32 MappingStrings � Win32API|Network Management Structures|AT_INFO|DaysOfMonth DaysOfWeek @ )
� � �� + uint32 MappingStrings 3 Win32API|Network Management Structures|AT_INFO|DaysOfWeek InteractWithDesktop > )
� � � ��� � boolean MappingStrings � Win32API|Network Management Structures|AT_INFO|Flags|JOB_NONINTERACTIVE JobId
4 4
� m � �� � ��u � uint32 MappingStrings � Win32API|Network Management Structures|AT_ENUM|JobId JobStatus @
( 6
� � �� $ / ? string Override JobStatus MappingStrings G Win32API|Network Management Structures|AT_ENUM|Flags|JOB_EXEC_ERROR RunRepeatedly < )
� � � ��� � boolean MappingStrings � Win32API|Network Management Structures|AT_INFO|Flags|JOB_RUN_PERIODICALLY StartTime e@ $ 6
� � � ��� � � � datetime Override StartTime MappingStrings � Win32API|Network Management Structures|AT_ENUM|JobTime N � � � � � � Create ? G ��T ��\ ��i s � � Constructor Static Implemented ValueMap � � � � � � � � 0 1 2 8 9 21 22 .. MappingStrings � Win32API|Network Management Functions|NetScheduleJobAdd � ae442007200009F ROOT\CIMV2 ���� � �7 �� * R u � � � q ^ U���������������������d � __PARAMETERS abstract Command string
� 3 In
� 3 Z �� � Win32API|Network Management Structures|AT_INFO|Command MappingStrings )
� 3 Z ��� � ID 6
� W Z ��� � string e StartTime datetime e
� | In e
� | � �� � Win32API|Network Management Structures|AT_ENUM|JobTime MappingStrings e )
� | � �� � ID e 6
� � � �� � Z datetime RunRepeatedly boolean
� � In
� � � �� Optional '
� � � ��# �� j Win32API|Network Management Structures|AT_INFO|Flags|JOB_RUN_PERIODICALLY MappingStrings 4
� � � ��# ��� b ID A
� Z � ��# ��� b boolean
DaysOfWeek uint32
� � In
� � � �� Optional
'
� � � ��� �� Win32API|Network Management Structures|AT_INFO|DaysOfWeek MappingStrings
4
� � � ��� ��X ID
A
� � � ��� ��X � uint32 DaysOfMonth uint32
� $ In
� $ K �� Optional '
� $ K ��y �� � Win32API|Network Management Structures|AT_INFO|DaysOfMonth MappingStrings 4
� $ K ��y ��� � ID A
� � K ��y ��� � N uint32 InteractWithDesktop boolean
� � In
� � � �� Optional '
� � � ��& �� m Win32API|Network Management Structures|AT_INFO|Flags|JOB_NONINTERACTIVE MappingStrings 4
� � � ��& ��� e ID A
� [ � ��& ��� e boolean __ �
ae442007200009F ROOT\CIMV2 ���� � �� �� * n � ��������� � __PARAMETERS abstract JobId uint32
� 1 Out
� 1 X �� � Win32API|Network Management Structures|AT_ENUM|JobId MappingStrings )
� 1 X ��� � ID 6
� T X ��� � uint32 ReturnValue uint32
� � uint32 out
� � � �� __ � Delete 4 � ��� ��� @ P Destructor Implemented ValueMap % ( + . 1 4 8 < 0 1 2 8 9 21 22 .. MappingStrings X Win32API|Network Management Functions|NetScheduleJobDel y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � �n� � |�Ͱ+ � O�k� # �?8�� I #�%�8 O 'J�O� O J�
�� � M S F T _ N e t R u l e I n P r o f i l e :ם��C�i MSFT_NetRuleInProfile N / < �� � �� � I R ` g o � � g q U����������� � MSFT_NetFirewallRuleInProfile UMLPackagePath CIM::Policy Association wfascim ClassVersion 1.0.0 locale GroupComponent f@
� � � � ref:MSFT_NetFirewallProfile Override GroupComponent PartComponent f@ )
� ( B ��M W ref:MSFT_NetFirewallRule Aggregate Override GroupComponent Priority @ )
� � � ��� � uint16 Override Priority � C I M _ S e t t i n g D a t a ;ם��C�� CIM_SettingData C
� �� � 2 ; I P X a � � + 8 � � U����������������� � MSFT_NetGPO UMLPackagePath CIM::Core::Settings wfascim ClassVersion 1.0.0 locale Caption @ 6
� � � @ � � � �� string MaxLen Override Caption Description @ )
� � �� string Override Description ElementName @ )
� o w � � �� string Override ElementName InstanceID @ )
� � � � � �� string Override InstanceID � � 5 � � Ov � % � � Open ��- �� implemented static � ae442007200009F ROOT\standardcimv2 ���� � �O �� � L * � ��������� � __PARAMETERS abstract PolicyStore string
� 7 In
� 7 ^ �� ID )
� � ^ ��� string DomainController string
� � In
� � �� ID )
� � ��H string __ �� ae442007200009F ROOT\standardcimv2 ���� � �� �� * � � " ��������L � __PARAMETERS abstract GPOSession string
� 6 Out
� 6 ] �� ID )
� � ] ��� string ReturnValue uint32
� uint32 out
� �� __ � Save �� �� implemented static
ae442007200009F ROOT\standardcimv2 ���� � �� �� * � ����� � __PARAMETERS abstract GPOSession string
� 6 In
� 6 ] �� ID )
� � ] ��� string __ �� ae442007200009F ROOT\standardcimv2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � C I M _ I K E P r o p o s a l <ם��C�� < CIM_IKEProposal + ) ; I P ������������������������������������������������������������X � MSFT_NetIKEAuthProposal UMLPackagePath CIM::IPsecPolicy ClassVersion 1.0.0 locale �
C I M _ I K E A c t i o n =ם��C� � CIM_IKEAction + $ 6 D K
S a � � � � � � . U d � � Z e � � � � �����WU���������������������������������������������������� ���� ��������������������������������������� � MSFT_NetIKEAuthSet UMLPackagePath CIM::IPsecPolicy ClassVersion 1.0.0 locale DisplayGroup ^
� � � �� string DisplayName Z
� � � �� string EnforcementStatus p
� # uint16 ValueMap � � � � � � � � � � � � � � � � � � � � � � � � 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 PolicyStoreSource v
� string PolicyStoreSourceType t
� M uint16 PrimaryStatus f
� � � � uint16 ValueMap � � � � � � 0 1 2 3 .. 0x8000.. Proposals
b
� / A object:MSFT_NetIKEAuthProposal EmbeddedInstance MSFT_NetIKEAuthProposal RuleGroup V
� � string Status l
� � string StatusCode h
� � uint32 �
C I M _ I K E A c t i o n Aם��C� � CIM_IKEAction + & 8 F M
U c � � � � � � 0 W f � � ` k � � � � �����WU���������������������������������������������������� ���� ��������������������������������������� � MSFT_NetIKECryptoSet UMLPackagePath CIM::IPsecPolicy ClassVersion 1.0.0 locale DisplayGroup ^
� � � �� string DisplayName Z
� � � �� string EnforcementStatus p
� % uint16 ValueMap � � � � � � � � � � � � � � � � � � � � � � � � 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 PolicyStoreSource v
� string PolicyStoreSourceType t
� O uint16 PrimaryStatus f
� � � � uint16 ValueMap � � � � � � 0 1 2 3 .. 0x8000.. Proposals
b
� 3 E object:MSFT_NetIKECryptoProposal EmbeddedInstance MSFT_NetIKECryptoProposal RuleGroup V
� � string Status l
� � string StatusCode h
� � uint32 � M S F T _ N e t M a i n M o d e R u l e F i l t e r s Pם��C� % MSFT_NetMainModeRuleFilters N % 5 N �� � �� � [ d r y � � � e��������` � MSFT_NetMainModeRuleFilterByAddress UMLPackagePath CIM::Core::CoreElements Association wfascim ClassVersion 1.0.0 locale GroupComponent f@
� � � � ref:MSFT_NetMainModeRule Override GroupComponent PartComponent f@
� , G Q ref:MSFT_NetAddressFilter Override PartComponent re � ؝��C�� ) �� . G O X � � � � � U����������������/ � CIM_ManagedElement Abstract UMLPackagePath CIM::Core::CoreElements locale Caption
� � � @ string MaxLen Description
� � string ElementName
� � string InstanceID
� ' string � ��� } ID A
� k ��> ��� } string
Access object
� � In
� � � �� Optional
'
� � � ��� �� ) WMI|Win32_SecurityDescriptor MappingStrings
4
� � � ��� ��G ! ID
A
� � � ��� ��G ! � object:Win32_SecurityDescriptor __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � GetAccessMask { ��� � Implemented MappingStrings � Win32API|Access Control Functions|GetEffectiveRightsFromAcl y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � Delete ' �! ���! ���! �! Destructor Implemented MappingStrings �! Win32API|Network Management Functions|NetShareDel y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ �EF7E249D991E911A200F124BE12E4F8F8C2 C_961B71EE3CEF77853FD06FD1FD078D670615B8B606936AC4407F5BADB29E35F4 C_B73E13EE752D9B5AF02139CC8E7B9DD86AA46977B13267D0D5F674F26F8C3D67 C_C1EDB2C3B16B75C05D994CBAD887CFED943CA4B2E1180F3891F60984B8988B63 CR_18844B622E692B354A4D328535B8F3AF7181D02C445E691E16C25BD8BD83D1D1 R_CF8C5D2298E729B081D1C131BD290A9E84673DFED35C60023220564D66F04E17 CR_211E06180BCB1B723514A6B61A4F9437E8B7FAF07E83A8E52C3887B5E0B0CDFC R_B7706B28FDE42900BD4C0DBC550087B0F05CF9BC30AB26E796AD48A7E503711E C_8F55F9DEF3426989FE817E17CEEF2E31FFED7183978F9BC99857EF3CAE702C82 R_094555A29C724CB99AD80F8257BA7ACBF3FB68F96D97E3E687892E1586B8D179 C_5D8A70064F693F027290F7573CE6C1A3BB6513B39CC41447AC81334C5DC5B8F9 CR_18D8719A943B4599747ADA74EA7D32C69D833172BB0F49178849B0570759A4F9 R_112D5871031FA8548B77FA449AA39B2BB51A4848F5CC93A4CF0AC90CF6249BE0 R_7C4D4C779B8655DD6A7E86DC91922E10770F67B8451A5A7276C3310C51D0FD42 CR_2442933444240B68F1B8232208304D509D6ECF5830E4F4F8E4EDD13186DE1B28 R_80AFDCC52F3C92AD7D0F8DD0B12150C7B0CC34A13BF2D3DD52C62A73F9713B79 R_D441AD3F69852AA912E7DB88FCCCC4374628FEB4888BBCF4D0B24CAE723208E2 R_DA60DE4570557569315706E8539F2BA1D42DB73DA9542D7DBEAA586346CFF0D8 CR_1592BFFCE522F75E708AF00D4ECAEEBA5AFE422B12D1211F8015509DB1FF98D6 R_29E8AA5244375C87F1F5AB9F42A22D9A1B648F420047277D7A92CD564C59256E CR_20C8A4313A9882D64219A6814548B8CA23AA20618BD06EA1320CC257373FA4D3 R_89FE4ECD715508D84EE36BC94DB9C9AB6DC6A560D227442061D4288D96910660 R_DDEDD07282B8324F60B5A48A479C1B42607AE5EA149F90058D5C2368C1337E02 R_ED2E871CAA85DB91DA82D43856C298DADCDDAA2D7C9D06C8655F1779E6509A4E R_6CE5293A4991040589451CEEA5CB3FB1F0BCB9AC8B0C16A2D34DE39822CD1F34 R_F22CF0C74A9002156D476F4DBA031C7F3F706A1A94FD4FF91611BCB6BD8FBB7C CR_16D6E45D9DC3C2448BBB5DF12E5A17B75BBAD53607DFAC1CCE27C411AB0AEA61 R_1E374C5CBDEECC7830AB4BADC56B9C8330C5C89908E9DD8A429AF2525AF02748 R_7F637DAE12A5C57B84338EBF2100C5D2953335CDC28294203995748012501B4E CR_2A82469DE4EDED369FA467BEF3E6440FE893BBC1F56ED2AB23AD8D2515E35AC8 CR_1F25AAFC1DFD302234A597D09198F965D3DA468B1863CE8D32B13C0CE151009D R_4F0DC2D766DE63D22C2118312C7C8A4306FD995CC443322263FCAFC5C5AE9AB8 R_3205C234B2D5F02B734949988492FBCD94159F50911E0F44A000D975CE1C5819 C_B7CFE88CDD4E2F20D43EF63AF2894F6D14A41F54E4CF74F7D9A3F5B4EC2A87C0 C_8D338BAABD5A4CDE9CD22C60F5FCC1F5326D81FC7BA6D48335E5E3513B7182CB R_486709A1BC1AEA1713B7B7854CB54E0BA9471BB018357C834E1DD6BAF7DE7457 R_8105231C8A3F2DF94C9C7F6EBD5BD2604617F4A36486778B9E1603208DF83C44 CR_1A9E3B957294E1E2A3BD1A3F9CA79E41F6CD3130E2786884F3F69878725410E6 R_2C9E96C7F7E323559ADDB98919DA9CB9D792B77EB6D7DB30E98DE86B6BCDF5FC CR_16275E16EEED6E74BD48AA48ACA3AF381CEAB3C980CF5112BF5B3053B0589A21 C_5F07E9A66A14C03CEA70F14BB69F6D6A77D54ED7E0162E55A1871003B04B5B0D CR_20C200D9E838157679E42B001B4147A35D03B45050CB643ED29839B5C1F1E6F1 C_71926B9951B4E8AFC04CC2F1AC5B5FEC04E9A08320F8B28164D32D905C0A41AC C_E7845F3041269988C5A1847DE98EF0D88E59CE50ED3A8AA1E310C1A1F393BB81 R_C504B91CF040A007F72C24FC0CC99A78401C1C475112424D0A789E6908FEF373 R_962C6E7C58B97BBA37F5179D96ED3E00EE4A4FC20E4C3C3A3312674F9F7C4195 R_378C3B019BA81FF898F9BF06FF0AC5FC705DA51C0F56DBDDF9AC986BBEE3099E C_A107EAA2D6C2A698530A8358D207D9A3B8B427F7073C80586F1820045E4C35C1 C_95CE38D55F514EB56E1FD96114137062153D80888E94FE34DB4826CDF9096258 C_4FF6A0D7C7A873EB07C9F2EA16C1C5FF4B6E7F5EC9C729192D48026A285849C5 R_CDE927435CAEB1D62EE8A15E5309F00C6263566F2B069604C803AE5D37D85A14 R_EC31DBAC8296A2F597184183FC259C7595AD4BCCFF23FB0BD832DE414BDE578A R_C067A199C1ACCE03298DA4A596E9323C2C865C447DF4449AEE4DAF3E29B9DD32 R_C6F2B33A9F7EE971E46DC4A05944D1F3ED258A4BBB229A6782F76407411C3AAF R_A66D0E591535F85D5DA7C1BDF3A1DC73BE40E7ED75F810DC35A2C1D0250B7F4C C_CFA7490FC441CDBFE3AC487F4E7E6794E550150460C43DF35BA636FBEF5C66C5 C_328F09EA94A11C49CE9879973AEFE371583535ABF3A24603CDCD08371B636C41 C_2BBDC6530C208169E005CD28108E36BCD72310DD490D1F6D9817675EE3291874 CR_2BBDC6530C208169E005CD28108E36BCD72310DD490D1F6D9817675EE3291874 C_361D98FB17C2BCDC621D6A7CFCE49AF430F4AC02365C7EBFB53223536307BD5A C_BA2C021F642EFC72B5ED5FC31813540F5BA649D97F9C2021662B9F43F49C356E CR_1B410CA2C4AD84A438C361AB2935A45E1487677A7411DBBFAE5D52EC6FB1AD7F C_44B2B33F232E78585BC06F82C484DB1BDFCFCAAFCAC5D29C12B11CCF8EE5BA88 4& W i n 3 2 _ S h a r e �ɝ��C�4 - Win32_Share
f � �� � & , T ��d n v ��� � � � ��������������������������������������������o � Win32_ClusterShare CIMWin32 Locale UUID {8502C4D6-5FBB-11D2-AAC1-006008C78BC7} SupportsCreate CreateBy Create SupportsDelete DeleteBy DeleteInstance ServerName
& 6
� � � ��� string Override ServerName MappingStrings & Win32API|Network Management Structures|SHARE_INFO_503|shi503_servername �# � � g u � � P _ � � ^! f! �! �! r# � Create 2 : J � ��� ��� �� MappingStrings R Win32API|Network Management Functions|NetShareAdd Constructor Static Implemented ? ae442007200009F ROOT\CIMV2 ���� � �� �� 3
� _ y i q � * � � U�����������������������������
� __PARAMETERS abstract Path string
� 0 In
� 0 W �� � Win32API|Network Management Structures|SHARE_INFO_502|shi502_path MappingStrings )
� 0 W ��� � ID 6
� _ W ��� � string Name string
� In
� � �� � Win32API|Network Management Structures|SHARE_INFO_1|shi1_netname MappingStrings )
� � �� � ID 6
� � � �� � e string Type uint32
� � In
� � � �� * Win32API|Network Management Structures|SHARE_INFO_502|shi502_type MappingStrings )
� � � ��m " ID 6
� � � ��m " � uint32 MaximumAllowed uint32
� & In
� & M �� Optional '
� & M ��{ �� � Win32API|Network Management Structures|SHARE_INFO_502|shi502_max_uses MappingStrings 4
� & M ��{ �� � ID A
� � M ��{ �� � [ uint32 Description string
� � In
� � � �� Optional '
� � � ��* �� q Win32API|Network Management Structures|SHARE_INFO_1|shi1_remark MappingStrings 4
� � � ��* ��� i ID A
� W � ��* ��� i string Password string
� { In
� { � �� Optional '
� { � ��� �� Win32API|Network Management Structures|SHARE_INFO_502|shi502_passwd MappingStrings 4
� { � ��� ��\ ID A
� � ��� ��\ � string
Access object
� # In
� # J �� Optional
'
� # J ��x �� � WMI|Win32_SecurityDescriptor MappingStrings
4
� # J ��x ��� � ID
A
� �
J ��x ��� � /
object:Win32_SecurityDescriptor __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � SetShareInfo � � � �� MappingStrings � Win32API|Network Management Functions|NetShareSetInfo Implemented � ae442007200009F ROOT\CIMV2 ���� � ��
�� � � � * s ������������
� __PARAMETERS abstract MaximumAllowed uint32
� : In
� : a �� Optional '
� : a ��� �� � Win32API|Network Management Structures|SHARE_INFO_502|shi502_max_uses MappingStrings 4
� : a ��� �� � ID A
� � a ��� �� � o uint32 Description string
� � In
� � �� Optional '
� � ��> �� � Win32API|Network Management Structures|SHARE_INFO_1|shi1_remark MappingStrings 4
� � ��> ��� } ID A
� k ��> ��� } string
Access object
� � In
� � � �� Optional
'
� � � ��� �� ) WMI|Win32_SecurityDescriptor MappingStrings
4
� � � ��� ��G ! ID
A
� � � ��� ��G ! � object:Win32_SecurityDescriptor __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � GetAccessMask { � � �� MappingStrings � Win32API|Access Control Functions|GetEffectiveRightsFromAcl Implemented y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � Delete ' �! �! �! ���! �� MappingStrings �! Win32API|Network Management Functions|NetShareDel Destructor Implemented y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ �FB6ABEB9CC6BF0071DCCD3AD247D51A9.28.3087008009.464 CD_7C4D4C779B8655DD6A7E86DC91922E10770F67B8451A5A7276C3310C51D0FD42.32.1156024894.539 CD_7DB76B3DD456363F496D78BB6E6B5352F812D97AF3EFBED78BEB66F92C943C4B.16.3044128147.367 CD_7E0816BCB5F44018ABCEB520770DDD7EE174F2DB2071F89833FE5E4D9500CE80.17.1132986877.2616 CD_7E68D046DB13BCE41C3337B31F82C6F35EBC386E53A1006A94CDF711AEF82870.26.388545067.2018 CD_7EB464F197DCBE575080B9282C967BE21B4306F539F2D486C42140F55C5D0FC8.17.4061886759.407 CD_80AFDCC52F3C92AD7D0F8DD0B12150C7B0CC34A13BF2D3DD52C62A73F9713B79.33.475487577.502 CD_830BF8BFA5BF93F39AE2488CCF30ECCF24868D5104B63DE9163FCAF3C26491CA.16.501938009.3111 CD_8348E5895FE4B45964F288F6208DF14CD383D0A357608E0BFF28F226F0190D45.11.2111108764.840 CD_86E4399BC4DD7BCA81C24CBCF67DD3AC1AB2674904D37AD60CB8F1387993FF14.28.2759581136.680 CD_8757FA834BF17A34F40DA9E567F73EB3C0F519BA77B457CB4D641370202A1355.30.467780462.1748 CD_8950808B8A2EB8D5AE895F8D253EC27AA46290C0D9FCF34907198A4AB3C923D1.19.1771646826.346 CD_89B3BC9F91AF19FD95569CEC4AE8264DCAA2B513E756CCAD927560FA5C73CDE5.18.731769041.523 CD_89D253C7F34DE1BDBB149B2A6193A187FAB48CDF693200563636A89559A9C956.32.2165962293.506 CD_89EF5B0E6A39F2A2970E3E102F92EF0C67087374518D87E3376022DE86BFE766.27.3657769340.466 CD_8AD8BB59AD76539933CA61E487AC9890B90072B3A3E2702B40F21CB1F591E761.26.3457629281.695 CD_8DE46DD6446B26621A23E11758AE5CBC62C9F72998CAFB08B9CD58DF66902A20.26.272167893.439 CD_8F55F9DEF3426989FE817E17CEEF2E31FFED7183978F9BC99857EF3CAE702C82.15.2616298554.374 CD_90EEF26AEE52AAEAA6C979CD586F5F478789816D2A5901B4B6A52181C962DFEE.32.1800481860.479 CD_91604F794B64A61196688751D972A0B3626DF7A1827369CDD4AD7A23AC00FD14.30.3039400815.1485 CD_9257E4A3C9993B750EBCB6C34C9BA11105FABAD75B9C0DE005A64417B00B58B0.16.3371176340.3276 CD_93D683378335762C284317F9836C36B73320C30A8A815437365079222449D208.13.2874743617.446 CD_95092F78A9C37B9D260D753733F7A0C73EB4F2C2027E3035DD546DE4EA2081AE.31.337541777.471 CD_95151EBC7602F93A6E06460EF447E398F547B7CD3033E5B6ADD3848197B31384.18.997297442.545 CD_9545373C4C410A85043435CEFDB53CA783FCE515B65345546AA266D2B18EC658.28.3963146569.452 CD_960A016BC71A8D938443FD5B4BD545FA10D9D76A0776A92D75D4E23235CAD0D0.18.1208096207.626 CD_961B71EE3CEF77853FD06FD1FD078D670615B8B606936AC4407F5BADB29E35F4.19.2785635623.2122 CD_9A3419D1BEB3DD772F317128C59554641FCDDB696104EEE43BBF4385A72BA8A9.31.3170577396.459 CD_9F036BA68CA921AFF06984BDB9CEE80E8A2696D8DB098A0C679A6507C62F4DAD.26.1394110070.544 CD_A3BB95ED0B202A25A7223B16F2A4B7FC5CE2975B203508279C7D21714713609A.19.841172646.1749 CD_A3FF4B5E169562F5D12527C651F2FA9F17677983CAE812428672F30175B2773F.13.1578226159.284 CD_A68B01B18C25C8BFC9B36419B9B64DB698A481D87C42ADCA7EC744307E0456D7.21.1676179055.993 CD_A726CC10C860A315296DCD93520657C7C068B6652EE5FFD6550B3E0DAB8CACAE.18.333954850.732 CD_A9FE98FE5C3E9051AEEC71D48BD2011F883E1553AA2DD7968A20C510AD60108F.27.260536886.439 CD_AB458ED9D1DD4314F88AF5FEEC588DFA53BAF8DC0A56FC3E30B319CA4FCADC37.27.1149736114.2695 CD_ADE497F7ADB52466B3BE933E20B36A79941262ED3793380A63DDC578ACBA1413.13.1981201934.2334 CD_B496E3C91F33B99F414E0CF911598E2EF9133E94328E67220F22C24A7531B226.14.2119544579.303 CD_90BEFD5DB48494878DB04E68E99BC36C64E916ACEBE36216625D7CE508C8EF7E.33.1543530394.458 CD_AF3DAFA72013C3690171F734765DB1412DBEFDA2A461CB66FFED0CC4B21B88F0.33.3631944843.532 CD_B3C81C13898C78829E8DEF02131D7FE87DA6C4CF126C25D1E3FED7A0F888E25A.33.768557612.493 CD_78AB2C692DAA3A4CDADED46AFA07DE51142E7138D313F37FE748C3A17F36D445.33.4098471834.509 CD_848678FEA3E9DEEA8B4E9FB42ED8A13EB705C3DB7C73AB893E320FAEEC87714C.34.613984869.501 CD_89FE4ECD715508D84EE36BC94DB9C9AB6DC6A560D227442061D4288D96910660.34.511597399.650 CD_8771AE8CEBB5614A0203ECA1F5690F7C9DE50BB712DED367D1D2978F0B190194.34.2885333943.476 CD_A21DD98AF56DC0A7D21C24764DDA5A5F7A3EA65FE4980FAAB7F2035E4807972C.35.3712413802.521 CD_7F637DAE12A5C57B84338EBF2100C5D2953335CDC28294203995748012501B4E.35.3843153634.475 CD_760A5CD37813CDB0802F97A15FFFC44EE06FFB8EC97E61F0CF228A37D3D46FFB.35.2009647581.390 CD_783F27E34E5C5D4D60E761148DA5CB8835B5F7C975356BFBACBAB29334321728.35.675181134.1890 CD_7A2306288BB25A962F3F7A0DA1538731F7904679B3CCE7E9A9A9F2638A6325D2.36.659662664.376 CD_829131EDC6839DA24011A54FBEA38B1D13A2BDFBD97A229CCB462F4A95FA5DB7.36.1369178645.366 CD_737D301CB8F93905D70C42253781F901EC7FCADD3289B3588BFF04F6F6A13AB1.36.994897939.1992 CD_88EB302CD16E8AAFC6641BEDCC17551C2C447BB8B7A2C0179406C6688EA18D65.37.1224553418.448 CD_81CCD9F49463DE42E5F24116205A8C2F9DB6E6D4063663217E282C3E20BE0A3D.37.896166009.420 CD_A53803A976BCA3FFB16063ACA85E663ADBA78B63EC0DAF8A23C68DAD672A3EF9.37.3980873692.441 CD_8D338BAABD5A4CDE9CD22C60F5FCC1F5326D81FC7BA6D48335E5E3513B7182CB.37.3866514674.256 CD_88AFB8925BED57D785F853EA39F60A2597B7DD047C4BBEFEFD01EFF42AC83C8A.37.2685729219.365 CD_8105231C8A3F2DF94C9C7F6EBD5BD2604617F4A36486778B9E1603208DF83C44.37.1640078498.411 CD_71926B9951B4E8AFC04CC2F1AC5B5FEC04E9A08320F8B28164D32D905C0A41AC.39.2688435104.342 CD_A810B8BCB28B4593289F5B14287BCC8F9F33A8E5A5BE4903C9226502B53FB3AA.39.2882379908.520 CD_962C6E7C58B97BBA37F5179D96ED3E00EE4A4FC20E4C3C3A3312674F9F7C4195.39.1072022791.494 CD_8A4037032A1E93595308B4A4BD6D8BFAF65C3C979F3304AFFC616809C573E05E.39.3634389385.570 CD_A107EAA2D6C2A698530A8358D207D9A3B8B427F7073C80586F1820045E4C35C1.31.2487923338.414 CD_95CE38D55F514EB56E1FD96114137062153D80888E94FE34DB4826CDF9096258.40.2972203076.677 CD_A66D0E591535F85D5DA7C1BDF3A1DC73BE40E7ED75F810DC35A2C1D0250B7F4C.41.3501172162.523 CD_A7E164E66BC7BA8FC3752641961C8B1829E354DA32CDE974E0423F3F5730EDE5.41.3982221127.474 CD_86063DABE8CE896A69DCD5B43BD505C1E3B2A298B4207DEC8AA9B679D5A8639E.42.2388087364.182 CD_88A0C7A0E72AE74936AEC0157B4B96E83CEA40238281088709B5DB02867E7CD2.43.2297486782.621 CD_76F06702E66816F9A4EE931DBEF795220B2BBD5798222D30A793AAB4882409B7.43.1349386905.902 CD_7531D0F73C9D0FCC20C0C9C036C7F34D7F189FB9D62AC61E8FFDD74B2A07A836.46.2650915644.4562 CD_86E8A5569DCAE5B400BCD0BC7C48FFAE53C06283B9698944273225E1996E11CF.46.914411734.496 CD_94119F7CE064741EFDFBF431345AF21D6DE41FA57EAD0A70AB2B0FB8D3F14451.46.2444373036.727 �4 C I M _ O p e r a t i n g S y s t e m �ɝ��C�� CIM_OperatingSystem L �� � �� � " , ��< D J ' r ~ � � � K T % � � p � � x � � � � 2 ? � �
) � � f n
|
�
�
�
? M �
6
B
�
�
� � � � w � 1 J } � � � R b � � j � $ / � � u � $ V _ - ? �����UUUUUUUUU������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������� � Win32_OperatingSystem Singleton CIMWin32 SupportsUpdate Locale UUID {8502C4DE-5FBB-11D2-AAC1-006008C78BC7} BootDevice � )
� � � ��� � string MappingStrings � Win32API|DRIVE_MAP_INFO|btInt13Unit BuildNumber � )
� > � ��F V string MappingStrings ^ Win32API|System Information Structures|OSVERSIONINFOEX|dwBuildNumber BuildType � )
� � � ��� � string MappingStrings Win32Registry|Software\Microsoft\Windows\CurrentVersion|CurrentType CodeSet � 6
� � � ��� � � string MaxLen MappingStrings � Win32API|National Language Support Functions|GetLocaleInfo|LOCALE_IDEFAULTANSICODEPAGE CountryCode ! � )
� \ � ��d t string MappingStrings | Win32API|National Language Support Functions|GetLocaleInfo|LOCALE_ICOUNTRY CSDVersion " � )
� � �� # string MappingStrings + Win32API|System Information Structures|OSVERSIONINFOEX|szCSDVersion DataExecutionPrevention_32BitApplications $ � )
� � � ��� � boolean MappingStrings � WMI DataExecutionPrevention_Available # � )
� R � ��[ k boolean MappingStrings s WMI DataExecutionPrevention_Drivers % � )
� � � ��� � boolean MappingStrings � WMI DataExecutionPrevention_SupportPolicy & � 6
� a � ��h r � � uint8 ValueMap � � � � 0 1 2 3 MappingStrings � WMI Debug ' � )
� � � ��� boolean MappingStrings Win32API|GetSystemMetrics|SM_DEBUG Description @ A
� � � �� � ��� � � � string Override Description MappingStrings � WMI EncryptionLevel : �
� � �� uint32 ForegroundApplicationBoost ( � 4
� k � �� � ��r � uint8 MappingStrings � Win32Registry|SYSTEM\CurrentControlSet\Control\PriorityControl|Win32PrioritySeparation LargeSystemCache ; � 4
� 6 � ��> ��J T uint32 DEPRECATED ValueMap ` c 0 1 Locale ) � )
� � � ��� � string MappingStrings � Win32API|National Language Support Functions|GetLocaleInfo|LOCALE_ILANGUAGE Manufacturer * � )
� W
� ��_
o
string MappingStrings w
WMI MUILanguages � )
� �
� ���
�
string MappingStrings �
WMI OperatingSystemSKU . � 6
� > � ��F P " 2 uint32 ValueMap � � � � � � � � � � � � � � � � � � �
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 MappingStrings : WMI Organization + � )
� � � ��� � string MappingStrings � Win32Registry|Software\Microsoft\Windows\CurrentVersion|RegisteredOrganization OSArchitecture �
� .
� �� string OSLanguage , � )
� y
� ���
�
uint32 MappingStrings �
Win32Registry|DEFAULT\Control Panel\International|Locale OSProductSuite - � )
� � ��" 2 uint32 MappingStrings : Win32Registry|SYSTEM\CurrentControlSet\Control\ProductOptions|ProductSuite PAEEnabled > �
� � � �� boolean PlusProductID / � )
� � �� # string MappingStrings + Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|Plus! ProductId PlusVersionNumber 0 � )
� � � ��� � string MappingStrings � Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|Plus! VersionNumber PortableOperatingSystem ?
� t � �� boolean Primary 1 � )
� � � ��� � boolean MappingStrings � WMI ProductType = � )
� ' � ��/ 9 uint32 ValueMap I L O 1 2 3 RegisteredUser 2 � )
� � � ��� � string MappingStrings � Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|RegisteredOwner SerialNumber 3 � )
� J � ��R b string MappingStrings j Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|ProductId ServicePackMajorVersion 4 � )
� � �� uint16 MappingStrings Win32API|System Information Structures|OSVERSIONINFOEX|wServicePackMajor ServicePackMinorVersion 5 � )
� � � ��� � uint16 MappingStrings � Win32API|System Information Structures|OSVERSIONINFOEX|wServicePackMinor SuiteMask < � )
� f � ��n v uint32 BitMap � � � � � � � � � � � 0 1 2 3 4 5 6 7 8 9 10 SystemDevice 6 � )
�
� �� % string MappingStrings - Win32API|Registry Functions|GetPrivateProfileString|Paths|TargetDevice SystemDirectory 7 � )
� � � ��� � string MappingStrings � Win32API|System Information Functions|GetSystemDirectory SystemDrive 8 �
� N � �� string Version @ @ 6
� � � ��� � $ string MappingStrings � Win32API|System Information Structures|OSVERSIONINFOEX|dwMajorVersion, dwMinorVersion Override Version WindowsDirectory 9 � )
� v � ��~ � string MappingStrings � Win32API|System Information Functions|GetWindowsDirectory � � � � � ! � � - � S ` � � n � Reboot C K ��X b j v � � � � Implemented Override Reboot Privileges ~ SeShutdownPrivilege ValueMap � � 0 .. MappingStrings � Win32API|System Shutdown Functions|ExitWindowsEx|EWX_REBOOT y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � Shutdown C � ��� � � ' : J Implemented Override Shutdown Privileges SeShutdownPrivilege ValueMap 3 6 0 .. MappingStrings R Win32API|System Shutdown Functions|ExitWindowsEx|EWX_SHUTDOWN y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out r ��� ! ��_� e ���d& 9 ZA�_ � ��ô�
� !�B�} � 5��3 � ��q)� b y�t � C I M _ S y s t e m R e s o u r c e �ɝ��C�� CIM_SystemResource ~ � �� � ) E M S { ��� � � ��� � � �� � � � � l v 9 H W������������������������������� � Win32_Environment CIMWin32 Privileges 1 SeRestorePrivilege Locale UUID {8502C4D2-5FBB-11D2-AAC1-006008C78BC7} SupportsCreate CreateBy PutInstance SupportsDelete DeleteBy DeleteInstance SupportsUpdate Name @ L
� < � �� � ��D N � ��T d string Override Name MappingStrings l Win32Registry|System\CurrentControlSet\Control\Session Manager\Environment SystemVariable )
� � � �� boolean MappingStrings Win32Registry|System\CurrentControlSet\Control\Session Manager\Environment UserName A
� � � �� � ��� � � string MaxLen MappingStrings � Win32Registry|System\CurrentControlSet\Control\Session Manager\Environment VariableValue 4
� � � �� � ��� � string MappingStrings � Win32Registry|System\CurrentControlSet\Control\Session Manager\Environment � C I M _ I R Q �ɝ��C�? 6 CIM_IRQ 6 � �� � % + S ] � � ������������������������������������������������������ � Win32_IRQResource CIMWin32 Locale UUID {8502C4D3-5FBB-11D2-AAC1-006008C78BC7} Hardware 0 )
� � � ��� � boolean MappingStrings � Win32API|System Structures|RESOURCE_DESCRIPTOR|InterfaceType Vector
, )
� 2 � ��: J uint32 MappingStrings R Win32API|System Structures|CM_PARTIAL_RESOURCE_DESCRIPTOR|Interrupt|Level � C I M _ L o g i c a l E l e m e n t �ɝ��C�� CIM_LogicalElement 6 � �� � ( . V e � � � ��������������������������b � Win32_LoadOrderGroup CIMWin32 Locale UUID {8502C4D4-5FBB-11D2-AAC1-006008C78BC7} DriverEnabled )
� � � ��� � boolean MappingStrings � Win32Registry|System\CurrentControlSet\Control\GroupOrderList GroupOrder )
� ? � ��G W uint32 MappingStrings _ Win32Registry|System\CurrentControlSet\Control\GroupOrderList Name @ A
� � � �� � ��� string Override Name MappingStrings # Win32Registry|System\CurrentControlSet\Control\GroupOrderList �
C I M _ C o m p o n e n t �ɝ��C�a CIM_Component 6 � �� � $ . 6 < d t ) 8 e��������� � Win32_LoadOrderGroupServiceMembers CIMWin32 Locale UUID {8502C4EF-5FBB-11D2-AAC1-006008C78BC7} GroupComponent f@ A
� � � �� � ��� � � ref:Win32_LoadOrderGroup Override GroupComponent MappingStrings WMI|Win32_LoadOrderGroup PartComponent f@ A
� � � �� � ��� � � � ref:Win32_BaseService Override PartComponent MappingStrings � WMI|Win32_BaseService � C I M _ D e p e n d e n c y �ɝ��C�W CIM_Dependency 6 � �� � ) 3 ; A i u & 1 U��������� � Win32_LoadOrderGroupServiceDependencies CIMWin32 Locale UUID {8502C4FC-5FBB-11D2-AAC1-006008C78BC7} Antecedent f@ A
� � � �� � ��� � � ref:Win32_LoadOrderGroup Override Antecedent MappingStrings WMI|Win32_LoadOrderGroup Dependent f@ A
� � � �� � ��� � � � ref:Win32_BaseService Override Dependent MappingStrings � WMI|Win32_BaseService �
C I M _ C o m p o n e n t �ɝ��C�S CIM_Component 6 � �� � * 2 8 ` p . e��������� � Win32_LogicalDiskRootDirectory CIMWin32 Locale UUID {F25FE468-783E-11d2-90BF-0060081A46FD} GroupComponent f@ A
� � � �� � ��� � � ref:Win32_LogicalDisk Override GroupComponent MappingStrings WMI|Win32_LogicalDisk PartComponent f@ A
� } � �� � ��� � � � ref:Win32_Directory Override PartComponent MappingStrings � WMI|Win32_Directory � C I M _ D e p e n d e n c y �ɝ��C�k CIM_Dependency 6 � �� � $ , 2 Z f $ U��������� � Win32_OperatingSystemQFE CIMWin32 Locale UUID {2CB2C452-C516-11D2-B364-00105A1F77A1} Antecedent f@ A
� � � �� � ��� � � � ref:Win32_OperatingSystem Override Antecedent MappingStrings � WMI|Win32_OperatingSystem Dependent f@ L
� ~ � �� � ��� ��� � � � ref:Win32_QuickFixEngineering Weak Override Dependent MappingStrings � WMI|Win32_QuickFixEngineering � C I M _ S e t t i n g �ɝ��C�4 4 CIM_Setting
A � �� � ) ��9 A G o { & 5 � � ` w � � � � � � " > � � � � z � UU������������������������������������������������5 � Win32_OSRecoveryConfiguration CIMWin32 SupportsUpdate Locale UUID {8502C4E8-5FBB-11D2-AAC1-006008C78BC7} AutoReboot 4
� � � �� � ��� � boolean MappingStrings � Win32Registry|SYSTEM\CurrentControlSet\Control\CrashControl|AutoReboot DebugFilePath 4
� w � �� � �� � string MappingStrings � Win32Registry|SYSTEM\CurrentControlSet\Control\CrashControl|DumpFile DebugInfoType ( 4
� . � �� � ��6 @ uint32 ValueMap T W Z ] 0 1 2 3 ExpandedDebugFilePath '
� � � �� � �� string ExpandedMiniDumpDirectory '
� � �� � �� string KernelDumpOnly . ?
� i � �� � ��r ��~ � boolean DEPRECATED MappingStrings � Win32Registry|SYSTEM\CurrentControlSet\Control\CrashControl|KernelDumpOnly MiniDumpDirectory 4
� 7 � �� � ��? O string MappingStrings W Win32Registry|SYSTEM\CurrentControlSet\Control\CrashControl|MiniDumpDir Name A
� � � �� � ��� string MaxLen MappingStrings WMI OverwriteExistingDebugFile " 4
� � � �� � ��� � boolean MappingStrings � Win32Registry|SYSTEM\CurrentControlSet\Control\CrashControl|Overwrite SendAdminAlert
$ 4
� : � �� � ��C S boolean MappingStrings [ Win32Registry|SYSTEM\CurrentControlSet\Control\CrashControl|SendAlert WriteDebugInfo & ?
� � � �� � �� �� $ boolean DEPRECATED MappingStrings , Win32Registry|SYSTEM\CurrentControlSet\Control\CrashControl|CrashDumpEnabled WriteToSystemLog
, 4
� � � �� � ��� � boolean MappingStrings � Win32Registry|SYSTEM\CurrentControlSet\Control\CrashControl|LogEvent � W i n 3 2 _ P n P D e v i c e P r o p e r t y
ʝ��C�� ! Win32_PnPDeviceProperty # ) ����������������������Z � Win32_PnPDevicePropertySint8Array Data
� S � �� Sint8 � mf
N0 I ����y N ��_^� V���� �l�� �D�
� >1//� N i\d�� I �v � � ��Z! ���<. . ,�{�\ ) j�x � 6�P< � ��� = ��9&D V Q��� � sp� � �
C I M _ C o m p o n e n t p֝��C� CIM_Component C * C P � �� � U f t x � u��������� � MSFT_NetLbfoTeam_TeamNic UMLPackagePath CIM::Core::CoreElements Description 412 MsNetImPlatform ClassVersion 10 GroupComponent f@ +
� � � � � � ref:MSFT_NetLbfoTeam Description 410 Override GroupComponent PartComponent f@ +
� K d q v � ref:MSFT_NetLbfoTeamNic Description 411 Override PartComponent �5 7 E 5 F 3 A D D 9 E 2 4 2 C 4 E 9 F 9 E D F 7 9 A A 9 7 F 7 9 E 7 9 1 1 C 5 A 8 B 9 0 2 E C 1 5 0 D 6 4 4 2 E 3 B 8 5 A 5 A A q֝��C�ȝ��C�� �?����M 9 \ � __Win32Provider {F43E8166-162C-4B12-8C2B-510D21516082} NetworkServiceHost NetSwitchTeam 7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D r֝��C�
ȝ��C�r [ � __MethodProviderRegistration \\.\Root\StandardCimv2:__Win32Provider.Name="NetSwitchTeam" R O O T \ S t a n d a r d C i m v 2 _ _ M e t h o d P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ B 5 E C 8 A D F 9 6 E 5 E 6 0 6 4 A D 9 E B 0 B 1 3 7 0 F D B D 6 6 4 E 0 B 0 E 7 8 0 2 B 6 A 2 A 5 7 9 6 B 5 F A F 2 2 A F E E \ K I _ 7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D \ I _ F D F F 3 C 9 B 0 6 6 4 E 0 F A F 2 8 4 B F A 1 2 A E 8 B 9 7 8 2 E 6 E 9 9 E 4 B A E A 0 5 A B 7 8 5 1 7 3 0 A F E 4 0 F 0 9 2 �֝��C� � �� � " K s � � 4 � � � � 2 @ U�������������� � Win32_OfflineFilesBackgroundSync Win32_OfflineFilesConfigurationProvider BackgroundSyncWorkOfflineSharesEnabled
'
� � � �� � �� boolean BlockOutDurationMin 4
� � �� � �� � uint16 Max BlockOutStartTimeHoursMinutes 4
� v � �� � ��~ ` uint16 Max MaxTimeBetweenSyncs '
� � � �� � �� uint16 SyncInterval 4
� % � �� � ��- � uint16 Max SyncVariance 4
� � � �� � ��� uint16 Max �
C I M _ P o l i c y
ם��C�[ 6 CIM_Policy ) " / ��9 A T � � � � - J � � � H T �_U���������������������������������������������������� � CIM_PolicyAction UMLPackagePath CIM::Policy Abstract locale CreationClassName
( )
� � � ��� string MaxLen DoActionLogging 0
� � boolean PolicyActionName , )
� � ��% string MaxLen PolicyRuleCreationClassName )
� � � ��� string MaxLen PolicyRuleName $ )
� � � ��� string MaxLen SystemCreationClassName )
� 8 � ��@ string MaxLen SystemName )
� � � ��� string MaxLen � M S F T _ M T R e g i s t r y V a l u e �ڝ��C� MSFT_MTRegistryValue 6 & ? � �� � G P V �������������������������������} � MSFT_MTRegistryDword UMLPackagePath CIM::Core::CoreElements locale regprov Data
� u uint32 �5 7 E 5 F 3 A D D 9 E 2 4 2 C 4 E 9 F 9 E D F 7 9 A A 9 7 F 7 9 E 7 9 1 1 C 5 A 8 B 9 0 2 E C 1 5 0 D 6 4 4 2 E 3 B 8 5 A 5 A A �ڝ��C�ȝ��C�� �����M @ 9 W � __Win32Provider {59D95679-9799-458F-8B5B-FE00D8DA0AE4} NetworkServiceHost nettcpip 7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D �ڝ��C�
ȝ��C�m V � __MethodProviderRegistration \\.\root\standardcimv2:__Win32Provider.Name="nettcpip" R O O T \ s t a n d a r d c i m v 2 _ _ M e t h o d P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ B 5 E C 8 A D F 9 6 E 5 E 6 0 6 4 A D 9 E B 0 B 1 3 7 0 F D B D 6 6 4 E 0 B 0 E 7 8 0 2 B 6 A 2 A 5 7 9 6 B 5 F A F 2 2 A F E E \ K I _ 7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D \ I _ 3 F B 1 C C 9 8 7 2 5 8 F 8 0 8 7 B D 7 8 3 8 6 B 8 D D A 0 9 3 F 7 A 2 0 3 0 F 9 6 6 F A F 6 1 9 9 D 4 3 E F A 0 F 6 2 7 5 C C E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C ��C� ȝ��C�� � ��������X q � __InstanceProviderRegistration \\.\root\standardcimv2:__Win32Provider.Name="nettcpip" ` WQL:UnarySelect R O O T \ s t a n d a r d c i m v 2 _ _ I n s t a n c e P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ B 5 E C 8 A D F 9 6 E 5 E 6 0 6 4 A D 9 E B 0 B 1 3 7 0 F D B D 6 6 4 E 0 B 0 E 7 8 0 2 B 6 A 2 A 5 7 9 6 B 5 F A F 2 2 A F E E \ K I _ E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C \ I _ 3 F B 1 C C 9 8 7 2 5 8 F 8 0 8 7 B D 7 8 3 8 6 B 8 D D A 0 9 3 F 7 A 2 0 3 0 F 9 6 6 F A F 6 1 9 9 D 4 3 E F A 0 F 6 2 7 5 C C C I M _ D e p e n d e n c y ��C�� CIM_Dependency ) & : ��G O [ � � U��������! � CIM_SAPSAPDependency UMLPackagePath CIM::Core::Service Association locale Antecedent f@
� � � � ref:CIM_ServiceAccessPoint Override Antecedent Dependent f@
� � ref:CIM_ServiceAccessPoint Override Dependent � C I M _ S A P S A P D e p e n d e n c y ��C�� CIM_SAPSAPDependency )
1 ��> F R � � U�������� � CIM_BindsTo UMLPackagePath CIM::Core::Service Association locale Antecedent f@
� ~ � � ref:CIM_ProtocolEndpoint Override Antecedent Dependent f@
� � ref:CIM_ServiceAccessPoint Override Dependent D � C I M _ B i n d s T o ��C� CIM_BindsTo
) ( I ��V ^ j � � ) 4 U����������� � CIM_BindsToLANEndpoint UMLPackagePath CIM::Network::ProtocolEndpoints Association locale Antecedent f@
� � � � ref:CIM_LANEndpoint Override Antecedent Dependent f@
� � ref:CIM_ServiceAccessPoint Override Dependent FrameType
� ` h r uint16 ValueMap � � � � � 0 1 2 3 4 � k��C�> � BaseStatus locale as � M S N T _ S y s t e m T r a c e ���jj��� MSNT_SystemTrace 6 � �� 7 E M C����W � SplitIo Guid {d837ca92-12b9-44a5-ad6a-3a65b3578aa8} EventVersion locale MS\0x409 �9 A B 5 3 8 0 6 E 8 8 6 6 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0 ��n�^�� ͝��C�o
��2���� N � WMIBinaryMofResource C:\Windows\System32\drivers\processr.sys[PROCESSORWMI] MofResourceName] ion locale MS\0x409 � � uint16 Max �ng �
� ^ f �� __ � Win32Shutdown 6 W ��d p � � � � Implemented Privileges x SeShutdownPrivilege ValueMap � � 0 .. MappingStrings � Win32API|System Shutdown Functions|ExitWindowsEx � ae442007200009F ROOT\CIMV2 ���� � �O �� * i M ���� � � __PARAMETERS abstract Flags sint32
� 1 in
� 1 X �� � Win32API|System Shutdown Functions|ExitWindowsEx MappingStrings )
� 1 X ��� � ID 6
� O X ��� � sint32 Reserved sint32
� s in
� s � �� � Win32API|System Shutdown Functions|ExitWindowsEx MappingStrings )
� s � �� � ID 6
� � � �� � I sint32 __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � Win32ShutdownTracker 6 c ��p | � � � � Implemented Privileges � SeShutdownPrivilege ValueMap � � 0 .. MappingStrings � Win32API|System Shutdown Functions|ExitWindowsEx � ae442007200009F ROOT\CIMV2 ���� � � �� � � x Y ) * � U����������������� � __PARAMETERS abstract Timeout uint32
� 3 in
� 3 Z �� ID )
� � Z ��� uint32 Comment string
� � in
� �
�� C Win32API|System Shutdown Functions|InitiateSystemShutdownEx MappingStrings )
� �
��� ; ID 6
�
��� ; � string ReasonCode uint32
� 5 in
� 5 \ �� � Win32API|System Shutdown Functions|InitiateSystemShutdownEx MappingStrings )
� 5 \ ��� � ID 6
� ^ \ ��� � uint32 Flags sint32
� in
� � �� � Win32API|System Shutdown Functions|ExitWindowsEx MappingStrings )
� � �� � ID 6
� � � �� � U sint32 __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � SetDateTime ) � ��� � � � Implemented Privileges � SeSystemTimePrivilege ValueMap � � 0 .. ae442007200009F ROOT\CIMV2 ���� � �� �� * � ����� � __PARAMETERS abstract e LocalDateTime datetime e
� 9 in e
� 9 b �� ID e )
� � b ��� DateTime __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � r � �� � ��� � � � ref:Win32_Processor Override Dependent MappingStrings � WMI|Win32_Processor � C I M _ C a r d �ɝ��C�� n CIM_Card
6 � �� � # ) Q ` � � \ a ������������������������������������������������������������������������������������������������������������� � Win32_BaseBoard CIMWin32 Locale UUID {FAF76B95-798C-11D2-AAD1-006008C78BC7} ConfigOptions b )
� � � ��� � string MappingStrings � SMBIOS|Type 12|Configuration Options Strings Product ^ )
� % � ��- = string MappingStrings E SMBIOS|Type 2|Product Tag @
( N
� � � ��� � ��� � � � string MaxLen Override Tag MappingStrings � WMI � C I M _ P r o d u c t �ɝ��C�X " CIM_Product
6 � �� � ' / 5 ] c ���������������������������������� � Win32_ComputerSystemProduct CIMWin32 Locale UUID {FAF76B96-798C-11D2-AAD1-006008C78BC7} UUID )
� � � ��� � String MappingStrings � SMBIOS|Type 1|UUID � C I M _ S e r v i c e S e r v i c e D e p e n d e n c y �ɝ��C�P & CIM_ServiceServiceDependency 6 � �� � " * 0 X d u����������� � Win32_DependentService CIMWin32 Locale UUID {8502C4FA-5FBB-11D2-AAC1-006008C78BC7} Antecedent f@ A
� � � �� � ��� � � � ref:Win32_BaseService Override Antecedent MappingStrings � WMI|Win32_BaseService Dependent f@ A
� i � �� � ��� � � � ref:Win32_BaseService Override Dependent MappingStrings � WMI|Win32_BaseService � ���p � Y�� <
' ��q�c o y��:� n �� �@ X ,���� % C I M _ N u m e r i c S e n s o r �ȝ��C�� � CIM_NumericSensor ) ! I �� S ] � � � ~ � @ [ � � q � ( 3 � � � � 2 = � � � � j
�
����UUW��������������������������������������������������������������������������������������������������������������������������������8 � CIM_CurrentSensor Locale UUID {DCA1D084-E3D3-11d2-8601-0000F8102E5F} Abstract Accuracy @ b 6
� � � ��� � � � sint32 Override Accuracy MappingStrings � MIF.DMTF|Electrical Current Probe|001.19 CurrentReading @ B 6
� S � ��[ e u � sint32 Override CurrentReading MappingStrings � MIF.DMTF|Electrical Current Probe|001.5 LowerThresholdCritical @ p 6
� � �� $ < L sint32 Override LowerThresholdCritical MappingStrings T MIF.DMTF|Electrical Current Probe|001.13 LowerThresholdFatal @ ! x 6
� � � ��� � � sint32 Override LowerThresholdFatal MappingStrings MIF.DMTF|Electrical Current Probe|001.15 LowerThresholdNonCritical @ h 6
� � � ��� � � � sint32 Override LowerThresholdNonCritical MappingStrings � MIF.DMTF|Electrical Current Probe|001.11 MaxReadable @ R 6
� _ � ��g q ~ � sint32 Override MaxReadable MappingStrings � MIF.DMTF|Electrical Current Probe|001.9 MinReadable @ V 6
� � �� " / ? sint32 Override MinReadable MappingStrings G MIF.DMTF|Electrical Current Probe|001.10 NominalReading @ F 6
� � � ��� � � � sint32 Override NominalReading MappingStrings � MIF.DMTF|Electrical Current Probe|001.6 NormalMax @ J 6
� w � �� � � � sint32 Override NormalMax MappingStrings � MIF.DMTF|Electrical Current Probe|001.7 NormalMin @ N 6
� $ � ��, 6 A Q sint32 Override NormalMin MappingStrings Y MIF.DMTF|Electrical Current Probe|001.8 Resolution @ Z 6
� � � ��� � � uint32 Override Resolution MappingStrings MIF.DMTF|Electrical Current Probe|001.17 Tolerance @ ^ 6
� � � ��� � � � sint32 Override Tolerance MappingStrings � MIF.DMTF|Electrical Current Probe|001.18 UpperThresholdCritical @ t 6
� < � ��D N f v sint32 Override UpperThresholdCritical MappingStrings ~ MIF.DMTF|Electrical Current Probe|001.14 UpperThresholdFatal @ " | 6
�
� ��
(
8
sint32 Override UpperThresholdFatal MappingStrings @
MIF.DMTF|Electrical Current Probe|001.16 UpperThresholdNonCritical @ l 6
� �
� ���
�
�
sint32 Override UpperThresholdNonCritical MappingStrings MIF.DMTF|Electrical Current Probe|001.12 D � C I M _ N u m e r i c S e n s o r �ȝ��C�� � CIM_NumericSensor ) ! I �� S ] � � � ] r / � � } � $ 4 � � r } � � \ t . � � ����UUW���������������������������������������������������������������������������������������������������������������������������������
� CIM_VoltageSensor Locale UUID {A998F9B4-E3D4-11d2-8601-0000F8102E5F} Abstract Accuracy @ b 6
� � � ��� � � � sint32 Override Accuracy MappingStrings � MIF.DMTF|Voltage Probe|001.19 CurrentReading @ B 6
� H � ��P Z j z sint32 Override CurrentReading MappingStrings � MIF.DMTF|Voltage Probe|001.5 LowerThresholdCritical @ p 6
� � � �� & 6 sint32 Override LowerThresholdCritical MappingStrings > MIF.DMTF|Voltage Probe|001.13 LowerThresholdFatal @ ! x 6
� � � ��� � � � sint32 Override LowerThresholdFatal MappingStrings � MIF.DMTF|Voltage Probe|001.15 LowerThresholdNonCritical @ h 6
� s � ��{ � � � sint32 Override LowerThresholdNonCritical MappingStrings � MIF.DMTF|Voltage Probe|001.11 MaxReadable @ R 6
� ( � ��0 : G W sint32 Override MaxReadable MappingStrings _ MIF.DMTF|Voltage Probe|001.9 MinReadable @ V 6
� � � ��� � � � sint32 Override MinReadable MappingStrings MIF.DMTF|Voltage Probe|001.10 NominalReading @ F 6
� x � ��� � � � sint32 Override NominalReading MappingStrings � MIF.DMTF|Voltage Probe|001.6 NormalMax @ J 6
� � ��' 1 < L sint32 Override NormalMax MappingStrings T MIF.DMTF|Voltage Probe|001.7 NormalMin @ N 6
� � � ��� � � � sint32 Override NormalMin MappingStrings � MIF.DMTF|Voltage Probe|001.8 Resolution @ Z 6
� d � ��l v � � uint32 Override Resolution MappingStrings � MIF.DMTF|Voltage Probe|001.17 Tolerance @ ^ 6
� � �� % 5 sint32 Override Tolerance MappingStrings = MIF.DMTF|Voltage Probe|001.18 UpperThresholdCritical @ t 6
� � � ��� � � � sint32 Override UpperThresholdCritical MappingStrings � MIF.DMTF|Voltage Probe|001.14 UpperThresholdFatal @ " | 6
� r � ��z � � � sint32 Override UpperThresholdFatal MappingStrings � MIF.DMTF|Voltage Probe|001.16 UpperThresholdNonCritical @ l 6
� /
� ��7
A
\
l
sint32 Override UpperThresholdNonCritical MappingStrings t
MIF.DMTF|Voltage Probe|001.12 � � C I M _ M e d i a A c c e s s D e v i c e �ȝ��C�- � CIM_MediaAccessDevice ) �� " ( ��������������������������������������������������������������������������������������������������������������������������������P � CIM_CDROMDrive Abstract Locale UUID {8502C52B-5FBB-11D2-AAC1-006008C78BC7} � C I M _ M e d i a A c c e s s D e v i c e �ȝ��C�, � CIM_MediaAccessDevice ) �� ! ' ��������������������������������������������������������������������������������������������������������������������������������O � CIM_DiskDrive Abstract Locale UUID {8502C52C-5FBB-11D2-AAC1-006008C78BC7} � C I M _ M e d i a A c c e s s D e v i c e �ȝ��C� � CIM_MediaAccessDevice ) �� ! ' O c � � � � �������W������������������������������������������������������������������������������������������������������������������������������������ � CIM_TapeDrive Abstract Locale UUID {8502C52D-5FBB-11D2-AAC1-006008C78BC7} EOTWarningZoneSize x
� � � �� uint32 MaxPartitionCount |
� � � �� uint32 Padding �
�
� �� uint32 � C I M _ M e m o r y M a p p e d I O �ɝ��C�� 3 CIM_MemoryMappedIO ) ��& . 4 ���������������������������������������������������\ � Win32_SystemMemoryResource Abstract Locale UUID {8502C4CE-5FBB-11D2-AAC1-006008C78BC7} � A C I M _ P r o c e s s �ɝ��C�L � CIM_Process
f � �� � ��) 3 ; ��K U e m s � � � � � � O _ � � � � S h * � � } � % 6 � � � � : N � � �
�
] h � � v
�
8 Q � � � t ! � � # � � Z o 1 ���]UUUUUU������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������ � Win32_Process CIMWin32 SupportsCreate CreateBy Create SupportsDelete DeleteBy DeleteInstance Locale UUID {8502C4DC-5FBB-11D2-AAC1-006008C78BC7} CommandLine , �
� � � �� string ExecutablePath R 6
� . � ��6 B \ l string Privileges J SeDebugPrivilege MappingStrings t Win32API|Tool Help Structures|MODULEENTRY32|szExePath HandleCount � )
� � � ��� uint32 MappingStrings Win32API|Process Status|SYSTEM_PROCESS_INFORMATION|HandleCount KernelModeTime @
(
� � � � uint64 Override KernelModeTime MaximumWorkingSetSize V 6
� � �� 6 F uint32 Privileges $ SeDebugPrivilege MappingStrings N Win32|WINNT.H|QUOTA_LIMITS|MaximumWorkingSetSize MinimumWorkingSetSize Z 6
� � � ��� � uint32 Privileges � SeDebugPrivilege MappingStrings ! Win32|WINNT.H|QUOTA_LIMITS|MinimumWorkingSetSize OtherOperationCount ( � )
� � � ��� � uint64 MappingStrings � Win32API|Process and Thread Structures|SYSTEM_PROCESS_INFORMATION|OtherOperationCount OtherTransferCount + � )
� a � ��i y uint64 MappingStrings � Win32API|Process and Thread Structures|SYSTEM_PROCESS_INFORMATION|OtherTransferCount PageFaults ^ )
� � ��" 2 uint32 MappingStrings : Win32API|Process Status|SYSTEM_PROCESS_INFORMATION|PageFaultCount PageFileUsage b )
� � � ��� � uint32 MappingStrings � Win32API|Process Status|SYSTEM_PROCESS_INFORMATION|PagefileUsage ParentProcessId ! � )
� m � ��u � uint32 MappingStrings � Win32API|Process Status|SYSTEM_PROCESS_INFORMATION|InheritedFromUniqueProcessId PeakPageFileUsage f )
� ( � ��0 @ uint32 MappingStrings H Win32API|Process Status|SYSTEM_PROCESS_INFORMATION|PeakPagefileUsage PeakVirtualSize $ � )
� � � ��� � uint64 MappingStrings � Win32API|Process Status|SYSTEM_PROCESS_INFORMATION|PeakVirtualSize PeakWorkingSetSize j )
� � � ��� � uint32 MappingStrings � Win32API|Process Status|SYSTEM_PROCESS_INFORMATION|PeakWorkingSetSize Priority @
8 6
� :
� ��B
L
V
f
uint32 Override Priority MappingStrings n
Win32API|Process Status|SYSTEM_PROCESS_INFORMATION|BasePriority PrivatePageCount # � )
� �
� �� uint64 MappingStrings Win32API|Process Status|SYSTEM_PROCESS_INFORMATION|PrivatePageCount ProcessId n )
� � � ��� � uint32 MappingStrings � Win32API|Process and Thread Structures|PROCESS_INFORMATION|dwProcessId QuotaNonPagedPoolUsage r )
� W � ��_ o uint32 MappingStrings w Win32API|Process Status|SYSTEM_PROCESS_INFORMATION|QuotaNonPagedPoolUsage QuotaPagedPoolUsage v )
�
� ��
&
uint32 MappingStrings .
Win32API|Process Status|SYSTEM_PROCESS_INFORMATION|QuotaPagedPoolUsage QuotaPeakNonPagedPoolUsage z )
� �
� ���
�
uint32 MappingStrings �
Win32API|Process Status|SYSTEM_PROCESS_INFORMATION|QuotaPeakNonPagedPoolUsage QuotaPeakPagedPoolUsage ~ )
� � � ��� � uint32 MappingStrings � Win32API|Process Status|SYSTEM_PROCESS_INFORMATION|QuotaPeakPagedPoolUsage ReadOperationCount & � )
� ? � ��G W uint64 MappingStrings _ Win32API|Process and Thread Structures|SYSTEM_PROCESS_INFORMATION|ReadOperationCount ReadTransferCount ) � )
� � � �� uint64 MappingStrings Win32API|Process and Thread Structures|SYSTEM_PROCESS_INFORMATION|ReadTransferCount SessionId " � )
� � � ��� � uint32 MappingStrings � Win32API|Process Status|SYSTEM_PROCESS_INFORMATION|SessionId ThreadCount � )
� X � ��` p uint32 MappingStrings x Win32API|Process Status|SYSTEM_PROCESS_INFORMATION|NumberOfThreads UserModeTime @ B
� � � uint64 Override UserModeTime VirtualSize % � )
� Z � ��b r uint64 MappingStrings z Win32API|Process Status|SYSTEM_PROCESS_INFORMATION|VirtualSize WindowsVersion � )
� � �� string MappingStrings ! Win32API|Process and Thread Functions|GetProcessVersion WriteOperationCount ' � )
� � � ��� � uint64 MappingStrings � Win32API|Process and Thread Structures|SYSTEM_PROCESS_INFORMATION|WriteOperationCount WriteTransferCount * � )
� h � ��p � uint64 MappingStrings � Win32API|Process and Thread Structures|SYSTEM_PROCESS_INFORMATION|WriteTransferCount �) m p { �
� L V � � � � p t , � ! �" �" # # �$ �$ % % �( � Create L T ��a ��i ��v � � � 0 Constructor Static Implemented Privileges � � � SeAssignPrimaryTokenPrivilege SeIncreaseQuotaPrivilege SeRestorePrivilege ValueMap 0 2 3 8 9 21 .. MappingStrings 8 Win32API|Process and Thread Functions|CreateProcess � ae442007200009F ROOT\CIMV2 ���� � �S
�� * s v � � ������������ � __PARAMETERS abstract CommandLine string
� 7 In
� 7 ^ �� � Win32API|Process and Thread Functions|lpCommandLine MappingStrings )
� 7 ^ ��� � ID 6
� Y ^ ��� � string CurrentDirectory string
� � In
� � � �� � Win32API|Process and Thread Functions|CreateProcess|lpCurrentDirectory MappingStrings )
� � � ��+ � ID 6
� � � ��+ � r string
ProcessStartupInformation object
� � In
� � �� L WMI|Win32_ProcessStartup MappingStrings
)
� � ��f D ID
6
� � ��f D � object:Win32_ProcessStartup __ �U ae442007200009F ROOT\CIMV2 ���� � � �� * 4 � � ��������� � __PARAMETERS abstract ProcessId uint32
� 5 Out
� 5 \ �� � Win32API|Process and Thread Functions|CreateProcess|lpProcessInformation|dwProcessId MappingStrings )
� 5 \ ��� � ID 6
� x \ ��� � 0 uint32 ReturnValue uint32
� � uint32 out
� � � �� __ � Terminate A � ��� ��� � �
<
L
Destructor Implemented Privileges � SeDebugPrivilege ValueMap %
(
+
.
1
4
8
0 2 3 8 9 21 .. MappingStrings T
Win32API|Process and Thread Functions|TerminateProcess ? ae442007200009F ROOT\CIMV2 ���� � �� �� * ����i � __PARAMETERS abstract Reason uint32
� 2 In
� 2 Y �� � Win32API|Process and Thread Functions|TerminateProcess|uExitCode MappingStrings )
� 2 Y ��� � ID 6
� a Y ��� � uint32 __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � GetOwner ) ��� � � � Implemented ValueMap � � � � � � � 0 2 3 8 9 21 .. MappingStrings � WMI � ae442007200009F ROOT\CIMV2 ���� � ��
�� < � P � * � ������������� � __PARAMETERS abstract User string
� 0 Out
� 0 W �� � WMI MappingStrings )
� 0 W ��� � ID 6
� " W ��� � � string Domain string
� D Out
� D k �� � WMI MappingStrings )
� D k ��� � ID 6
� 6 k ��� � � string ReturnValue uint32
� � uint32 out
� � � �� __ � GetOwnerSid ) �� S c Implemented ValueMap < ? B E H K O 0 2 3 8 9 21 .. MappingStrings k WMI � ae442007200009F ROOT\CIMV2 ���� � �T �� ; | * � ��������� � __PARAMETERS abstract Sid string
� / Out
� / V �� � WMI MappingStrings )
� / V ��� � ID 6
� ! V ��� � � string ReturnValue uint32
� o uint32 out
� o w �� __ � SetPriority ) U ��b l � � Implemented ValueMap � � � � � � � 0 2 3 8 9 21 .. MappingStrings � Win32API|Process and Thread Functions|SetPriorityClass ae442007200009F ROOT\CIMV2 ���� � �� �� * � ����/ � __PARAMETERS abstract Priority sint32
� 4 in
� 4 [ �� � Win32API|Process and Thread Functions|SetPriorityClass|dwPriorityClass MappingStrings )
� 4 [ ��� � < H T ` l x 0x00000040 0x00004000 0x00000020 0x00008000 0x00000080 0x00000100 ValueMap 6
� 4 [ ��� � � ID C
� ' [ ��� � � � sint32 __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � AttachDebugger �" �" �" �� ValueMap �" �" �" �" �" �" �" 0 2 3 8 9 21 .. Implemented y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � GetAvailableVirtualSize �$ �$ % �� ValueMap �$ �$ �$ �$ �$ �$ �$ 0 2 3 8 9 21 .. Implemented � ae442007200009F ROOT\CIMV2 ���� � �z
�� * � L � ������������� � __PARAMETERS abstract AvailableVirtualSize uint64
� @ Out
� @ g �� � WMI MappingStrings )
� @ g ��� � ID 6
� 2 g ��� � � uint64 ReturnValue uint32
� � uint32 out
� � � �� __ ����������������������������������������������������������������������������������~ u ! $ ' * - 0 3 6 9 < ? B E H K x N Q � T W Z { ] ` c f i l o r � , , , , , , , , , , , ,
, , , , , , , , , , , , , , , , , , ! , " , $ , % , & , ' , ( , ) , * , + ,
, , # , , - \D � � F��F��Z
F��D��F��I��L��N��
�Q �� � T
�
W � X �
NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805 CD_30C53A78E5A4B68CCA584E17EF756F46F9A296CE6092725A408D68B59BB13207.33.3456306334.538 CD_3205C234B2D5F02B734949988492FBCD94159F50911E0F44A000D975CE1C5819.35.1366954467.430 CD_3221B359A5416B849210C8EDE6CA9A31AE77982A28D76140A2605705EA5F2416.31.3967912237.571 CD_328F09EA94A11C49CE9879973AEFE371583535ABF3A24603CDCD08371B636C41.41.1586835469.932 CD_329C7091D99134315D75F4D3A2328F98C961B173B884F03A89824A063291C3C4.29.293478105.419 CD_336E7A880175CEC7983BFE0692AA78604916DE79A3400288DC3CA68EB96A07CD.33.875742430.521 CD_33AFC5533FEF2AB8957C705077D2CB2428067503BF4A8D79697DC98C53B8A138.35.825035272.438 CD_34904804988920D5ADDD4699E89CCA3704B43C3E300E615C1194ACA851BF70B5.14.1948357866.370 CD_35002FCC142049858649CB1BCD62043BE23AE98B3CC34288C266F1C2B8C4A3A3.29.627256401.396 CD_35B1B65B914DF07FAC7860C3407AEAACB382311D5C7C7979B2E9A007C56D4FA3.26.9885434.372 CD_35C0F224CC2308A9D8BACDB20F08468AE9D1134753B5808A41A3EA43EE4C047D.38.504442732.459 CD_35FE0F2AF2D5B86CBC794195519170432F5D5323DD65B59310A1399B7795BD77.27.1886675880.498 CD_361D98FB17C2BCDC621D6A7CFCE49AF430F4AC02365C7EBFB53223536307BD5A.42.1924715731.320 CD_378C3B019BA81FF898F9BF06FF0AC5FC705DA51C0F56DBDDF9AC986BBEE3099E.39.2142382657.509 CD_3929A976292C0E92F1EE078CF7C2D3C5371AB7D7BA2E3A5C78D38FD26BACE479.12.163999173.1617 CD_3935D6345388A245E9FF50F1CD42F69CC8FD444FF90B93C789385D0BD31672F7.17.1792750074.652 CD_39DCEF2AB20FDF7CAFAA304F91E99DB86E3E37A5DC94A931621C7269DB8703BF.40.4294419729.1182 CD_39E75790979650C120BE778856591D7E59D2F85DDFBB3BFF1733B73153D5DC01.31.3711837652.474 CD_3AA1CCF33D8CEFD2B415A45A121A40E7E45802CD4F254AAE61989F4AA8DC738A.30.2561275367.502 CD_3CDC4183D44F52048CE0039132A93204204F5A3326DCB27DE7954C1D3930FD11.12.2266393339.274 CD_3F67FA0166F0C8A24B462CDA43C543F340CD7BDE061E1F57A0BF997BF74531EB.15.2862958231.3175 CD_3FF84C03B328C80EE72EA722B2C1AB0D0A4549FDEC5EB94A2670D175C0A3657F.40.2364545293.666 CD_403C7DAFD38411FBB7FFA51AD2D0CC5E3462A61D34EA60E279877DCCDC222D62.39.3518326436.452 CD_40BEEFCD86669714A96D09FC1ADF38E568E0B01D634EF8F9AD700B7740B2B19A.36.3655922183.646 CD_40CAFB87B847B798AC8F2045737A2A8390AC0416A38406D6F38EE740FBB0A4AC.21.3279404182.1508 CD_410A129DDF9C5559586E57FD96A9E962121A44EE9BB4B632CAC4A1E45DD8F6B4.16.2785057155.600 CD_44B2B33F232E78585BC06F82C484DB1BDFCFCAAFCAC5D29C12B11CCF8EE5BA88.46.3756983148.357 CD_45999BE1E716B224CDC60BBAEC2E4A9422A7548870411AB5310F9D9DCF7A8F92.18.1902325320.505 CD_47B8D9FB99659B3546500CA55AB79FFA62B2FC16F96D81F5B390216EEB78A7A9.38.1342073028.1932 CD_486709A1BC1AEA1713B7B7854CB54E0BA9471BB018357C834E1DD6BAF7DE7457.37.3333778245.365 CD_488B67E05BD8C144F890DD1628D2D632822D5CE3B99BFDA24BA6CC55C387B3C4.30.3481508297.718 CD_49777012274A486E8E2DA653CCC9FE3C0BAFC8CB49FF0E373F8540A5B458A655.12.2070587822.520 CD_4981A3BB969F4ED9382A86F274047A36B2A04D2A53526DFA477217266B033E1E.30.1796451580.1237 CD_49C003F958AE429B51E409471F01A643359D07DB4A4E6AA865D8578747CC13A3.34.857260647.577 CD_4A805754DC4920C5CDF55FA12C65FB3FF31068A56F7569D69AC9CEBF6B6C724B.26.1419836098.533 CD_4B66FACE2F9688020890084420324926AA3CF21932AD39E8C9ACEA5209F73583.43.1803524372.262 CD_4B73D65E2FE4553C66EBB3CAEECF929ED3C6295923490BCF82E45AB15E13C3B2.33.2760449097.546 CD_4BBA71B8B969B6626A0E7F60779736282C60AEC40553354F5884C7B9E51AF36A.17.2861912781.288 CD_4BD0F8A6C8D9EC0678D50228DC3CB44B9F26CFF9B291F8B882B0AD7C252B23A9.42.1963676873.219 CD_35A718313A1D788647FBE70E3BDCD7DD0916025FCA299E4EDF879E32418A1A55.52.4065189175.8061 CD_43B35DA4EAEBC0284206ADBC4132DA71EB8556E731586CFE46B5A658E2C2F498.51.1187054776.682 CD_48C8FF9D3F57E7744A3D1C2C52E57FC97BA717E184730EB1BDE77718DB3C9C93.51.454054616.772 CD_3035B16D02866D7EE030442132A18B7ACF25E1EBBE385D31EBEA6DA0AB2F86A6.57.358853045.3394 CD_45F5A698FE1F369FCC9E35170EFC43E4DFBC18F38DA62C3D1FEF22A7B3B706DD.58.2223180914.1313 4DB8EA7DEC92B3AEAE5EC6DF957DB2495087F658D2 R_E0728E680677E2DC755DB0B32FACA9688F4B71D12279046ADFB604C5714997EF R_A21DD98AF56DC0A7D21C24764DDA5A5F7A3EA65FE4980FAAB7F2035E4807972C CR_E7845F3041269988C5A1847DE98EF0D88E59CE50ED3A8AA1E310C1A1F393BB81 R_33AFC5533FEF2AB8957C705077D2CB2428067503BF4A8D79697DC98C53B8A138 R_57839BB831B678823813D6DE5621B2492B8DEE2CAA3C37F3643245385D720644 C_62D705EEE1342BED8EAA270755244DE39EAF602D11698E63DBE2E645EB742AFE C_4E6B2407BBFA735CD558FA956E39FDDAEBB739747AD4109DB6B2E67ADBD0148A C_EA2F4ED6B8AA0BEEE14A7235028BAD0C1DDD97703732E8317B8FE1581E43A3CF C_C9D9452296EB13E3615C122157CD56E9BB0D20377DF2B13731EB18D5AF7A66B0 C_A53803A976BCA3FFB16063ACA85E663ADBA78B63EC0DAF8A23C68DAD672A3EF9 CR_E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 C_FFF2AE454B5EBA423321420C962DDADA7E00808CE9D4E5B4FF81481A2E9CA1B6 R_FFF2AE454B5EBA423321420C962DDADA7E00808CE9D4E5B4FF81481A2E9CA1B6 C_A810B8BCB28B4593289F5B14287BCC8F9F33A8E5A5BE4903C9226502B53FB3AA C_FFBBEEB41878AC75CD38671CF9A4CECEB2F673622833FAA9EA04376FB4297330 R_C504B91CF040A007F72C24FC0CC99A78401C1C475112424D0A789E6908FEF373 R_962C6E7C58B97BBA37F5179D96ED3E00EE4A4FC20E4C3C3A3312674F9F7C4195 R_403C7DAFD38411FBB7FFA51AD2D0CC5E3462A61D34EA60E279877DCCDC222D62 R_8A4037032A1E93595308B4A4BD6D8BFAF65C3C979F3304AFFC616809C573E05E R_15DD3B0DCF2819EDB87C4363412C3F99792BF1AFEF4BDC92585A3BCD2CD95F12 C_7531D0F73C9D0FCC20C0C9C036C7F34D7F189FB9D62AC61E8FFDD74B2A07A836 C_86E8A5569DCAE5B400BCD0BC7C48FFAE53C06283B9698944273225E1996E11CF C_94119F7CE064741EFDFBF431345AF21D6DE41FA57EAD0A70AB2B0FB8D3F14451 C_D439D24286A48779EB1CF85E2093853178A3502A21F1F13F44868D671886BA98 8779EB1CF85E2093853178A3502A21F1F13F44868D671886BA98.46.1225406108.1468 MU+�� � �a@c} � ;��� � u75ߡ � 4wi( � �a�B�
� 퇜�d � d�� ` n><s ^ ���u� | ��M d ��D� � ϛx� � C I M _ S y s t e m C o m p o n e n t �ɝ��C�_ CIM_SystemComponent 6 � �� � $ , 2 Z j . e��������� � Win32_SystemSystemDriver CIMWin32 Locale UUID {8502C4F1-5FBB-11D2-AAC1-006008C78BC7} GroupComponent f@ A
� � � �� � ��� � � � ref:Win32_ComputerSystem Override GroupComponent MappingStrings WMI|Win32_ComputerSystem PartComponent f@ A
� } � �� � ��� � � � ref:Win32_SystemDriver Override PartComponent MappingStrings � WMI|Win32_SystemDriver � C I M _ S y s t e m C o m p o n e n t �ɝ��C�V CIM_SystemComponent 6 � �� � % + S c ' e��������� � Win32_SystemUsers CIMWin32 Locale UUID {8502C4F2-5FBB-11D2-AAC1-006008C78BC7} GroupComponent f@ A
� � � �� � ��� � � � ref:Win32_ComputerSystem Override GroupComponent MappingStrings � WMI|Win32_ComputerSystem PartComponent f@ A
� v � �� � ��� � � � ref:Win32_UserAccount Override PartComponent MappingStrings � WMI|Win32_UserAccount � C I M _ S y s t e m C o m p o n e n t �ɝ��C�R CIM_SystemComponent 6 � �� � ! ) / W g + e��������� � Win32_SystemProcesses CIMWin32 Locale UUID {8502C4F3-5FBB-11D2-AAC1-006008C78BC7} GroupComponent f@ A
� � � �� � ��� � � � ref:Win32_ComputerSystem Override GroupComponent MappingStrings WMI|Win32_ComputerSystem PartComponent f@ A
� z � �� � ��� � � � ref:Win32_Process Override PartComponent MappingStrings � WMI|Win32_Process � W i n 3 2 _ S y s t e m D e v i c e s �ɝ��C�I Win32_SystemDevices 6 � �� � " * 0 X h ! e��������� � Win32_SystemPartitions CIMWin32 Locale UUID {8502C4F5-5FBB-11D2-AAC1-006008C78BC7} GroupComponent f@ 6
� � � ��� � � � ref:Win32_ComputerSystem Override GroupComponent MappingStrings � WMI|Win32_ComputerSystem PartComponent f@ 6
� e � ��~ � � � ref:Win32_DiskPartition Override PartComponent MappingStrings � WMI|Win32_DiskPartition � C I M _ S y s t e m C o m p o n e n t �ɝ��C�Q CIM_SystemComponent 6 � �� � ( . V f * e��������� � Win32_SystemServices CIMWin32 Locale UUID {8502C4F6-5FBB-11D2-AAC1-006008C78BC7} GroupComponent f@ A
� � � �� � ��� � � � ref:Win32_ComputerSystem Override GroupComponent MappingStrings WMI|Win32_ComputerSystem PartComponent f@ A
� y � �� � ��� � � � ref:Win32_Service Override PartComponent MappingStrings � WMI|Win32_Service � C I M _ S y s t e m C o m p o n e n t �ɝ��C�o CIM_SystemComponent 6 � �� � * 2 8 ` p % 4 e��������� � Win32_SystemNetworkConnections CIMWin32 Locale UUID {8502C4F7-5FBB-11D2-AAC1-006008C78BC7} GroupComponent f@ A
� � � �� � ��� � � ref:Win32_ComputerSystem Override GroupComponent MappingStrings WMI|Win32_ComputerSystem PartComponent f@ A
� � � �� � ��� � � � ref:Win32_NetworkConnection Override PartComponent MappingStrings � WMI|Win32_NetworkConnection � C I M _ C o m p u t e r S y s t e m R e s o u r c e �ɝ��C�c $ CIM_ComputerSystemResource 6 � �� � ! ) / W g + e��������� � Win32_SystemResources CIMWin32 Locale UUID {8502C4F8-5FBB-11D2-AAC1-006008C78BC7} GroupComponent f@ A
� � � �� � ��� � � � ref:Win32_ComputerSystem Override GroupComponent MappingStrings WMI|Win32_ComputerSystem PartComponent f@ A
� z � �� � ��� � � � ref:CIM_SystemResource Override PartComponent MappingStrings � CIM|CIM_SystemResource � C I M _ E l e m e n t S e t t i n g �ɝ��C�$ CIM_ElementSetting ) �� ' - U ^ e��������� � Win32_SystemSetting Abstract Locale UUID {8502C501-5FBB-11D2-AAC1-006008C78BC7} Element f@ A
� � � �� � ��� � � � ref:Win32_ComputerSystem Override Element MappingStrings � WMI|Win32_ComputerSystem Setting f@ A
� d � �� � ��u � � ref:CIM_Setting Override Setting MappingStrings � CIM|CIM_Setting U � W i n 3 2 _ S y s t e m S e t t i n g �ɝ��C� Win32_SystemSetting 6 � �� � ' - U ^
e��������� � Win32_SystemDesktop CIMWin32 Locale UUID {8502C506-5FBB-11D2-AAC1-006008C78BC7} Element f@ 6
� � � ��� � � � ref:Win32_ComputerSystem Override Element MappingStrings � WMI|Win32_ComputerSystem Setting f@ 6
� N � ��a k t � ref:Win32_Desktop Override Setting MappingStrings � WMI|Win32_Desktop IM � W i n 3 2 _ S y s t e m S e t t i n g �ɝ��C�> Win32_SystemSetting 6 � �� � ) 1 7 _ h e��������� � Win32_SystemBootConfiguration CIMWin32 Locale UUID {8502C507-5FBB-11D2-AAC1-006008C78BC7} Element f@ 6
� � � ��� � � � ref:Win32_ComputerSystem Override Element MappingStrings � WMI|Win32_ComputerSystem Setting f@ 6
� X � ��u � � ref:Win32_BootConfiguration Override Setting MappingStrings � WMI|Win32_BootConfiguration 07 � C I M _ C h a s s i s �ɝ��C�6 � CIM_Chassis
6 � �� � ! ) / W g + � � ������������������������������������������������������������������������������������������������������������������������������������8 � Win32_SystemEnclosure CIMWin32 Locale UUID {FAF76B94-798C-11D2-AAD1-006008C78BC7} SecurityStatus $ z 6
� � � ��� � � � uint16 ValueMap � � � � � 1 2 3 4 5 MappingStrings � SMBIOS|Type 3|Security Status SMBIOSAssetTag # v )
� b � ��j z string MappingStrings � SMBIOS|Type 3|Asset Tag Tag @
( N
� � � �� � �� + string MaxLen Override Tag MappingStrings 3 WMI � W i n 3 2 _ P n P D e v i c e P r o p e r t y ʝ��C�� ! Win32_PnPDeviceProperty $ * ����������������������\ � Win32_PnPDevicePropertySint32Array Data
� T � �� Sint32 � W i n 3 2 _ P n P D e v i c e P r o p e r t y ʝ��C�� ! Win32_PnPDeviceProperty $ * ����������������������\ � Win32_PnPDevicePropertyStringArray Data
� T � �� string � ;3p � ���uI i d2 b� � � XDV K �3W,� � �t��b � C I M _ S e t t i n g �ɝ��C�� ` CIM_Setting
6 � �� � " ( P V � � � � * = � � � � : J � � � � e s
� � U h
�
�
e u -
;
�
�
� � UUUUU������������������������������������������������������������������������������������������C � Win32_TimeZone CIMWin32 Locale UUID {8502C4EC-5FBB-11D2-AAC1-006008C78BC7} Bias )
� � � ��� � sint32 MappingStrings � Win32API|Time Structures|TIME_ZONE_INFORMATION|Bias DaylightBias )
� ' � ��/ ? sint32 MappingStrings G Win32API|Time Structures|TIME_ZONE_INFORMATION|DaylightBias DaylightDay )
� � � ��� � uint32 MappingStrings � Win32API|Time Structures|TIME_ZONE_INFORMATION|DaylightDate|wDay DaylightDayOfWeek )
� t � ��{ � uint8 MappingStrings � Win32API|Time Structures|TIME_ZONE_INFORMATION|DaylightDate|wDayOfWeek DaylightHour )
� � ��( 8 uint32 MappingStrings @ Win32API|Time Structures|TIME_ZONE_INFORMATION|DaylightDate|wHour DaylightMillisecond )
� � � ��� � uint32 MappingStrings � Win32API|Time Structures|TIME_ZONE_INFORMATION|DaylightDate|wMilliseconds DaylightMinute ! )
� � � ��� � uint32 MappingStrings � Win32API|Time Structures|TIME_ZONE_INFORMATION|DaylightDate|wMinute DaylightMonth
% 6
� 9 � ��A Q � � uint32 MappingStrings Y Win32API|Time Structures|TIME_ZONE_INFORMATION|DaylightDate|wMonth ValueMap � � � � � � � � � � � � 1 2 3 4 5 6 7 8 9 10 11 12 DaylightName ) 6
� T � ��\ d t string MaxLen MappingStrings | Win32API|Time Structures|TIME_ZONE_INFORMATION|DaylightName DaylightSecond - )
� � �� uint32 MappingStrings Win32API|Time Structures|TIME_ZONE_INFORMATION|DaylightDate|wSecond DaylightYear
1 )
� � � ��� � uint32 MappingStrings � Win32API|Time Structures|TIME_ZONE_INFORMATION|DaylightDate|wYear StandardBias 5 )
� R � ��Z j uint32 MappingStrings r Win32API|Time Structures|TIME_ZONE_INFORMATION|StandardBias StandardDay 9 )
� � � ��� uint32 MappingStrings Win32API|Time Structures|TIME_ZONE_INFORMATION|StandardDate|wDay StandardDayOfWeek = )
� � � ��� � uint8 MappingStrings � Win32API|Time Structures|TIME_ZONE_INFORMATION|StandardDate|wDayOfWeek StandardHour > )
� K
� ��S
c
uint32 MappingStrings k
Win32API|Time Structures|TIME_ZONE_INFORMATION|StandardDate|wHour StandardMillisecond B )
� �
� �� uint32 MappingStrings Win32API|Time Structures|TIME_ZONE_INFORMATION|StandardDate|wMilliseconds StandardMinute F )
� � � ��� � uint32 MappingStrings � Win32API|Time Structures|TIME_ZONE_INFORMATION|StandardDate|wMinute StandardMonth J 6
� d � ��l | � � uint32 MappingStrings � Win32API|Time Structures|TIME_ZONE_INFORMATION|StandardDate|wMonth ValueMap
!
%
)
1 2 3 4 5 6 7 8 9 10 11 12 StandardName N A
� �
� �� � ���
�
�
string MaxLen MappingStrings �
Win32API|Time Structures|TIME_ZONE_INFORMATION|StandardName StandardSecond R )
� 6 � ��> N uint32 MappingStrings V Win32API|Time Structures|TIME_ZONE_INFORMATION|StandardDate|wSecond StandardYear V )
� � � ��� � uint32 MappingStrings Win32API|Time Structures|TIME_ZONE_INFORMATION|StandardDate|wYear � C I M _ E l e m e n t S e t t i n g �ɝ��C�- CIM_ElementSetting 6 � �� � % + S \
e��������� � Win32_UserDesktop CIMWin32 Locale UUID {8502C4FF-5FBB-11D2-AAC1-006008C78BC7} Element f@ A
� � � �� � ��� � � � ref:Win32_UserAccount Override Element MappingStrings � WMI|Win32_UserAccount Setting f@ A
� \ � �� � ��o y � � ref:Win32_Desktop Override Setting MappingStrings � WMI|Win32_Desktop { � C I M _ L o g i c a l E l e m e n t �ɝ��C�h / CIM_LogicalElement 6 � �� � % - 3 [ c ' � � � � , 9 � � �W��������������������������������������������� � Win32_QuickFixEngineering CIMWin32 Locale UUID {0827250D-BA3E-11d2-B361-00105A1F77A1} CSName N
� � � ��� ��� � � �
string CIM_Key MaxLen Propagated CIM_ComputerSystem.Name MappingStrings WMI FixComments )
� ^ � ��f v string MappingStrings ~ Win32Registry|SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix HotFixID A
� � �� � ��" * : string MaxLen MappingStrings B Win32Registry|SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix InstalledBy $ )
� � � ��� � string MappingStrings � Win32Registry|SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix InstalledOn
( )
� p � ��x � string MappingStrings � Win32Registry|SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix ServicePackInEffect A
� 7 � �� � ��? G W string MaxLen MappingStrings _ Win32Registry|SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix � C I M _ L o g i c a l E l e m e n t �ɝ��C� CIM_LogicalElement 6 � �� � ! ) / W ` � � $ }�������������������������v � Win32_OptionalFeature CIMWin32 Locale UUID {0827250D-BA3E-11d2-B361-00105A1F77A2} Caption @ )
� � � � �� string MaxLen InstallState )
� � � ��� � uint32 ValueMap 1 2 3 4 Name @ 4
� f � �� � ��n string MaxLen � C I M _ D e p e n d e n c y �ɝ��C�� CIM_Dependency C � �� � $ . : V ^ d � � S ^ U�������� � Win32_LogicalProgramGroupDirectory CIMWin32 Privileges B SeRestorePrivilege Locale UUID {F25FE467-783E-11d2-90BF-0060081A46FD} Antecedent f@ A
� � � �� � �� , ref:Win32_LogicalProgramGroup Override Antecedent MappingStrings 4 WMI|Win32_LogicalProgramGroup Dependent f@ A
� � � �� � ��� � � � ref:Win32_Directory Override Dependent MappingStrings � WMI|Win32_Directory � W i n 3 2 _ P n P D e v i c e P r o p e r t y ʝ��C�� ! Win32_PnPDeviceProperty $ * ����������������������\ � Win32_PnPDevicePropertyReal32Array Data
� T � �� real32 � <��P � ��k�� ��� � ���+� C I M _ P C V i d e o C o n t r o l l e r �ɝ��C�j � CIM_PCVideoController 6 � �� � ! ) / W m � � e q � � � K U � � y � Q ] � � � � k v H U � � {
�
�
� � = S � � ����������WUUU������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������y
� Win32_VideoController CIMWin32 Locale UUID {1008CCF1-7BFF-11D2-AAD2-006008C78BC7} AdapterCompatibility ) � )
� � � ��� � string MappingStrings � Win32Registry AdapterDACType * � )
� � ��" 2 string MappingStrings : Win32Registry|HardwareInformation.DACType AdapterRAM + � )
� � � ��� � uint32 MappingStrings � Win32Registry|HardwareInformation.MemorySize ColorTableEntries 6 � )
� @ � ��H X uint32 MappingStrings ` Win32API|Device Context Functions|GetDeviceCaps CurrentRefreshRate @ ! v 6
� � � ��� - 7 uint32 MappingStrings Win32Registry|HardwareInformation. Override CurrentRefreshRate DeviceID @ A
� � � �� � ��� � � � string Override DeviceId MappingStrings � WMI DeviceSpecificPens 7 � )
� ( � ��0 @ uint32 MappingStrings H Win32API|Device Context Functions|GetDeviceCaps DitherType - � 6
� � � ��� � * uint32 MappingStrings � Win32API|Device Context Functions|EnumDisplaySettings ValueMap B E H K N 1 2 3 4 5 DriverDate e 1 � )
� � � ��� � datetime MappingStrings � Win32Registry|System\CurrentControlSet\Services\Class\ DriverVersion 2 � )
� 4 � ��< L string MappingStrings T Win32API|File Installation Library Functions|GetFileVersionInfo ICMIntent 3 � 6
� � � ��� � H R uint32 MappingStrings Win32API|Printing and Print Spooler Structures|DevMode|dmICMIntent ValueMap b e h 1 2 3 ICMMethod 4 � 6
� � � ��� � ( uint32 MappingStrings � Win32API|Printing and Print Spooler Structures|DevMode|dmICMMethod ValueMap < ? B E 1 2 3 4 InfFilename . � )
� � � ��� � string MappingStrings � Win32Registry|SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000 InfSection / � )
� Q � ��Y i string MappingStrings q Win32Registry|SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000 InstalledDisplayDrivers 0 � )
� #
� ��+
;
string MappingStrings C
Win32Registry|System\CurrentControlSet\Services\Class\ Monochrome , � )
� �
� ���
�
boolean MappingStrings �
WMI ReservedSystemPaletteEntries 8 � )
� 9 � ��A Q uint32 MappingStrings Y Win32API|Device Context Functions|GetDeviceCaps SpecificationVersion 5 � )
� � � ��� � uint32 MappingStrings � Win32API|Printing and Print Spooler Structures|DevMode|dmSpecVersion SystemPaletteEntries 9 � )
� � � ��� � uint32 MappingStrings � Win32API|Device Context Functions|GetDeviceCaps VideoModeDescription : � )
� (
� ��0
@
string MappingStrings H
Win32API|Device Context Functions|GetDeviceCaps � C I M _ S e t t i n g �ɝ��C��
@ CIM_Setting
A �� � �� � ( 2 : @ h t ) � � � � : F 7 F � � � � � � � � N Y " UU������������������������������������������������������������� � Win32_DisplayConfiguration DEPRECATED CIMWin32 Locale UUID {8502C4E4-5FBB-11D2-AAC1-006008C78BC7} BitsPerPel 4
� � � �� � ��� � uint32 DEPRECATED MappingStrings � Win32API|Device Context Functions|GetDeviceCaps|BITSPIXEL DeviceName L
� � � �� � �� � ��� � � string DEPRECATED MaxLen MappingStrings � WMI DisplayFlags 4
� �� � �� 0 uint32 DEPRECATED MappingStrings 8 Win32API|Printing and Print Spooler Structures|DEVMODE|dmDisplayFlags DisplayFrequency 4
� � � �� � ��� � uint32 DEPRECATED MappingStrings Win32API|Device Context Functions|GetDeviceCaps|VREFRESH DitherType A
� � � �� � ��� � uint32 DEPRECATED MappingStrings � Win32API|Printing and Print Spooler Structures|DEVMODE|dmDitherType ValueMap ( + . 1 4 1 2 3 4 5 DriverVersion 4
� � � �� � ��� � string DEPRECATED MappingStrings � Win32Registry|System\CurrentControlSet\Services\Class|Ver ICMIntent $ A
� I Q �� � ��] m � � uint32 DEPRECATED MappingStrings u Win32API|Printing and Print Spooler Structures|DEVMODE|dmICMIntent ValueMap � � � 1 2 3 ICMMethod
( A
� 6 > �� � ��J Z � � uint32 DEPRECATED MappingStrings b Win32API|Printing and Print Spooler Structures|DEVMODE|dmICMMethod ValueMap � � � � 1 2 3 4 LogPixels , 4
� & �� � ��2 B uint32 DEPRECATED MappingStrings J Win32API|Printing and Print Spooler Structures|DEVMODE|dmLogPixels PelsHeight 0 4
� � � �� � ��� uint32 DEPRECATED MappingStrings Win32API|Printing and Print Spooler Structures|DEVMODE|dmPelsHeight PelsWidth
4 4
� � � �� � ��� � uint32 DEPRECATED MappingStrings � Win32API|Printing and Print Spooler Structures|DEVMODE|dmPelsWidth SpecificationVersion 8 4
� d l �� � ��x � uint32 DEPRECATED MappingStrings � Win32API|Printing and Print Spooler Structures|DEVMODE|dmSpecVersion � C I M _ B a t t e r y �ɝ��C�e � CIM_Battery
6 � �� � ! ' O d � � ��������������������������������������������������������������������������������������������������������������������������������l � Win32_Battery CIMWin32 Locale UUID {8502C4B9-5FBB-11D2-AAC1-006008C78BC7} BatteryRechargeTime t 4
� � � ��� ��� � uint32 DEPRECATED MappingStrings � HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services|RechargeRate DeviceID @ A
� n � �� � ��v � � � string Override DeviceId MappingStrings � WMI ExpectedBatteryLife p 4
� � � �� �� " uint32 DEPRECATED MappingStrings * HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services|BatteryLife � W i n 3 2 _ D e v i c e C h a n g e E v e n t ʝ��C�� ! Win32_DeviceChangeEvent & . 4 ?��������������X � Win32_SystemConfigurationChangeEvent Locale UUID 76746942-D94B-47E2-BBA4-AFD2FDBA61 � �& C I M _ S e t t i n g &ʝ��C�R+ � CIM_Setting
6 � �� � # - 5 ; : c y ( 9 � � � � Y k
� � k x � � k w
� � u � 6
C
�
�
� � � � �
F
Q
# * � � + 6 � � * � � � � T l 0 � � � � ? S �
� � 3 A < J > P & � � � f r
� � e z ' = � � � � � ! �! �! �" �" K# g# $ +$ �$ �$ �% �% M& `& �& ' �' �' UUUUUUUUUUUUUU����������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������I( � Win32_NetworkAdapterConfiguration CIMWin32 Locale UUID {8502C515-5FBB-11D2-AAC1-006008C78BC7} ArpAlwaysSourceRoute P )
� � � ��� � boolean MappingStrings � Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|ArpAlwaysSourceRoute ArpUseEtherSNAP R )
� p � ��y � boolean MappingStrings � Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|ArpUseEtherSNAP DatabasePath J )
� ( � ��0 @ string MappingStrings H Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|DatabasePath DeadGWDetectEnabled V )
� � � ��� � boolean MappingStrings Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|EnableDeadGWDetect DefaultIPGateway )
� � � ��� � string MappingStrings � Win32Registry|System\CurrentControlSet\Services|Parameters|DefaultGateway DefaultTOS T )
� P � ��W g uint8 MappingStrings o Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|DefaultTOS DefaultTTL U )
� � � �� uint8 MappingStrings Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|DefaultTTL DHCPEnabled )
� � � ��� � boolean MappingStrings � Win32Registry|SYSTEM\CurrentControlSet\Services|EnableDHCP DHCPLeaseExpires e )
� U � ��_ o datetime MappingStrings w Win32Registry|SYSTEM\CurrentControlSet\Services|LeaseTerminatesTime DHCPLeaseObtained e )
� � �� datetime MappingStrings ( Win32Registry|SYSTEM\CurrentControlSet\Services|LeaseObtainedTime DHCPServer )
� � � ��� � string MappingStrings � Win32Registry|SYSTEM\CurrentControlSet\Services|DhcpServer DNSDomain / � )
� L � ��T d string MappingStrings l Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|Domain DNSDomainSuffixSearchOrder 1 � )
� � �� string MappingStrings ( Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|SearchList DNSEnabledForWINSResolution 2 � )
� � � ��� � boolean MappingStrings � Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|EnableDNS DNSHostName . � )
� z
� ���
�
string MappingStrings �
Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|Hostname DNSServerSearchOrder 0 � )
� 2 � ��: J string MappingStrings R Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|NameServer DomainDNSRegistrationEnabled D
� � � �� boolean ForwardBufferMemory \ )
� < � ��D T uint32 MappingStrings \ Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|ForwardBufferMemory FullDNSRegistrationEnabled B
� � � �� boolean GatewayCostMetric
� >
� �� uint16 IGMPLevel ` 6
� �
� ���
�
�
�
uint8 ValueMap �
�
�
0 1 2 MappingStrings �
Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|IGMPLevel Index " 4
� l � �� � ��t � uint32 MappingStrings � Win32Registry|SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318} InterfaceIndex
&
� # � �� uint32 IPAddress * )
� m � ��u � string MappingStrings � Win32Registry|System\CurrentControlSet\Services|Parameters\Tcpip|IPAddress IPConnectionMetric F
� � �� uint32 IPEnabled > )
� a � ��j z boolean MappingStrings � Win32Registry|System\CurrentControlSet\Services|Parameters\Tcpip IPFilterSecurityEnabled * � )
� � �� - boolean MappingStrings 5 Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|IPFilterSecurityEnabled IPPortSecurityEnabled ) � 4
� � � �� � ���
boolean DEPRECATED MappingStrings WMI|Win32_NetworkAdapterConfiguration|IPFilterSecurityEnabled IPSecPermitIPProtocols - � )
� � � ��� � string MappingStrings � Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|RawIPAllowedProtocols IPSecPermitTCPPorts + � )
� g � ��o string MappingStrings � Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|TCPAllowedPorts IPSecPermitUDPPorts , � )
� % � ��- = string MappingStrings E Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|UDPAllowedPorts IPSubnet . )
� � � ��� � string MappingStrings � Win32Registry|System\CurrentControlSet\Services|Parameters|SubnetMask IPUseZeroBroadcast N )
� � � ��� � boolean MappingStrings � Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|UseZeroBroadcast IPXAddress
2 4
� L T �� � ��` p string DEPRECATED MappingStrings x Win32API|Windows Sockets Version 2|getsockopt|IPX_ADDRESS IPXEnabled @ 4
�
�� � �� & boolean DEPRECATED MappingStrings . WMI IPXFrameType ; � A
� � � �� � ��� � uint32 DEPRECATED MappingStrings � Win32Registry|SYSTEM\CurrentControlSet\Services\nwlnkipx\Parameters|PktType ValueMap + . 1 4 7 0 1 2 3 255 IPXMediaType < � A
� � � �� � ��� � uint32 DEPRECATED MappingStrings � Win32Registry|SYSTEM\CurrentControlSet\Services\nwlnkipx\Parameters|MediaType ValueMap 2 5 8 ; 1 2 3 8 IPXNetworkNumber : � 4
� � � �� � ��� � string DEPRECATED MappingStrings � Win32Registry|SYSTEM\CurrentControlSet\Services\nwlnkipx\Parameters|NetworkNumber IPXVirtualNetNumber 9 � 4
� h p �� � ��| � string DEPRECATED MappingStrings � Win32Registry|SYSTEM\CurrentControlSet\Services\nwlnkipx\Parameters|VirtualNetworkNumber KeepAliveInterval a )
� 8 � ��@ P uint32 MappingStrings X Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|KeepAliveInterval KeepAliveTime ! e )
� � � ���
uint32 MappingStrings Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|KeepAliveInterval MACAddress 6 )
� � � ��� � string Map�D� � 2�0D a ���� | Q���! �B��' � �}B�� � �� � )K6�3 � Jť/ � C I M _ S y s t e m C o m p o n e n t �ɝ��C�f CIM_SystemComponent 6 � �� � ' / 5 ] m " 1 e��������� � Win32_SystemLoadOrderGroups CIMWin32 Locale UUID {8502C503-5FBB-11D2-AAC1-006008C78BC7} GroupComponent f@ A
� � � �� � ��� � � ref:Win32_ComputerSystem Override GroupComponent MappingStrings WMI|Win32_ComputerSystem PartComponent f@ A
� � � �� � ��� � � � ref:Win32_LoadOrderGroup Override PartComponent MappingStrings � WMI|Win32_LoadOrderGroup � W i n 3 2 _ S y s t e m S e t t i n g �ɝ��C�# Win32_SystemSetting 6 � �� � ( . V _ e��������� � Win32_SystemTimeZone CIMWin32 Locale UUID {8502C504-5FBB-11D2-AAC1-006008C78BC7} Element f@ 6
� � � ��� � � � ref:Win32_ComputerSystem Override Element MappingStrings � WMI|Win32_ComputerSystem Setting f@ 6
� O � ��c m v � ref:Win32_TimeZone Override Setting MappingStrings � WMI|Win32_TimeZone in � W i n 3 2 _ S y s t e m S e t t i n g �ɝ��C�> Win32_SystemSetting 6 � �� � % - 3 [ d e��������� � Win32_SystemProgramGroups CIMWin32 Locale UUID {8502C505-5FBB-11D2-AAC1-006008C78BC7} Element f@ 6
� � � ��� � � � ref:Win32_ComputerSystem Override Element MappingStrings � WMI|Win32_ComputerSystem Setting f@ 6
� T � ��s } � � ref:Win32_LogicalProgramGroup Override Setting MappingStrings � WMI|Win32_LogicalProgramGroup -A � C I M _ S l o t �ɝ��C�� � CIM_Slot
6 � �� � $ * R ] � � s � � w � � � � j ~ � � �����U����������������������������������������������������������������������������������������������������������������������������� � Win32_SystemSlot CIMWin32 Locale UUID {FAF76B91-798C-11D2-AAD1-006008C78BC7} BusNumber p )
� � � ��� � uint32 MappingStrings � SMBIOS|Type 9|Bus Number ConnectorType ` > 6
� ! � ��) 9 Z d uint16 MappingStrings A SMBIOS|Type 9|Slot Type Override ConnectorType CurrentUsage f )
� � � ��� � uint16 MappingStrings � SMBIOS|Type 9|Current Usage DeviceNumber ! t )
� : � ��B R uint32 MappingStrings Z SMBIOS|Type 9|Device Number FunctionNumber " x )
� � � ��� � uint32 MappingStrings � SMBIOS|Type 9|Function Number MaxDataWidth @ L C
� \ d t � ��� � � � uint16 MappingStrings | MIF.DMTF|System Slot|004.3 Override MaxDataWidth ValueMap � � � � � 0 1 2 3 4 PMESignal h )
� # � ��, < boolean MappingStrings D SMBIOS|Type 9|Slot Characteristics 2 SegmentGroupNumber l )
� � � ��� � uint32 MappingStrings � SMBIOS|Type 9|Segment Group Number Shared j )
� 8 � ��A Q boolean MappingStrings Y SMBIOS|Type 9|Slot Characteristics 1 SlotDesignation b )
� � � ��� � string MappingStrings � SMBIOS|Type 9|Slot Designation Tag @
( N
� h � ��p � ��x � � � string MaxLen Override Tag MappingStrings � WMI �
C I M _ T h r e a d �ɝ��C�w h CIM_Thread 6 � �� � &
N [ � � � � � � B P � � � � � - � � ���uU���������������������������������������������������������������������������������������������������` � Win32_Thread CIMWin32 Locale UUID {8502C4DD-5FBB-11D2-AAC1-006008C78BC7} ElapsedTime J )
� � � ��� � uint64 MappingStrings � Win32API|Performance Data Structures|PERF_OBJECT_TYPE|PerfTime Handle @ 0 C
� K � ��S [ e m } string MaxLen Override Handle MappingStrings � Win32API|Tool Help Structures|THREADENTRY32|th32ThreadID KernelModeTime @ B +
� * : uint64 Override KernelModeTime MappingStrings B Win32API|Performance Data Structures|PERF_OBJECT_TYPE|PrivilegedTime Priority @
4 6
� � � ��� � � uint32 Override Priority MappingStrings
Win32API|Tool Help Structures|THREADENTRY32|tpDeltaPri PriorityBase R )
� � � ��� � uint32 MappingStrings � Win32API|Performance Data Structures|PERF_OBJECT_TYPE|PerfPriorityBase ProcessHandle @
( P
� \ � ��d p � � � � � string Propagated CIM_Process.Handle MaxLen Override ProcessHandle MappingStrings � Win32API|Tool Help Structures|THREADENTRY32|th32OwnerProcessID StartAddress V )
� B � ��J Z uint32 MappingStrings b WIn32API|Thread Object|LPTHREAD_START_ROUTINE|lpStartAddress ThreadState Z )
� � � ��� � uint32 MappingStrings Win32API|Thread State ThreadWaitReason ^ )
� d � ��l | uint32 MappingStrings � Win32API|Thread Wait Reason UserModeTime @ : +
� � � � uint64 Override UserModeTime MappingStrings Win32API|Performance Data Structures|PERF_OBJECT_TYPE|UserTime � C I M _ D e p e n d e n c y �ɝ��C�� CIM_Dependency C � �� � ' 1 = Y a g � � ^ i U�������� � Win32_LogicalProgramGroupItemDataFile CIMWin32 Privileges E SeRestorePrivilege Locale UUID {08FFAD62-8050-11d2-90CE-0060081A46FD} Antecedent f@ A
� � � �� � ��
# 3 ref:Win32_LogicalProgramGroupItem Override Antecedent MappingStrings ; WMI|Win32_LogicalProgramGroupItem Dependent f@ A
� � � �� � ��� � � � ref:CIM_DataFile Override Dependent MappingStrings � CIM|CIM_DataFile �
C I M _ C o m p o n e n t �ɝ��C�q CIM_Component 6 � �� � & . 4 \ l + : e��������� � Win32_ProgramGroupContents CIMWin32 Locale UUID {86E30E83-7DB2-11d2-90CB-0060081A46FD} GroupComponent f@ A
� � � �� � ��� � � ref:Win32_LogicalProgramGroup Override GroupComponent MappingStrings WMI|Win32_LogicalProgramGroup PartComponent f@ A
� � � �� � ��� � � � ref:Win32_ProgramGroupOrItem Override PartComponent MappingStrings � WMI|Win32_ProgramGroupOrItem � W i n 3 2 _ P n P D e v i c e P r o p e r t y ʝ��C�� ! Win32_PnPDeviceProperty % + ����������������������^ � Win32_PnPDevicePropertyBooleanArray Data
� U � �� boolean �6 4 6 5 9 A B 9 F 8 F 1 C 4 B 5 6 8 D B 6 4 3 8 B A E 1 1 B 2 6 E E 8 F 9 3 C B 5 F 8 1 9 5 E 2 1 E 8 C 3 8 3 D 6 C 4 4 C C 4 1 �؝��C�ȝ��C�(
� __NAMESPACE PT g�]R` � ���� � *���
���� ��� C I M _ L o g i c a l E l e m e n t 9ѝ��C�� _ CIM_LogicalElement ) � �� � # + = p w � � � � * : m z � � � � / A t x � � � 4 A t � � � 7 = p | � � � � ) 0 � � ) �WUUUUU����������������������������������������������������������������������������������������[ � Win32_ShadowCopy MSVSS__PROVIDER Locale ClientAccessible B
� g � �� boolean Count
� � � �� uint32 DeviceObject $
� � � �� string Differential N
� ! � �� boolean ExposedLocally V
� d � �� boolean ExposedName
4
� � � �� string ExposedPath 8
� � � �� string ExposedRemotely T
� & � �� boolean HardwareAssisted L
� k � �� boolean ID '
� � � �� � �� string Imported R
� � � �� boolean NoAutoRelease D
� + � �� boolean NotSurfaced J
� k � �� boolean NoWriters F
� � � �� boolean OriginatingMachine ,
� � � �� string Persistent @
� . � �� boolean Plex P
� g � �� boolean ProviderID
� � � �� string ServiceMachine 0
� � � �� string SetID
� ! � �� string State < )
� g o y � �� uint32 Valuemap
� � � � � � � � � � � � � 0 1 2 3 4 5 6 7 8 9 10 11 12 Transportable H
� � �� boolean VolumeName
(
� S � �� string � O � � � � � | � Create % - ��5 ��B �� static implemented constructor � ae442007200009F ROOT\CIMV2 ���� � �3 �� � P * � ���� � � __PARAMETERS abstract Volume string
� 2 in
� 2 Y �� ID )
� � Y ��� string Context string
� � ClientAccessible in
� � �� ID )
� � ��L string __ �� ae442007200009F ROOT\CIMV2 ���� � �� �� � * � ��������J � __PARAMETERS abstract ShadowID string
� 4 out
� 4 [ �� ID )
� � [ ��� string ReturnValue uint32
� uint32 out
� �� __ � Revert � �� implemented ae442007200009F ROOT\CIMV2 ���� � �� �� * � ��� � __PARAMETERS abstract ForceDismount boolean
� 9 in
� 9 a �� ID )
� � a ��� boolean __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � :ѝ��C�� " 4 �� � �� � " 3 ; K } � � � ; F x � U���������������������������������� � Win32_ShadowStorage Association MSVSS__PROVIDER Locale AllocatedSpace
� u � �� uint64 DiffVolume f A
� � � ��� � � �� ref:Win32_Volume min max MaxSpace '
� 3 � �� � �� uint64 UsedSpace
� p � �� uint64 Volume f A
� � � ��� � � �� ref:Win32_Volume min max � O W � � Create % - ��5 ��B �� static implemented constructor ae442007200009F ROOT\CIMV2 ���� � �� �� � A � � * � ����������������4 � __PARAMETERS abstract Volume string
� 2 in
� 2 Y �� ID )
� � Y ��� string DiffVolume string
� � in
� � �� ID )
� x ��= string MaxSpace uint64
� � in
� � � �� ID )
� , � ��� UINT64 __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � C I M _ D e p e n d e n c y ;ѝ��C�� CIM_Dependency ) � �� � ! ) 5 � � U��������g � Win32_ShadowBy MSVSS__PROVIDER Locale Antecedent f@ N
� � � �� � ��� � � � ref:Win32_ShadowProvider min max override Antecedent Dependent f@ N
� 2 � �� � ��H M R \ ref:Win32_ShadowCopy min max override Dependent ov � C I M _ D e p e n d e n c y <ѝ��C�� CIM_Dependency ) � �� � " * 6 � � U��������` � Win32_ShadowFor MSVSS__PROVIDER Locale Antecedent f@ N
� � � �� � ��� � � � ref:Win32_Volume min max override Antecedent Dependent f@ N
� + � �� � ��A F K U ref:Win32_ShadowCopy min max override Dependent re � R S O P _ P o l i c y S e t t i n g �ҝ��C�� " RSOP_PolicySetting " I Q �^��������� � � ������������x � RSOP_SecuritySettings ErrorCode
� A uint32 Status
� p uint32 � �%��� �
�qFTv � ָ�( � 9$�� r F.cQ �6� X � ZU� � �@�� � C I M _ L o g i c a l E l e m e n t �Н��C� CIM_LogicalElement d � �� � ��, 6 > ��N X h ��x � � e k � � � wW������������������������������3 � Win32_DfsNode DFSProvider SupportsCreate CreateBy Create SupportsDelete DeleteBy DeleteInstance SupportsUpdate Locale Description @ )
� � � � � �� string Override The Description indicates a comment describing the node. Name @ )
� M U _ � �� string Override Name Root
� � boolean State
� � � � uint32 ValueMap � � � � 0 1 2 3 Timeout
� + � �� uint32 � y � � Create 2 : ��B ��O ��\ f Static Constructor Implemented ValueMap r u 0 .. � ae442007200009F ROOT\CIMV2 ���� � �5 �� M � * � � G � � U����������������< � __PARAMETERS abstract DfsEntryPath string
� 8 In
� 8 _ �� ID )
� � _ ��� string ServerName string
� � In
� � �� ID )
� ~ ��C string ShareName string
� � In
� � � �� ID )
� 3 � ��� string Description string
� Z In
� Z � �� Optional '
� Z � ��� �� ID 4
� 4 � ��� ��� string __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � C I M _ L o g i c a l E l e m e n t ���C�v ' CIM_LogicalElement d � �� ��! + 8 ��H R b �� � r � � � � > E �W�������������������������������������� � Win32_DfsTarget SupportsCreate CreateBy PutInstance SupportsDelete DeleteBy DeleteInstance SupportsUpdate DFSProvider Locale LinkName
� � � �� string ServerName
� � � �� string ShareName
� 6 � �� string State
� q y � uint32 BitMap � � � 0 1 2 � C I M _ D e p e n d e n c y ���C�� CIM_Dependency ) � �� � " * 6 � � U�������� � Win32_DfsNodeTarget DFSProvider Locale Antecedent f@ 6
� z � ��� � � ref:Win32_DfsTarget Override Antecedent Min Dependent f@ )
� � � � �� ref:Win32_DfsNode Override Dependent � C I M _ S e t t i n g ���C�D + CIM_Setting
A � �� � & ��6 > D j x � � [ b � � # @ U�����������������������������������������~ � Win32_QuotaSetting DskQuotaProvider SupportsUpdate Locale UUID 29013152-7F77-4A8A-A8BB-E1F24DECE9F7 DefaultLimit '
� � � �� � �� sint64 DefaultWarningLimit '
� � � �� � �� sint64 ExceededNotification $ '
� R � �� � �� boolean State 4
� � � �� � ��� � uint32 ValueMap � � � 0 1 2 VolumePath 2
� � �� � �� � �� string WarningExceededNotification & '
� u � �� � �� boolean � C I M _ E l e m e n t S e t t i n g ���C�� CIM_ElementSetting 6 � �� � , 4 : ` i � � e��������K � Win32_VolumeQuotaSetting DskQuotaProvider Locale UUID FA452BCE-5B4F-4A56-BF52-7C4533984706 Element f@ 4
� � � �� � ��� � ref:Win32_LogicalDisk Override Element Setting f@ 4
� � �� � ��8 B ref:Win32_QuotaSetting Override Setting tt �6 4 6 5 9 A B 9 F 8 F 1 C 4 B 5 6 8 D B 6 4 3 8 B A E 1 1 B 2 6 E E 8 F 9 3 C B 5 F 8 1 9 5 E 2 1 E 8 C 3 8 3 D 6 C 4 4 C C 4 1 xѝ��C�ȝ��C�2
� __NAMESPACE MicrosoftTpm ���C�� & ) � ��� � � � � I V � � � q U�������������������������������������9 � Win32_DiskQuota Description The Win32_DiskQuota association class tracks disk space usage for NTFS volumes. System administrators can configure Windows to prevent further disk space use and log an event when a user exceeds a specified disk space limit. They can also log an event when a user exceeds a specified disk space warning level. Note that disk quotas cannot be set for the Administrator accounts themselves. AMENDMENT LOCALE DiskSpaceUsed +
� � " uint64 Units bytes Description The DiskSpaceUsed property indicates the current number of bytes currently in use by this particular user or group. Limit +
� � � � � � uint64 Units bytes Description The Limit property indicates the limit set for this particular user or group. QuotaVolume f )
� � � ��� � ref:Win32_LogicalDisk Description The QuotaVolume reference represents the disk volume which has disk quotas. Status +
� ? G T � � uint32 Description A Status property indicates the current status of the Disk Quota. Values � � � OK Warning Exceeded User f )
� � �� # ref:Win32_Account Description The User reference represents the user account associated with a disk quota. WarningLimit +
� � � � � � uint64 Units bytes Description The WarningLimit property indicates the warning limit set for this particular user or group. � C I M _ D e p e n d e n c y ���C�� CIM_Dependency ) $ � ��� � � � � u��������J � Win32_ConnectionShare Description The Win32_ConnectionShare class represents an association between a shared resource on the computer and the connection made to the shared resource. AMENDMENT LOCALE Antecedent f@ )
� - � �� ref:Win32_Share Description The Antecedent property references the shared resource to which the connection was made. Dependent f@ )
� � � � � �� ref:Win32_ServerConnection Description The Dependent property references the connection that was made to the shared resource. LO � �softTpm 1���0 � �z� u C I M _ L o g i c a l D i s k �ɝ��C�� � CIM_LogicalDisk A � �� � ��- 5 ; c o � � * 6 � � f q � � � � * < o � � � u � � � � � ������_UUU������������������������������������������������������������������������������������������������������������������������������������������������������4 � Win32_LogicalDisk CIMWin32 SupportsUpdate Locale UUID {8502C4B7-5FBB-11D2-AAC1-006008C78BC7} Compressed l )
� � � ��� � boolean MappingStrings � Win32API|File System Functions|GetVolumeInformation|FS_VOL_IS_COMPRESSED DeviceID @ A
� j � �� � ��r | � � string Override DeviceId MappingStrings � WMI DriveType n )
� � � ��� � uint32 MappingStrings Win32API|FileFunctions|GetDriveType FileSystem r )
� m � ��u � string MappingStrings � Win32API|File System Functions|GetVolumeInformation MaximumComponentLength v )
� � �� ) uint32 MappingStrings 1 Win32API|File System Functions|GetVolumeInformation MediaType " � )
� � � ��� � uint32 MappingStrings � Win32API|Device Input and Output Functions|DeviceIoControl ProviderName z )
� I � ��Q a string MappingStrings i Win32API|Windows Networking Functions|WNetGetConnection QuotasDisabled $ �
� � � �� boolean QuotasIncomplete % �
� ! � �� boolean QuotasRebuilding & �
� f � �� boolean SupportsDiskQuotas # �
� � � �� boolean SupportsFileBasedCompression ~ )
� � �� $ boolean MappingStrings , Win32API|File System Functions|GetVolumeInformation|FS_FILE_COMPRESSION VolumeDirty ' � )
� � � ��� � boolean MappingStrings � FSCTL_IS_VOLUME_DIRTY VolumeName � 4
� ? � �� � ��G W string MappingStrings _ Win32API|File System Functions|GetVolumeInformation VolumeSerialNumber ! � )
� � � ��� � string MappingStrings � Win32API|File System Functions|GetVolumeInformation � m % �
�
� � � � Chkdsk $ ��1 A Implemented MappingStrings I Fmifs.dll | Method ChkDskExRoutine � ae442007200009F ROOT\CIMV2 ���� � �a �� * � ^ � � C � � � O ���� � � __PARAMETERS abstract FixErrors boolean
� 5 in
� 5 ] �� ID )
� � ] ��� boolean VigorousIndexCheck boolean
� � in
� � �� ID )
� � ��K boolean SkipFolderCycle boolean
� � in
� � � �� ID )
� C � �� boolean ForceDismount boolean
� m in
� m � �� ID )
� � � ��� boolean RecoverBadSectors boolean
� , in
� , T �� ID )
� � T ��� boolean
OkToRunAtBootUp boolean
� � in
� � �� ID
)
� z ��? boolean __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � ScheduleAutoChk ' �
���
���
�
Static Implemented MappingStrings Chkntfs.exe ae442007200009F ROOT\CIMV2 ���� � �� �� * � ����� � __PARAMETERS abstract LogicalDisk string
� 7 in
� 7 ^ �� ID )
� � ^ ��� string __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � ExcludeFromAutochk ' � ��� ��� � Static Implemented MappingStrings Chkntfs.exe ae442007200009F ROOT\CIMV2 ���� � �� �� * � ����� � __PARAMETERS abstract LogicalDisk string
� 7 in
� 7 ^ �� ID )
� � ^ ��� string __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � C I M _ A l l o c a t e d R e s o u r c e �ɝ��C�3 CIM_AllocatedResource 6 � �� � & . 4 Z f U��������� � Win32_PNPAllocatedResource CIMWin32 Locale UUID 970C0998-41FE-4275-B7D9-7DABAD3FBC4D Antecedent f@ 6
� � � ��� � � � ref:CIM_SystemResource Override Antecedent MappingStrings � CIM|CIM_SystemResource Dependent f@ 6
� W � ��l v � � ref:Win32_PNPEntity Override Dependent MappingStrings � CIM|CIM_LogicalDevice Al � �!E�� x ���( �:9G )q->S pU �Z y��b ] �P�j� � 9��� @ a�� � ��k�� � 5 7 E 5 F 3 A D D 9 E 2 4 2 C 4 E 9 F 9 E D F 7 9 A A 9 7 F 7 9 E 7 9 1 1 C 5 A 8 B 9 0 2 E C 1 5 0 D 6 4 4 2 E 3 B 8 5 A 5 A A &ӝ��C�ȝ��C�� ���j 9 � � __Win32Provider {D7C3453E-1F1C-48CD-AFE6-CFF2A937D337} NetworkServiceHost:[ReliabilityMetricsProvider] ReliabilityMetricsProvider E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C 'ӝ��C� ȝ��C�� � �� �� b � __InstanceProviderRegistration \\.\ROOT\CIMV2:__Win32Provider.Name="ReliabilityMetricsProvider"
R O O T \ C I M V 2 _ _ I n s t a n c e P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 6 8 5 7 7 3 7 2 C 6 6 A 7 B 2 0 6 5 8 4 8 7 F B D 9 5 9 A A 1 5 4 E F 5 4 B 5 F 9 3 5 D C C 5 6 6 3 E 9 2 2 8 B 4 4 3 2 2 8 0 5 \ K I _ E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C \ I _ 3 0 2 1 5 9 D D 4 3 7 D F 3 1 C 3 4 4 7 7 4 0 E 0 D 6 6 6 1 7 7 5 6 B B 4 0 F B E 8 4 0 8 7 8 8 6 8 5 1 0 D 2 2 B 9 C A 0 6 1 8 7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D (ӝ��C�
ȝ��C�w ` � __MethodProviderRegistration \\.\ROOT\CIMV2:__Win32Provider.Name="ReliabilityMetricsProvider"
R O O T \ C I M V 2 _ _ M e t h o d P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 6 8 5 7 7 3 7 2 C 6 6 A 7 B 2 0 6 5 8 4 8 7 F B D 9 5 9 A A 1 5 4 E F 5 4 B 5 F 9 3 5 D C C 5 6 6 3 E 9 2 2 8 B 4 4 3 2 2 8 0 5 \ K I _ 7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D \ I _ 3 0 2 1 5 9 D D 4 3 7 D F 3 1 C 3 4 4 7 7 4 0 E 0 D 6 6 6 1 7 7 5 6 B B 4 0 F B E 8 4 0 8 7 8 8 6 8 5 1 0 D 2 2 B 9 C A 0 6 1 8 3 d 9 b )ӝ��C�E �� � Win32_Reliability Abstract il � W i n 3 2 _ R e l i a b i l i t y *ӝ��C�M Win32_Reliability ) � �� � # ? G Q e � � � � 2 d s U�������������������������� � Win32_ReliabilityStabilityMetrics ReliabilityMetricsProvider locale MS\0x409 EndMeasurementDate e
� � � �� datetime RelID
� � � �� string StartMeasurementDate e
� � �� datetime SystemStabilityIndex
� \ � �� real64 TimeGenerated e '
� � � �� � �� datetime ` ? C < � GetRecordCount * ��7 �� Implemented Static � ae442007200009F ROOT\CIMV2 ���� � �� �� * � � # ��������M � __PARAMETERS abstract RecordCount uint32
� 7 OUT
� 7 ^ �� ID )
� � ^ ��� uint32 ReturnValue uint32
� uint32 out
� �� __ � W i n 3 2 _ R e l i a b i l i t y +ӝ��C�� + Win32_Reliability ) � �� � 6 >
H V � � � � U ^ � � � � & X g � � UU������������������������������������������ � Win32_ReliabilityRecords ReliabilityMetricsProvider locale MS\0x409 ComputerName
� � � �� string EventIdentifier
� � � �� uint32 InsertionStrings $
� � �� string Logfile '
� M � �� � �� string Message
� � � �� string ProductName
� � � �� string RecordNumber '
� � �� � �� uint32 SourceName
� P � �� string TimeGenerated e '
� � � �� � �� datetime User
� � � �� string ` ? C < � GetRecordCount * ��7 �� Implemented Static � ae442007200009F ROOT\CIMV2 ���� � �� �� * � � # ��������M � __PARAMETERS abstract RecordCount uint32
� 7 OUT
� 7 ^ �� ID )
� � ^ ��� uint32 ReturnValue uint32
� uint32 out
� �� __ � 8ӝ��C�� N �� ! � �� � I R _ u � � � $ 8 � � - � � F T c | 3 E UU����������������������������� � MSiSCSI_RADIUSConfig WMI guid {8EAEF9D8-C053-49d3-9205-65C703C2ECC1} wmiprov DisplayName Radius Configuration cpp_quote //
// This class is required if adapter supports using RADIUS for CHAP authentication.
//
// This class exposes the configuration capabilities if the adapter able to
// use radius to perform CHAP authentication. Using RADIUS is encouraged
// since it allows centralized management of CHAP credentials.
//
// This class uses PDO instance names with a single instance.
//
Active
� boolean BackupRADIUSServer
A
� � � � �� � ��� � object:ISCSI_IP_Address WmiDataId description Fixed address of backup RADIUS server InstanceName
� � �� string RADIUSServer
A
� | � � �� � ��� � object:ISCSI_IP_Address WmiDataId description Fixed address of primary RADIUS server Reserved +
� + 8 uint32 WmiDataId Description Must be zero SharedSecret N
� � � � �� � ��� � � � uint8 WmiDataId WmiSizeIs SharedSecretSizeInBytes description Shared secret for communicating with primary and backup RADIUS servers. This field is a variable length array. SharedSecretSizeInBytes A
� � � � �� � ��� � uint32 WmiDataId description Size in bytes of shared secret used to communicate with RADIUS servers UseRADIUSForCHAP A
� � � � �� � ��� � boolean WmiDataId description TRUE if adapter should use RADIUS for CHAP authentication g � /ӝ��C�� ' �� 1 7 _ l � � U��������+ � ISCSI_TargetPortalGroup WMI WmiGenerateHeader guid {3081F2A5-95F5-4d2a-813D-EE59864C6FC5} PortalCount
� � � uint32 WmiDataId Portals
+
� � object:ISCSI_TargetPortal WmiDataId WmiSizeIs PortalCount � � � � �� � ��� � boolean WmiDataId description TRUE if adapter should use RADIUS for CHAP authentication g � �M F D 3 B B D 4 C 4 2 A C 2 F 7 F E F 2 6 4 3 4 0 A 9 E B 7 8 A 5 8 1 F E 5 C 2 8 5 6 1 C B 6 3 E D F 7 8 0 B 3 2 9 E A C 2 E E 4 ��b��5��͝��C�%M + n &J -J GJ dJ �L � MSFT_CliAlias � F N u � � � � �
U�������������������������4 � MSFT_CliConnection Authority
� > STRING Locale
� m STRING NameSpace
� � STRING Password
� � STRING Server
� � STRING User
� , STRING | � & ) � MSFT_CliConnection ms_409 ROOT\cli . This provides access to the aliases available on the local system � < �) �E � �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � q � MSFT_CliFormat LIST FULL @ y � _ X
] � L 5 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � h t � MSFT_CliProperty Connection The Connection object defines parameters required when connecting to WMI Connection + 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � ] j � MSFT_CliProperty Description The Description property provides a description of the alias Description � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier y � � � � MSFT_CliProperty Formats The elements of the Formats array define lists of properties to be shown for this alias. This is a list of lists indexed by the format name (for example FULL, BRIEF, INSTANCE or a user defined qualifier). Formats � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � & 4 � MSFT_CliProperty FriendlyName The FriendlyName string provides the name for the alias. The name will be unique in the context of the namespace in which the alias is defined. Note CLASS, QUERY, PATH and RESTORE cannot be used as alias names as they appear in the same location in the syntax. FriendlyName 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � 8 @ � MSFT_CliProperty PWhere The PWhere property defines a from/where clause (i.e. a WQL query without the Select clause). The query string may contain substitution parameters (tokens preceded by a '#' mark) indicating where values may be substituted into the query string. The parameter values are taken from the tokens immediately after the alias if the token cannot be resolved to a switch or verb - this allows for example a command such as 'w KillProcess 154' where the PWhere value for the KillProcess alias would be 'From Win32_process Where ProcessId = #ProcId' PWhere 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � G S � MSFT_CliProperty Qualifiers The qualifiers applicable to this Alias Qualifiers � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � � MSFT_CliProperty Target The Target string defines the object to be operated on through the Alias. The string may be a simple class name or a WQL query. If the Target property is empty only verbs based on commandline utilities may be used by the alias Target ! 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � Y ` � MSFT_CliProperty Verbs The Verbs array is the list of verbs supported for this alias. Verbs � �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � oJ3
�P K �y=-� � ��;� � �3n" x
C I M _ T a p e D r i v e �ɝ��C� � CIM_TapeDrive 6 � �� � # ) Q ^ � � � H V � � � " � � ��������UU��������������������������������������������������������������������������������������������������������������������������������������������������������������������� � Win32_TapeDrive CIMWin32 Locale UUID {8502C4B1-5FBB-11D2-AAC1-006008C78BC7} Compression � )
� � � ��� � uint32 MappingStrings � Win32API|Tape Backup Structures|TAPE_GET_DRIVE_PARAMETERS|Compression DeviceID @ A
� U � �� � ��] g q � string Override DeviceId MappingStrings � Win32API|File Functions|CreateFile ECC ! � )
� � � ��� uint32 MappingStrings Win32API|Tape Backup Structures|TAPE_GET_DRIVE_PARAMETERS|ECC FeaturesHigh " � )
� � � ��� � uint32 MappingStrings � Win32API|Tape Backup Structures|TAPE_GET_DRIVE_PARAMETERS|FeaturesHigh FeaturesLow # � )
� 9 � ��A Q uint32 MappingStrings Y Win32API|Tape Backup Structures|TAPE_GET_DRIVE_PARAMETERS|FeaturesLow Id & � )
� � � ��� � string MappingStrings � Win32API|File Functions Manufacturer ' � )
� Y � ��a q string MappingStrings y Win32Registry MediaType $ � )
� � � ��� � string MappingStrings � Win32_TapeDrive|MediaType|Tape Drive ReportSetMarks % � )
� W � ��_ o uint32 MappingStrings w Win32API|Tape Backup Structures|TAPE_GET_DRIVE_PARAMETERS|ReportSetmarks �
C I M _ D i s k D r i v e �ɝ��C�� � CIM_DiskDrive 6 � �� � # ) Q a � � Z a � � � � � B M ] d J V
� � K U � � �
�
L Z � � U
e
� � a n % �������WUUUU������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������� � Win32_DiskDrive CIMWin32 Locale UUID {8502C4B2-5FBB-11D2-AAC1-006008C78BC7} BytesPerSector x )
� � � ��� � uint32 MappingStrings � Win32API|Device Input and Output Structures|DISK_GEOMETRY|BytesPerSector DeviceID @ A
� [ � �� � ��c m w � string Override DeviceId MappingStrings � WMI FirmwareRevision 2 � )
� � � ��� � string MappingStrings � Win32API|Device Input and Output Structures|STORAGE_DEVICE_DESCRIPTOR|ProductRevisionOffset Index & � )
� � � ��� � uint32 MappingStrings � Win32API|Windows 95/98 Functions|DRIVE_MAP_INFObtInt13Unit InterfaceType | )
� : � ��B R string MappingStrings Z Win32API|Device Input and Output Functions|DeviceIoControl Manufacturer ' � )
� � � ��� � string MappingStrings � q Win32Registry|HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\Scsi\Scsi Port\Scsi Bus\Target Id\Logical Unit Id\Identifier Win32Registry|Manufacturer MediaLoaded ( � )
� � � ��� � boolean MappingStrings � Win32API|Device Input and Output Structures|DISK_GEOMETRY|MediaType|FixedMedia MediaType ) � 6
� � � ��� � � string MappingStrings � Win32API|Device Input and Output Structures|DISK_GEOMETRY|MediaType ValueMap 3 J Removable media other than floppy Fixed hard disk media Format is unknown Model * � )
� � � ��� � string MappingStrings � 1 Win32Registry|HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\Scsi\Scsi Port\Scsi Bus\Target Id\Logical Unit Id\Identifier Win32Registry|ProductId Partitions � )
� � � ��� � uint32 MappingStrings � Win32API|Device Input and Output Structures|PARTITION_INFORMATION|RecognizedPartition SCSIBus + � )
� D � ��L \ uint32 MappingStrings d Win32API|Device Input and Output Structures|SCSI_ADDRESS|PathId SCSILogicalUnit , � )
� � � ��� uint16 MappingStrings
Win32API|Device Input and Output Structures|SCSI_ADDRESS|Lun SCSIPort - � )
� � � ��� � uint16 MappingStrings � Win32API|Device Input and Output Structures|SCSI_ADDRESS|PortNumber SCSITargetId . � )
� 6
� ��>
N
uint16 MappingStrings V
Win32API|Device Input and Output Structures|SCSI_ADDRESS|TargetId SectorsPerTrack � )
� �
� ���
�
uint32 MappingStrings Win32API|Device Input and Output Structures|DISK_GEOMETRY|SectorsPerTrack SerialNumber 1 � )
� � � ��� � string MappingStrings � Win32API|Device Input and Output Structures|STORAGE_DEVICE_DESCRIPTOR|SerialNumberOffset Signature 0 � )
� M � ��U e uint32 MappingStrings m Win32API|Device Input and Output Structures|DRIVE_LAYOUT_INFORMATION|Signature Size / � )
� � � ��
uint64 MappingStrings
Win32API|Device Input and Output Structures|DISK_GEOMETRY TotalCylinders ! � )
� �
� ���
�
uint64 MappingStrings �
Win32API|Device Input and Output Structures|DISK_GEOMETRY|Cylinders TotalHeads " � )
� D � ��L \ uint32 MappingStrings d Win32API|Device Input and Output Structures|DISK_GEOMETRY|TracksPerCylinder TotalSectors # � )
� � � ��� uint64 MappingStrings Win32API|Device Input and Output Structures|DISK_GEOMETRY|SectorsPerTrack TotalTracks $ � )
� � � ��� � uint64 MappingStrings � Win32API|Device Input and Output Structures|DISK_GEOMETRY|TracksPerCylinder TracksPerCylinder % � )
� \ � ��d t uint32 MappingStrings | Win32API|Device Input and Output Structures|DISK_GEOMETRY|TracksPerCylinder � C I M _ V i d e o S e t t i n g �ɝ��C�U CIM_VideoSetting 6 � �� � ' - U ^ e��������� � Win32_VideoSettings CIMWin32 Locale UUID {1008CCEE-7BFF-11D2-AAD2-006008C78BC7} Element f@ A
� � � �� � ��� � � � ref:Win32_VideoController Override Element MappingStrings � WMI|Win32_VideoController Setting f@ A
� f � �� � ��� � � � ref:CIM_VideoControllerResolution Override Setting MappingStrings � CIM|CIM_VideoControllerResolution D2 � C I M _ D e p e n d e n c y �ɝ��C�D CIM_Dependency A �� � �� � % / 7 = e q U��������� � Win32_AllocatedResource DEPRECATED CIMWin32 Locale UUID {8502C50D-5FBB-11D2-AAC1-006008C78BC7} Antecedent f@ 6
� � � ��� � � � ref:CIM_SystemResource Override Antecedent MappingStrings � CIM|CIM_SystemResource Dependent f@ 6
� b � ��y � � � ref:CIM_LogicalDevice Override Dependent MappingStrings � CIM|CIM_LogicalDevice � �v� ,�� � !,_Y� � J��uR � ��^ AY� � S" m� � C I M _ C o m p u t e r S y s t e m zȝ��C�� > CIM_ComputerSystem ) ��% - 3 [ l � � � � x � � � ��_U����������������������������������������������������������� � CIM_UnitaryComputerSystem Abstract Locale UUID {8502C526-5FBB-11D2-AAC1-006008C78BC7} InitialLoadInfo
(
� � � �� string LastLoadInfo ,
� � � �� string PowerManagementCapabilities
2 )
� 2 � ��: J uint16 MappingStrings R MIF.DMTF|System Power Controls|001.2 PowerManagementSupported 0
� � � �� boolean PowerState 6
� � � �� uint16 ResetCapability 8 6
� X � ��` j � � uint16 ValueMap � � � � � 1 2 3 4 5 MappingStrings � MIF.DMTF|System Hardware Security|001.4 T � 0 � SetPowerState � ae442007200009F ROOT\CIMV2 ���� � �I �� * j � ������ � __PARAMETERS abstract PowerState uint16
� 6 IN
� 6 ] �� � � � � � � � � 1 2 3 4 5 6 7 8 ValueMap )
� 6 ] ��� � ID 6
� P ] ��� � uint16 e Time datetime e
� p IN e
� p � �� ID e )
� � ��� datetime __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � C I M _ L o g i c a l E l e m e n t {ȝ��C�z ) CIM_LogicalElement )
�� % M ` � � B M � � K W W���������������������������������������� � CIM_Service Abstract Locale UUID {8502C527-5FBB-11D2-AAC1-006008C78BC7} CreationClassName '
� � � �� � �� string CIM_Key Name @ 4
� � � ��� � �� string Override Name Started
� 9 � �� boolean StartMode )
� � � � � �� string ValueMap � � Automatic Manual SystemCreationClassName 4
� $ B �� � �� string Propagated CIM_System.CreationClassName CIM_Key SystemName " 4
� � � � � �� � �� string Propagated CIM_System.Name CIM_Key a � � � � % � StartService y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � StopService y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � C I M _ S e r v i c e |ȝ��C�� ) CIM_Service
) ��! ) / �����������������������������������������W � CIM_ClusteringService Abstract Locale UUID {debac832-6b54-4add-8a62-8d3861b97b1d} �
� ; F J � x � AddNode � ae442007200009F ROOT\CIMV2 ���� � �Z �� * � ����� � __PARAMETERS abstract f CS ref f
� . IN f
� . R �� ID f )
� � R ��� ref:CIM_ComputerSystem __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � EvictNode � ae442007200009F ROOT\CIMV2 ���� � �Z �� * � ����� � __PARAMETERS abstract f CS ref f
� . IN f
� . R �� ID f )
� � R ��� ref:CIM_ComputerSystem __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � C I M _ L o g i c a l E l e m e n t }ȝ��C�t ' CIM_LogicalElement ) & N �� X k � � ; T � � w } W�������������������������������������� � CIM_ServiceAccessPoint Locale UUID {F126ACC2-E3D4-11d2-8601-0000F8102E5F} Abstract CreationClassName 4
� � � ��� � �� string CIM_Key MaxLen Name @ A
� � ��# - � ��3 string Override Name MaxLen SystemCreationClassName A
� � � � � ��� � �� string Propagated CIM_System.CreationClassName CIM_Key MaxLen SystemName A
� A I U f ��o � �� string Propagated CIM_System.Name CIM_Key MaxLen Type )
� � � ��� � uint32 Schema Win32 � C I M _ S e r v i c e A c c e s s P o i n t ~ȝ��C�� ' CIM_ServiceAccessPoint ) �� % + ���������������������������������������S � CIM_ClusteringSAP Abstract Locale UUID {2bb2b772-ffed-4aa6-b1b3-3d0cb74fc613} � C I M _ A s s o c i a t e d M e m o r y �ȝ��C�~
CIM_AssociatedMemory ) ��) 1 7 _ i � � W������������ � CIM_AssociatedProcessorMemory abstract Locale UUID {464FFAB1-946F-11d2-AAE2-006008C78BC7} BusSpeed
� � � �� uint32 Dependent f@ )
� � � ��� � ref:CIM_Processor Override Dependent � W i n 3 2 _ P n P D e v i c e P r o p e r t y �ɝ��C�� ! Win32_PnPDeviceProperty % ����������������������W � Win32_PnPDevicePropertyUint32 Data
� O � �� Uint32 � �I��� � �G� � � ce
� �u� p L!ӡ� R �:, � H ,�ZT# > ��9�a q �N��� � �M� � ��r" $ �lH�F V���G I �ڝ��C�� 6 % � �� � - E � SDNDiagnostics ClassVersion 1.0.0 locale SDNDiagnosticsProvider # � iag 7 g 1 @ D � nos � , 0 �
� Enable " ��/ �� implemented static , ae442007200009F ROOT\Microsoft\Windows\SDNDiagnostics\Server ���� � �� �� * � ����N � __PARAMETERS abstract
DiagnosticInformation object
� A In
� A h �� DiagnosticInfo EmbeddedInstance
)
� A h ��� � ID
6
� 7 h ��� � � object:DiagnosticInfo __ �� ae442007200009F ROOT\Microsoft\Windows\SDNDiagnostics\Server ���� � �( �� � N * � � � ���������� � __PARAMETERS abstract ErrorCode uint32
� 5 Out
� 5 \ �� ID )
� � \ ��� uint32 ChangeInErrorCode boolean
� � Out
� � �� ID )
� � ��J boolean ReturnValue uint32
� � uint32 out
� � � �� __ � Disable + ��8 �� implemented static � ae442007200009F ROOT\Microsoft\Windows\SDNDiagnostics\Server ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � UpdateTraceProvidersList ��$ �� implemented static � ae442007200009F ROOT\Microsoft\Windows\SDNDiagnostics\Server ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ �6 4 6 5 9 A B 9 F 8 F 1 C 4 B 5 6 8 D B 6 4 3 8 B A E 1 1 B 2 6 E E 8 F 9 3 C B 5 F 8 1 9 5 E 2 1 E 8 C 3 8 3 D 6 C 4 4 C C 4 1 �ڝ��C�ȝ��C�2
� __NAMESPACE Powershellv3 F D 1 C 1 D 4 1 4 B 7 1 B 5 0 8 2 C 2 6 6 A 6 5 0 E 3 1 E F 6 D 5 0 1 9 3 8 2 7 2 4 2 4 4 B 6 8 5 F 2 1 7 C 0 A A E 0 0 A 9 2 1 �ڝ��C�Cȝ��C�$ � __SystemSecurity 4 1 C 5 3 E 6 D B 1 A C F 2 4 5 3 C E F D 4 1 3 9 8 1 9 8 E 6 1 3 F 1 0 D F F 4 7 7 0 9 E C A B 1 D 7 F 0 3 7 7 5 6 A C 8 C E 7 �ڝ��C�ȝ��C�� � � __thisNAMESPACE � �� � � ? 5 7 E 5 F 3 A D D 9 E 2 4 2 C 4 E 9 F 9 E D F 7 9 A A 9 7 F 7 9 E 7 9 1 1 C 5 A 8 B 9 0 2 E C 1 5 0 D 6 4 4 2 E 3 B 8 5 A 5 A A �ڝ��C�ȝ��C�� �����M @ 9 ` � __Win32Provider {442FF639-3DA0-4A70-A1D8-579E26C46A60} NetworkServiceHost DiscoveryProvider E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C �ڝ��C� ȝ��C�� � ��������r � � __InstanceProviderRegistration \\.\root\Microsoft\Windows\Powershellv3:__Win32Provider.Name="DiscoveryProvider" z WQL:UnarySelect # R O O T \ M i c r o s o f t \ W i n d o w s \ P o w e r s h e l l v 3 _ _ I n s t a n c e P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ A 7 9 5 D 8 8 4 5 7 0 9 3 3 2 6 0 7 D F F B B 7 F 0 0 2 D E 0 4 E 0 9 9 7 E 4 0 9 B E 3 1 D 5 B A 9 F F 0 5 A 1 F 3 F C 9 0 6 8 \ K I _ E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C \ I _ 6 6 E 6 C B 7 6 E 1 C B B 5 C 5 C 1 4 C A A 8 D 9 0 D A 0 C E C 8 4 C 6 E F A 9 E 1 F D A 7 4 3 B 2 C 6 6 9 9 7 6 1 3 0 E 2 6 0 �ڝ��C�Y 4 �� ��' 7 P X d � � U��������� � CIM_Dependency Association Abstract UMLPackagePath CIM::Core::CoreElements locale Antecedent f
� � � �� ref:CIM_ManagedElement Dependent f
� � � �� ref:CIM_ManagedElement :: � �ڝ��C�� ) �� . G O X � � � � � U����������������/ � CIM_ManagedElement Abstract UMLPackagePath CIM::Core::CoreElements locale Caption
� � � @ string MaxLen Description
� � string ElementName
� � string InstanceID
� ' string � C I M _ M a n a g e d E l e m e n t �ڝ��C�Z CIM_ManagedElement C 4 B I � �� � Q d p � � ' N Z ���������������������������� � PS_Module UMLPackagePath CIM::Core::CoreElements ClassVersion 1.0.0 locale DiscoveryProvider InstanceID @ )
� � � ��� � string Override instanceID moduleManifestFileData
� �� uint8 Octetstring ModuleName
� F string moduleType
� � � � uint16 ValueMap � � 0 1 � C I M _ M a n a g e d E l e m e n t �ڝ��C�� CIM_ManagedElement C 8 F M � �� � U h r � � � � ��������������������������B � PS_ModuleFile UMLPackagePath CIM::Core::CoreElements ClassVersion 1.0.0 locale DiscoveryProvider FileData
� � � �� uint8 Octetstring FileName
� � string InstanceID @ )
� $ � ��, 6 string Override instanceID � C I M _ D e p e n d e n c y �ڝ��C�� CIM_Dependency N ' @ ��M [ b � �� � j } � � � U��������9 � PS_ModuleToModuleFile UMLPackagePath CIM::Core::CoreElements Association ClassVersion 1.0.0 locale DiscoveryProvider Antecedent f@
� � � � ref:PS_Module Override Antecedent Dependent f@
� $ . ref:PS_ModuleFile Override Dependent � �5 7 E 5 F 3 A D D 9 E 2 4 2 C 4 E 9 F 9 E D F 7 9 A A 9 7 F 7 9 E 7 9 1 1 C 5 A 8 B 9 0 2 E C 1 5 0 D 6 4 4 2 E 3 B 8 5 A 5 A A �ڝ��C�ȝ��C�� �����K @ 9 W � __Win32Provider {F9E7E51B-800C-4AE5-A662-E90BB01156E7} LocalServiceHost PlatIdProv �
C I M _ P o t s M o d e m ʝ��C�� 5 CIM_PotsModem 6 � �� � # ) - Q ] � � � � 3 G � � � � ? T � � p y
� � D P Z f � � d
t
" � � m ~
-
�
�
> E � � { � $ 4 � � � � � � > J � � � � # * � � m ~ + � � q � ! 4 � � � � 6 D � � | � ( ���������UUUUUUUUUUU�������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������� � Win32_POTSModem CIMWin32 Locale UUID {8502C4BE-5FBB-11D2-AAC1-006008C78BC7} AttachedTo $ q )
� � � ��� � string MappingStrings � Win32Registry|SYSTEM\CurrentControlSet\Control\Class|AttachedTo BlindOff % u )
� 6 � ��> N string MappingStrings V Win32Registry|SYSTEM\CurrentControlSet\Control\Class|BlindOff BlindOn & y )
� � � ��� � string MappingStrings � Win32Registry|SYSTEM\CurrentControlSet\Control\Class|BlindOn CompatibilityFlags ' } )
� ~ � ��� � string MappingStrings � Win32Registry|SYSTEM\CurrentControlSet\Control\Class|CompatibilityFlags CompressionOff ( � )
� . � ��6 F string MappingStrings N Win32Registry|SYSTEM\CurrentControlSet\Control\Class|Compression_Off CompressionOn ) � )
� � � ��� � string MappingStrings � Win32Registry|SYSTEM\CurrentControlSet\Control\Class|Compression_On ConfigurationDialog * � )
� � � ��� � string MappingStrings � Win32Registry|SYSTEM\CurrentControlSet\Control\Class|ConfigDialog DCB + � )
� * � ��1 A uint8 MappingStrings I Win32API|Communication Structures|DCB Default , � )
� � � ��� � uint8 MappingStrings � Win32Registry|SYSTEM\CurrentControlSet\Control\Class|Default DeviceID @ A
� f � �� � ��n x � � string Override DeviceId MappingStrings � WMI DeviceLoader - � )
� � � ��� � string MappingStrings Win32Registry|SYSTEM\CurrentControlSet\Control\Class|DevLoader DeviceType . � 6
� � � ��� � � � string MappingStrings � Win32Registry|SYSTEM\CurrentControlSet\Control\Class|DeviceType ValueMap # 3 C Q Null Modem Internal Modem External Modem PCMCIA Modem Unknown DriverDate e / � )
� � � ��� � datetime MappingStrings � Win32Registry|SYSTEM\CurrentControlSet\Control\Class|DriverDate ErrorControlForced 0 � )
� K � ��S c string MappingStrings k Win32Registry|SYSTEM\CurrentControlSet\Control\Class|ErrorControl_Forced ErrorControlOff 1 � )
� � � ��
string MappingStrings
Win32Registry|SYSTEM\CurrentControlSet\Control\Class|ErrorControl_Off ErrorControlOn 2 � )
� �
� ���
�
string MappingStrings �
Win32Registry|SYSTEM\CurrentControlSet\Control\Class|ErrorControl_On FlowControlHard 3 � )
� Y � ��a q string MappingStrings y Win32Registry|SYSTEM\CurrentControlSet\Control\Class|FlowControl_Hard FlowControlOff 5 � )
� � �� string MappingStrings ' Win32Registry|SYSTEM\CurrentControlSet\Control\Class|FlowControl_Off FlowControlSoft 4 � )
� � � ��� � string MappingStrings � Win32Registry|SYSTEM\CurrentControlSet\Control\Class|FlowControl_Soft InactivityScale 6 � )
� d
� ��l
|
string MappingStrings �
Win32Registry|SYSTEM\CurrentControlSet\Control\Class|InactivityScale Index 7 �
� �
� �� uint32 IndexEx 8 �
� 6 � �� string Model 9 � )
� | � ��� � string MappingStrings � Win32Registry|SYSTEM\CurrentControlSet\Control\Class|Model ModemInfPath : � )
� � ��% 5 string MappingStrings = Win32Registry|SYSTEM\CurrentControlSet\Control\Class|InfPath ModemInfSection ; � )
� � � ��� � string MappingStrings � Win32Registry|SYSTEM\CurrentControlSet\Control\Class|InfSection ModulationBell < � )
� k � ��s � string MappingStrings � Win32Registry|SYSTEM\CurrentControlSet\Control\Class|Modulation_Bell ModulationCCITT = � )
� � ��! 1 string MappingStrings 9 Win32Registry|SYSTEM\CurrentControlSet\Control\Class|Modulation_CCITT PortSubClass > � C
� � � ��� � B I | � string MappingStrings � Win32Registry|SYSTEM\CurrentControlSet\Control\Class|PortSubClass Value Y h u Parallel Port Serial Port Modem ValueMap � � � 00 01 02 Prefix ? � )
� � � ��� � string MappingStrings Win32Registry|SYSTEM\CurrentControlSet\Control\Class|Prefix Properties @ � )
� � � ��� � uint8 MappingStrings � Win32Registry|SYSTEM\CurrentControlSet\Control\Class|Properties ProviderName A � )
� & � ��. > string MappingStrings F Win32Registry|SYSTEM\CurrentControlSet\Control\Class|ProviderName Pulse B � )
� � � ��� � string MappingStrings � Win32Registry|SYSTEM\CurrentControlSet\Control\Class|Pulse Reset C � )
� a � ��i y string MappingStrings � Win32Registry|SYSTEM\CurrentControlSet\Control\Class|Reset ResponsesKeyName D � )
� � �� string MappingStrings & Win32Registry|SYSTEM\CurrentControlSet\Control\Class|ResponsesKeyName SpeakerModeDial E � )
� � � ��� � string MappingStrings � Win32Registry|SYSTEM\CurrentControlSet\Control\Class|SpeakerModeDial SpeakerModeOff F � )
� b � ��j z string MappingStrings � Win32Registry|SYSTEM\CurrentControlSet\Control\Class|SpeakerModeOff SpeakerModeOn G � )
�
� �� % string MappingStrings - Win32Registry|SYSTEM\CurrentControlSet\Control\Class|SpeakerModeOn SpeakerModeSetup H )
� � � ��� � string MappingStrings � Win32Registry|SYSTEM\CurrentControlSet\Control\Class|SpeakerModeSetup SpeakerVolumeHigh I )
� k � ��s � string MappingStrings � Win32Registry|SYSTEM\CurrentControlSet\Control\Class|SpeakerVolume_High SpeakerVolumeLow J )
� � ��% 5 string MappingStrings = Win32Registry|SYSTEM\CurrentControlSet\Control\Class|SpeakerVolume_Low SpeakerVolumeMed K
)
� � � ��� � string MappingStrings � Win32Registry|SYSTEM\CurrentControlSet\Control\Class|SpeakerVolume_Med StringFormat L )
� { � ��� � string MappingStrings � Win32_API|Line Device Structures|LINEDEVCAPS|dwStringFormat Terminator M )
� � ��# 3 string MappingStrings ; Win32Registry|SYSTEM\CurrentControlSet\Control\Class|Terminator Tone N )
� � � ��� � string MappingStrings � Win32Registry|SYSTEM\CurrentControlSet\Control\Class|Tone VoiceSwitchFeature O )
� _ � ��g w string MappingStrings Win32Registry|SYSTEM\CurrentControlSet\Control\Class|VoiceSwitchFeature �08323F6CE5B5EF342C0F93E02A0590BFC4 CD_2432A5ABBE7173FA98223D70B4EDFB312E0AA87F456103A25E4B4191AB55FA02.11.3857636931.429 CD_2DC5A6B44F3255647A4F9E3D4F932FDB937FF6A6BFC90FAEFA2788D220375335.11.1930088935.329 CI_2432A5ABBE7173FA98223D70B4EDFB312E0AA87F456103A25E4B4191AB55FA02 IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.11.856052873.230 IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.10.3704842052.368 IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.10.2303113859.180 CR_FCBAF5A1255D45B1176570C0B63AA60199749700C79A11D5811D54A83A1F4EFD C_2432A5ABBE7173FA98223D70B4EDFB312E0AA87F456103A25E4B4191AB55FA02 C_2DC5A6B44F3255647A4F9E3D4F932FDB937FF6A6BFC90FAEFA2788D220375335 KI_2432A5ABBE7173FA98223D70B4EDFB312E0AA87F456103A25E4B4191AB55FA02 I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.11.856052873.230 KI_2DC5A6B44F3255647A4F9E3D4F932FDB937FF6A6BFC90FAEFA2788D220375335 I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.11.949979019.243 I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.10.3704842052.368 I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.10.2303113859.180 NS_E8C4F9926E52E9240C37C4E59745CEB61A67A77C9F6692EA4295A97E0AF583C5 CD_20F26C6236C8252E1FCBB508B5F5781449304BFBC276C5E3DD747A3A26989746.10.2264993615.258 CD_2432A5ABBE7173FA98223D70B4EDFB312E0AA87F456103A25E4B4191AB55FA02.10.2938204669.443 CD_4477CA66979EB36A4812EB84064B57FCF10A17595E6D43320B7012BE2EEBF12B.10.3489159820.246 CD_576EF4A0CA90F6D8810BFB793D022B2E61E1CD9C1C9EC856ECD04FF80D2D4518.7.1546888865.135 CD_6EDCAD2493CB9C9AE066E77642818C8D9B9BC312C7B4C3A76A07871F0E60FEB1.10.870336647.1709 CD_7982F1017538FCA639874841D68FAD4E24866671A5CDE2C6CB4C169C859203D9.10.2017356135.251 CD_A2F0F731789B8BD6294886FFBA95B74CEA7B86072988F101ACF53FD6E840B35A.10.4286931907.253 CD_B62E3BC0ED4669CB12D462E1CA25681D5779A9B4C4E1FD95E1263BCD94258894.10.2400143833.215 CD_BBCB50A3E35BB9672B8B458A16DD242DDDDEA6BED48E25ABA8EEF2B0E49A9B3E.10.469725751.504 CD_C937FF2960366D3679AB8F23C7A6B508B41E35226B8C5FD67AC45163D3C64350.10.2850899823.250 CI_2DC5A6B44F3255647A4F9E3D4F932FDB937FF6A6BFC90FAEFA2788D220375335 IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.11.949979019.243 NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805 I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.11.222882137.180 KI_7010B213179D98B16AF38723EE1D750E86F808F341EE215AD8783D29EA117262 I_9731A66D417FDC024A9D93DAD0B38C4D96CBFD2BEC45E5FB4706D56140B553A0.11.1079377597.329 KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C I_86B3BCA296587429BCD61A2968A848617DB93023BC6D3C1858853C5540E12A3E.11.2245875547.294 IR_9731A66D417FDC024A9D93DAD0B38C4D96CBFD2BEC45E5FB4706D56140B553A0 KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD I_86B3BCA296587429BCD61A2968A848617DB93023BC6D3C1858853C5540E12A3E.11.4228721979.245 R_8782DF593D87E15E70F328199782FA2AE53123A672514C1F3FA22CA1BDA7212E.11.244342731.520 I_6E9DD02E52C196C71CD529E2D8111E7EE60BD0D43965AAC2D903C8F515A0E666.11.3265284943.330 I_DF1D72ECC9268213FCB43A06A38DBF2A7452DFF83D9A2AF1D89F3CECA76D4AF1.11.3465618677.295 I_DF1D72ECC9268213FCB43A06A38DBF2A7452DFF83D9A2AF1D89F3CECA76D4AF1.11.600185802.246 I_AC0D055AE7600C2FC6AB7B3493AB0844B90905ABE7702F6A368CE617E7383919.42.1709858477.318 I_58F8973372F3501A9EC11539D15E25FC4FCFC2D0AB8D64BD3D0FD5BE87B740C6.42.248356789.269 IR_AC0D055AE7600C2FC6AB7B3493AB0844B90905ABE7702F6A368CE617E7383919 R_0D73E3780A7CEA082AA4AC4E209E3DDAE49A1C0F578B12485C630172BE1B9522.42.3853301919.524 I_0B8645AAE8365A921E6AB402A97682BB4F516F905DBB8B814BF3EA695FB9FFF7.74.859139593.352 I_2C954BC688DA51FBB5260AB5E002A5C395A6540DE89E02F3E5A9E1A1CEE1E69D.76.2470561052.336 I_F3A7CF95E8421F67BF28459423C82D21629E16E53EF074D5B75137F6770EAFE9.76.77904403.349 IR_F3A7CF95E8421F67BF28459423C82D21629E16E53EF074D5B75137F6770EAFE9 R_4DF33D006E5CAF355721008999323C4928310D7E86A56BB401FD17D98672CE1E.77.3916539246.518 �T|� ��n� �m%� ��� �
��J� M |�< r��� � ^>�� 3 R O O T \ S e r v i c e M o d e l _ _ I n s t a n c e P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 5 B 2 C C 7 E B 2 A A F 0 1 0 D D 5 D 0 0 8 4 F 2 D E F C 3 4 0 A F E E E C C 1 2 F 2 4 D 8 7 0 D F C 5 0 B 8 E B 7 C 9 8 1 3 9 \ K I _ E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C \ I _ 9 1 B B 5 F 8 A F E 5 8 7 3 E 9 B A 8 E B D 1 1 8 9 F 1 7 D 9 4 7 D C 5 B B 7 E 3 6 6 A F 5 6 8 F 2 5 A 5 B D 3 F A D D 3 4 E 6 � 7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D �ԝ��C�
ȝ��C�p Y � __MethodProviderRegistration \\.\root\ServiceModel:__Win32Provider.Name="ServiceModel" R O O T \ S e r v i c e M o d e l _ _ M e t h o d P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 5 B 2 C C 7 E B 2 A A F 0 1 0 D D 5 D 0 0 8 4 F 2 D E F C 3 4 0 A F E E E C C 1 2 F 2 4 D 8 7 0 D F C 5 0 B 8 E B 7 C 9 8 1 3 9 \ K I _ 7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D \ I _ 9 1 B B 5 F 8 A F E 5 8 7 3 E 9 B A 8 E B D 1 1 8 9 F 1 7 D 9 4 7 D C 5 B B 7 E 3 6 6 A F 5 6 8 F 2 5 A 5 B D 3 F A D D 3 4 E 6 �ԝ��C��
+ 6 � �� � < J P x � ( � � � � � � � � � � 7 L � � V r W c UUU����������������������������������������
� AppDomainInfo Description Application domain information ServiceModel UUID {A598F86F-FC0D-4b6b-A591-661E0B49DB9E} AppDomainId A
� � � � � �� � �� sint32 Description The Id of the appdomain. DisplayName AppDomainId IsDefault 6
� l u � � � � �� boolean Description Indicates if the appdomain is the default appdomain. DisplayName IsDefault LogMalformedMessages +
� ( 5 t � boolean Description A value that specifies whether malformed messages are logged. DisplayName LogMalformedMessages LogMessagesAtServiceLevel +
� � � � � boolean Description A value that specifies whether messages are traced at the service level (before encryption and transport-related transforms). DisplayName LogMessagesAtServiceLevel LogMessagesAtTransportLevel +
� � ` m boolean Description A value that specifies whether messages are traced at the transport level. DisplayName LogMessagesAtTransportLevel MessageLoggingTraceListeners
6
� � s � � �� object:TraceListener Description The collection trace listeners that listen to the System.ServiceModel.MessageLogging trace source. DisplayName MessageLoggingTraceListeners Name A
� � � $ 1 � �� � �� string Description The name of the appdomain. DisplayName Name PerformanceCounters 6
� � � � � � � �� string Description The scope of active performance counters in the appdomain. DisplayName PerformanceCounters ProcessId A
� ] e r � � � �� � �� sint32 Description The process Id. DisplayName ProcessId ServiceConfigPath 6
� � � 6 C � �� string Description The path to the configuration of the service. DisplayName ServiceConfigPath ServiceModelTraceListeners
6
� � � � . ; � �� object:TraceListener Description The collection trace listeners that listen to the System.ServiceModel trace source. DisplayName ServiceModelTraceListeners TraceLevel $ +
� � � � � � string Description The trace level of the System.ServiceModel trace source. DisplayName TraceLevel � �ԝ��C�5 6 � �� � , : @ h n � e��������� � TraceListener Description Trace Listener ServiceModel UUID {4556569B-4546-4C74-A0DB-8D889238137D} Name 6
� � � � � � � �� string Description The name of the trace listener. DisplayName Name TraceListenerArguments
6
� W u � � � � �� object:TraceListenerArgument Description The arguments of the trace listener. DisplayName TraceListenerArguments W � �ԝ��C�� 6 $ � �� � = K Q y
u��������� � TraceListenerArgument Description Trace Listener Argument ServiceModel UUID {81A1FEF1-9A54-4B10-927C-877F1241F4E8} Name 6
� � � � � � �� string Description The name of the argument. DisplayName Name Value 6
� Q Y f � � � �� string Description The value of the argument. DisplayName Value De � �ԝ��C�� 3 6 � �� � , : @ h w � � y � U h
� � e k � � � . @ � UUU������������������������������������������������� � Service Description ServiceModel Service ServiceModel UUID {94C1FEE8-EDFD-4db1-B07F-FB06622C882D} BaseAddresses 6
� � � � � � �� string Description The base addresses used by the service. DisplayName BaseAddresses Behaviors
6
� d u � � � � �� object:Behavior Description The behaviors associated with this service. DisplayName Behaviors ConfigurationName 6
� & 3 Y f � �� string Description ServiceElement_BehaviorConfiguration DisplayName ConfigurationName CounterInstanceName 6
� � � � 3 @ � �� string Description Instance name of the instance of the performance counters of the service. DisplayName CounterInstanceName DistinguishedName A
� � � � � � � �� � �� string Description Service name at the address. DisplayName DistinguishedName Extensions 6
� Z b o � � � �� string Description The instance contexts for the extensions of the service instance. DisplayName Extensions Metadata , 6
� ! . N [ � �� string Description The service metadata settings. DisplayName Metadata Name 6
� � � � � � � �� string Description The unique name of this service. DisplayName Name Namespace 6
� H P ] | � � �� string Description The namespace of the service. DisplayName Namespace Opened e $ 6
� � � � & � �� datetime Description The time the service was opened. DisplayName Opened OutgoingChannels
( 6
� � � � � � � �� object:Channel Description The channels that are outgoing from the service instance. DisplayName OutgoingChannels ProcessId A
� U ] j � � � �� � �� sint32 Description The process id of the process that hosts the service. DisplayName ProcessId �E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C �՝��C� ȝ��C�� � ��������] v � __InstanceProviderRegistration \\.\root\standardcimv2:__Win32Provider.Name="NetAdapterCim" e WQL:UnarySelect ;���` q `-,k� B rl�� s ��U�� � �]\H � C I M _ I n f r a r e d C o n t r o l l e r *ʝ��C�- V CIM_InfraredController 6 � �� � ( . V ` � � �������������������������������������������������������������������������������������\ � Win32_InfraredDevice CIMWin32 Locale UUID {67F74295-BA42-11d2-85E5-0000F8102E5F} DeviceID @ A
� � � �� � ��� � � � string Override DeviceId MappingStrings � WMI Manufacturer L )
� - � ��5 E string MappingStrings M Win32Registry � C I M _ S e r i a l C o n t r o l l e r +ʝ��C� � CIM_SerialController 6 � �� � $ * R Z � � � � C \ � � � � 5 G � � � � P ` � � � d v * � � �
�
C X � � � j
z
7 � � � � ������WUUUU������������������������������������������������������������������������������������������������������������������������������������������K � Win32_SerialPort CIMWin32 Locale UUID {8502C4BF-5FBB-11D2-AAC1-006008C78BC7} Binary X )
� � � ��� � boolean MappingStrings � Win32API|Communication Structures|DCB|fBinary DeviceID @ A
� : � �� � ��B L V f string Override DeviceId MappingStrings n Win32Registry|Hardware\DeviceMap\SerialComm MaximumInputBufferSize Z )
� � � ��� uint32 MappingStrings
Win32API|Communication Structures|COMMPROP|dwMaxRxQueue MaximumOutputBufferSize ^ )
� � � ��� � uint32 MappingStrings � Win32API|Communication Structures|COMMPROP|dwMaxTxQueue OSAutoDiscovered . � )
� 5 � ��> N boolean MappingStrings V Win32Registry|HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter ProviderType b )
� � � ��� � string MappingStrings � Win32API|Communication Structures|COMMPROP|dwProvSubType SettableBaudRate f )
� ~ � ��� � boolean MappingStrings � Win32API|Communication Structures|COMMPROP|dwSettableParams|SP_BAUD SettableDataBits h )
� - � ��6 F boolean MappingStrings N Win32API|Communication Structures|COMMPROP|dwSettableParams|SP_DATABITS SettableFlowControl j )
� � � ��� � boolean MappingStrings Win32API|Communication Structures|COMMPROP|dwSettableParams|SP_HANDSHAKING SettableParity l )
� � � ��� � boolean MappingStrings � Win32API|Communication Structures|COMMPROP|dwSettableParams|SP_PARITY SettableParityCheck ! n )
� K � ��T d boolean MappingStrings l Win32API|Communication Structures|COMMPROP|dwSettableParams|SP_PARITY_CHECK SettableRLSD " p )
� � � �� boolean MappingStrings Win32API|Communication Structures|COMMPROP|dwSettableParams|SP_RLSD SettableStopBits # r )
� � � ��� � boolean MappingStrings � Win32API|Communication Structures|COMMPROP|dwSettableParams|SP_STOPBITS Supports16BitMode $ t )
� a � ��j z boolean MappingStrings � Win32API|Communication Structures|COMMPROP|dwProvCapabilities|PCF_16BITMODE SupportsDTRDSR % v )
�
� ��
/
boolean MappingStrings 7
Win32API|Communication Structures|COMMPROP|dwProvCapabilities|PCF_DTRDSR SupportsElapsedTimeouts & x )
� �
� ���
�
boolean MappingStrings �
Win32API|Communication Structures|COMMPROP|dwProvCapabilities|PCF_TOTALTIMEOUTS SupportsIntTimeouts ' z )
� � � ��� � boolean MappingStrings � Win32API|Communication Structures|COMMPROP|dwProvCapabilities|PCF_INTTIMEOUTS SupportsParityCheck ( | )
� K � ��T d boolean MappingStrings l Win32API|Communication Structures|COMMPROP|dwProvCapabilities|PCF_PARITY_CHECK SupportsRLSD ) ~ )
�
� ��
boolean MappingStrings "
Win32API|Communication Structures|COMMPROP|dwProvCapabilities|PCF_RLSD SupportsRTSCTS * � )
� �
� ���
�
boolean MappingStrings �
Win32API|Communication Structures|COMMPROP|dwProvCapabilities|PCF_RTSCTS SupportsSpecialCharacters + � )
� n � ��w � boolean MappingStrings � Win32API|Communication Structures|COMMPROP|dwProvCapabilities|PCF_SPECIALCHARS SupportsXOnXOff , � )
� ' � ��0 @ boolean MappingStrings H Win32API|Communication Structures|COMMPROP|dwProvCapabilities|PCF_XONXOFF SupportsXOnXOffSet - � )
� � � ��� � boolean MappingStrings � Win32API|Communication Structures|COMMPROP|dwProvCapabilities|PCF_SETXCHAR � C I M _ S C S I C o n t r o l l e r ,ʝ��C�7 z CIM_SCSIController 6 � �� � ( . V `
� � X i � � � ������_������������������������������������������������������������������������������������������������������������������& � Win32_SCSIController CIMWin32 Locale UUID {8502C4C1-5FBB-11D2-AAC1-006008C78BC7} DeviceID @ A
� � � �� � ��� � � � string Override DeviceId MappingStrings � Win32Registry|Hardware\DeviceMap\Scsi DeviceMap f 4
� W _ �� � ��k { string DEPRECATED MappingStrings � Win32Registry|Hardware\DeviceMap\Scsi|ScsiPort DriverName b )
� � � ��� string MappingStrings Win32Registry|System\CurrentControlSet\Services\Class|PortDriver HardwareVersion j )
� � � ��� � string MappingStrings � Win32Registry|System\CurrentControlSet\Enum\Root|HWRevision Index ^ )
� ; � ��C S uint32 MappingStrings [ Win32Registry|Hardware\DeviceMap\Scsi|ScsiPort Manufacturer n )
� � � ��� � string MappingStrings � Win32Registry|System\CurrentControlSet\Enum\Root|Mfg � C I M _ C o n t r o l l e d B y -ʝ��C�\ CIM_ControlledBy 6 � �� � % - 3 [ g ��������������������������������� � Win32_USBControllerDevice CIMWin32 Locale UUID {DE57D792-A032-11D2-90F0-0060081A46FD} Antecedent f@ A
� � � �� � ��� � � � ref:CIM_USBController Override Antecedent MappingStrings � CIM|CIM_USBController Dependent f@ A
� l � �� � ��� � � � ref:CIM_LogicalDevice Override Dependent MappingStrings � CIM|CIM_LogicalDevice Co � C I M _ C o n t r o l l e d B y .ʝ��C�c CIM_ControlledBy 6 � �� � & . 4 \ h $ ��������������������������������� � Win32_SCSIControllerDevice CIMWin32 Locale UUID {CC0F48D2-C847-11d2-911E-0060081A46FD} Antecedent f@ A
� � � �� � ��� � � � ref:Win32_SCSIController Override Antecedent MappingStrings � CIM|Win32_SCSIController Dependent f@ A
� s � �� � ��� � � � ref:CIM_LogicalDevice Override Dependent MappingStrings � CIM|CIM_LogicalDevice ol � pingStrings � Win32API|Device Input and Output Functions|DeviceIoControl MTU " i )
� A � ��I Y uint32 MappingStrings a Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|MTU NumForwardPackets # m )
� � � ��� uint32 MappingStrings Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|NumForwardPackets PMTUBHDetectEnabled X )
� � � ��� � boolean MappingStrings � Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|EnablePMTUBHDetect PMTUDiscoveryEnabled Z )
� t � ��} � boolean MappingStrings � Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|EnablePMTUDiscovery ServiceName : )
� / � ��7 G string MappingStrings O Win32Registry|Software\Microsoft\Windows NT\CurrentVersion\NetworkCards|ServiceName TcpipNetbiosOptions 8 �
� � � �� uint32 TcpMaxConnectRetransmissions $ q )
� @! � ��H! X! uint32 MappingStrings `! Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|TcpMaxConnectRetransmissions TcpMaxDataRetransmissions % u )
� " � ��" )" uint32 MappingStrings 1" Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|TcpMaxDataRetransmissions TcpNumConnections & y )
� �" � ���" �" uint32 MappingStrings �" Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|TcpNumConnections TcpUseRFC1122UrgentPointer ' } )
� �# � ���# �# boolean MappingStrings �# Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|TcpUseRFC1122UrgentPointer TcpWindowSize ( )
� b$ � ��j$ z$ uint16 MappingStrings �$ Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|TcpWindowSize WINSEnableLMHostsLookup 3 � )
� "% � ��+% ;% boolean MappingStrings C% Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|EnableLMHOSTS WINSHostLookupFile 6 � )
� �% � ���% �% string MappingStrings �% Win32API|System Information Functions|GetSystemDirectory|\drivers\etc\lmhosts WINSPrimaryServer 4 � )
� �& � ���& �& string MappingStrings �& Win32API|Device Input and Output Functions|DeviceIoControl WINSScopeID 7 � )
� 7' � ��?' O' string MappingStrings W' Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|ScopeID WINSSecondaryServer 5 � )
� �' � ���' ( string MappingStrings
( Win32API|Device Input and Output Functions|DeviceIoControl �� ) � � % 5 � � N a � � 7 ; � � x | � � � t � � � � 3+ �, �, �. �0 )2 B2 4 U6 �7 �7 �9 #< �= �= )? B �C �C E &G �H �H �J iN �O �O �Q K\ �] �] G_ ha �b �b �d l m �m mo qo �p
q s Tu �v �v �x �| {~ �~ t� �� � 0� � V� Ӊ � ԋ � �� �� �� ɓ F� U� =� X� ՚ � ̜ � d� u� ]� �� � .� � Y� ֫ � Э � �� �� �� ص U� c� K� b� �� ݾ � �� �� �� �� =� E� D� �� �� � �� 8� �� �� �� C� �� �� �� "� �� �� �� �� V� u� ]� �� :� L� 4� ^� �� �� �� *� �� � EnableDHCP ) 5 ��B L � � Implemented ValueMap ' � � � � � �
" & * . 2 6 : > B F J N R V Z ^ b f j n r v z ~ � 0 1 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 100 .. MappingStrings � WMI y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � RenewDHCPLease ) ^ ��k u � � Implemented ValueMap ' # ' + / 3 7 ; ? C G K O S W [ _ c g k o s w { � � � � � � � � � � � 0 1 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 100 .. MappingStrings � WMI y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � RenewDHCPLeaseAll 4 � ��� ��� � � � Implemented Static ValueMap ' T W Z ^ b f j n r v z ~ � � � � � � � � � � � � � � � � � � � � � � � � � � � 0 1 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 100 .. MappingStrings WMI y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � ReleaseDHCPLease ) � ��� � * Implemented ValueMap '
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
0 1 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 100 .. MappingStrings 2 WMI y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � ReleaseDHCPLeaseAll 4
��
��
[ k Implemented Static ValueMap ' �
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
" & * . 2 6 : > B F J N R W 0 1 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 100 .. MappingStrings s WMI y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � EnableStatic ) 0 ��= G � � Implemented ValueMap ' � � � � � � �
! % ) - 1 5 9 = A E I M Q U Y ] a e i m q u y ~ 0 1 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 100 .. MappingStrings � WMI T ae442007200009F ROOT\CIMV2 ���� � � �� * � @ � ��������E � __PARAMETERS abstract IPAddress string
� 5 In
� 5 \ �� � WMI MappingStrings )
� 5 \ ��� � ID 6
� & \ ��� � � string SubnetMask string
� L In
� L s �� � WMI MappingStrings )
� L s ��� � ID 6
� = s ��� � � string __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � SetGateways ) � ��� � � Implemented ValueMap ' a d g k o s w { � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � 0 1 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 100 .. MappingStrings WMI ae442007200009F ROOT\CIMV2 ���� � �� �� * 2 � � ��������� � __PARAMETERS abstract DefaultIPGateway string
� < In
� < c �� � Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\ MappingStrings )
� < c ��� � ID 6
� v c ��� � . string GatewayCostMetric uint16
� � In
� � � �� Optional '
� � � ��� �� ? WMI MappingStrings 4
� � � ��� ��D 7 ID A
� � � ��� ��D 7 � uint16 __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � EnableDNS 4 � ��� ��� � 5 E Implemented Static ValueMap ' � � � � � � � � � � � � � � � � � � � � � � � � � � $ ( , 1 0 1 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 100 .. MappingStrings M Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters � ae442007200009F ROOT\CIMV2 ���� � �M �� � # J � * t � � U����������������� � __PARAMETERS abstract DNSHostName string
� 7 In
� 7 ^ �� Optional '
� 7 ^ ��� �� � Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|Hostname MappingStrings 4
� 7 ^ ��� �� � ID A
� � ^ ��� �� � p string DNSDomain string
� � In
� � �� Optional '
� � ��= �� � Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|Domain MappingStrings 4
� � ��= ��� | ID A
� r ��= ��� | string DNSServerSearchOrder string
� � In
� � � �� Optional '
� � � ��� �� > Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|NameServer MappingStrings 4
� � � ��� ��� 6 ID A
� 0 � ��� ��� 6 � string DNSDomainSuffixSearchOrder string
� f In
� f � �� Optional '
� f � ��� �� Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|SearchList MappingStrings 4
� f � ��� ��O � ID A
� � � ��� ��O � � string __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � SetDNSDomain ) �, ���, �, 9. I. Implemented ValueMap ' �- �- �- �- �- �- �- �- �- �- �- �- �- �- �- �- �- �- �- �- �- �- �- �- �- . . . . . . . . . $. (. ,. 0. 5. 0 1 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 100 .. MappingStrings Q. Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters ae442007200009F ROOT\CIMV2 ���� � �� �� * & ����r � __PARAMETERS abstract DNSDomain string
� 5 In
� 5 \ �� � Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|Domain MappingStrings )
� 5 \ ��� � ID 6
� j \ ��� � " string __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � SetDNSServerSearchOrder ) k2 ��x2 �2 �3 �3 Implemented ValueMap ' "3 %3 (3 ,3 03 43 83 <3 @3 D3 H3 L3 P3 T3 X3 \3 `3 d3 h3 l3 p3 t3 x3 |3 �3 �3 �3 �3 �3 �3 �3 �3 �3 �3 �3 �3 �3 �3 �3 0 1 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 100 .. MappingStrings �3 Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters : ae442007200009F ROOT\CIMV2 ���� � �� �� * 5 ����� � __PARAMETERS abstract DNSServerSearchOrder string
� @ In
� @ g �� � Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|NameServer MappingStrings )
� @ g ��� � ID 6
� y g ��� � 1 string __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � SetDNSSuffixSearchOrder 4 8 ��,8 ��48 >8 y9 �9 Implemented Static ValueMap ' �8 �8 �8 �8 �8 �8 �8 �8 �8 9 9 9 9 9 9 9 9 9 $9 (9 ,9 09 49 89 <9 @9 D9 H9 L9 P9 T9 X9 \9 `9 d9 h9 l9 p9 u9 0 1 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 100 .. MappingStrings �9 Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters L ae442007200009F ROOT\CIMV2 ���� � �� �� * ; ����� � __PARAMETERS abstract DNSDomainSuffixSearchOrder string
� F In
� F m �� � Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|NameServer MappingStrings )
� F m ��� � ID 6
� m ��� � 7 string __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � SetDynamicDNSRegistration �= ���= �= Implemented ValueMap ' �> �> �> �> �> �> �> �> �> �> �> �> �> �> �> �> �> �> �> �> �> �> �> �> �> �> �> �> �> ? ? ? ? ? ? ? ? ? %? 0 1 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 100 .. � ae442007200009F ROOT\CIMV2 ���� � �� �� � � * � ����� � __PARAMETERS abstract FullDNSRegistrationEnabled boolean
� F In
� F n �� ID )
� � n ��� boolean DomainDNSRegistrationEnabled boolean
� In
� 8 �� Optional '
� 8 ��f �� ID 4
� � 8 ��f ��� boolean __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � SetIPConnectionMetric �C ���C �C Implemented ValueMap ' mD pD sD wD {D D �D �D �D �D �D �D �D �D �D �D �D �D �D �D �D �D �D �D �D �D �D �D �D �D �D �D �D �D �D �D �D �D E 0 1 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 100 .. ae442007200009F ROOT\CIMV2 ���� � �� �� * � ����� � __PARAMETERS abstract IPConnectionMetric uint32
� > In
� > e �� ID )
� � e ��� uint32 __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � SetWINSServer ) �H ���H �H -J =J Implemented ValueMap ' �I �I �I �I �I �I �I �I �I �I �I �I �I �I �I �I �I �I �I �I �I �I �I �I �I �I �I �I J J J J J J J J J $J )J 0 1 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 100 .. MappingStrings EJ Win32API|Device Input and Output Functions|DeviceIoControl � ae442007200009F ROOT\CIMV2 ���� � �� �� * ! x ��������� � __PARAMETERS abstract WINSPrimaryServer string
� = In
� = d �� � Win32API|Device Input and Output Functions|DeviceIoControl MappingStrings )
� = d ��� � ID 6
� e d ��� � string WINSSecondaryServer string
� � In
� � � �� � Win32API|Device Input and Output Functions|DeviceIoControl MappingStrings )
� � � ��- � ID 6
� � � ��- � t string __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � EnableWINS 4 &P ��3P ��;P EP �Q �Q Implemented Static ValueMap ' �P �P �P �P �P �P �P �P Q Q Q Q Q Q Q Q #Q 'Q +Q /Q 3Q 7Q ;Q ?Q CQ GQ KQ OQ SQ WQ [Q _Q cQ gQ kQ oQ sQ wQ |Q 0 1 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 100 .. MappingStrings �Q Win32Registry|SYSTEM\CurrentControlSet\Services ~
ae442007200009F ROOT\CIMV2 ���� � �+
�� * < � � a � U������������j � __PARAMETERS abstract DNSEnabledForWINSResolution boolean
� G In
� G o �� � Win32Registry|SYSTEM\CurrentControlSet\Services\Netbt\Parameters|EnableDNS MappingStrings )
� G o ��� � ID 6
� � o ��� � 8 boolean WINSEnableLMHostsLookup boolean
� � In
� � � �� Win32Registry|SYSTEM\CurrentControlSet\Services\Netbt\Parameters|EnableLMHOSTS MappingStrings )
� � � ��b
ID 6
� � � ��b
� boolean WINSHostLookupFile string
� In
� G �� optional '
� G ��u �� � Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|DatabasePath MappingStrings 4
� G ��u �� � ID A
� � G ��u �� � ] string WINSScopeID string
� � In
� � � �� optional '
� � � ��, �� s Win32Registry|SYSTEM\CurrentControlSet\Services\Netbt\Parameters|ScopeID MappingStrings 4
� � � ��, ��� k ID A
� b � ��, ��� k string __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � SetTcpipNetbios �] ��^ ^ Implemented ValueMap ' �^ �^ �^ �^ �^ �^ �^ �^ �^ �^ �^ �^ �^ �^ �^ �^ �^ �^ �^ �^ �^ �^ _ _
_ _ _ _ _ _ "_ &_ *_ ._ 2_ 6_ :_ >_ C_ 0 1 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 100 .. ae442007200009F ROOT\CIMV2 ���� � �� �� * � ����� � __PARAMETERS abstract TcpipNetbiosOptions uint32
� ? In
� ? f �� ID )
� � f ��� uint32 __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � EnableIPSec ) c ��(c 2c md }d Implemented ValueMap ' �c �c �c �c �c �c �c �c �c �c �c �c d d d d d d d d d $d (d ,d 0d 4d 8d <d @d Dd Hd Ld Pd Td Xd \d `d dd id 0 1 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 100 .. MappingStrings �d Win32Registry|SYSTEM\CurrentControlSet\Services|Tcpip\Parameters\Interfaces , ae442007200009F ROOT\CIMV2 ���� � ��
�� = * D � � ������������� � __PARAMETERS abstract IPSecPermitTCPPorts string
� ? In
� ? f �� � Win32Registry|SYSTEM\CurrentControlSet\Services|Tcpip\Parameters\Interfaces|TCPAllowedPorts MappingStrings )
� ? f ��� � ID 6
� � f ��� � @ string IPSecPermitUDPPorts string
� � In
� � � �� Win32Registry|SYSTEM\CurrentControlSet\Services|Tcpip\Parameters\Interfaces|UDPAllowedPorts MappingStrings )
� � � ��q ID 6
� � ��q � string IPSecPermitIPProtocols string
� 2 In
� 2 Y �� � Win32Registry|SYSTEM\CurrentControlSet\Services|Tcpip\Parameters\Interfaces|RawIPAllowedProtocols MappingStrings )
� 2 Y ��� � ID 6
� � Y ��� � 9 string __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � DisableIPSec ) �m ���m �m o o Implemented ValueMap ' mn pn sn wn {n n �n �n �n �n �n �n �n �n �n �n �n �n �n �n �n �n �n �n �n �n �n �n �n �n �n �n �n �n �n �n �n �n o 0 1 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 100 .. MappingStrings o Win32Registry|SYSTEM\CurrentControlSet\Services|Tcpip\Parameters\Interfaces y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � SetIPXVirtualNetworkNumber ? Iq ��Uq ��bq ��jq tq �r �r DEPRECATED Implemented Static ValueMap ' r r r r "r &r *r .r 2r 6r :r >r Br Fr Jr Nr Rr Vr Zr ^r br fr jr nr rr vr zr ~r �r �r �r �r �r �r �r �r �r �r �r 0 1 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 100 .. MappingStrings �r Win32Registry|SYSTEM\CurrentControlSet\Services\nwlnkipx\Parameters D ae442007200009F ROOT\CIMV2 ���� � �� �� * A ����� � __PARAMETERS abstract IPXVirtualNetNumber string
� ? In
� ? f �� � Win32Registry|SYSTEM\CurrentControlSet\Services\nwlnkipx\Parameters|VirtualNetworkNumber MappingStrings )
� ? f ��� � ID 6
� � f ��� � = string __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � SetIPXFrameTypeNetworkPairs 4 "w ��.w ��;w Ew �x �x DEPRECATED Implemented ValueMap ' �w �w �w �w �w �w �w �w x x x x x x x x #x 'x +x /x 3x 7x ;x ?x Cx Gx Kx Ox Sx Wx [x _x cx gx kx ox sx wx |x 0 1 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 100 .. MappingStrings �x Win32Registry|SYSTEM\CurrentControlSet\Services\nwlnkipx\Parameters\Adapters ae442007200009F ROOT\CIMV2 ���� � �� �� � ! * @ ��������z � __PARAMETERS abstract IPXNetworkNumber string
� < In
� < c �� � Win32Registry|SYSTEM\CurrentControlSet\Services\nwlnkipx\Parameters\Adapters|NetworkNumber MappingStrings )
� < c ��� � ID 6
� � c ��� � < string IPXFrameType uint32
� � In
� � � �� Win32Registry|SYSTEM\CurrentControlSet\Services\nwlnkipx\Parameters\Adapters|PktType MappingStrings )
� � � ��_ � � � � � 0 1 2 3 255 ValueMap 6
� � � ��_ � � ID C
� r � ��_ � � uint32 __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � SetDatabasePath 4 �~ ���~ ���~ �~ � *� Implemented Static ValueMap ' � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � �
� � � 0 1 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 100 .. MappingStrings 2� Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters $ ae442007200009F ROOT\CIMV2 ���� � �� �� * / ����{ � __PARAMETERS abstract DatabasePath string
� 8 In
� 8 _ �� � Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|DatabasePath MappingStrings )
� 8 _ ��� � ID 6
� s _ ��� � + string __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � SetIPUseZeroBroadcast 4 d� ��q� ��y� �� �� ΅ Implemented Static ValueMap ' #� &� )� -� 1� 5� 9� =� A� E� I� M� Q� U� Y� ]� a� e� i� m� q� u� y� }� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� 0 1 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 100 .. MappingStrings օ Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters : ae442007200009F ROOT\CIMV2 ���� � �� �� * : ��� � __PARAMETERS abstract IPUseZeroBroadcast boolean
� > In
� > f �� � Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|UseZeroBroadcast MappingStrings )
� > f ��� � ID 6
� ~ f ��� � 6 boolean __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � SetArpAlwaysSourceRoute 4 � ��-� ��5� ?� z� �� Implemented Static ValueMap ' ߊ � � � � � �� �� �� � � �
� � � � � !� %� )� -� 1� 5� 9� =� A� E� I� M� Q� U� Y� ]� a� e� i� m� q� v� 0 1 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 100 .. MappingStrings �� Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters D ae442007200009F ROOT\CIMV2 ���� � �� �� * @ ��� � __PARAMETERS abstract ArpAlwaysSourceRoute boolean
� @ In
� @ h �� � Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|ArpAlwaysSourceRoute MappingStrings )
� @ h ��� � ID 6
� � h ��� � < boolean __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � SetArpUseEtherSNAP 4 � ��� ���� � ;� K� Implemented Static ValueMap ' �� �� �� �� �� �� �� �� �� Ɛ ʐ ΐ Ґ ڐ ސ � � � � � �� �� �� � �
� � � � � � "� &� *� .� 2� 7� 0 1 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 100 .. MappingStrings S� Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters 0 ae442007200009F ROOT\CIMV2 ���� � �� �� * 6 ��� � __PARAMETERS abstract ArpUseEtherSNAP boolean
� ; In
� ; c �� � Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|ArpUseEtherSNAP MappingStrings )
� ; c ��� � ID 6
� z c ��� � 2 boolean __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � SetDefaultTOS 4 �� ���� ���� �� � � Implemented Static ValueMap ' H� K� N� R� V� Z� ^� b� f� j� n� r� v� z� ~� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� Ɩ ʖ Ζ Җ ֖ ږ ߖ 0 1 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 100 .. MappingStrings �� Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters ae442007200009F ROOT\CIMV2 ���� � �� �� * * �u � __PARAMETERS abstract DefaultTOS uint8
� 6 In
� 6 \ �� � Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|DefaultTOS MappingStrings )
� 6 \ ��� � ID 6
� n \ ��� � & uint8 __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � SetDefaultTTL 4 � ��%� ��-� 7� r� �� Implemented Static ValueMap ' כ ڛ ݛ � � � � � �� �� �� � � �
� � � � � !� %� )� -� 1� 5� 9� =� A� E� I� M� Q� U� Y� ]� a� e� i� n� 0 1 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 100 .. MappingStrings �� Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters ae442007200009F ROOT\CIMV2 ���� � �� �� * * �u � __PARAMETERS abstract DefaultTTL uint8
� 6 In
� 6 \ �� � Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|DefaultTTL MappingStrings )
� 6 \ ��� � ID 6
� n \ ��� � & uint8 __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � SetDeadGWDetect 4 �� ���� ���� Ƞ � � Implemented Static ValueMap ' h� k� n� r� v� z� ~� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� ¡ ơ ʡ Ρ ҡ ֡ ڡ ޡ � � � � � �� �� �� 0 1 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 100 .. MappingStrings � Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters ? ae442007200009F ROOT\CIMV2 ���� � �� �� * = ��� � __PARAMETERS abstract DeadGWDetectEnabled boolean
� ? In
� ? g �� � Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|EnableDeadGWDetect MappingStrings )
� ? g ��� � ID 6
� � g ��� � 9 boolean __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � SetPMTUBHDetect 4 b� ��o� ��w� �� �� ̧ Implemented Static ValueMap ' !� $� '� +� /� 3� 7� ;� ?� C� G� K� O� S� W� [� _� c� g� k� o� s� w� {� � �� �� �� �� �� �� �� �� �� �� �� �� �� �� 0 1 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 100 .. MappingStrings ԧ Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters ? ae442007200009F ROOT\CIMV2 ���� � �� �� * = ��� � __PARAMETERS abstract PMTUBHDetectEnabled boolean
� ? In
� ? g �� � Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|EnablePMTUBHDetect MappingStrings )
� ? g ��� � ID 6
� � g ��� � 9 boolean __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � SetPMTUDiscovery 4 � ��)� ��1� ;� v� �� Implemented Static ValueMap ' ۬ ެ � � � � � �� �� �� � � �
� � � � � !� %� )� -� 1� 5� 9� =� A� E� I� M� Q� U� Y� ]� a� e� i� m� r� 0 1 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 100 .. MappingStrings �� Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters C ae442007200009F ROOT\CIMV2 ���� � �� �� * ? ��� � __PARAMETERS abstract PMTUDiscoveryEnabled boolean
� @ In
� @ h �� � Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|EnablePMTUDiscovery MappingStrings )
� @ h ��� � ID 6
� � h ��� � ; boolean __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � SetForwardBufferMemory 4 � ��� ���� �� :� J� Implemented Static ValueMap ' �� �� �� �� �� �� �� �� �� �� Ų ɲ Ͳ Ѳ ղ ٲ ݲ � � � � � �� �� �� � � �
� � � � � !� %� )� -� 1� 6� 0 1 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 100 .. MappingStrings R� Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters @ ae442007200009F ROOT\CIMV2 ���� � �� �� * = ����� � __PARAMETERS abstract ForwardBufferMemory uint32
� ? In
� ? f �� � Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|ForwardBufferMemory MappingStrings )
� ? f ��� � ID 6
� � f ��� � 9 uint32 __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � SetIGMPLevel 4 �� ���� ���� �� � � Implemented Static ValueMap ' V� Y� \� `� d� h� l� p� t� x� |� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� ĸ ȸ ̸ и Ը ظ ܸ � � � � 0 1 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 100 .. MappingStrings � Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters ae442007200009F ROOT\CIMV2 ���� � �� �� * ( �s � __PARAMETERS abstract IGMPLevel uint8
� 5 In
� 5 [ �� � Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|IGMPLevel MappingStrings )
� 5 [ ��� � ID 6
� l [ ��� � $ uint8 __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � SetKeepAliveInterval 4 )� ��6� ��>� H� �� �� Implemented Static ValueMap ' � � � � �� �� �� � �
� � � � � � "� &� *� .� 2� 6� :� >� B� F� J� N� R� V� Z� ^� b� f� j� n� r� v� z� � 0 1 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 100 .. MappingStrings �� Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters 8 ae442007200009F ROOT\CIMV2 ���� � �� �� * 9 ����� � __PARAMETERS abstract KeepAliveInterval uint32
� = In
� = d �� � Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|KeepAliveInterval MappingStrings )
� = d ��� � ID 6
� } d ��� � 5 uint32 __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � SetKeepAliveTime 4 �� ���� ���� �� 6� F� Implemented Static ValueMap ' �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� � � �
� � � � � !� %� )� -� 2� 0 1 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 100 .. MappingStrings N� Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters , ae442007200009F ROOT\CIMV2 ���� � �� �� * 5 ����� � __PARAMETERS abstract KeepAliveTime uint32
� 9 In
� 9 ` �� � Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|KeepAliveInterval MappingStrings )
� 9 ` ��� � ID 6
� y ` ��� � 1 uint32 __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � SetMTU ? �� ���� ���� ���� �� �� �� DEPRECATED Implemented Static ValueMap ' O� R� U� Y� ]� a� e� i� m� q� u� y� }� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� 0 1 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 100 .. MappingStrings � Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters 9 ae442007200009F ROOT\CIMV2 ���� � �� �� * ����i � __PARAMETERS abstract MTU uint32
� / In
� / V �� � Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|MTU MappingStrings )
� / V ��� � ID 6
� a V ��� � uint32 __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � SetNumForwardPackets 4 H� ��U� ��]� g� �� �� Implemented Static ValueMap ' �
�
� � � � � !� %� )� -� 1� 5� 9� =� A� E� I� M� Q� U� Y� ]� a� e� i� m� q� u� y� }� �� �� �� �� �� �� �� �� 0 1 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 100 .. MappingStrings �� Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters 8 ae442007200009F ROOT\CIMV2 ���� � �� �� * 9 ����� � __PARAMETERS abstract NumForwardPackets uint32
� = In
� = d �� � Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|NumForwardPackets MappingStrings )
� = d ��� � ID 6
� } d ��� � 5 uint32 __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � SetTcpMaxConnectRetransmissions 4
� ��� �� � )� d� t� Implemented Static ValueMap ' �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� � � � � � � � � #� '� +� /� 3� 7� ;� ?� C� G� K� O� S� W� [� `� 0 1 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 100 .. MappingStrings |� Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|TcpMaxConnectRetransmissions d ae442007200009F ROOT\CIMV2 ���� � � �� * O ����� � __PARAMETERS abstract TcpMaxConnectRetransmissions uint32
� H In
� H o �� � Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|TcpMaxConnectRetransmissions MappingStrings )
� H o �� � ID 6
� � o �� � K uint32 __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � SetTcpMaxDataRetransmissions 4 � �� � ��'� 1� l� |� Implemented Static ValueMap ' �� �� �� �� �� �� �� �� �� �� �� �� �� � � � � � � � � #� '� +� /� 3� 7� ;� ?� C� G� K� O� S� W� [� _� c� h� 0 1 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 100 .. MappingStrings �� Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters X ae442007200009F ROOT\CIMV2 ���� � � �� * I ����� � __PARAMETERS abstract TcpMaxDataRetransmissions uint32
� E In
� E l �� � Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|TcpMaxDataRetransmissions MappingStrings )
� E l ��� � ID 6
� � l ��� � E uint32 __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � SetTcpNumConnections 4 �� ���� ���� � C� S� Implemented Static ValueMap ' �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� � �
� � � � � � "� &� *� .� 2� 6� :� ?� 0 1 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 100 .. MappingStrings [� Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters 8 ae442007200009F ROOT\CIMV2 ���� � �� �� * 9 ����� � __PARAMETERS abstract TcpNumConnections uint32
� = In
� = d �� � Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|TcpNumConnections MappingStrings )
� = d ��� � ID 6
� } d ��� � 5 uint32 __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � SetTcpUseRFC1122UrgentPointer 4 �� ���� ���� �� � � Implemented Static ValueMap ' h� k� n� r� v� z� ~� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� 0 1 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 100 .. MappingStrings � Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters \ ae442007200009F ROOT\CIMV2 ���� � � �� * L ��� � __PARAMETERS abstract TcpUseRFC1122UrgentPointer boolean
� F In
� F n �� � Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|TcpUseRFC1122UrgentPointer MappingStrings )
� F n �� � ID 6
� � n �� � H boolean __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � SetTcpWindowSize 4 �� ���� ���� �� �� �� Implemented Static ValueMap ' ?� B� E� I� M� Q� U� Y� ]� a� e� i� m� q� u� y� }� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� 0 1 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 100 .. MappingStrings �� Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters & ae442007200009F ROOT\CIMV2 ���� � �� �� * 1 ��} � __PARAMETERS abstract TcpWindowSize uint16
� 9 In
� 9 ` �� � Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|TcpWindowSize MappingStrings )
� 9 ` ��� � ID 6
� u ` ��� � - uint16 __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � EnableIPFilterSec 4 "� ��/� ��7� A� |� �� Implemented Static ValueMap ' �� �� �� �� �� �� �� �� �� � � � � � � � � #� '� +� /� 3� 7� ;� ?� C� G� K� O� S� W� [� _� c� g� k� o� s� x� 0 1 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 100 .. MappingStrings �� Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters P ae442007200009F ROOT\CIMV2 ���� � �� �� * F ��� � __PARAMETERS abstract IPFilterSecurityEnabled boolean
� C In
� C k �� � Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|IPFilterSecurityEnabled MappingStrings )
� C k ��� � ID 6
� � k ��� � B boolean __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � C CIM_SoftwareElement ) �� ( . V b �������������������������������������������������������������������� � CIM_VideoBIOSElement Abstract Locale UUID {76148BF6-E3D1-11d2-8601-0000F8102E5F} IsShadowed < )
� � � ��� � BOOLEAN MappingStrings � MIF.DMTF|Video BIOS|001.5 �
C I M _ S y s t e m Bɝ��C�� + CIM_System ) ��! ) / �������������������������������������������W � CIM_ApplicationSystem Abstract Locale UUID {120BB700-DB2B-11d2-85FC-0000F8102E5F} � Cɝ��C�U 4 �� " ( P �� ] b � � U��������� � CIM_ProductFRU Abstract Locale UUID {EB98A1B2-DB36-11d2-85FC-0000F8102E5F} Association FRU f
� � � �� ref:CIM_FRU Product f )
� � � ��� ref:CIM_Product Max � Dɝ��C�~ ? ��" * 0 X ��e �� r y � � u��������
� CIM_ProductParentChild Abstract Locale UUID {3E24D5A6-DB2B-11d2-85FC-0000F8102E5F} Aggregation Association Child f
� � � �� ref:CIM_Product Parent f '
� � � �� �� ref:CIM_Product Aggregate � Eɝ��C�� ? ��' / 5 ] ��j �� w � � � u��������1 � CIM_ProductPhysicalElements Abstract Locale UUID {502F00A0-DB2B-11d2-85FC-0000F8102E5F} Aggregation Association Component f
� � � �� ref:CIM_PhysicalElement Product f 4
� � ��! ��, ref:CIM_Product Aggregate Max � � Fɝ��C�� 4 ��( 0 6 ^ �� k } � � U����������H � CIM_ProductProductDependency Abstract Locale UUID {65878E68-DB2B-11d2-85FC-0000F8102E5F} Association DependentProduct f
� � � �� ref:CIM_Product RequiredProduct f
� � � �� ref:CIM_Product TypeOfDependency
� @ � �� UINT16 ct � Gɝ��C�U 4 �� & , T �� a j � � e��������� � CIM_ProductSupport Abstract Locale UUID {8D6D6880-DB2B-11d2-85FC-0000F8102E5F} Association Product f
� � � �� ref:CIM_Product Support f
� � � �� ref:CIM_SupportAccess 2- � Hɝ��C�� ? �� & , T ��a �� n w � � e�������� � CIM_SettingContext Abstract Locale UUID {F0B752E8-DB30-11d2-85FC-0000F8102E5F} Aggregation Association Context f '
� � � ��� �� ref:CIM_Configuration Aggregate Setting f
� � �� ref:CIM_Setting in � Iɝ��C�� ? �� % + S ��` �� m t � � e��������H � CIM_StorageDefect Abstract Locale UUID {5CC70817-DB31-11d2-85FC-0000F8102E5F} Aggregation Association Error f '
� � � ��� �� ref:CIM_StorageError Weak Extent f A
� � ��3 ��> C ref:CIM_StorageExtent Aggregate Max Min ge � Jɝ��C�� " ) �� $ * R k � � � � � 4 � � U���������������������������������_ � CIM_StorageError Abstract Locale UUID {71312AB6-DB31-11d2-85FC-0000F8102E5F} DeviceCreationClassName A
� � � �� � ��� � � STRING MaxLen Propagated CIM_StorageExtent.CreationClassName DeviceID A
� T � �� � ��\ @ d p STRING MaxLen Propagated CIM_StorageExtent.DeviceID EndingAddress
� � � �� UINT64 StartingAddress '
� � �� � �� UINT64 SystemCreationClassName A
� � � �� � ��� � � STRING MaxLen Propagated CIM_StorageExtent.SystemCreationClassName SystemName A
� % � �� � ��- 5 A STRING MaxLen Propagated CIM_StorageExtent.SystemName � Kɝ��C�� ) �� % + S f � � � � < D � � U�������������������+ � CIM_SupportAccess Abstract Locale UUID {80321714-DB31-11d2-85FC-0000F8102E5F} CommunicationInfo )
� � � ��� � STRING MappingStrings � � MIF.DMTF|FRU|002.11 MIF.DMTF|FRU|002.12 CommunicationMode 6
� B � ��J Z z � UINT16 MappingStrings b MIF.DMTF|Support|001.5 ValueMap � � � � � � � � 1 2 3 4 5 6 7 8 Description )
� � �� STRING MappingStrings $ MIF.DMTF|Support|001.3 Locale
6
� � � ��� � � @ STRING MappingStrings � MIF.DMTF|Support|001.2 MaxLen SupportAccessId 4
� � �� � ��# STRING MaxLen � Lɝ��C�� 4 ��! ) / W �� d z � � e��������? � CIM_ToDirectoryAction Abstract Locale UUID {B58D172E-DB31-11d2-85FC-0000F8102E5F} Association DestinationDirectory f 6
� � � ��� � ref:CIM_DirectoryAction Max Min FileName f )
� " � ��: ref:CIM_CopyFileAction Min � W i n 3 2 _ P n P D e v i c e P r o p e r t y ʝ��C�� ! Win32_PnPDeviceProperty & ��������������������Y � Win32_PnPDevicePropertyBoolean Data
� P � �� boolean � <�� K n�q�� P��� � ���q � �Y�JM � 1��w � w��� � G�.�z 4 0 8 9 9 3 0 7 4 0 8 A 3 2 0 4 0 A 6 D A 1 9 C 0 B 1 E C 2 7 4 5 A 3 D 6 0 4 B A A 9 D F F E 8 E E 4 B 7 5 C 3 D 9 1 E 1 6 1 0 9 ʝ��C�ȝ��C�� Y � � __EventProviderRegistration % select * from Win32_SystemConfigurationChangeEvent \\.\Root\CIMV2:__Win32Provider.Name="SystemConfigurationChangeEvents"
R O O T \ C I M V 2 _ _ E v e n t P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 6 8 5 7 7 3 7 2 C 6 6 A 7 B 2 0 6 5 8 4 8 7 F B D 9 5 9 A A 1 5 4 E F 5 4 B 5 F 9 3 5 D C C 5 6 6 3 E 9 2 2 8 B 4 4 3 2 2 8 0 5 \ K I _ 0 8 9 9 3 0 7 4 0 8 A 3 2 0 4 0 A 6 D A 1 9 C 0 B 1 E C 2 7 4 5 A 3 D 6 0 4 B A A 9 D F F E 8 E E 4 B 7 5 C 3 D 9 1 E 1 6 1 0 9 \ I _ 1 D D 9 7 6 C 2 C 1 E C 4 1 A E 2 C 2 E 9 A E 4 3 7 7 9 8 C 8 3 5 C 9 5 C 6 8 3 6 5 1 B 2 D F F D 6 D E 0 0 E F 8 B D 3 7 B 9 B d i � C I M _ C o n t r o l l e d B y ʝ��C�X CIM_ControlledBy 6 � �� � ' / 5 ] i ��������������������������������� � Win32_POTSModemToSerialPort CIMWin32 Locale UUID {8502C4B6-5FBB-11D2-AAC1-006008C78BC7} Antecedent f@ A
� � � �� � ��� � � � ref:Win32_SerialPort Override Antecedent MappingStrings � WMI|Win32_SerialPort Dependent f@ A
� l � �� � ��� � � � ref:Win32_POTSModem Override Dependent MappingStrings � WMI|Win32_POTSModem � C I M _ N e t w o r k A d a p t e r !ʝ��C�� � CIM_NetworkAdapter 6 � �� � ( . V c � � � � � � { � I Y � � * 8 � � � � � � � � � � ! . � � �
�
������UUUU��������������������������������������������������������������������������������������������������������������������������������������������������F � Win32_NetworkAdapter CIMWin32 Locale UUID {8502C4C0-5FBB-11D2-AAC1-006008C78BC7} AdapterType ` 6
� � � ��� � � � string MappingStrings � DeviceIoControl::OID_GEN_MEDIA_IN_USE ValueMap 4 D V � � � � � � � � Ethernet 802.3 Token Ring 802.5 Fiber Distributed Data Interface (FDDI) Wide Area Network (WAN) LocalTalk Ethernet using DIX header format ARCNET ARCNET (878.2) ATM Wireless Infrared Wireless Bpc CoWan 1394 AdapterTypeId d )
� W � ��_ o uint16 MappingStrings w DeviceIoControl::OID_GEN_MEDIA_IN_USE DeviceID @ A
� � � �� � ��� # string Override DeviceId MappingStrings + Win32Registry|System\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318} GUID & �
� � � �� string Index t )
� � � �� uint32 MappingStrings Win32Registry|System\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318} Installed r 4
� � � �� � ��� � boolean DEPRECATED MappingStrings � Win32Registry|Software\Microsoft\Windows NT\CurrentVersion\NetworkCards|DriverDate InterfaceIndex x
� � � �� uint32 MACAddress f )
� � � ��� � string MappingStrings � Win32API|Device Input and Output Functions|DeviceIoControl Manufacturer n )
� o � ��w � string MappingStrings � Win32Registry|Software\Microsoft\Windows NT\CurrentVersion\NetworkCards|Manufacturer MaxNumberControlled ! | )
� 1 � ��9 I uint32 MappingStrings Q MIF.DMTF|Bus Port|001.9|Maximum Number of Attachments NetConnectionID # � '
� � � �� � �� string NetConnectionStatus $ � )
� " � ��* 4 uint16 ValueMap p s v y | � � � � � � � � 0 1 2 3 4 5 6 7 8 9 10 11 12 .. NetEnabled % �
� � � �� boolean PhysicalAdapter ' �
� � �� boolean ProductName \ )
� e � ��m } string MappingStrings � Win32Registry|Software\Microsoft\Windows NT\CurrentVersion\NetworkCards|ServiceName ServiceName j )
�
� ��&
6
string MappingStrings >
Win32Registry|Software\Microsoft\Windows NT\CurrentVersion\NetworkCards|ProductName TimeOfLastReset e " � )
� �
� ���
�
datetime MappingStrings �
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\009|System Up Time � N R � � " � � Enable $ ��1 A Implemented MappingStrings I WMI y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � Disable � �� Implemented MappingStrings WMI y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � %ʝ��C��
A � �� �� � $ . 6 < d p � � U������������ � Win32_ProtocolBinding Association CIMWin32 Locale UUID {8502C509-5FBB-11D2-AAC1-006008C78BC7} Antecedent f 4
� � � �� � ��� � ref:Win32_NetworkProtocol MappingStrings � WMI|Win32_NetworkProtocol Dependent f )
� B � ��Z j ref:Win32_SystemDriver MappingStrings r WMI|Win32_SystemDriver Device f 4
� � � �� � ��� � ref:Win32_NetworkAdapter MappingStrings WMI|Win32_NetworkAdapter A � W i n 3 2 _ D e v i c e S e t t i n g s 'ʝ��C�Q Win32_DeviceSettings 6 � �� � ' / 5 ] f e��������� � Win32_NetworkAdapterSetting CIMWin32 Locale UUID {8502C50A-5FBB-11D2-AAC1-006008C78BC7} Element f@ 6
� � � ��� � � � ref:Win32_NetworkAdapter Override Element MappingStrings � WMI|Win32_NetworkAdapter Setting f@ 6
� V � ��} � � � ref:Win32_NetworkAdapterConfiguration Override Setting MappingStrings � WMI|Win32_NetworkAdapterConfiguration � C I M _ U S B C o n t r o l l e r (ʝ��C�� V CIM_USBController 6 � �� � ' - U _ ��������������������������������������������������������������������������������������� � Win32_USBController CIMWin32 Locale UUID {98C7E2C7-D592-11d2-B355-00105A0A323A} DeviceID @ A
� � � �� � ��� � � � string Override DeviceId MappingStrings � WMI � C I M _ C o n t r o l l e r )ʝ��C� R CIM_Controller ) ��" * 0 ����������������������������������������������������������������������������������X � CIM_InfraredController Abstract Locale UUID {EDCE42F9-0991-11d3-910A-00105AA630BE} � #! W i n 3 2 _ C O M S e t t i n g Bʝ��C� / Win32_COMSetting 6 � �� � ( 0 6 ^ e % ! 2 � � � � P b ! � � | � UU��������������������������������������������; � Win32_DCOMApplicationSetting CIMWin32 Locale UUID {E5D8A561-F6C0-11d2-B35E-00105A1F8569} AppID 4
� � � �� � ��� � string MappingStrings � Win32Registry|HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{GUID}[Default] AuthenticationLevel A
� t � �� � ��| � � � uint32 MappingStrings � Win32Registry|HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{GUID}[AuthenticationLevel] ValueMap 1 2 3 4 5 6 CustomSurrogate )
� i � ��q � string MappingStrings � Win32Registry|HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{GUID}[DllSurrogate] EnableAtStorageActivation )
� ) � ��2 B boolean MappingStrings J Win32Registry|HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{GUID}[ActivateAtStorage] LocalService
$ )
� � � ��� � string MappingStrings Win32Registry|HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{GUID}[LocalService] RemoteServerName 4
� � � �� � ��� � string MappingStrings � Win32Registry|HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{GUID}[RemoteServerName] RunAsUser )
� X � ��` p string MappingStrings x Win32Registry|HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{GUID}[RunAs] ServiceParameters ( )
� � �� ! string MappingStrings ) Win32Registry|HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{GUID}[ServiceParameters] UseSurrogate 4
� � � �� � ��� � boolean MappingStrings � Win32Registry|HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{GUID}[DllSurrogate] � � � � � � � / � � �
� � $ H � � - � � D � GetLaunchSecurityDescriptor ) F ��S ] p | implemented ValueMap i l 0 .. Privileges � � SeSecurityPrivilege SeRestorePrivilege % ae442007200009F ROOT\CIMV2 ���� � �� �� * � � ; ��������e � __PARAMETERS abstract
Descriptor object
� 6 out
� 6 ] �� ID
)
� � ] ��� object:Win32_SecurityDescriptor ReturnValue uint32
� . uint32 out
� . 6 �� __ � SetLaunchSecurityDescriptor ) $ ��1 ; N Z implemented ValueMap G J 0 .. Privileges f { SeSecurityPrivilege SeRestorePrivilege ae442007200009F ROOT\CIMV2 ���� � �� �� * � ����� � __PARAMETERS abstract
Descriptor object
� 6 in
� 6 ] �� ID
)
� � ] ��� object:Win32_SecurityDescriptor __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � GetAccessSecurityDescriptor ) X ��e o � � implemented ValueMap { ~ 0 .. Privileges � � SeSecurityPrivilege SeRestorePrivilege % ae442007200009F ROOT\CIMV2 ���� � �� �� * � � ; ��������e � __PARAMETERS abstract
Descriptor object
� 6 out
� 6 ] �� ID
)
� � ] ��� object:Win32_SecurityDescriptor ReturnValue uint32
� . uint32 out
� . 6 �� __ � SetAccessSecurityDescriptor ) 6 ��C M ` l implemented ValueMap Y \ 0 .. Privileges x � SeSecurityPrivilege SeRestorePrivilege ae442007200009F ROOT\CIMV2 ���� � �� �� * � ����� � __PARAMETERS abstract
Descriptor object
� 6 in
� 6 ] �� ID
)
� � ] ��� object:Win32_SecurityDescriptor __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � GetConfigurationSecurityDescriptor ) q ��~ � � � implemented ValueMap � � 0 .. Privileges � � SeSecurityPrivilege SeRestorePrivilege % ae442007200009F ROOT\CIMV2 ���� � �� �� * � � ; ��������e � __PARAMETERS abstract
Descriptor object
� 6 out
� 6 ] �� ID
)
� � ] ��� object:Win32_SecurityDescriptor ReturnValue uint32
� . uint32 out
� . 6 �� __ � SetConfigurationSecurityDescriptor ) V ��c m � � implemented ValueMap y | 0 .. Privileges � � SeSecurityPrivilege SeRestorePrivilege ae442007200009F ROOT\CIMV2 ���� � �� �� * � ����� � __PARAMETERS abstract
Descriptor object
� 6 in
� 6 ] �� ID
)
� � ] ��� object:Win32_SecurityDescriptor __ �y ae442007200009F ROOT\CIMV2 ���� � C I M _ M a n a g e d E l e m e n t �vR|�C�� CIM_ManagedElement ) ! . M ��X ` �����������������h � MSFT_NetBranchCacheOrchestrator Description BranchCache task orchestrator AMENDMENT LOCALE MS_409 � � � ? � �
z � � � p � � � i u � � J { � � 0 S � $ �% �% �% =6 y9 �9 �9 �I -M <M �M �O Q )Q �Q �W cY wY �Y ` �a �a b ~e
g g �g �k Ym rm n
p �q �q Lr St �u �u �v �z !| 2| �| U� � � �� V� �� ю Z� � <� S� � � �� �� �� ԣ `� j� �� �� �� �� ٭ J� ֿ � +� �� (� P� �� �� i� �� �� �� *� A� x� �� �� �� �� �� E� � Enable_BCDistributed ' 4 Description Enables BranchCache and configures a machine to operate in distributed cache mode. a42c9160500003S ROOT\StandardCimV2\MS_409 ���� � �� �� * ��X � __PARAMETERS abstract Force boolean
� 1 In
� 1 Y �� Indicates the operation should not prompt for confirmation Description )
� 1 Y ��� � ID 6
� O Y ��� � boolean __ �� a42c9160500003S ROOT\StandardCimV2\MS_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � Enable_BCHostedClientByServerNames P ] Description Configures BranchCache to operate in hosted cache client mode. L a42c9160500003S ROOT\StandardCimV2\MS_409 ���� � �� �� � � * � ] V ����������� � __PARAMETERS abstract ServerNames string
� 7 In
� 7 ^ �� Names of the hosted cache servers to use. Description )
� 7 ^ ��� � ID 6
� C ^ ��� � � string UseVersion uint32
� i In
� i � �� Version of the offer protocol to use when contacting this hosted cache server. Description )
� i � �� � ID 6
� � � �� � R uint32 Force boolean
� � In
� � � �� Indicates the operation should not prompt for confirmation Description )
� � � ��M ID 6
� � � ��M � boolean __ �� a42c9160500003S ROOT\StandardCimV2\MS_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � Enable_BCHostedClientByUseSCP � � Description Configures BranchCache to operate in hosted cache client mode. � a42c9160500003S ROOT\StandardCimV2\MS_409 ���� � �� �� � j * * ����� � __PARAMETERS abstract UseSCP boolean
� 2 In
� 2 Z �� Indicates the client should locate hosted cache servers using service connection points. Description )
� 2 Z ��� � ID 6
� n Z ��� � & boolean Force boolean
� � In
� � � �� Indicates the operation should not prompt for confirmation Description )
� � � ��" � ID 6
� � � ��" � f boolean __ �� a42c9160500003S ROOT\StandardCimV2\MS_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � Enable_BCLocal � � Description Enables the BranchCache service in local caching mode. a42c9160500003S ROOT\StandardCimV2\MS_409 ���� � �� �� * ��X � __PARAMETERS abstract Force boolean
� 1 In
� 1 Y �� Indicates the operation should not prompt for confirmation Description )
� 1 Y ��� � ID 6
� O Y ��� � boolean __ �� a42c9160500003S ROOT\StandardCimV2\MS_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � Disable_BC � � Description Disables the BranchCache service. a42c9160500003S ROOT\StandardCimV2\MS_409 ���� � �� �� * ��X � __PARAMETERS abstract Force boolean
� 1 In
� 1 Y �� Indicates the operation should not prompt for confirmation Description )
� 1 Y ��� � ID 6
� O Y ��� � boolean __ �� a42c9160500003S ROOT\StandardCimV2\MS_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � Remove_BCDataCacheExtensionByDataCacheExtension � � Description Deletes a cache file. � a42c9160500003S ROOT\StandardCimV2\MS_409 ���� � �� �� * � m ������� � __PARAMETERS abstract
DataCacheExtension object
� > In
� > e �� The cache extension which should be removed Description
o�鸠 � ʐpv
* O��[� ��v`� � ���5- � ��h� � vV{�g � ��.x� G�>� � C I M _ S t o r a g e E x t e n t 6ʝ��C�� � CIM_StorageExtent ) �� & , T i # � � Z g < J � � { � � � R d � � D O � � 6 � � }
�
������UUU�����������������������������������������������������������������������������������������������������������������������������������������������������������' � Win32_SMBIOSMemory Abstract Locale UUID {FECB095B-F0FA-11d2-8617-0000F8102E5F} AdditionalErrorData % � 6
� � � ��� � @ uint8 MappingStrings � SMBIOS|Type 18|32-bit Memory Error Information|Vendor Syndrome MAX CorrectableError r )
� Z � ��c s boolean MappingStrings { SMBIOS|Type 18|32-bit Memory Error Information|Error Type EndingAddress d )
� � � �� uint64 MappingStrings SMBIOS|Type 19|Memory Device Mapped Addresses|Ending Address ErrorAccess x 6
� � � ��� � uint16 MappingStrings � SMBIOS|Type 18|32-bit Memory Error Information|Error Operation ValueMap - 0 3 6 9 1 2 3 4 5 ErrorAddress " � )
� � � ��� � uint64 MappingStrings � SMBIOS|Type 18|32-bit Memory Error Information|Error Address ErrorData ~ C
� ; � ��B M V f v @ uint8 ArrayType Indexed MappingStrings n SMBIOS MAX ErrorDataOrder ! � )
� � � ��� � uint16 MappingStrings � WMI ErrorInfo l C
� C � ��K ` � � � � uint16 ModelCorrespondence h CIM_Memory.OtherErrorDescription MappingStrings � SMBIOS|Type 18|32-bit Memory Error Information|Error Type ValueMap # & ) , / 2 5 8 ; > B F J N 1 2 3 4 5 6 7 8 9 10 11 12 13 14 ErrorMethodology @ L C
� � � ��� � � � / 9 string Override ErrorMethodology MappingStrings � SMBIOS|Type 16|Physical Memory Array|Memory Error Correction ValueMap Y ` i o w � � Other Unknown None Parity Single-bit ECC Multi-bit ECC CRC ErrorResolution $ � )
� � � ��� � uint64 MappingStrings SMBIOS|Type 18|32-bit Memory Error Information|Error Resolution ErrorTime e t )
� � � ��� � datetime MappingStrings � WMI ErrorTransferSize z )
� � � ��� uint32 MappingStrings SMBIOS OtherErrorDescription n 6
� z � ��� � � � string ModelCorrespondence � CIM_Memory.ErrorInfo MappingStrings � SMBIOS StartingAddress \ )
�
� ��%
5
uint64 MappingStrings =
SMBIOS|Type 19|Memory Device Mapped Addresses|Starting Address SystemLevelAddress # � )
� �
� ���
�
boolean MappingStrings �
SMBIOS|Type 18|32-bit Memory Error Information|Error Address � W i n 3 2 _ S M B I O S M e m o r y 7ʝ��C�� � Win32_SMBIOSMemory 6 � �� � % + S ] � � ���������������������������������������������������������������������������������������������������������������������������������������������������������������������� � Win32_MemoryArray CIMWin32 Locale UUID {FAF76B9A-798C-11D2-AAD1-006008C78BC7} DeviceID @ A
� � � �� � ��� � � � string Override DeviceId MappingStrings � WMI ErrorGranularity & � 6
� ; � ��C S } � uint16 MappingStrings [ SMBIOS|Type 18|Error Granularity ValueMap � � � � Other Unknown Device level Memory partition level � W i n 3 2 _ S M B I O S M e m o r y 8ʝ��C�� � Win32_SMBIOSMemory 6 � �� � & , T ^ � � ���������������������������������������������������������������������������������������������������������������������������������������������������������������������� � Win32_MemoryDevice CIMWin32 Locale UUID {FAF76B9B-798C-11D2-AAD1-006008C78BC7} DeviceID @ A
� � � �� � ��� � � � string Override DeviceId MappingStrings � WMI ErrorGranularity & � 6
� < � ��D T ~ � uint16 MappingStrings \ SMBIOS|Type 18|Error Granularity ValueMap � � � � 1 2 3 4 � C I M _ R e a l i z e s 9ʝ��C�\ CIM_Realizes 6 � �� � & . 4 \ h + 6 U��������� � Win32_MemoryDeviceLocation CIMWin32 Locale UUID {FAF76B9C-798C-11D2-AAD1-006008C78BC7} Antecedent f@ N
� � � �� � ��� � � � ref:Win32_PhysicalMemory Override Antecedent Max MappingStrings WMI|Win32_PhysicalMemory Dependent f@ A
� � � �� � ��� � � � ref:Win32_MemoryDevice Override Dependent MappingStrings � WMI|Win32_MemoryDevice � � C I M _ R e a l i z e s :ʝ��C�Q CIM_Realizes 6 � �� � % - 3 [ g " - U��������� � Win32_MemoryArrayLocation CIMWin32 Locale UUID {B24EF561-BBBE-11d2-ABFB-00805F538618} Antecedent f@ A
� � � �� � ��� � � � ref:Win32_PhysicalMemoryArray Override Antecedent MappingStrings WMI|Win32_PhysicalMemoryArray Dependent f@ A
� | � �� � ��� � � � ref:Win32_MemoryArray Override Dependent MappingStrings � WMI|Win32_MemoryArray UI � C I M _ P a c k a g e d C o m p o n e n t ;ʝ��C�w
CIM_PackagedComponent 6 � �� � ( 0 6 ^ n - < u������������� � Win32_PhysicalMemoryLocation CIMWin32 Locale UUID {B24EF562-BBBE-11d2-ABFB-00805F538618} GroupComponent f@ A
� � � �� � ��� � � ref:Win32_PhysicalMemoryArray Override GroupComponent MappingStrings WMI|Win32_PhysicalMemoryArray PartComponent f@ A
� � � �� � ��� � � � ref:Win32_PhysicalMemory Override PartComponent MappingStrings � WMI|Win32_PhysicalMemory �
C I M _ C o m p o n e n t <ʝ��C�R CIM_Component 6 � �� � # + 1 Y i ' e��������� � Win32_MemoryDeviceArray CIMWin32 Locale UUID {B24EF563-BBBE-11d2-ABFB-00805F538618} GroupComponent f@ A
� � � �� � ��� � � � ref:Win32_MemoryArray Override GroupComponent MappingStrings WMI|Win32_MemoryArray PartComponent f@ A
� v � �� � ��� � � � ref:Win32_MemoryDevice Override PartComponent MappingStrings � WMI|Win32_MemoryDevice � C I M _ L o g i c a l E l e m e n t =ʝ��C�� CIM_LogicalElement ) �� ( . ����������������������V � Win32_COMApplication abstract Locale UUID {0F73ED4F-8ED9-11d2-B340-00105A1F8569} � C I M _ L o g i c a l E l e m e n t >ʝ��C�� CIM_LogicalElement ) �� " ( ����������������������P � Win32_COMClass abstract Locale UUID {0F73ED50-8ED9-11d2-B340-00105A1F8569} � ĝ X� C
�Ըr# @ G� +c � /t�^ � ��m� � �T uo � E�n�J 2 DRW�| � �^�e2 > ���p
����} 4��ۉ � K]�4 � C I M _ L o g i c a l D e v i c e |ɝ��C�� T CIM_LogicalDevice @ Z � � X i � � � � � ����U������������������������������������������������������������������������������* � CIM_USBDevice ClassCode D
� 9 uint8 CurrentAlternateSettings I
� � � � uint8 ModelCorrespondence � CIM_USBDevice.CurrentConfigValue CurrentConfigValue H
� ( uint8 ModelCorrespondence 0 CIM_USBDevice.CurrentAlternateSettings NumberOfConfigs G
� � uint8 ProtocolCode F
� � uint8 SubclassCode E
� � uint8 USBVersion B
� " uint16 +
�
� GetDescriptor � ae442007200009F ROOT\CIMV2 ���� � �4 �� � � O � * � � F U�������� � __PARAMETERS abstract RequestType uint8
� 7 IN
� 7 ] �� ID )
� � ] ��� uint8 RequestValue uint16
� � IN
� � �� ID )
� } ��B uint16 RequestIndex uint16
� � IN
� � � �� ID )
� 5 � ��� uint16 RequestLength uint16
� ^ IN
� ^ � �� ID )
� � � ��� uint16 __ �e ae442007200009F ROOT\CIMV2 ���� � � �� � E * � � � ���������� � __PARAMETERS abstract RequestLength uint16
� 9 OUT
� 9 ` �� ID )
� � ` ��� uint16 Buffer uint8
� � OUT
� � �� ID )
� | ��A uint8 ReturnValue uint32
� � uint32 out
� � � �� __ �
C I M _ U S B D e v i c e }ɝ��C� W CIM_USBDevice B Q ������_��������������������������������������������������������������������������������w � CIM_USBHub GangSwitched M
� 9 boolean NumberOfPorts O
� p uint8 � C I M _ C o n t r o l l e d B y ~ɝ��C�s CIM_ControlledBy % � � �������������������������������� � CIM_USBControllerHasHub Antecedent f@ 8
� k � � � � ref:CIM_USBController Override Antecedent Min Max Dependent f@ +
� � � ref:CIM_USBHub Override Dependent Min � C I M _ S t a t i s t i c a l I n f o r m a t i o n ɝ��C�@ ? $ CIM_StatisticalInformation �� 0 W k � � � � A U U�������������������������������������������������������������| � Win32_Perf abstract Locale Frequency_Object ,
� O uint64 Frequency_PerfTime
� � uint64 Frequency_Sys100NS $
� � uint64 Timestamp_Object 4
� � uint64 Timestamp_PerfTime
� 9 uint64 Timestamp_Sys100NS
� t uint64 �
W i n 3 2 _ P e r f �ɝ��C�� ? Win32_Perf �� ���������������������������������������������������������������% � Win32_PerfRawData abstract Locale �
W i n 3 2 _ P e r f �ɝ��C�� ? Win32_Perf ��# ���������������������������������������������������������������+ � Win32_PerfFormattedData abstract Locale � _ _ E x t e n d e d S t a t u s �ɝ��C�� __ExtendedStatus & N a � � ����������������������������� � Win32_PrivilegesStatus Locale UUID {BE46D060-7A7C-11d2-BC85-00104B2CF71C} PrivilegesNotHeld )
� � � ��� � string MappingStrings � Win32API|AccessControl|Windows NT Privileges PrivilegesRequired )
� 1 � ��9 I string MappingStrings Q Win32API|AccessControl|Windows NT Privileges � �ɝ��C�� ) ��& . 4 \ � Win32_MethodParameterClass Abstract Locale UUID {8502C4DA-5FBB-11D2-AAC1-006008C78BC7} s �5 7 E 5 F 3 A D D 9 E 2 4 2 C 4 E 9 F 9 E D F 7 9 A A 9 7 F 7 9 E 7 9 1 1 C 5 A 8 B 9 0 2 E C 1 5 0 D 6 4 4 2 E 3 B 8 5 A 5 A A �ɝ��C�ȝ��C�� �?����B 9 L � __Win32Provider {A83EF168-CA8D-11d2-B33D-00104BCC4B4A} WmiCore WBEMCORE E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C �ɝ��C� ȝ��C�} �� ���� �� P � __InstanceProviderRegistration \\.\Root\CIMV2:__Win32Provider.Name="WBEMCORE"
R O O T \ C I M V 2 _ _ I n s t a n c e P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 6 8 5 7 7 3 7 2 C 6 6 A 7 B 2 0 6 5 8 4 8 7 F B D 9 5 9 A A 1 5 4 E F 5 4 B 5 F 9 3 5 D C C 5 6 6 3 E 9 2 2 8 B 4 4 3 2 2 8 0 5 \ K I _ E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C \ I _ 5 8 F 8 9 7 3 3 7 2 F 3 5 0 1 A 9 E C 1 1 5 3 9 D 1 5 E 2 5 F C 4 F C F C 2 D 0 A B 8 D 6 4 B D 3 D 0 F D 5 B E 8 7 B 7 4 0 C 6 C I M _ E l e m e n t S e t t i n g �ɝ��C�L CIM_ElementSetting 6 � �� � ( 0 6 ^ g e��������� � Win32_PageFileElementSetting CIMWin32 Locale UUID {8E7F70E8-C856-11D2-B364-00105A1F77A1} Element f@ A
� � � �� � ��� � � � ref:Win32_PageFileUsage Override Element MappingStrings � WMI|Win32_PageFileUsage Setting f@ A
� k � �� � ��� � � � ref:Win32_PageFileSetting Override Setting MappingStrings � WMI|Win32_PageFileSetting 6- � C I M _ S e t t i n g ?ʝ��C��
CIM_Setting
) �� $ * ������������R � Win32_COMSetting abstract Locale UUID {E5D8A560-F6C0-11d2-B35E-00105A1F8569} � � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ ����������������������������������������������������������������3
� Win32_NetworkConnection CIMWin32 Locale UUID {8502C4CD-5FBB-11D2-AAC1-006008C78BC7} AccessMask > 6
� � � ��� � � � uint32 Schema Win32 BitMap
# ' + / 0 1 2 3 4 5 6 7 8 16 17 18 19 20 Comment )
� s � ��{ � string MappingStrings � Win32API|Windows Networking Structures|NETRESOURCE|lpComment ConnectionState C
� 3 � ��; C M � � string MaxLen ValueMap i t { � � � Connected Error Paused Disconnected Connecting Reconnecting MappingStrings � Win32API|Network Management Structures|USE_INFO_1|ui1_status ConnectionType 6
� U � ��] m � � string MappingStrings u Win32API|Windows Networking Structures|NETRESOURCE|dwScope ValueMap � � Current Connection Persistent Connection DisplayType 6
� C � ��K [ � � string MappingStrings c Win32API|Windows Networking Structures|NETRESOURCE|dwDisplayType ValueMap � � � � Domain Generic Server Share LocalName $ )
� % � ��- = string MappingStrings E Win32API|Windows Networking Structures|NETRESOURCE|lpLocalName Name @ A
� � � �� � ��� � � string Override Name MappingStrings
Win32API|Windows Networking Structures|NETRESOURCE Persistent
( )
� � � ��� � boolean MappingStrings � Win32API|Windows Networking Functions|WNetEnumResource ProviderName * )
� � ��' 7 string MappingStrings ? Win32API|Windows Networking Structures|NETRESOURCE|lpProvider RemoteName . )
� � � ��� � string MappingStrings � Win32API|Windows Networking Structures|NETRESOURCE|lpRemoteName RemotePath
2 )
� e � ��m } string MappingStrings � Win32API|Windows Networking Structures|NETRESOURCE|lpRemoteName ResourceType 6 6
� � �� 0 s } string MappingStrings 8 Win32API|Windows Networking Structures|NETRESOURCE|dwType ValueMap � � � Disk Print Any UserName : )
� � � ��� � string MappingStrings
Win32API|Windows Networking Functions|WNetGetUser � C I M _ L o g i c a l E l e m e n t #ʝ��C� CIM_LogicalElement 6 � �� � ' - U c �������������������������� � Win32_NetworkClient CIMWin32 Locale UUID {8502C4D5-5FBB-11D2-AAC1-006008C78BC7} Manufacturer )
� � � ��� � string MappingStrings � Win32Registry|SYSTEM\CurrentControlSet\Services\LanmanWorkstation\NetworkProvider|Mfg Name @ A
� f � �� � ��n x ~ � string Override Name MappingStrings � Win32Registry|SYSTEM\CurrentControlSet\Services\LanmanWorkstation\NetworkProvider|Name Wo � C I M _ L o g i c a l E l e m e n t $ʝ��C�� D CIM_LogicalElement 6 � �� � ! ) / W n 0 � � � � S g � � m s 1 G � � � z � @ T �
�
�
� � H e
.
�
�
WUUU��������������������������������������������������������������� � Win32_NetworkProtocol CIMWin32 Locale UUID {8502C4D8-5FBB-11D2-AAC1-006008C78BC7} ConnectionlessService )
� � � ��� � boolean MappingStrings � Win32_API|Windows Sockets Structures|PROTOCOL_INFO|dwServiceFlags|XP1_CONNECTIONLESS GuaranteesDelivery )
� g � ��p � boolean MappingStrings � Win32_API|Windows Sockets Structures|PROTOCOL_INFO|dwServiceFlags|XP_GUARANTEED_DELIVERY GuaranteesSequencing )
� / � ��8 H boolean MappingStrings P Win32_API|Windows Sockets Structures|PROTOCOL_INFO|dwServiceFlags|XP_GUARANTEED_ORDER MaximumAddressSize )
� � � ���
uint32 MappingStrings Win32_API|Windows Sockets Structures|PROTOCOL_INFO|iMaxSockAddr MaximumMessageSize )
� � � ��� � uint32 MappingStrings � Win32_API|Windows Sockets Structures|PROTOCOL_INFO|dwMessageSize MessageOriented
" )
� H � ��Q a boolean MappingStrings i Win32_API|Windows Sockets Structures|PROTOCOL_INFO|dwServiceFlags|XP_MESSAGE_ORIENTED MinimumAddressSize $ )
� � �� # uint32 MappingStrings + Win32_API|Windows Sockets Structures|PROTOCOL_INFO|iMinSockAddr Name @ A
� � � �� � ��� � � � string Override Name MappingStrings � Win32_API|Windows Sockets Structures|PROTOCOL_INFO|lpProtocol PseudoStreamOriented ( )
� ~ � ��� � boolean MappingStrings � Win32_API|Windows Sockets Structures|PROTOCOL_INFO|dwServiceFlags|XP_PSEUDO_STREAM SupportsBroadcasting
* )
� @ � ��I Y boolean MappingStrings a Win32_API|Windows Sockets Structures|PROTOCOL_INFO|dwServiceFlags|XP_SUPPORTS_BROADCAST SupportsConnectData , )
� � �� boolean MappingStrings ' Win32_API|Windows Sockets Structures|PROTOCOL_INFO|dwServiceFlags|XP_CONNECT_DATA SupportsDisconnectData . )
� � � ��� � boolean MappingStrings � Win32_API|Windows Sockets Structures|PROTOCOL_INFO|dwServiceFlags|XP_DISCONNECT_DATA SupportsEncryption 0 )
� � � ��� � boolean MappingStrings � Win32_API|Windows Sockets Structures|PROTOCOL_INFO|dwServiceFlags|XP_ENCRYPTS SupportsExpeditedData 2 )
� I
� ��R
b
boolean MappingStrings j
Win32_API|Windows Sockets Structures|PROTOCOL_INFO|dwServiceFlags|XP_EXPEDITED_DATA SupportsFragmentation 4 )
�
� �� & boolean MappingStrings . Win32_API|Windows Sockets Structures|PROTOCOL_INFO|dwServiceFlags|XP_FRAGMENTATION SupportsGracefulClosing 6 )
� � � ��� � boolean MappingStrings � Win32_API|Windows Sockets Structures|PROTOCOL_INFO|dwServiceFlags|XP_GRACEFUL_CLOSE SupportsGuaranteedBandwidth 8 )
� � � ��� � boolean MappingStrings � Win32_API|Windows Sockets Structures|PROTOCOL_INFO|dwServiceFlags|XP_BANDWIDTH_ALLOCATION SupportsMulticasting : )
� e
� ��n
~
boolean MappingStrings �
Win32_API|Windows Sockets Structures|PROTOCOL_INFO|dwServiceFlags|XP_SUPPORTS_MULTICAST SupportsQualityofService < )
� 0 � ��9 I boolean MappingStrings Q Win32_API|Windows Sockets Structures|WSAPROTOCOL_INFO|dwServiceFlags1|XP1_QOS_SUPPORTED � ��P � wE��� � � 0�� � ��!�I p �wR|�C�� ) % 6 ��A I Q � PS_DnsClientNrptGlobal Description DNS Client NRPT AMENDMENT LOCALE MS_409 � nsC D rip
b � � � Set # Description Modifies Global NRPT settings �
a42c9160500003S ROOT\Microsoft\Windows\Dns\MS_409 ���� � �Y
�� * c H V 6 � � � ; � U������������������������ � __PARAMETERS abstract EnableDAForAllNetworks string
� B In
� B i �� Property that controls Direct Access Description )
� B i ��� � ID 6
� I i ��� � string GpoName string
� l In
� l � �� Name of GPO, if not specified the default GPO on the domain
Description )
� l � �� � ID 6
� � � �� � D string SecureNameQueryFallback string
� � In
� � � �� Property for controlling DNS client name resolution fallback policy. Description )
� � � ��Z ID 6
� � � ��Z � string QueryPolicy string
�
In
�
4 �� Property for controlling DNS client query policy. Description )
�
4 ��� b ID 6
� ! 4 ��� b � string Server string
� C In
� C j �� Server hosting the GPO Description )
� C j ��� � ID 6
� < j ��� � � string PassThru boolean
� ` In
� ` � �� Specifies if result of the cmdlet should be displayed Description )
� ` � ��� � ID 6
� z � ��� � 2 boolean __ �� a42c9160500003S ROOT\Microsoft\Windows\Dns\MS_409 ���� � �� �� * e � ��������B � __PARAMETERS abstract
cmdletOutput object
� 8 Out
� 8 _ �� Microsoft.Management.Infrastructure.CimInstance#DnsClientNrptGlobal object contains all the properties of DNS client NRPT Global settings. Description
)
� 8 _ �� � ID
6
� � _ �� � a object:DnsClientNrptGlobal ReturnValue uint32
� uint32 out
� �� __ � Get ( Description Retrieves Name Resolution Policy Table global settings o a42c9160500003S ROOT\Microsoft\Windows\Dns\MS_409 ���� � � �� E * * � ��������v � __PARAMETERS abstract Server string
� 2 In
� 2 Y �� Server hosting the GPO Description )
� 2 Y ��� � ID 6
� + Y ��� � � string GpoName string
� N In
� N u �� Name of GPO, if not specified the default GPO on the domain
Description )
� N u ��� � ID 6
� n u ��� � & string __ �� a42c9160500003S ROOT\Microsoft\Windows\Dns\MS_409 ���� � �� �� * e � ��������B � __PARAMETERS abstract
cmdletOutput object
� 8 Out
� 8 _ �� Microsoft.Management.Infrastructure.CimInstance#DnsClientNrptGlobal object contains all the properties of DNS client NRPT Global settings. Description
)
� 8 _ �� � ID
6
� � _ �� � a object:DnsClientNrptGlobal ReturnValue uint32
� uint32 out
� �� __ � �wR|�C�| ) ' ��2 : � MSFT_SmbShare DisplayName Smb Share AMENDMENT LOCALE � �wR|�C�� ) ! . N ��Y a � MSFT_SmbShareAccessControlEntry DisplayName Smb Share Access Control Entry AMENDMENT LOCALE �4 1 C 5 3 E 6 D B 1 A C F 2 4 5 3 C E F D 4 1 3 9 8 1 9 8 E 6 1 3 F 1 0 D F F 4 7 7 0 9 E C A B 1 D 7 F 0 3 7 7 5 6 A C 8 C E 7 �:Ͼlu�ȝ��C�� � � __thisNAMESPACE � �� � � # ? z�s�` � �"))
) �6�KR K �1�ӝ a M��� _ C I M _ M a n a g e d E l e m e n t
֝��C�� 2 CIM_ManagedElement ) * C ��M
U j � � � � � � � �
2 E � � � � � �UU������������������������������������������������ � CIM_ManagedSystemElement UMLPackagePath CIM::Core::CoreElements Abstract locale CommunicationStatus
&
� � � � uint16 ValueMap � � � � � � � 0 1 2 3 4 .. 0x8000.. DetailedStatus ( +
� . 6 @ � � uint16 ValueMap d g j m p s v z 0 1 2 3 4 5 .. 0x8000.. ModelCorrespondence � � CIM_EnabledLogicalElement.PrimaryStatus CIM_ManagedSystemElement.HealthState HealthState $
� - 5 ? uint16 ValueMap c f i m q u y } 0 5 10 15 20 25 30 .. InstallDate e
� � datetime Name
� � � string MaxLen OperatingStatus * +
� C K U � uint16 ValueMap � � � � � � � � � � � � � � � � � � � 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 .. 0x8000.. ModelCorrespondence
CIM_EnabledLogicalElement.EnabledState OperationalStatus 8
� � � � E P Y n uint16 ValueMap � � � �
# ' + / 3 7 ; 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 .. 0x8000.. ArrayType Indexed ModelCorrespondence v CIM_ManagedSystemElement.StatusDescriptions PrimaryStatus
, +
� � � � 3 H uint16 ValueMap " % ) 0 1 2 3 .. 0x8000.. ModelCorrespondence T } CIM_ManagedSystemElement.DetailedStatus CIM_ManagedSystemElement.HealthState Status 8
� � � 9 C �
string Deprecated
CIM_ManagedSystemElement.OperationalStatus ValueMap
{ � � � � � � � � � � � OK Error Degraded Unknown Pred Fail Starting Stopping Service Stressed NonRecover No Contact Lost Comm Stopped MaxLen StatusDescriptions +
� L T _ h } string ArrayType Indexed ModelCorrespondence � CIM_ManagedSystemElement.OperationalStatus � C I M _ M a n a g e d S y s t e m E l e m e n t ֝��C�� 2 " CIM_ManagedSystemElement ) $ = ��G ��������������������������������������������������O � CIM_LogicalElement UMLPackagePath CIM::Core::CoreElements Abstract locale � C I M _ L o g i c a l E l e m e n t ֝��C� m CIM_LogicalElement 6 ' @ � �� � H ` l � � � 8 C j s � � � � � 8 G n { � � � � ! H N � � ���_UUU������������������������������������������������������������������������������������������������������� � MSFT_AutologgerConfig UMLPackagePath CIM::Core::CoreElements locale EventTracingManagement BufferSize .
� � uint32 ClockType 2
� � � � uint32 ValueMap � � � 1 2 3 DisableRealtimePersistence 6
� 0 uint32 FileCount :
� b uint32 FileMax B
� � uint32 FlushTimer F
� � uint32 Guid J
� � string InitStatus b
� 0 � �� uint32 LocalFilePath >
� f string LogFileMode N
� � uint32 MaximumBuffers V
� � uint32 MaximumFileSize R
� uint32 MinimumBuffers Z
� @ uint32 Name @ )
� � � � �� string MaxLen Start ^
� � uint32 � C I M _ L o g i c a l E l e m e n t ֝��C�% U CIM_LogicalElement 6 ' @ � �� � H ` p � � � � ? P w } � � � � ���_U��������������������������������������������������������������������������������) � MSFT_EtwTraceProvider UMLPackagePath CIM::Core::CoreElements locale EventTracingManagement AutologgerName 2
� � � �� string Guid .
� � � �� string Level :
� uint8 MatchAllKeyword C
� 7 uint64 MatchAnyKeyword ;
� o uint64 Name @
� � � string MaxLen Property K
� � uint32 SessionName 6
� ! � �� string � C I M _ L o g i c a l E l e m e n t ֝��C�� T CIM_LogicalElement 6 & ? � �� � G _ k � � � ' 6 ] j � � � � 7 = ���_U�������������������������������������������������������������������������������� � MSFT_EtwTraceSession UMLPackagePath CIM::Core::CoreElements locale EventTracingManagement BufferSize 2
� � uint32 ClockType B
� � � � uint32 ValueMap � � � 1 2 3 FlushTimer >
� uint32 LocalFilePath J
� U string LogFileMode .
� � uint32 MaximumBuffers :
� � uint32 MaximumFileSize F
� � uint32 MinimumBuffers 6
� / uint32 Name @ )
� t | � �� string MaxLen � " � � � Send �� implemented � ae442007200009F ROOT\microsoft\windows\EventTracingManagement ���� � �N �� � M * � ������� � __PARAMETERS abstract DestinationFolder string
� = In
� = d �� ID )
� � d ��� string DeleteFile boolean
� � In
� � �� ID )
� � ��I boolean __ �� ae442007200009F ROOT\microsoft\windows\EventTracingManagement ���� � �
�� � J � � * � ������������ � __PARAMETERS abstract SourceFilePath string
� : Out
� : a �� ID )
� � a ��� string ErrorCode uint32
� � Out
� � �� ID )
� � ��F uint32 ReturnValue uint32
� � uint32 out
� � � �� __ � �&� /�y�� � +�(u � ��8W � ��T !T6# � vnS a<�& � �֖ � t �� Q � $QW4 � C I M _ L o g i c a l E l e m e n t �ȝ��C�� O CIM_LogicalElement ) �� $ L _ � � d l � 6 > � � � � | � H b � � � �WUU���������������������������������������������������������������������������� � CIM_Thread Abstract Locale UUID {8502C571-5FBB-11D2-AAC1-006008C78BC7} CreationClassName , 4
� � � ��� ��� string Cim_Key MaxLen CSCreationClassName A
� � ��& 2 S ��\ string Propagated CIM_Process.CSCreationClassName Cim_Key MaxLen CSName A
� � � ��� � � ��� string Propagated CIM_Process.CSName Cim_Key MaxLen ExecutionState 8
� . � �� uint16 Handle 0 4
� � � �� � ��� string MaxLen KernelModeTime B
� � � �� uint64 OSCreationClassName A
� 6 � ��> J k ��t string Propagated CIM_Process.OSCreationClassName Cim_Key MaxLen OSName A
� � � ��� � � �� string Propagated CIM_Process.OSName Cim_Key MaxLen Priority
4
� @ � �� uint32 ProcessCreationClassName $ A
� � � ��� � � ��� string Propagated CIM_Process.CreationClassName Cim_Key MaxLen ProcessHandle
( A
� S � ��[ g � ��{ string Propagated CIM_Process.Handle MaxLen UserModeTime :
� � � �� uint64 � �ȝ��C��
)
�� % M V � � � � U������������. � CIM_Setting Abstract Locale UUID {8502C572-5FBB-11D2-AAC1-006008C78BC7} Caption )
� � � ��� @ string MaxLen Description
� � � �� string SettingID )
� � ��& string MaxLen � C I M _ S e t t i n g �ȝ��C�� - CIM_Setting
6 � �� � ) 1 7 _ u K [ $ 4 �
� � n x � � � }U�������������������������������������������� � CIM_VideoControllerResolution CIMWin32 Locale UUID {1008CCEA-7BFF-11D2-AAD2-006008C78BC7} HorizontalResolution 6
� � � ��� � uint32 ModelCorrespondence � CIM_VideoController.CurrentHorizontalResolution MappingStrings ' MIF.DMTF|Monitor Resolutions|002.2 MaxRefreshRate 6
� � � ��� � � � uint32 ModelCorrespondence � CIM_VideoController.MaxRefreshRate MappingStrings MIF.DMTF|Monitor Resolutions|002.7 MinRefreshRate 6
� x � ��� � � � uint32 ModelCorrespondence � CIM_VideoController.MinRefreshRate MappingStrings � MIF.DMTF|Monitor Resolutions|002.6 NumberOfColors " )
� D � ��L a uint64 ModelCorrespondence i CIM_VideoController.CurrentNumberOfColors RefreshRate 6
� � � ��� 2 B uint32 ModelCorrespondence
CIM_VideoController.CurrentRefreshRate MappingStrings J MIF.DMTF|Monitor Resolutions|002.4 ScanMode C
� � � ��� � D T uint16 ValueMap � � � � � 1 2 3 4 5 ModelCorrespondence CIM_VideoController.CurrentScanMode MappingStrings \ MIF.DMTF|Monitor Resolutions|002.5 SettingID @ A
� � � ��� � � � �� string MaxLen Override SettingID VerticalResolution 6
� W � ��_ t � � uint32 ModelCorrespondence | CIM_VideoController.CurrentVerticalResolution MappingStrings � MIF.DMTF|Monitor Resolutions|002.3 � �ȝ��C�� ? �� ��& ��3 ; A i y � � e��������. � CIM_Component Association Abstract Aggregation Locale UUID {8502C573-5FBB-11D2-AAC1-006008C78BC7} GroupComponent f '
� � � ��� �� ref:CIM_ManagedSystemElement Aggregate PartComponent f
� � �� ref:CIM_ManagedSystemElement ct �
C I M _ C o m p o n e n t �ȝ��C�� CIM_Component 6 � �� � % - 3 [ k � � e��������h � CIM_DirectoryContainsFile CIMWin32 Locale UUID {6F9D4740-8324-11d2-AAD9-006008C78BC7} GroupComponent f@ A
� � � �� � ��� � � ref:CIM_Directory Override GroupComponent Max PartComponent f@ 4
� = � �� � ��O Y ref:CIM_DataFile Override PartComponent �
C I M _ C o m p o n e n t �ȝ��C�� CIM_Component ) �� ' - U e � � e��������C � CIM_SystemComponent Abstract Locale UUID {527BC6CE-BAFE-11d2-85E5-0000F8102E5F} GroupComponent f@ )
� � � ��� � ref:CIM_System Override GroupComponent PartComponent f@ )
� � ��* 4 ref:CIM_ManagedSystemElement Override PartComponent em � C I M _ S y s t e m C o m p o n e n t �ȝ��C�� CIM_SystemComponent ) �� $ * R b � � e��������n � CIM_SystemDevice Abstract Locale UUID {4B2C30D7-BAFE-11d2-85E5-0000F8102E5F} GroupComponent f@ C
� � � ��� � � � ref:CIM_System Override GroupComponent Max Min PartComponent f@ 4
� 8 � ��O Y h �� ref:CIM_LogicalDevice Override PartComponent Weak � C I M _ S y s t e m C o m p o n e n t �ȝ��C�y CIM_SystemComponent ) �� # ) Q a � � w � U����������� � CIM_InstalledOS Abstract Locale UUID {8502C575-5FBB-11D2-AAC1-006008C78BC7} GroupComponent f@ C
� � � ��� � � � ref:CIM_ComputerSystem Override GroupComponent Min Max PartComponent f@ 4
� ? � ��X b q �� ref:CIM_OperatingSystem Override PartComponent Weak PrimaryOS )
� � � ��� � boolean MappingStrings � MIF.DMTF|Operating System|001.4 � �ȝ��C�\ 4 �� ��+ 3 9 a j � � e��������� � CIM_ElementSetting Abstract Association Locale UUID {8502C577-5FBB-11D2-AAC1-006008C78BC7} Element f
� � � �� ref:CIM_ManagedSystemElement Setting f
� � � �� ref:CIM_Setting U � C I M _ E l e m e n t S e t t i n g �ȝ��C�� CIM_ElementSetting ) �� $ * R [ � � e��������4 � CIM_VideoSetting Abstract Locale UUID {1008CCEB-7BFF-11D2-AAD2-006008C78BC7} Element f@ )
� � � ��� � ref:CIM_VideoController Override Element Setting f@ )
� � � ��! + ref:CIM_VideoControllerResolution Override Setting � �6 4 6 5 9 A B 9 F 8 F 1 C 4 B 5 6 8 D B 6 4 3 8 B A E 1 1 B 2 6 E E 8 F 9 3 C B 5 F 8 1 9 5 E 2 1 E 8 C 3 8 3 D 6 C 4 4 C C 4 1 ֝��C�ȝ��C�1
� __NAMESPACE DeviceGuard �(Qp __�� � �o��: � ��� � e���o � }�* � � W i n 3 2 _ C O M S e t t i n g Dʝ��C�� i Win32_COMSetting 6 � �� � ( 0 6 ^ e � � � � ; D � � � � Z k ) � � � � D O � � w
�
6 > � � � � �
�
j x / � � � � UUUUU���������������������������������������������������������������������������������������������������[ � Win32_ClassicCOMClassSetting CIMWin32 Locale UUID {E5D8A562-F6C0-11d2-B35E-00105A1F8569} AppID )
� � � ��� � string MappingStrings � Win32Registry|HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{GUID}[AppID] AutoConvertToClsid F )
� N � ��V f string MappingStrings n Win32Registry|HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{GUID}\AutoConvertTo[Default] AutoTreatAsClsid J )
� � �� & string MappingStrings . Win32Registry|HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{GUID}\AutoTreatAs[Default] ComponentId 4
� � � �� � ��� � string MappingStrings � Win32Registry|HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{GUID}[Default] Control " )
� { � ��� � boolean MappingStrings � Win32Registry|HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{GUID}\Control DefaultIcon N )
� ( � ��0 @ string MappingStrings H Win32Registry|HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{GUID}\DefaultIcon[Default] InprocHandler > )
� � � ��� � string MappingStrings Win32Registry|HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{GUID}\InprocHandler[Default] InprocHandler32 B )
� � � ��� � string MappingStrings � Win32Registry|HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{GUID}\InprocHandler32[Default] InprocServer
. )
� ` � ��h x string MappingStrings � Win32Registry|HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{GUID}\InprocServer[Default] InprocServer32 2 )
� � ��% 5 string MappingStrings = Win32Registry|HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{GUID}\InprocServer32[Default] Insertable )
� � � ��� � boolean MappingStrings � Win32Registry|HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{GUID}\Insertable JavaClass ( )
� � � ��� � boolean MappingStrings � Win32Registry|HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{GUID}\InprocServer32[JavaClass] LocalServer 6 )
� E � ��M ] string MappingStrings e Win32Registry|HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{GUID}\LocalServer[Default] LocalServer32 : )
�
� ��
string MappingStrings
Win32Registry|HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{GUID}\LocalServer32[Default] LongDisplayName Z )
� �
� ���
�
string MappingStrings �
Win32Registry|HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{GUID}\AuxUserType\3[Default] ProgId )
� u � ��} � string MappingStrings � Win32Registry|HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{GUID}\ProgID[Default] ShortDisplayName V )
� . � ��6 F string MappingStrings N Win32Registry|HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{GUID}\AuxUserType\2[Default] ThreadingModel 6
� � � ��
2
B
string ValueMap
&
,
Apartment Free Both MappingStrings J
Win32Registry|HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{GUID}\InprocServer32[ThreadingModel] ToolBoxBitmap32 ^ )
� �
� ���
string MappingStrings Win32Registry|HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{GUID}\ToolBoxBitmap32[Default] TreatAsClsid * )
� � � ��� � string MappingStrings � Win32Registry|HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{GUID}\TreatAs[Default] TypeLibraryId
$ )
� f � ��n ~ string MappingStrings � Win32Registry|HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{GUID}\TypeLib[Default] Version )
� � �� / string MappingStrings 7 Win32Registry|HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{GUID}\Version[Default] VersionIndependentProgId R )
� � � ��� � string MappingStrings � Win32Registry|HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{GUID}\VersionIndependentProgId[Default] � W i n 3 2 _ C O M A p p l i c a t i o n C l a s s e s Eʝ��C�c % Win32_COMApplicationClasses 6 � �� � $ . 6 < d t / e��������� � Win32_ClassicCOMApplicationClasses CIMWin32 Locale UUID {0F73ED54-8ED9-11d2-B340-00105A1F8569} GroupComponent f@ 6
� � � ��� � � � ref:Win32_DCOMApplication Override GroupComponent MappingStrings WMI|Win32_DCOMApplication PartComponent f@ 6
� s � ��� � � � ref:Win32_ClassicCOMClass Override PartComponent MappingStrings � WMI|Win32_ClassicCOMClass pp � C I M _ E l e m e n t S e t t i n g Fʝ��C�^ CIM_ElementSetting 6 � �� � ( 0 6 ^ g e��������� � Win32_COMApplicationSettings CIMWin32 Locale UUID {E5D8A563-F6C0-11d2-B35E-00105A1F8569} Element f@ A
� � � �� � ��� � � � ref:Win32_DCOMApplication Override Element MappingStrings � WMI|Win32_DCOMApplication Setting f@ A
� o � �� � ��� � � � ref:Win32_DCOMApplicationSetting Override Setting MappingStrings � WMI|Win32_DCOMApplicationSetting nt � C I M _ E l e m e n t S e t t i n g Gʝ��C�_ CIM_ElementSetting 6 � �� � ) 1 7 _ h ! e��������� � Win32_ClassicCOMClassSettings CIMWin32 Locale UUID {E5D8A564-F6C0-11d2-B35E-00105A1F8569} Element f@ A
� � � �� � ��� � � � ref:Win32_ClassicCOMClass Override Element MappingStrings � WMI|Win32_ClassicCOMClass Setting f@ A
� p � �� � ��� � � � ref:Win32_ClassicCOMClassSetting Override Setting MappingStrings � WMI|Win32_ClassicCOMClassSetting me � C I M _ L o g i c a l E l e m e n t Hʝ��C�S CIM_LogicalElement 6 � �� � # + 1 Y e �������������������������� � Win32_ComponentCategory CIMWin32 Locale UUID {0F73ED5A-8ED9-11d2-B340-00105A1F8569} CategoryId A
� � � �� � ��� � � string MaxLen MappingStrings � Win32API|Component Categories|CATEGORYINFO|catid Name @ 6
� X � ��` j p � string Override Name MappingStrings � Win32API|Component Categories|CATEGORYINFO|szDescription � C I M _ D e p e n d e n c y Vʝ��C�f CIM_Dependency 6 � �� � & , T ` � � U��������� � Win32_LoggedOnUser CIMWin32 Locale UUID {8BB5B3EC-E1F7-4b39-942A-605D5F55789A} Antecedent f@
� � � �� ref:Win32_Account Dependent f@
� � � �� ref:Win32_LogonSession � U�_
� < ���� � $ �tW � �� [� K �&}5 � s�|� g �[��j = M�� 0 ' X e S o s P k g _ l a r g e _ c a c h e _ e n t r y _ v a l u e _ c h a n g e _��7 �� f 1 XeSosPkg_large_cache_entry_value_change ) ) � �� + 9 E � K Z � � * 6 � � � P f � � 6 F � � _ q � � # WUUU��������������������������������������������������������������������������������������������������� � large_cache_entry_value_change EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid average_interval 9 )
� 8 @ � �� real64 WmiDataId cache_address
4
� � � � ��� �� object WmiDataId Pointer descriptor_address
4
� � ��! �� object WmiDataId Pointer FragmentId 6
� z � � � � �� uint32 WmiDataId Description FragmentId new_value Y )
� � � � �� real64 WmiDataId old_value Q )
� = E � �� real64 WmiDataId probability_of_reuse I )
� � � � �� real64 WmiDataId RemainingLength 6
�
% � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber size_in_pages ! )
� � �� uint64 WmiDataId state P
� x � ��� � � � � uint8 WmiDataId XEMapId ValueMap � � � � 0 1 2 3 Values � � � � Actual Simulated History Destroyed time_since_last_use
A )
� L T
� �� real64 WmiDataId time_to_generate
) )
� � �
� �� real64 WmiDataId use_count 1 )
� � � �� uint64 WmiDataId user_data_address
4
� e m � ��x �� object WmiDataId Pointer � X e S o s P k g _��7 �c XeSosPkg
C � ��& 3 � � � � � � _����� � XeSosPkg_large_cache_memory_pressure Description Occurs when we try to reclaim memory from a large cache store due to memory pressure. Guid {29752c32-d9e4-42c3-9416-411f29056a73} locale MS\0x409 DisplayName large_cache_memory_pressure �$ X e S o s P k g _ l a r g e _ c a c h e _ m e m o r y _ p r e s s u r e _��7 �3 f . XeSosPkg_large_cache_memory_pressure & ) � �� ( 6 B � � H X � � g { � � U k � � ; K � � * t � � : A � � WUUU��������������������������������������������������������������������������������������������������� � large_cache_memory_pressure EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid average_interval 8 )
� 5 = � �� real64 WmiDataId benefit_cutoff X )
� � � � �� real64 WmiDataId cache_address
4
� � � � �� �� object WmiDataId Pointer cutoff_index P )
� T \ � �� uint64 WmiDataId descriptor_address
4
� � � � ��� �� object WmiDataId Pointer FragmentId 6
� ) 1 < I � �� uint32 WmiDataId Description FragmentId probability_of_reuse @ )
� � � � �� real64 WmiDataId RemainingLength 6
�
* � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber size_in_pages )
�
� �� uint64 WmiDataId time_to_generate ( )
� a i � �� real64 WmiDataId use_count
0 )
� � �
� �� uint64 WmiDataId user_data_address
4
� & � ��1 �� object WmiDataId Pointer value
H )
� x �
� �� real64 WmiDataId was_removed ` )
� � � � �� sint8 WmiDataId � X e S o s P k g _��7 �# XeSosPkg
C � �� ) T Z � � � � _����� � XeSosPkg_large_cache_sweep Description Records the result of a large-cache sweep Guid {cb080d31-0a40-49e9-a34b-e1fe09b26ff9} locale MS\0x409 DisplayName large_cache_sweep � X e S o s P k g _ l a r g e _ c a c h e _ s w e e p _��7 �� < $ XeSosPkg_large_cache_sweep ) � ��
, 8 � � O ` � � � � � / @ � � 9 K WU���������������������������������������������������������� � large_cache_sweep EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid cache_address
4
� 3 ; � ��F �� object WmiDataId Pointer entries_evicted )
� � � � �� uint64 WmiDataId entries_swept )
� � � � �� uint64 WmiDataId FragmentId 6
� S [ f s � �� uint32 WmiDataId Description FragmentId pages_evicted 0 )
� � � � �� uint64 WmiDataId pages_swept ( )
� $ � �� uint64 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� ) � �� uint32 WmiDataId Description SequenceNumber simulation_sweep
8 )
� � �
� �� sint8 WmiDataId � X e S o s P k g _��7 �? XeSosPkg
C � ��$ 1 h n � � � � _����� � XeSosPkg_nonpreemptive_long_syncio Description record long sync io operation in nonpreemptive worker Guid {8926a6cf-22cc-4f77-8ba5-9082c03cb243} locale MS\0x409 DisplayName nonpreemptive_long_syncio �0 8 9 9 3 0 7 4 0 8 A 3 2 0 4 0 A 6 D A 1 9 C 0 B 1 E C 2 7 4 5 A 3 D 6 0 4 B A A 9 D F F E 8 E E 4 B 7 5 C 3 D 9 1 E 1 6 1 0 9 kO����ȝ��C�� A � � __EventProviderRegistration % select * from MSFT_MpEvent \\.\root\Microsoft\Windows\Defender:__Win32Provider.Name="ProtectionManagement" R O O T \ M i c r o s o f t \ W i n d o w s \ D e f e n d e r _ _ E v e n t P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 1 A 8 9 B 5 7 D F A 9 2 6 F A B 2 8 E F D 5 C 7 F C 8 2 B 0 7 8 C 2 A 1 2 3 A 4 6 0 0 4 B C 2 9 9 B 2 1 4 E F E C 4 2 4 D 2 B 0 \ K I _ 0 8 9 9 3 0 7 4 0 8 A 3 2 0 4 0 A 6 D A 1 9 C 0 B 1 E C 2 7 4 5 A 3 D 6 0 4 B A A 9 D F F E 8 E E 4 B 7 5 C 3 D 9 1 E 1 6 1 0 9 \ I _ C 2 E 2 D 7 F 2 9 4 A 3 9 E 9 5 0 F C B 0 F E 9 1 E B 4 1 D 6 C 6 6 6 3 0 2 7 3 B 2 E F 4 9 9 0 C 9 7 F 6 0 D B 5 8 2 F 2 E 1 7 52567418.1928 Sequence �e] �5E� F 9L7� � ���v � S�/�& � ïu9� � �ЃgQ i ���� � �Ա�B o ��`^� * ) X e S q l P k g _ r b p e x _ s e g m e n t _ a l l o c a t i n g _ s t a r t e d �]��7 �� 3 XeSqlPkg_rbpex_segment_allocating_started + ) � ��" - ; G � � H Q � � ( � � W������������������������! � rbpex_segment_allocating_started EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� 5 = � �� uint16 WmiDataId file_id )
� � � � �� uint16 WmiDataId FragmentId 6
� � � � � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� l t � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �]��7 �h XeSqlPkg
C � ��- : � � � � � � c����� � XeSqlPkg_rbpex_segment_allocating_completed Description Occurs when asynchronous segment allocation of covering RBPEX has completed. Guid {abf62c0b-0a36-469f-93ae-da278fc03496} locale MS\0x409 DisplayName rbpex_segment_allocating_completed �+ X e S q l P k g _ r b p e x _ s e g m e n t _ a l l o c a t i n g _ c o m p l e t e d �]��7 �B 5 XeSqlPkg_rbpex_segment_allocating_completed - ) � ��$ / = I � J V � � � � o � � WU����������������������������y � rbpex_segment_allocating_completed EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� 7 ? � �� uint16 WmiDataId error_code )
� � � � �� sint32 WmiDataId file_id )
� � � � �� uint16 WmiDataId FragmentId 6
� C K V c � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� I Q \ i � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �]��7 �_ XeSqlPkg
C � ��* 7 � � � � � � c����� � XeSqlPkg_rbpex_segment_allocating_failed Description Occurs when asynchronous segment allocation of covering RBPEX has failed. Guid {b2eeaf03-f58c-4ed6-a7c5-d844f17332e2} locale MS\0x409 DisplayName rbpex_segment_allocating_failed �( X e S q l P k g _ r b p e x _ s e g m e n t _ a l l o c a t i n g _ f a i l e d �]��7 �< 2 XeSqlPkg_rbpex_segment_allocating_failed * ) � ��! , : F � � G S � � � � l } � WU����������������������������v � rbpex_segment_allocating_failed EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� 4 < � �� uint16 WmiDataId error_code )
� � � � �� sint32 WmiDataId file_id )
� � � � �� uint16 WmiDataId FragmentId 6
� @ H S ` � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� F N Y f � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �]��7 �A XeSqlPkg
C � �� - n t � � � � c����� � XeSqlPkg_rbpex_seeding_started Description Occurs when asynchronous seeding of covering RBPEX has started. Guid {a0a15de2-2470-4034-b75a-f40edd34db6a} locale MS\0x409 DisplayName rbpex_seeding_started � X e S q l P k g _ r b p e x _ s e e d i n g _ s t a r t e d �]��7 �4 + ( XeSqlPkg_rbpex_seeding_started ) � �� "
0 < � � = L � � 1 = � � ) : � � I Z � � WU����������������������������������������S � rbpex_seeding_started EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� * 2 � �� uint16 WmiDataId database_name C
� � � � ��� � � � string WmiDataId StringTermination NullTerminated Format w file_id )
� & � �� uint16 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId logical_db_id
$ 6
�
� �� # object:guid WmiDataId Extension Guid logical_db_name C
� � � � ��� � � � string WmiDataId StringTermination NullTerminated Format w physical_db_id
6
� - � ��8 C object:guid WmiDataId Extension Guid RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� # + 6 C � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �]��7 �G XeSqlPkg
C � ��" / r x � � � � c����� � XeSqlPkg_rbpex_seeding_completed Description Occurs when asynchronous seeding of covering RBPEX has completed. Guid {393590e3-7283-4309-8164-0b60d05cb52a} locale MS\0x409 DisplayName rbpex_seeding_completed �! X e S q l P k g _ a d r _ s o r t _ p a g e _ a l l o c a t i o n �]��7 �� + XeSqlPkg_adr_sort_page_allocation # ) � �� % 3 ? � � @ L � � � � W���������������������������� � adr_sort_page_allocation EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� - 5 � �� uint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId page_id )
� � � �� uint32 WmiDataId RemainingLength 6
� d l w � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � �� uint32 WmiDataId Description SequenceNumber �ber �9 A B 5 3 8 0 6 E 8 8 6 6 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0 N�8P�� ͝��C�x :�� (D� W � WMIBinaryMofResource C:\Windows\system32\drivers\en-US\ndis.sys.mui[MofResourceName] sourceName] U�_
� < ���� � $ �tW � �� [� K �&}5 � s�|� g O�{/j = ��ध 0 ' X e S o s P k g _ l a r g e _ c a c h e _ e n t r y _ v a l u e _ c h a n g e _��7 �� f 1 XeSosPkg_large_cache_entry_value_change ) ) � �� + 9 E � K Z � � * 6 � � � P f � � 6 F � � _ q � � # WUUU��������������������������������������������������������������������������������������������������� � large_cache_entry_value_change EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid average_interval 9 )
� 8 @ � �� real64 WmiDataId cache_address
4
� � � � ��� �� object WmiDataId Pointer descriptor_address
4
� � ��! �� object WmiDataId Pointer FragmentId 6
� z � � � � �� uint32 WmiDataId Description FragmentId new_value Y )
� � � � �� real64 WmiDataId old_value Q )
� = E � �� real64 WmiDataId probability_of_reuse I )
� � � � �� real64 WmiDataId RemainingLength 6
�
% � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber size_in_pages ! )
� � �� uint64 WmiDataId state P
� x � ��� � � � � uint8 WmiDataId XEMapId ValueMap � � � � 0 1 2 3 Values � � � � Actual Simulated History Destroyed time_since_last_use
A )
� L T
� �� real64 WmiDataId time_to_generate
) )
� � �
� �� real64 WmiDataId use_count 1 )
� � � �� uint64 WmiDataId user_data_address
4
� e m � ��x �� object WmiDataId Pointer � X e S o s P k g _��7 �c XeSosPkg
C � ��& 3 � � � � � � _����� � XeSosPkg_large_cache_memory_pressure Description Occurs when we try to reclaim memory from a large cache store due to memory pressure. Guid {29752c32-d9e4-42c3-9416-411f29056a73} locale MS\0x409 DisplayName large_cache_memory_pressure �$ X e S o s P k g _ l a r g e _ c a c h e _ m e m o r y _ p r e s s u r e _��7 �3 f . XeSosPkg_large_cache_memory_pressure & ) � �� ( 6 B � � H X � � g { � � U k � � ; K � � * t � � : A � � WUUU��������������������������������������������������������������������������������������������������� � large_cache_memory_pressure EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid average_interval 8 )
� 5 = � �� real64 WmiDataId benefit_cutoff X )
� � � � �� real64 WmiDataId cache_address
4
� � � � �� �� object WmiDataId Pointer cutoff_index P )
� T \ � �� uint64 WmiDataId descriptor_address
4
� � � � ��� �� object WmiDataId Pointer FragmentId 6
� ) 1 < I � �� uint32 WmiDataId Description FragmentId probability_of_reuse @ )
� � � � �� real64 WmiDataId RemainingLength 6
�
* � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber size_in_pages )
�
� �� uint64 WmiDataId time_to_generate ( )
� a i � �� real64 WmiDataId use_count
0 )
� � �
� �� uint64 WmiDataId user_data_address
4
� & � ��1 �� object WmiDataId Pointer value
H )
� x �
� �� real64 WmiDataId was_removed ` )
� � � � �� sint8 WmiDataId � X e S o s P k g _��7 �# XeSosPkg
C � �� ) T Z � � � � _����� � XeSosPkg_large_cache_sweep Description Records the result of a large-cache sweep Guid {cb080d31-0a40-49e9-a34b-e1fe09b26ff9} locale MS\0x409 DisplayName large_cache_sweep � X e S o s P k g _ l a r g e _ c a c h e _ s w e e p _��7 �� < $ XeSosPkg_large_cache_sweep ) � ��
, 8 � � O ` � � � � � / @ � � 9 K WU���������������������������������������������������������� � large_cache_sweep EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid cache_address
4
� 3 ; � ��F �� object WmiDataId Pointer entries_evicted )
� � � � �� uint64 WmiDataId entries_swept )
� � � � �� uint64 WmiDataId FragmentId 6
� S [ f s � �� uint32 WmiDataId Description FragmentId pages_evicted 0 )
� � � � �� uint64 WmiDataId pages_swept ( )
� $ � �� uint64 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� ) � �� uint32 WmiDataId Description SequenceNumber simulation_sweep
8 )
� � �
� �� sint8 WmiDataId � X e S o s P k g _��7 �? XeSosPkg
C � ��$ 1 h n � � � � _����� � XeSosPkg_nonpreemptive_long_syncio Description record long sync io operation in nonpreemptive worker Guid {8926a6cf-22cc-4f77-8ba5-9082c03cb243} locale MS\0x409 DisplayName nonpreemptive_long_syncio �0 8 9 9 3 0 7 4 0 8 A 3 2 0 4 0 A 6 D A 1 9 C 0 B 1 E C 2 7 4 5 A 3 D 6 0 4 B A A 9 D F F E 8 E E 4 B 7 5 C 3 D 9 1 E 1 6 1 0 9 զn�^��ȝ��C�� A � � __EventProviderRegistration % select * from MSFT_MpEvent \\.\root\Microsoft\Windows\Defender:__Win32Provider.Name="ProtectionManagement" R O O T \ M i c r o s o f t \ W i n d o w s \ D e f e n d e r _ _ E v e n t P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 1 A 8 9 B 5 7 D F A 9 2 6 F A B 2 8 E F D 5 C 7 F C 8 2 B 0 7 8 C 2 A 1 2 3 A 4 6 0 0 4 B C 2 9 9 B 2 1 4 E F E C 4 2 4 D 2 B 0 \ K I _ 0 8 9 9 3 0 7 4 0 8 A 3 2 0 4 0 A 6 D A 1 9 C 0 B 1 E C 2 7 4 5 A 3 D 6 0 4 B A A 9 D F F E 8 E E 4 B 7 5 C 3 D 9 1 E 1 6 1 0 9 \ I _ C 2 E 2 D 7 F 2 9 4 A 3 9 E 9 5 0 F C B 0 F E 9 1 E B 4 1 D 6 C 6 6 6 3 0 2 7 3 B 2 E F 4 9 9 0 C 9 7 F 6 0 D B 5 8 2 F 2 E 1 7 52567418.1928 Sequence �e] E�g@� � 'Yq� � #�(Fd * b"���
� �}0t � �,�% p @^�3� � � }J � �49�� p M e s s a g e E n c o d i n g B i n d i n g E l e m e n t ՝��C�� ' MessageEncodingBindingElement 6 � �� � " 0 = _ e � � T e C U 3 A W���������������������� � WebMessageEncodingBindingElement ServiceModel Description WebMessageEncodingBindingElement UUID {9d66cffa-b7c5-42e0-a7df-a16ee84b020e} Encoding 6
� � � � = J � �� string Description The character set encoding to be used for emitting messages on the binding. DisplayName Encoding MaxReadPoolSize 6
� � � � % 2 � �� sint32 Description An integer that defines how many messages can be read simultaneously without allocating new readers. DisplayName MaxReadPoolSize MaxWritePoolSize 6
� � � � ! � �� sint32 Description An integer that defines how many messages can be sent simultaneously without allocating new writers. DisplayName MaxWritePoolSize ReaderQuotas
6
� � � � � � � �� object:XmlDictionaryReaderQuotas Description The quotas of the readers. DisplayName ReaderQuotas � B e h a v i o r ՝��C�� Behavior
6 � �� � / = C k } : % D W����������������1 � WebHttpBehavior Description WebHttpBehavior ServiceModel UUID {50ffd030-c7d2-449a-be4a-a3f272996fd4} DefaultBodyStyle 6
� � � � �
� �� string Description Specifies the web message body style. DisplayName DefaultBodyStyle DefaultOutgoingRequestFormat 6
� ~ � � � � �� string Description Specifies the default web message format for outgoing requests if the operation does not specify one. DisplayName DefaultOutgoingRequestFormat DefaultOutgoingResponseFormat 6
� � � � � �� string Description Specifies the default web message format for outgoing responses if the operation does not specify one. DisplayName DefaultOutgoingResponseFormat e � W e b H t t p B e h a v i o r ՝��C�� WebHttpBehavior 6 � �� � ) 6 Q W ����������������� � WebScriptEnablingBehavior ServiceModel Description WebScriptEnablingBehavior UUID {c03d857e-9979-44f6-9bc8-caab762a8235} � B e h a v i o r ՝��C�� Behavior
6 � �� � / = C k v ( � � � � � � ` m WU��������������������������
� WebGetAttribute Description WebGetAttribute ServiceModel UUID {f16185ab-da1b-4e5f-aab4-84a0f1e673c7} BodyStyle 6
� � � � � � �� string Description Specifies the web message body style. DisplayName BodyStyle IsBodyStyleSetExplicitly 6
� l u � � � � �� boolean Description Specifies whether a body style has been explicitly specified. DisplayName IsBodyStyleSetExplicitly IsRequestFormatSetExplicitly 6
� J S ` � � � �� boolean Description Specifies whether the outgoing request's web message format has been explicitly specified. DisplayName IsRequestFormatSetExplicitly IsResponseFormatSetExplicitly 6
� J S ` � � � �� boolean Description Specifies whether the outgoing response's web message format has been explicitly specified. DisplayName IsResponseFormatSetExplicitly RequestFormat
6
� < D Q � � � �� string Description Specifies the outgoing request's web message format. DisplayName RequestFormat ResponseFormat 6
� � � C P � �� string Description Specifies the outgoing response's web message format. DisplayName ResponseFormat UriTemplate 6
� � � � � � �� string Description Specifies the URI template for the request. DisplayName UriTemplate � B e h a v i o r ՝��C�{ ! Behavior
6 ! � �� � 5 C I q | . � � � � � � S c WU�������������������������������� � WebInvokeAttribute Description WebInvokeAttribute ServiceModel UUID {46456be3-05cf-4a65-88b6-99ef787d0d1f} BodyStyle 6
� � � � � � �� string Description Specifies the web message body style. DisplayName BodyStyle IsBodyStyleSetExplicitly 6
� r { � � � � �� boolean Description Specifies whether a body style has been explicitly specified. DisplayName IsBodyStyleSetExplicitly IsRequestFormatSetExplicitly 6
� P Y f � � � �� boolean Description Specifies whether the outgoing request's web message format has been explicitly specified. DisplayName IsRequestFormatSetExplicitly IsResponseFormatSetExplicitly 6
� P Y f � � � �� boolean Description Specifies whether the outgoing response's web message format has been explicitly specified. DisplayName IsResponseFormatSetExplicitly Method 6
� ; C P � � � �� string Description Specifies the HTTP method allowed for the request. DisplayName Method RequestFormat
6
� � � 7 D � �� string Description Specifies the outgoing request's web message format. DisplayName RequestFormat ResponseFormat 6
� � � � � � �� string Description Specifies the outgoing response's web message format. DisplayName ResponseFormat UriTemplate 6
� a i v � � � �� string Description Specifies the URI template for the request. DisplayName UriTemplate �
E v e n t T r a c e ՝��C�D EventTrace 6 � �� 9 ? g o y � y����� � WLanDiagCtlGuid Description WLAN HC Diagnostics Trace guid {6DA4DDCA-0901-4BAE-9AD4-7E6030BAB531} locale MS\0x409 Flags R
� � � � � � z � uint32 Description Enable Flags ValueDescriptions . F [ o � WLANHC_AUTOCONFIG Flag WLANHC_RNWFMSM Flag WLANHC_FATMSM Flag WLANHC_DLLMAIN Flag WLANHC_TEST Flag DefineValues � � � � � WLANHC_AUTOCONFIG WLANHC_RNWFMSM WLANHC_FATMSM WLANHC_DLLMAIN WLANHC_TEST Values + > N ] m WLANHC_AUTOCONFIG WLANHC_RNWFMSM WLANHC_FATMSM WLANHC_DLLMAIN WLANHC_TEST ValueMap � � � � � 0x00000001 0x00000002 0x00000004 0x00000008 0x00000010 _R �6 4 6 5 9 A B 9 F 8 F 1 C 4 B 5 6 8 D B 6 4 3 8 B A E 1 1 B 2 6 E E 8 F 9 3 C B 5 F 8 1 9 5 E 2 1 E 8 C 3 8 3 D 6 C 4 4 C C 4 1 ՝��C�ȝ��C�3
� __NAMESPACE StandardCimv2 F D 1 C 1 D 4 1 4 B 7 1 B 5 0 8 2 C 2 6 6 A 6 5 0 E 3 1 E F 6 D 5 0 1 9 3 8 2 7 2 4 2 4 4 B 6 8 5 F 2 1 7 C 0 A A E 0 0 A 9 2 1 ՝��C�Cȝ��C�$ � __SystemSecurity 4 1 C 5 3 E 6 D B 1 A C F 2 4 5 3 C E F D 4 1 3 9 8 1 9 8 E 6 1 3 F 1 0 D F F 4 7 7 0 9 E C A B 1 D 7 F 0 3 7 7 5 6 A C 8 C E 7 "՝��C�ȝ��C�� � � __thisNAMESPACE � �� � � ? ��AQ� � ��^�� � $�?^l � �Q�� X �g��d P �>@ش � ��{H� � �tz� u ~c'X � �;� # B �!8 � y��% � �vR|�C�� ) ! N ��Y a i � Msft_MiStreamTasks Description Defines the MI stream collection interface. AMENDMENT LOCALE MS_409 1 � _Mi m f A ion G � F
� am � J N �
� Collect ' Description Deserializes the specified file and collects all the stream objects. � a42c9160500003S ROOT\InventoryLogging\MS_409 ���� � �� �� * � ����? � __PARAMETERS abstract Filename string
� 4 In
� 4 [ �� The stream definition file name. Description )
� 4 [ ��� � ID 6
� 7 [ ��� � � string __ �� a42c9160500003S ROOT\InventoryLogging\MS_409 ���� � �r �� * � J � ��������� � __PARAMETERS abstract
Results object
� 3 Out
� 3 Z �� The output of the stream. Description
)
� 3 Z ��� � ID
6
� 0 Z ��� � � object ReturnValue uint32
� ~ uint32 out
� ~ � �� __ � Push X e Description Same as Collect but pushes the data to configured end-point. � a42c9160500003S ROOT\InventoryLogging\MS_409 ���� � �: �� Q Q * � ������� � __PARAMETERS abstract Filename string
� 4 In
� 4 [ �� The stream definition file name. Description )
� 4 [ ��� � ID 6
� 7 [ ��� � � string CheckCollectionHistory boolean
� i In
� i � �� Whether to suppress the output based on the previous collection history. Description )
� i � �� � ID 6
� � � �� � M boolean __ �� a42c9160500003S ROOT\InventoryLogging\MS_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � Flush � � Description Instructs the web client to push any pending data to the configured end-point. � a42c9160500003S ROOT\InventoryLogging\MS_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ �F D 1 C 1 D 4 1 4 B 7 1 B 5 0 8 2 C 2 6 6 A 6 5 0 E 3 1 E F 6 D 5 0 1 9 3 8 2 7 2 4 2 4 4 B 6 8 5 F 2 1 7 C 0 A A E 0 0 A 9 2 1 �vR|�C�Cȝ��C�$ � __SystemSecurity 4 1 C 5 3 E 6 D B 1 A C F 2 4 5 3 C E F D 4 1 3 9 8 1 9 8 E 6 1 3 F 1 0 D F F 4 7 7 0 9 E C A B 1 D 7 F 0 3 7 7 5 6 A C 8 C E 7 �vR|�C�ȝ��C� � � __thisNAMESPACE � �� � � ? 3 ? �vR|�C�@ 6 & - : t �� � � � ��� � MSFT_OptionalCompanion ClassVersion 1.0.0 Description Represents an optional companion for a server component. AMENDMENT LOCALE MS_409 CompanionType
� � � � uint8 Values � RSAT E � �vR|�C�8 6 # 1 8 E � ��� � � � ��� � MSFT_ServerManagerDeploymentError ClassVersion 1.0.0 Description Represents an error that happened during one of the deployment requests. AMENDMENT LOCALE MS_409 ErrorCategory
� � � � uint8 Values ` n y � � � � � � � � � - ? Q ^ k } � � � � � � NotSpecified OpenError CloseError DeviceError DeadlockDetected InvalidArgument InvalidData InvalidOperation InvalidResult InvalidType MetadataError NotImplemented NotInstalled ObjectNotFound OperationStopped OperationTimeout SyntaxError ParserError PermissionDenied ResourceBusy ResourceExists ResourceUnavailable ReadError WriteError FromStdErr FromStdErr ar � �vR|�C�� 6 # 1 8 E } ��� � � � MSFT_ServerManagerDeploymentTasks ClassVersion 1.0.0 Description Add/Remove/Enumerate Server Components asynchronously. AMENDMENT LOCALE MS_409 � � �vR|�C�� 6 - 4 A t �� � � � MSFT_ServerManagerRequestGuid ClassVersion 1.0.0 Description Represents a GUID to uniquely identify a request. AMENDMENT LOCALE MS_409 � � �vR|�C�] 6 . 5 B q ��| � � � �� � MSFT_ServerManagerRequestState ClassVersion 1.0.0 Description Represents the state of a deployment request. AMENDMENT LOCALE MS_409 RequestState
� � � � uint8 Values � � � InProgress Completed Failed ui � �vR|�C�� 6 # 1 8 E y ��� � � � D Q � � ����t � MSFT_ServerManagerServerComponent ClassVersion 1.0.0 Description Represents a server component on the managed node. AMENDMENT LOCALE MS_409 ConfigurationStatus
� � � � uint8 Values � , ; ConfigurationFailed NotConfigured Configured NotApplicable Unknown FeatureType
� } � � uint8 Values � � � Role RoleService Feature Installed
� � � � uint8 Values ) 4 F V b k Available Installed UninstallPending InstallPending NotPresent Removed Unknown � �vR|�C� 6 - ; B O � ��� � � � MSFT_ServerManagerServerComponentDescriptor ClassVersion 1.0.0 Description Represents a base class for all Server component identities on the managed node. AMENDMENT LOCALE MS_409 � � �vR|�C�� 6 % , 9 k ��v ~ � � MSFT_ServiceToMonitor ClassVersion 1.0.0 Description Represents a system service on the managed node. AMENDMENT LOCALE MS_409 � �6 4 6 5 9 A B 9 F 8 F 1 C 4 B 5 6 8 D B 6 4 3 8 B A E 1 1 B 2 6 E E 8 F 9 3 C B 5 F 8 1 9 5 E 2 1 E 8 C 3 8 3 D 6 C 4 4 C C 4 1 �vR|�C�ȝ��C�,
� __NAMESPACE MS_409 }��� � ��63
� ���� � ���E�
" ��� ' �z%�$ �"�w8 � /˺K1 � C I M _ S A P r o p o s a l ם��C�o < CIM_SAProposal ! 3
; Q i z � � r � r � - A � � � � V j �UU���������������������������������������������������������� � CIM_IKEProposal UMLPackagePath CIM::IPsecPolicy locale AuthenticationMethod
, +
� � � � �
uint16 ValueMap � � � � � � � � � 1 2 3 4 5 6 7..64999 65000 65001..65535 ModelCorrespondence > CIM_IKESAEndpoint.AuthenticationMethod CIM_IKEProposal.OtherAuthenticationMethod CipherAlgorithm +
� � � � / uint16 ValueMap � � � � � � � 1 2 3 4 5 6 7 8..65000 65001..65535 ModelCorrespondence ; ^ CIM_IKESAEndpoint.CipherAlgorithm CIM_IKEProposal.OtherCipherAlgorithm GroupId 2 +
� � � � 1 uint16 ValueMap � � 0 1 2 3 4 5 .. 0x8000.. ModelCorrespondence = X CIM_IKESAEndpoint.GroupID CIM_IKEProposal.VendorID HashAlgorithm & +
� � � � ! uint16 ValueMap � � � � � � 1 2 3 4 5..65000 65001..65535 ModelCorrespondence - N CIM_IKESAEndpoint.HashAlgorithm CIM_IKEProposal.OtherHashAlgorithm MaxLifetimeKilobytes +
� � � � uint64 ModelCorrespondence � CIM_SecurityAssociationEndpoint.LifetimeKilobytes PUnit byte * 10^3 MaxLifetimeSeconds +
� z � � � � uint64 ModelCorrespondence � CIM_SecurityAssociationEndpoint.LifetimeSeconds PUnit second OtherAuthenticationMethod .
� & . C string ModelCorrespondence O | CIM_IKESAEndpoint.OtherAuthenticationMethod CIM_IKEProposal.AuthenticationMethod OtherCipherAlgorithm "
� � � string ModelCorrespondence
5 CIM_IKESAEndpoint.OtherCipherAlgorithm CIM_IKEProposal.CipherAlgorithm OtherHashAlgorithm (
� � � � string ModelCorrespondence � � CIM_IKESAEndpoint.OtherHashAlgorithm CIM_IKEProposal.HashAlgorithm VendorID
4
� : B W string ModelCorrespondence c CIM_IKESAEndpoint.VendorID CIM_IKEProposal.GroupId � C I M _ D e p e n d e n c y ם��C�� CIM_Dependency ) + @ ��M U a � � U��������? � CIM_Phase1SAUsedForPhase2 UMLPackagePath CIM::Network::IPsec Association locale Antecedent f@ +
� � � � � ref:CIM_SecurityAssociationEndpoint Override Antecedent Max Dependent f@
� * 4 ref:CIM_IPsecSAEndpoint Override Dependent id �
C I M _ C o m p o n e n t ם��C�� CIM_Component 4 % 2 ��? ��I Q a � � e�������� � CIM_PolicyComponent UMLPackagePath CIM::Policy Association Abstract locale GroupComponent f@
� � � � ref:CIM_Policy Override GroupComponent PartComponent f@
� � ref:CIM_Policy Override PartComponent � C I M _ P o l i c y C o m p o n e n t ם��C�� CIM_PolicyComponent 4 + 8 ��E ��O W d � � � U����������[ � CIM_PolicyActionStructure UMLPackagePath CIM::Policy Association Abstract locale ActionOrder
� � uint16 GroupComponent f@
� � � � ref:CIM_Policy Override GroupComponent PartComponent f@
� , B L ref:CIM_PolicyAction Override PartComponent � C I M _ S e c u r i t y A s s o c i a t i o n E n d p o i n t .��C�� � ) CIM_SecurityAssociationEndpoint ! # 8
@ V @ Q = F � * E � � H \ � � ��������_UU���������������������������������������������� ���� �������� ������������������������ ��������������������������������������������| � CIM_IKESAEndpoint UMLPackagePath CIM::Network::IPsec locale AuthenticationMethod " v +
� � � � � � uint16 ModelCorrespondence � CIM_IKESAEndpoint.OtherAuthenticationMethod ValueMap " % ( 2 0 1 2 3 4 5 6 7..65000 65001..65535 CipherAlgorithm # x +
� � � � � � uint16 ModelCorrespondence � CIM_IKESAEndpoint.OtherCipherAlgorithm ValueMap
" % / 0 1 2 3 4 5 6 7 8..65000 65001..65535 GroupId $ z +
� � � � � uint16 ModelCorrespondence � CIM_IKESAEndpoint.VendorID ValueMap � � � � � � 0 1 2 3 4 5 .. 0x8000.. HashAlgorithm % | +
� V ^ s � � uint16 ModelCorrespondence { CIM_IKESAEndpoint.OtherHashAlgorithm ValueMap � � � � � � � 0 1 2 3 4 5..65000 65001..65535 InitiatorCookie & ~
� " uint64 OtherAuthenticationMethod ' �
� q y � string ModelCorrespondence � CIM_IKESAEndpoint.AuthenticationMethod OtherCipherAlgorithm ( �
� string ModelCorrespondence % CIM_IKESAEndpoint.CipherAlgorithm OtherHashAlgorithm ) �
� � � � string ModelCorrespondence � CIM_IKESAEndpoint.HashAlgorithm ResponderCookie * �
� � uint64 VendorID + �
� < D Y string ModelCorrespondence a CIM_IKESAEndpoint.GroupId � C I M _ S e c u r i t y A s s o c i a t i o n E n d p o i n t 0��C�� � ) CIM_SecurityAssociationEndpoint ! % : B N � � ( P Z � � ��������_���������������������������������������������� ���� �������� ������������������������ ����������������� � CIM_IPsecSAEndpoint UMLPackagePath CIM::Network::IPsec locale DFHandling " v
� z � � uint16 ValueMap � � � � 0 2 3 4 EncapsulationMode # x
� � � � uint16 ValueMap
0 2 3 InboundDirection $ z
� G boolean PFSInUse % |
� y boolean SPI & ~
� � uint32 � C I M _ P r o t o c o l E n d p o i n t 1��C�� CIM_ProtocolEndpoint ! 1 F N c � � � � / V k � � ' J �������@����������������������������������������������� ���� �������� ������������������������ ����� � CIM_SecurityAssociationEndpoint UMLPackagePath CIM::Network::IPsec locale IdleDurationSeconds Z
� � uint64 InstallDate e@
� � � � datetime Override InstallDate LifetimeKilobytes b
� uint64 LifetimeSeconds j
� N uint64 PacketLoggingActive r
� � � �� boolean RefreshThresholdKbytesPercentage t 6
� $ � �� uint8 MaxValue 100 MinValue 0 RefreshThresholdSecondsPercentage ! u 6
� � � � � � � �� uint8 MaxValue 100 MinValue 0 �6 4 6 5 9 A B 9 F 8 F 1 C 4 B 5 6 8 D B 6 4 3 8 B A E 1 1 B 2 6 E E 8 F 9 3 C B 5 F 8 1 9 5 E 2 1 E 8 C 3 8 3 D 6 C 4 4 C C 4 1 ~yR|�C�ȝ��C�,
� __NAMESPACE MS_409 �9ˑ� ` �C� � �� = �ϸB � ;k 45 � �\5� B �.:D� ��f � ��5 H C I M _ F i l t e r E n t r y B a s e \ם��C�" E CIM_FilterEntryBase C ' � �� � @ I W ^ f o � � � � ! . � � � � ( 5 � � I U � �
t � � � e t �
�
�
�
� � Z
f
UUUU�����������������������������������������������������������������
� MSFT_NetServiceFilter UMLPackagePath CIM::Network::Filtering wfascim ClassVersion 1.0.0 locale Caption @ 6
� � � @ � � � �� string MaxLen Override Caption CommunicationStatus @
& 6
� / 7 A ~ � � �� uint16 ValueMap a d g j m p t 0 1 2 3 4 .. 0x8000.. Override CommunicationStatus CreationClassName @ 6 6
� � � � �� string MaxLen Override CreationClassName Description @ )
� e m w � �� string Override Description DetailedStatus @ ( C
� � � � ; P � � � �� uint16 ValueMap ! $ ' * - 1 0 1 2 3 4 5 .. 0x8000.. ModelCorrespondence \ � CIM_EnabledLogicalElement.PrimaryStatus CIM_ManagedSystemElement.HealthState Override DetailedStatus ElementName @ )
� � �� string Override ElementName HealthState @ $ 6
� y � � � � � �� uint16 ValueMap � � � � � � � � 0 5 10 15 20 25 30 .. Override HealthState InstallDate e@ )
� ( 2 < � �� datetime Override InstallDate InstanceID @ )
� � � � � �� string Override InstanceID IsNegated @ : )
� � � � � �� boolean Override IsNegated Name @ 6
� T \ d n � �� string MaxLen Override Name OperatingStatus @ * C
� � � � � � � � � �� uint16 ValueMap 8 ; > A D G J M P S V Z ^ b f j n r v 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 .. 0x8000.. ModelCorrespondence � CIM_EnabledLogicalElement.EnabledState Override OperatingStatus OperationalStatus ` C
� D L V � H R � �� uint16 ValueMap � � � � � � � � � � � � � � � � � � � � � 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 .. 0x8000.. ModelCorrespondence CIM_ManagedSystemElement.StatusDescriptions Override OperationalStatus PrimaryStatus @
, C
� � � �
"
}
�
� �� uint16 ValueMap � � � � �
0 1 2 3 .. 0x8000.. ModelCorrespondence .
W
CIM_ManagedSystemElement.DetailedStatus CIM_ManagedSystemElement.HealthState Override PrimaryStatus ServiceName <
� �
string Status @ C
� # + 5 �
� � � �� string ValueMap
m q x � � � � � � � � � � OK Error Degraded Unknown Pred Fail Starting Stopping Service Stressed NonRecover No Contact Lost Comm Stopped MaxLen Override Status StatusDescriptions ` 6
� [ c x � � � �� string ModelCorrespondence � CIM_ManagedSystemElement.OperationalStatus Override StatusDescriptions SystemCreationClassName @ . 6
� '
/
7
A
� �� string MaxLen Override SystemCreationClassName SystemName @ 2 6
� �
�
�
�
� �� string MaxLen Override SystemName �
E v e n t T r a c e ]ם��C�� EventTrace 6 � �� : @ h p z � MSNetLogonTrace Description Active Directory: NetLogon Guid {f33959b4-dbec-11d2-895b-00c04f79ab69} locale MS\0x409 M � M S N e t L o g o n T r a c e ^ם��C� MSNetLogonTrace C � �� ; A i v � � � � NlServerAuth Description NetLogon Server Authentication Guid {393da8c0-dbed-11d2-895b-00c04f79ab69} DisplayName NlServerAuth locale MS\0x409 � N l S e r v e r A u t h _ם��C�� NlServerAuth C � �� ! A L [ b j t } 2 ? � � � � U����������������$ � NlServerAuth_Start Description NetLogon Server Authentication EventType EventTypeName Start locale MS\0x409 Account P
� � � � � ' / � �� string WmiDataId Description Account StringTermination NullTerminated format w ChannelType C
� � � � � � � � �� uint32 WmiDataId Description Channel Type format x Client P
� / 7 B O W j z � � �� string WmiDataId Description Client StringTermination NullTerminated format w NegotiatedFlags C
� � � � ! � �� uint32 WmiDataId Description Negotiated Flags format x � N l S e r v e r A u t h `ם��C�X NlServerAuth C � �� ? J Y ^ f p y . ; � � � � ( U���������������������� � NlServerAuth_End Description NetLogon Server Authentication EventType EventTypeName End locale MS\0x409 Account P
� � � � � # + � �� string WmiDataId Description Account StringTermination NullTerminated format w ChannelType C
� � � � � � � � �� uint32 WmiDataId Description Channel Type format x Client P
� + 3 > K S f v ~ � �� string WmiDataId Description Client StringTermination NullTerminated format w NegotiatedFlags C
� � � � � �� uint32 WmiDataId Description Negotiated Flags format x Status C
� y � � � � � � �� uint32 WmiDataId Description Status format x � M S N e t L o g o n T r a c e aם��C� MSNetLogonTrace C � �� = C k x � � � � NlSecChanlSetup Description NetLogon Secure Channel Setup Guid {63dbb180-dbed-11d2-895b-00c04f79ab69} DisplayName NlSecChanlSetup locale MS\0x409 � N l S e c C h a n l S e t u p bם��C�� NlSecChanlSetup C � �� $ C N ] d l v � NlSecChanlSetup_Start Description NetLogon Secure Channel Setup EventType EventTypeName Start locale MS\0x409 � N l S e c C h a n l S e t u p cם��C�� NlSecChanlSetup C � �� " A L [ ` h r � NlSecChanlSetup_End Description NetLogon Secure Channel Setup EventType EventTypeName End locale MS\0x409 �5 7 E 5 F 3 A D D 9 E 2 4 2 C 4 E 9 F 9 E D F 7 9 A A 9 7 F 7 9 E 7 9 1 1 C 5 A 8 B 9 0 2 E C 1 5 0 D 6 4 4 2 E 3 B 8 5 A 5 A A dם��C�ȝ��C�� �����K @ 9 V � __Win32Provider {124E2045-8D63-4C23-B420-BBCD6A0ED61A} LocalServiceHost NetQosCim n�'� ���& ƒ�> �Q��- � (��[#
�|- � h�8F�
�
�V� v �?n- � �FTJ � v��s� p �;; ) �,F#d ���Rj � �4�)= � R O O T \ P o l i c y _ _ I n s t a n c e P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 3 D 9 8 E C 3 7 D 6 3 E B F B 9 2 1 0 D B 6 5 8 1 2 0 A 8 1 8 0 7 8 4 6 1 3 6 9 A 7 1 E F F A 3 D D E 4 7 4 1 2 F 5 2 8 D 5 5 E \ K I _ E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C \ I _ 6 1 6 4 2 E 7 9 7 C B A 7 F D 3 0 8 7 6 5 D 4 2 2 A 2 6 4 5 8 A 7 7 0 A D 0 B C 7 7 5 5 3 C 0 5 3 4 C C C D 9 F C A 1 B D 1 8 7 E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C �Ν��C� ȝ��C�� � �� T � __InstanceProviderRegistration \\.\Root\Policy:__Win32Provider.Name="PolicStatus" R O O T \ P o l i c y _ _ I n s t a n c e P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 3 D 9 8 E C 3 7 D 6 3 E B F B 9 2 1 0 D B 6 5 8 1 2 0 A 8 1 8 0 7 8 4 6 1 3 6 9 A 7 1 E F F A 3 D D E 4 7 4 1 2 F 5 2 8 D 5 5 E \ K I _ E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C \ I _ 0 B F 1 F 1 4 F 0 E 0 C 4 3 9 5 7 D 6 6 F E 2 6 E 4 3 0 8 2 7 3 2 2 F 9 0 9 1 C 1 E 5 C 9 2 D 0 4 A B 8 B A 7 9 1 B 9 F 6 7 E 0 7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D �Ν��C�
ȝ��C�f O � __MethodProviderRegistration \\.\Root\Policy:__Win32Provider.Name="PolicSOM" R O O T \ P o l i c y _ _ M e t h o d P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 3 D 9 8 E C 3 7 D 6 3 E B F B 9 2 1 0 D B 6 5 8 1 2 0 A 8 1 8 0 7 8 4 6 1 3 6 9 A 7 1 E F F A 3 D D E 4 7 4 1 2 F 5 2 8 D 5 5 E \ K I _ 7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D \ I _ 6 1 6 4 2 E 7 9 7 C B A 7 F D 3 0 8 7 6 5 D 4 2 2 A 2 6 4 5 8 A 7 7 0 A D 0 B C 7 7 5 5 3 C 0 5 3 4 C C C D 9 F C A 1 B D 1 8 7 �Ν��C��
) �� # K R � � � U������������G � MSFT_Rule Abstract Locale UUID {D157AAFD-D42F-45cd-B30B-F67CF152C9F9} Query '
� � � �� � �� string NOT_NULL QueryLanguage '
� � � �� � �� string NOT_NULL TargetNameSpace '
� 5 = �� � �� string NOT_NULL tr � ���C�� ' 6 � �� � " ( P X � � � � K S � � � � 3 : � � UU�������������������������������������� � MSFT_SomFilter PolicSOM Locale UUID {AE7B614F-AFE0-41ea-807E-3BD3F83CAF66} Author
� � � �� String ChangeDate e
� � � �� DateTime CreationDate e
� � �� DateTime Description
� C � �� String Domain '
� � � �� � �� String ID 4
� � � �� � ��� & string MaxLen Name '
� ! � ��) �� string NOT_NULL Rules
'
� o � ��� �� object:MSFT_Rule NOT_NULL SourceOrganization
� � � �� String )
C G � � � � � Evaluate $ ��1 �� Implemented bypass_getobject z ae442007200009F ROOT\Policy ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ Uint32 out
� ^ f �� __ � BatchEvaluate � ��� �� Implemented Static � ae442007200009F ROOT\Policy ���� � �� �� * � ����� � __PARAMETERS abstract f filters ref f
� 3 IN f
� 3 W �� ID f )
� � W ��� ref:MSFT_SomFilter __ �� ae442007200009F ROOT\Policy ���� � �� �� * � � ��������I � __PARAMETERS abstract results uint32
� 3 OUT
� 3 Z �� ID )
� � Z ��� Uint32 ReturnValue uint32
� Uint32 out
� �� __ � ���C�^ ) � �� � # + ? r z � � ��������� � MSFT_SomFilterStatus PolicStatus Locale ContainerAvailable
� i � �� Boolean Domain '
� � � �� � �� String SchemaAvailable
� � � �� Boolean _S � _ _ E x t e n d e d S t a t u s ���C�� __ExtendedStatus + ��������������������������] � SomFilterPutStatus RuleValidationResults
� U � �� Uint32 �F D 1 C 1 D 4 1 4 B 7 1 B 5 0 8 2 C 2 6 6 A 6 5 0 E 3 1 E F 6 D 5 0 1 9 3 8 2 7 2 4 2 4 4 B 6 8 5 F 2 1 7 C 0 A A E 0 0 A 9 2 1 �Ν��C�Cȝ��C�$ � __SystemSecurity 4 1 C 5 3 E 6 D B 1 A C F 2 4 5 3 C E F D 4 1 3 9 8 1 9 8 E 6 1 3 F 1 0 D F F 4 7 7 0 9 E C A B 1 D 7 F 0 3 7 7 5 6 A C 8 C E 7 �Ν��C�ȝ��C�� � � __thisNAMESPACE � �� � � ? �Ν��C�
) N ��Y a h � � 2 C U������������� � MSFT_Rule Description Defines a single rule in a SOM, expressed as a query AMENDMENT LOCALE Query
� � � � string Description Query of interest QueryLanguage
� � � string Description Language in which query is expressed TargetNameSpace
� o w � string Description Namespace in which to evaluate query r �
R O O T \ C I M V 2 _ _ E v e n t P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 6 8 5 7 7 3 7 2 C 6 6 A 7 B 2 0 6 5 8 4 8 7 F B D 9 5 9 A A 1 5 4 E F 5 4 B 5 F 9 3 5 D C C 5 6 6 3 E 9 2 2 8 B 4 4 3 2 2 8 0 5 \ K I _ 0 8 9 9 3 0 7 4 0 8 A 3 2 0 4 0 A 6 D A 1 9 C 0 B 1 E C 2 7 4 5 A 3 D 6 0 4 B A A 9 D F F E 8 E E 4 B 7 5 C 3 D 9 1 E 1 6 1 0 9 \ I _ 6 3 2 5 C 5 C 9 6 D F D 6 B 5 1 F E 5 D 9 7 6 2 1 F D 6 5 E C 8 F E 5 E A 2 1 1 A E F 5 0 E C B 0 8 E 7 7 8 B 3 0 E 5 7 B C A C
E v e n t T r a c e �sR|�C�� EventTrace ) B ��M U � CscNetApi Description Microsoft-Windows-OfflineFiles-CscNetApi AMENDMENT LOCALE �6 4 6 5 9 A B 9 F 8 F 1 C 4 B 5 6 8 D B 6 4 3 8 B A E 1 1 B 2 6 E E 8 F 9 3 C B 5 F 8 1 9 5 E 2 1 E 8 C 3 8 3 D 6 C 4 4 C C 4 1 !tR|�C�ȝ��C�,
� __NAMESPACE ms_409 �s�p � d@GX � �jr�
)� �* ���A ` '�t� �
E v e n t T r a c e iѝ��C�� EventTrace ) � �� > F P W Q����] � RestartManager guid {0888e5ef-9b98-4695-979d-e92ce4247224} locale MS\0x409 Flags 8
� � � � � � ) uint32 ValueDescriptions � � � Error Flag Debug Flag Noise Flag DefineValues
Error Debug Noise ValueMap 9 E Q 0x00000001 0x00000002 0x00000004 �
E v e n t T r a c e jѝ��C�� EventTrace 6 � �� 5 ; c k u | u����* � CtlGuidWPDCI Description WPD ClassInstaller Trace guid {45350D79-4497-42f1-BD1B-83587575B91A} locale MS\0x409 Flags R
� � � � � � � v ~ � uint32 Description Enable Flags ValueDescriptions ^ } � � � � 4 S e r � � � � � � WPD_TRACE_LEVEL_CRITICAL Flag WPD_TRACE_LEVEL_ERROR Flag WPD_TRACE_LEVEL_WARNING Flag WPD_TRACE_LEVEL_ASSERT Flag WPD_TRACE_LEVEL_FUNCTRACE Flag WPD_TRACE_LEVEL_INFORMATION Flag WPD_TRACE_LEVEL_VERBOSE Flag WPD_TRACE_LEVEL_RESERVED Flag WPD_Install Flag WPD_F2 Flag WPD_F3 Flag WPD_F4 Flag WPD_F5 Flag WPD_F6 Flag WPD_F7 Flag WPD_F8 Flag WPDCI_feature1 Flag WPDCI_feature2 Flag DefineValues D ^ u � � � � � & . 6 > F N V f WPD_TRACE_LEVEL_CRITICAL WPD_TRACE_LEVEL_ERROR WPD_TRACE_LEVEL_WARNING WPD_TRACE_LEVEL_ASSERT WPD_TRACE_LEVEL_FUNCTRACE WPD_TRACE_LEVEL_INFORMATION WPD_TRACE_LEVEL_VERBOSE WPD_TRACE_LEVEL_RESERVED WPD_Install WPD_F2 WPD_F3 WPD_F4 WPD_F5 WPD_F6 WPD_F7 WPD_F8 WPDCI_feature1 WPDCI_feature2 Values � � � , G d } � � � � � � � � � � WPD_TRACE_LEVEL_CRITICAL WPD_TRACE_LEVEL_ERROR WPD_TRACE_LEVEL_WARNING WPD_TRACE_LEVEL_ASSERT WPD_TRACE_LEVEL_FUNCTRACE WPD_TRACE_LEVEL_INFORMATION WPD_TRACE_LEVEL_VERBOSE WPD_TRACE_LEVEL_RESERVED WPD_Install WPD_F2 WPD_F3 WPD_F4 WPD_F5 WPD_F6 WPD_F7 WPD_F8 WPDCI_feature1 WPDCI_feature2 ValueMap R ^ j v � � � � � � � � � � � 0x00000001 0x00000002 0x00000004 0x00000008 0x00000010 0x00000020 0x00000040 0x00000080 0x00000100 0x00000200 0x00000400 0x00000800 0x00001000 0x00002000 0x00004000 0x00008000 0x00010000 0x00020000 D_ �
E v e n t T r a c e hѝ��C�� EventTrace 6 � ��
4 : b j t { u����x � PlugPlay Description User-mode PnP Manager Trace guid {a676b545-4cfb-4306-a067-502d9a0f2220} locale MS\0x409 Flags R
� � � � � � � � � * 4 uint32 Description Enable Flags ValueDescriptions e { � � � � � = ^ } � � � � / O m � PNP_ERROR_LEVEL Flag PNP_WARNING_LEVEL Flag PNP_TRACE_LEVEL Flag PNP_INFO_LEVEL Flag PNP_REGISTRY_WARNING_LEVEL Flag PNP_REGISTRY_TRACE_LEVEL Flag PNP_REGISTRY_INFO_LEVEL Flag PNP_REGISTRY_VERBOSE_LEVEL Flag PNP_RESOURCE_WARNING_LEVEL Flag PNP_RESOURCE_TRACE_LEVEL Flag PNP_RESOURCE_INFO_LEVEL Flag PNP_RESOURCE_VERBOSE_LEVEL Flag PNP_EVENT_WARNING_LEVEL Flag PNP_EVENT_TRACE_LEVEL Flag PNP_EVENT_INFO_LEVEL Flag PNP_EVENT_VERBOSE_LEVEL Flag PNP_INSTALL_WARNING_LEVEL Flag PNP_INSTALL_TRACE_LEVEL Flag PNP_INSTALL_INFO_LEVEL Flag PNP_INSTALL_VERBOSE_LEVEL Flag DefineValues 0 A Q m � � � � � ' @ W m � � � � PNP_ERROR_LEVEL PNP_WARNING_LEVEL PNP_TRACE_LEVEL PNP_INFO_LEVEL PNP_REGISTRY_WARNING_LEVEL PNP_REGISTRY_TRACE_LEVEL PNP_REGISTRY_INFO_LEVEL PNP_REGISTRY_VERBOSE_LEVEL PNP_RESOURCE_WARNING_LEVEL PNP_RESOURCE_TRACE_LEVEL PNP_RESOURCE_INFO_LEVEL PNP_RESOURCE_VERBOSE_LEVEL PNP_EVENT_WARNING_LEVEL PNP_EVENT_TRACE_LEVEL PNP_EVENT_INFO_LEVEL PNP_EVENT_VERBOSE_LEVEL PNP_INSTALL_WARNING_LEVEL PNP_INSTALL_TRACE_LEVEL PNP_INSTALL_INFO_LEVEL PNP_INSTALL_VERBOSE_LEVEL Values I Z m ~ � � � � � / H d } � � � � � PNP_ERROR_LEVEL PNP_WARNING_LEVEL PNP_TRACE_LEVEL PNP_INFO_LEVEL PNP_REGISTRY_WARNING_LEVEL PNP_REGISTRY_TRACE_LEVEL PNP_REGISTRY_INFO_LEVEL PNP_REGISTRY_VERBOSE_LEVEL PNP_RESOURCE_WARNING_LEVEL PNP_RESOURCE_TRACE_LEVEL PNP_RESOURCE_INFO_LEVEL PNP_RESOURCE_VERBOSE_LEVEL PNP_EVENT_WARNING_LEVEL PNP_EVENT_TRACE_LEVEL PNP_EVENT_INFO_LEVEL PNP_EVENT_VERBOSE_LEVEL PNP_INSTALL_WARNING_LEVEL PNP_INSTALL_TRACE_LEVEL PNP_INSTALL_INFO_LEVEL PNP_INSTALL_VERBOSE_LEVEL ValueMap � � � � � � � � � � $ 0 < H T ` l 0x00000001 0x00000002 0x00000004 0x00000008 0x00000010 0x00000020 0x00000040 0x00000080 0x00000100 0x00000200 0x00000400 0x00000800 0x00001000 0x00002000 0x00004000 0x00008000 0x00010000 0x00020000 0x00040000 0x00080000 � eѝ��C�� ) m ��x � � ���������� � Win32_MountPoint Description The mount point associates a volume to the directory at which it is mounted. AMENDMENT LOCALE Directory f 6
� � � � � ��� ref:Win32_Directory DisplayName Directory Description The directory Volume f 6
� d v � � ��� � ref:Win32_Volume DisplayName Volume Description The volume � C I M _ E l e m e n t S e t t i n g fѝ��C�$ CIM_ElementSetting ) v ��� � � ���������� � Win32_VolumeQuota Description The Win32_VolumeQuota association relates a volume to the per volume quota settings. AMENDMENT LOCALE Element f@ 6
� � � � � �� ref:Win32_Volume Description The volume DisplayName Volume Setting f@ 6
� c { � � � � �� ref:Win32_QuotaSetting Description The quota setting DisplayName Setting � gѝ��C�� & ) $ � ��� � � Z i J Q
� � x � U�������������������������������������N � Win32_VolumeUserQuota Description The Win32_VolumeUserQuota association relates per user quotas to quota enabled volumes. System administrators can configure Windows to prevent further disk space use and log an event when a user exceeds a specified disk space limit. They can also log an event when a user exceeds a specified disk space warning level. Note that disk quotas cannot be set for the Administrator accounts themselves. AMENDMENT LOCALE Account f 6
� % 2 � ��; H ref:Win32_Account DisplayName Account Description The user account DiskSpaceUsed +
� � � � � � uint64 DisplayName Disk Space Used Description The DiskSpaceUsed property indicates the current number of Bytes currently in use by this particular user or group. Limit +
� � � � � � uint64 DisplayName Limit Description The Limit property indicates the limit set for this particular user or group. Status 8
� P X e m z � � uint32 DisplayName Status Description A Status property indicates the current status of the Disk Quota. Values � � � OK Warning Exceeded Volume f 6
� 8 J W � ��_ l ref:Win32_Volume DisplayName Volume Description The volume WarningLimit +
� � � � � � uint64 DisplayName Warning Limit Description The WarningLimit property indicates the warning limit set for this particular user or group. � � � � � ����p , Y��B� � ����# � C��� � ��
sX I ���8� � Y�H
� � i�Q}H p ��U@�
I [W݅ & E�C�'
;-
�3 � �_�( OK��0 J �$��z ' � �[� ��#� � J&ӣ ���}� H P����
4�0�
���� � _ _ S e c u r i t y R e l a t e d C l a s s `ȝ��C�� __SecurityRelatedClass �� R ` � � � � � � ) 6 A��] ���� ` � __Subject abstract Authority
� J � �� string EditSecurity
� boolean Enabled
� � boolean ExecuteMethods
� � boolean Name
� ! � �� string Permissions
� U sint32 . � _ _ S u b j e c t aȝ��C�] __Subject �� ����H ���� � __User abstract � _ _ S u b j e c t bȝ��C�^ __Subject �� ����H ���� � __Group abstract �
_ _ S y s t e m C l a s s dȝ��C�{ __SystemClass �� " 1 X q � � � � U���������������� � __CIMOMIdentification singleton SetupDateTime
� P string VersionCurrentlyRunning
� � string VersionUsedToCreateDB
� � string WorkingDirectory
� string �
_ _ S y s t e m C l a s s fȝ��C�
__SystemClass �� ( Q _ � � ������������� � __AdapStatus singleton LastStartTime e
� G datetime LastStopTime e
� ~ datetime Status
� � uint32 �2 D C 5 A 6 B 4 4 F 3 2 5 5 6 4 7 A 4 F 9 E 3 D 4 F 9 3 2 F D B 9 3 7 F F 6 A 6 B F C 9 0 F A E F A 2 7 8 8 D 2 2 0 3 7 5 3 3 5 gȝ��C�fȝ��C�c ) D � __AdapStatus 00000000000000.000000:000 00000000000000.000000:000 F D 1 C 1 D 4 1 4 B 7 1 B 5 0 8 2 C 2 6 6 A 6 5 0 E 3 1 E F 6 D 5 0 1 9 3 8 2 7 2 4 2 4 4 B 6 8 5 F 2 1 7 C 0 A A E 0 0 A 9 2 1 iȝ��C�Cȝ��C�$ � __SystemSecurity 4 1 C 5 3 E 6 D B 1 A C F 2 4 5 3 C E F D 4 1 3 9 8 1 9 8 E 6 1 3 F 1 0 D F F 4 7 7 0 9 E C A B 1 D 7 F 0 3 7 7 5 6 A C 8 C E 7 kȝ��C�ȝ��C�� � � __thisNAMESPACE � �� � � ? 5 7 E 5 F 3 A D D 9 E 2 4 2 C 4 E 9 F 9 E D F 7 9 A A 9 7 F 7 9 E 7 9 1 1 C 5 A 8 B 9 0 2 E C 1 5 0 D 6 4 4 2 E 3 B 8 5 A 5 A A lȝ��C�ȝ��C�� �?����M 9 W � __Win32Provider {d63a5850-8f16-11cf-9f47-00aa00bf345c} NetworkServiceHost CIMWin32 E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C mȝ��C� ȝ��C�� � ��������P i � __InstanceProviderRegistration \\.\Root\CIMV2:__Win32Provider.Name="CIMWin32" X WQL:UnarySelect
R O O T \ C I M V 2 _ _ I n s t a n c e P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 6 8 5 7 7 3 7 2 C 6 6 A 7 B 2 0 6 5 8 4 8 7 F B D 9 5 9 A A 1 5 4 E F 5 4 B 5 F 9 3 5 D C C 5 6 6 3 E 9 2 2 8 B 4 4 3 2 2 8 0 5 \ K I _ E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C \ I _ 8 6 B 3 B C A 2 9 6 5 8 7 4 2 9 B C D 6 1 A 2 9 6 8 A 8 4 8 6 1 7 D B 9 3 0 2 3 B C 6 D 3 C 1 8 5 8 8 5 3 C 5 5 4 0 E 1 2 A 3 E <CA>7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D nȝ��C�
ȝ��C�e N � __MethodProviderRegistration \\.\Root\CIMV2:__Win32Provider.Name="CIMWin32"
R O O T \ C I M V 2 _ _ M e t h o d P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 6 8 5 7 7 3 7 2 C 6 6 A 7 B 2 0 6 5 8 4 8 7 F B D 9 5 9 A A 1 5 4 E F 5 4 B 5 F 9 3 5 D C C 5 6 6 3 E 9 2 2 8 B 4 4 3 2 2 8 0 5 \ K I _ 7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D \ I _ 8 6 B 3 B C A 2 9 6 5 8 7 4 2 9 B C D 6 1 A 2 9 6 8 A 8 4 8 6 1 7 D B 9 3 0 2 3 B C 6 D 3 C 1 8 5 8 8 5 3 C 5 5 4 0 E 1 2 A 3 E 5 7 E 5 F 3 A D D 9 E 2 4 2 C 4 E 9 F 9 E D F 7 9 A A 9 7 F 7 9 E 7 9 1 1 C 5 A 8 B 9 0 2 E C 1 5 0 D 6 4 4 2 E 3 B 8 5 A 5 A A oȝ��C�ȝ��C�� �?����M 9 X � __Win32Provider {04788120-12C2-498d-83C1-A7D92E677AC6} NetworkServiceHost Cimwin32A E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C pȝ��C� ȝ��C�� � ��������Q j � __InstanceProviderRegistration \\.\Root\CIMV2:__Win32Provider.Name="Cimwin32A" Y WQL:UnarySelect
R O O T \ C I M V 2 _ _ I n s t a n c e P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 6 8 5 7 7 3 7 2 C 6 6 A 7 B 2 0 6 5 8 4 8 7 F B D 9 5 9 A A 1 5 4 E F 5 4 B 5 F 9 3 5 D C C 5 6 6 3 E 9 2 2 8 B 4 4 3 2 2 8 0 5 \ K I _ E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C \ I _ D F 1 D 7 2 E C C 9 2 6 8 2 1 3 F C B 4 3 A 0 6 A 3 8 D B F 2 A 7 4 5 2 D F F 8 3 D 9 A 2 A F 1 D 8 9 F 3 C E C A 7 6 D 4 A F 1 d 1r l 7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D qȝ��C�
ȝ��C�f O � __MethodProviderRegistration \\.\Root\CIMV2:__Win32Provider.Name="Cimwin32A"
R O O T \ C I M V 2 _ _ M e t h o d P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 6 8 5 7 7 3 7 2 C 6 6 A 7 B 2 0 6 5 8 4 8 7 F B D 9 5 9 A A 1 5 4 E F 5 4 B 5 F 9 3 5 D C C 5 6 6 3 E 9 2 2 8 B 4 4 3 2 2 8 0 5 \ K I _ 7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D \ I _ D F 1 D 7 2 E C C 9 2 6 8 2 1 3 F C B 4 3 A 0 6 A 3 8 D B F 2 A 7 4 5 2 D F F 8 3 D 9 A 2 A F 1 D 8 9 F 3 C E C A 7 6 D 4 A F 1 rȝ��C�0 ) ��$ , 2 Z c � � � � k q � � U���������������������� � CIM_ManagedSystemElement Abstract Locale UUID {8502C517-5FBB-11D2-AAC1-006008C78BC7} Caption )
� � � @ � �� string MaxLen Description
� � � �� string InstallDate e )
� - 7 G � �� datetime MappingStrings O MIF.DMTF|ComponentID|001.5 Name
� � � �� string Status 6
� � � ���
� string MaxLen ValueMap = A H R [ f p z � � � � OK Error Degraded Unknown Pred Fail Starting Stopping Service Stressed NonRecover No Contact Lost Comm �2 4 3 2 A 5 A B B E 7 1 7 3 F A 9 8 2 2 3 D 7 0 B 4 E D F B 3 1 2 E 0 A A 8 7 F 4 5 6 1 0 3 A 2 5 E 4 B 4 1 9 1 A B 5 5 F A 0 2 Ѡn�^��Tȝ��C�z ; * W � __CIMOMIdentification 10.0.20348.3451 10.0.20348.3451 %systemroot%\system32\wbem 2 4 3 2 A 5 A B B E 7 1 7 3 F A 9 8 2 2 3 D 7 0 B 4 E D F B 3 1 2 E 0 A A 8 7 F 4 5 6 1 0 3 A 2 5 E 4 B 4 1 9 1 A B 5 5 F A 0 2 Ҡn�^��dȝ��C�z ; * W � __CIMOMIdentification 10.0.20348.3451 10.0.20348.3451 %systemroot%\system32\wbem 6 4 6 5 9 A B 9 F 8 F 1 C 4 B 5 6 8 D B 6 4 3 8 B A E 1 1 B 2 6 E E 8 F 9 3 C B 5 F 8 1 9 5 E 2 1 E 8 C 3 8 3 D 6 C 4 4 C C 4 1 Ӡn�^��ȝ��C�@
� __NAMESPACE CIMV2 Locale ���� � ]���� R �w�� , �}N+= ��
~W
V �8�� 4 0=f� *B�o� M ,�0H 2 �\�z �� Д � >�#�( � �ߋ�� _ _ E v e n t C o n s u m e r 2͝��C�� 6 __EventConsumer
# j s � � � � ( . ` w � � � S _ � � oA���������� ������������ �� � ��������� � NTEventLogEventConsumer Category '
� X ` �� � �� uint16 NOT_NULL EventID '
� � � �� � �� uint32 NOT_NULL EventType A
� �� � ��& 0 _ g uint32 NOT_NULL ValueMap L O R U X [ 0 1 2 4 8 16 Values � � � � � � Success Error Warning Information Audit Success Audit Failure InsertionStringTemplates
& '
� �� � �� string Template Name
� X � �� string NameOfRawDataProperty *
� � � �� string NameOfUserSIDProperty .
� � � �� string NumberOfInsertionStrings " '
� A I �� � �� uint32 NOT_NULL SourceName '
� � � �� � �� string NOT_NULL UNCServerName
� � � �� string � �5 7 E 5 F 3 A D D 9 E 2 4 2 C 4 E 9 F 9 E D F 7 9 A A 9 7 F 7 9 E 7 9 1 1 C 5 A 8 B 9 0 2 E C 1 5 0 D 6 4 4 2 E 3 B 8 5 A 5 A A 3͝��C�ȝ��C�� ���J 9 ` � __Win32Provider {266c72d4-62e8-11d1-ad89-00c04fd8fdff} LocalSystemHost LogFileEventConsumer C F F 4 1 3 7 0 C 7 0 E 2 6 A 1 6 9 C 5 F 7 C C 5 5 9 4 0 5 0 6 4 6 C 5 B 9 B C 0 F 0 D 1 F 0 F C 4 7 3 3 F A 2 A A 3 5 9 3 9 C 4͝��C�ȝ��C�� C % � � __EventConsumerProviderRegistration - LogFileEventConsumer \\.\root\default:__Win32Provider.Name="LogFileEventConsumer" R O O T \ d e f a u l t # _ _ E v e n t C o n s u m e r P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 8 9 2 F 8 D B 6 9 C 4 E D F B C 6 8 1 6 5 C 9 1 0 8 7 B 7 A 0 8 3 2 3 F 6 C E 5 B 5 E F 3 4 2 C 0 F 9 3 E 0 2 A 0 5 9 0 B F C 4 \ K I _ C F F 4 1 3 7 0 C 7 0 E 2 6 A 1 6 9 C 5 F 7 C C 5 5 9 4 0 5 0 6 4 6 C 5 B 9 B C 0 F 0 D 1 F 0 F C 4 7 3 3 F A 2 A A 3 5 9 3 9 C \ I _ 7 C F 7 D A 7 8 8 C B 6 3 3 5 9 1 F E 5 B 3 1 F 4 F 2 2 0 7 A 3 A 6 2 9 F D 0 9 8 D 5 5 A D 1 9 1 3 C E 2 E 4 6 1 8 6 B 8 7 B 6 � 5 7 E 5 F 3 A D D 9 E 2 4 2 C 4 E 9 F 9 E D F 7 9 A A 9 7 F 7 9 E 7 9 1 1 C 5 A 8 B 9 0 2 E C 1 5 0 D 6 4 4 2 E 3 B 8 5 A 5 A A 5͝��C�ȝ��C�� ���J 9 d � __Win32Provider {266c72e5-62e8-11d1-ad89-00c04fd8fdff} LocalSystemHost CommandLineEventConsumer C F F 4 1 3 7 0 C 7 0 E 2 6 A 1 6 9 C 5 F 7 C C 5 5 9 4 0 5 0 6 4 6 C 5 B 9 B C 0 F 0 D 1 F 0 F C 4 7 3 3 F A 2 A A 3 5 9 3 9 C 6͝��C�ȝ��C�� G % � � __EventConsumerProviderRegistration - CommandLineEventConsumer \\.\root\default:__Win32Provider.Name="CommandLineEventConsumer" R O O T \ d e f a u l t # _ _ E v e n t C o n s u m e r P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 8 9 2 F 8 D B 6 9 C 4 E D F B C 6 8 1 6 5 C 9 1 0 8 7 B 7 A 0 8 3 2 3 F 6 C E 5 B 5 E F 3 4 2 C 0 F 9 3 E 0 2 A 0 5 9 0 B F C 4 \ K I _ C F F 4 1 3 7 0 C 7 0 E 2 6 A 1 6 9 C 5 F 7 C C 5 5 9 4 0 5 0 6 4 6 C 5 B 9 B C 0 F 0 D 1 F 0 F C 4 7 3 3 F A 2 A A 3 5 9 3 9 C \ I _ C B 9 7 6 3 C A D F A E 4 6 1 D F E 9 7 6 5 3 6 B 6 2 D C 6 5 9 9 E B 9 A 4 B F D C F 3 4 8 7 2 0 0 7 0 0 2 B 0 B 9 8 9 6 A 3 A � 5 7 E 5 F 3 A D D 9 E 2 4 2 C 4 E 9 F 9 E D F 7 9 A A 9 7 F 7 9 E 7 9 1 1 C 5 A 8 B 9 0 2 E C 1 5 0 D 6 4 4 2 E 3 B 8 5 A 5 A A 7͝��C�ȝ��C�� ���B 9 [ � __Win32Provider {266c72e6-62e8-11d1-ad89-00c04fd8fdff} WmiCore NTEventLogEventConsumer C F F 4 1 3 7 0 C 7 0 E 2 6 A 1 6 9 C 5 F 7 C C 5 5 9 4 0 5 0 6 4 6 C 5 B 9 B C 0 F 0 D 1 F 0 F C 4 7 3 3 F A 2 A A 3 5 9 3 9 C 8͝��C�ȝ��C�� F % � � __EventConsumerProviderRegistration - NTEventLogEventConsumer \\.\root\default:__Win32Provider.Name="NTEventLogEventConsumer" R O O T \ d e f a u l t # _ _ E v e n t C o n s u m e r P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 8 9 2 F 8 D B 6 9 C 4 E D F B C 6 8 1 6 5 C 9 1 0 8 7 B 7 A 0 8 3 2 3 F 6 C E 5 B 5 E F 3 4 2 C 0 F 9 3 E 0 2 A 0 5 9 0 B F C 4 \ K I _ C F F 4 1 3 7 0 C 7 0 E 2 6 A 1 6 9 C 5 F 7 C C 5 5 9 4 0 5 0 6 4 6 C 5 B 9 B C 0 F 0 D 1 F 0 F C 4 7 3 3 F A 2 A A 3 5 9 3 9 C \ I _ A 7 E 8 4 B B 1 D 3 7 3 9 B 5 4 3 6 9 D F F E 4 4 B A D D 2 2 0 0 8 3 D D 3 5 6 D 5 C 5 A B 4 6 B F 5 7 0 D 9 C 7 7 D 7 D C 1 9 _ _ E v e n t C o n s u m e r :͝��C�^ $ __EventConsumer ) # ? ��J R \ - 8 � � � � J P oU��������� ����������������������� � LogFileEventConsumer Description Logs events to a text file AMENDMENT LOCALE Filename
� � � � string Description Fully qualified path name for the log file. If file does not exist, it will be created. If directory does not exist, file will not be created. IsUnicode
� d m z boolean Description If FALSE or NULL, file will not be Unicode. MaximumFileSize
� � � � uint64 Description Maximum size to which file is allowed to grow. It will be archived when it exceeds this size. Archived files have an extension of .001 through .999. A value of zero will be interpreted to mean 'do not archive.' Name )
� � �� # string Description A unique identifier for this instance Text
� | � � string Description Message to be inserted into the log file � _ _ E v e n t C o n s u m e r N͝��C�^ $ __EventConsumer ) # ? ��J R \ - 8 � � � � J P oU��������� ����������������������� � LogFileEventConsumer Description Logs events to a text file AMENDMENT LOCALE Filename
� � � � string Description Fully qualified path name for the log file. If file does not exist, it will be created. If directory does not exist, file will not be created. IsUnicode
� d m z boolean Description If FALSE or NULL, file will not be Unicode. MaximumFileSize
� � � � uint64 Description Maximum size to which file is allowed to grow. It will be archived when it exceeds this size. Archived files have an extension of .001 through .999. A value of zero will be interpreted to mean 'do not archive.' Name )
� � �� # string Description A unique identifier for this instance Text
� | � � string Description Message to be inserted into the log file �
E v e n t T r a c e l͝��C�� EventTrace 6 � �� / 5 ] e o v m����~ � TSPkgDebugTrace Description Security: TSPkg Guid {6165f3e2-ae38-45d4-9b23-6b4818758bd9} locale MS\0x409 Flags E
� � � � � � � � � � uint32 Description Enable Flags ValueDescriptions # / = I Z e q | Error Flag Warning Flag Trace Flag Credential Flag CTXT Flag CALLS Flag AUTH Flag SESS Flag Values � � � � � � � � Error Warning Trace Creds Context Calls Auth Session ValueMap * 6 B N Z f r 0x00000001 0x00000002 0x00000004 0x00000008 0x00000010 0x00000020 0x00000040 0x00000080 � � ���Y� � ��4�� l � #� 8 x���8 ����> [ó�O � �r� � ��� � �?��F � �j�� � $ M s f t _ W m i P r o v i d e r _ O p e r a t i o n E v e n t _ P o s t �̝��C�� < . Msft_WmiProvider_OperationEvent_Post & # * Q ` � � � � ��W���������������������������������������������������������� � Msft_WmiProvider_AccessCheck_Post Query
,
� I string QueryLanguage (
� string Result 4
� � uint32 Sid 0
� � uint8 �$ M s f t _ W m i P r o v i d e r _ O p e r a t i o n E v e n t _ P o s t �̝��C� 3 . Msft_WmiProvider_OperationEvent_Post & % , S [ ��������������������������������������������������� � Msft_WmiProvider_ProvideEvents_Post Flags (
� K uint32 Result
,
� z uint32 �0 8 9 9 3 0 7 4 0 8 A 3 2 0 4 0 A 6 D A 1 9 C 0 B 1 E C 2 7 4 5 A 3 D 6 0 4 B A A 9 D F F E 8 E E 4 B 7 5 C 3 D 9 1 E 1 6 1 0 9 �̝��C�ȝ��C�� T � � __EventProviderRegistration % select * from Msft_WmiProvider_OperationEvent \\.\root\cimv2:__Win32Provider.Name="ProviderSubSystem"
R O O T \ c i m v 2 _ _ E v e n t P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 6 8 5 7 7 3 7 2 C 6 6 A 7 B 2 0 6 5 8 4 8 7 F B D 9 5 9 A A 1 5 4 E F 5 4 B 5 F 9 3 5 D C C 5 6 6 3 E 9 2 2 8 B 4 4 3 2 2 8 0 5 \ K I _ 0 8 9 9 3 0 7 4 0 8 A 3 2 0 4 0 A 6 D A 1 9 C 0 B 1 E C 2 7 4 5 A 3 D 6 0 4 B A A 9 D F F E 8 E E 4 B 7 5 C 3 D 9 1 E 1 6 1 0 9 \ I _ C 2 4 8 C 5 4 7 D C 1 5 B 7 8 4 B 3 A 4 0 2 B B D 3 0 D 0 3 6 F D 9 2 9 A D 8 0 7 F C 5 B 8 7 D 0 9 3 2 5 7 C 8 6 1 5 F E 4 B 2 __ �̝��C�� � ' � �� � 3 �� > ] � � � � D k � � �
0 W { � � � : \ � � � � 1 X w � � � ) J q � � � $ K t � � � UUUUUU������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������3 � Msft_WmiProvider_Counters Msft_ProviderSubSystem Singleton ProviderOperation_AccessCheck �
� | Uint64 ProviderOperation_CancelQuery �
� � Uint64 ProviderOperation_CreateClassEnumAsync
� Uint64 ProviderOperation_CreateInstanceEnumAsync 0
� c Uint64 ProviderOperation_CreateRefreshableEnum
h
� � Uint64 ProviderOperation_CreateRefreshableObject X
� Uint64 ProviderOperation_CreateRefresher
P
� O Uint64 ProviderOperation_DeleteClassAsync
� � Uint64 ProviderOperation_DeleteInstanceAsync (
� � Uint64 ProviderOperation_ExecMethodAsync @
� 2 Uint64 ProviderOperation_ExecQueryAsync 8
� { Uint64 ProviderOperation_FindConsumer �
� � Uint64 ProviderOperation_GetObjectAsync
� Uint64 ProviderOperation_GetObjects p
� P Uint64 ProviderOperation_GetProperty x
� � Uint64 ProviderOperation_NewQuery �
� � Uint64 ProviderOperation_ProvideEvents �
� ! Uint64 ProviderOperation_PutClassAsync
� i Uint64 ProviderOperation_PutInstanceAsync
� � Uint64 ProviderOperation_PutProperty �
� � Uint64 ProviderOperation_QueryInstances H
� C Uint64 ProviderOperation_SetRegistrationObject �
� � Uint64 ProviderOperation_StopRefreshing `
� � Uint64 ProviderOperation_ValidateSubscription �
� + Uint64 �
͝��C�� ' d l � � � U����������������> � WDMClassesOfDriver Locale ClassName '
� \ � �� � �� string Driver '
� � � �� � �� string HighDateTime '
� � � �� � �� uint32 LowDateTime '
� 6 � �� � �� uint32 W � M S F T _ W m i S e l f E v e n t �̝��C�Y + MSFT_WmiSelfEvent ) ! . � ��� � � # 9 � � � � �X � � � _U������������������������������������������ � Msft_WmiProvider_OperationEvent Description The Msft_WmiProvider_OperationEvent event class is the root definition of all WMI provider events.A provider operation is defined as some execution on behalf of a client via WMI that resultsin one or more calls to a provider executable, The properties of this class define the identity of the provider associated with the operation being executed and is uniquely associated with instances of the class Msft_Providers. Each instance of __Win32Provider can have an associated operation and be identified using the properties below. Internally WMI can contain any number of objects that refer to a particular instance of __Win32Provider since it differentiates each object based on whether the provider supports per user or per locale instantiation and also depending on where the provider is being hosted. Currently TransactionIdentifier is always an empty string. AMENDMENT LOCALE HostingGroup $
� � � � String Description The HostingGroup property currently is not used. HostingSpecification
� e m z Uint32 Description The HostingSpecification property currently is not used. Locale
� � � � String Description If the provider registration specifies per locale initialization, then the Locale property defines the client locale associated with specific instantiation of a provider. Namespace
� � � � String Description The Namespace property indicates the namespace where instance of __Win32Provider is instantiated.
� � � � String Description The Provider property indicates the Unique Name associated with the instance of __Win32Provider. TransactionIdentifer
� = E R String Description The TransactionIdentifer property is for internal use, currently always empty. User
� � � � String Description If the provider registration specifies per user initialization, then the User property defines the client principal identity associated with specific instantiation of a provider. � M s f t _ W m i P r o v i d e r _ O p e r a t i o n E v e n t �̝��C�] + ) Msft_WmiProvider_OperationEvent ! ) % 2 � ��� �������������������������������������������� � Msft_WmiProvider_OperationEvent_Pre Description The Msft_WmiProvider_OperationEvent_Pre event class contains the operation event generated prior to calling provider implementation. AMENDMENT LOCALE � M s f t _ W m i P r o v i d e r _ O p e r a t i o n E v e n t �̝��C�f + ) Msft_WmiProvider_OperationEvent ! ) & 3 � ��� �������������������������������������������� � Msft_WmiProvider_OperationEvent_Post Description The Msft_WmiProvider_OperationEvent_Post event class contains the operation event generated following completion of provider implementation. AMENDMENT LOCALE �6 4 6 5 9 A B 9 F 8 F 1 C 4 B 5 6 8 D B 6 4 3 8 B A E 1 1 B 2 6 E E 8 F 9 3 C B 5 F 8 1 9 5 E 2 1 E 8 C 3 8 3 D 6 C 4 4 C C 4 1 �uR|�C�ȝ��C�,
� __NAMESPACE ms_409 � � ms_409 �ڥ� g ���' � yD 9 ps̵}
���� � �@C� C� /� g 7*�8 � � 5Ռ z �E!� � � ��
C I M _ L o g i c a l E l e m e n t �vR|�C�+ K CIM_LogicalElement ) ' F ��Q Y a y � � % � � ���_�����������������������������������������������������������������������^ � MSFT_NetBranchCacheCache Description Describes a BranchCache cache AMENDMENT LOCALE MS_409 CacheFileDirectoryPath B
� � � � string Description The directory path where the cache file is located CurrentSizeOnDiskAsNumberOfBytes :
� < D Q uint64 Description The size of the cache file on disk, in bytes InstanceID @ )
� � � � � �� string Description Identifies an instance of MSFT_BranchCacheStore MaxCacheSizeAsNumberOfBytes 2
� Q Y f uint64 Description The maximum cache file size, in bytes MaxCacheSizeAsPercentageOfDiskVolume .
� � � � uint32 Description The maximum cache file size, represented as a percentage of the disk volume on which the cache is stored � M S F T _ N e t S e t t i n g D a t a �vR|�C�� MSFT_NetSettingData ) - X ��c k �����������������s � MSFT_NetBranchCacheSettingData Description Describes settings related to BranchCache AMENDMENT LOCALE MS_409 � M S F T _ N e t B r a n c h C a c h e S e t t i n g D a t a �vR|�C�� - ( MSFT_NetBranchCacheSettingData ) & 3 n ��y � � � r � � � � 1 � � V z ? k �UU������������������������������������������ � MSFT_NetBranchCacheClientSettingData Description Describes settings related to the BranchCache client role AMENDMENT LOCALE MS_409 CurrentClientMode +
� � � � ! ) uint32 Description The current operating mode of this BranchCache client Values = G S e Disabled LocalCache DistributedCache HostedCache DistributedCachingIsEnabled
� � � � boolean Description Indicates if Distributed Caching is enabled HostedCacheDiscoveryEnabled
� G P ] boolean Description Indicates if Hosted Cache discovery is enabled HostedCacheServerList
� � � � string Description Hosted cache servers to which this client will connect HostedCacheVersion
"
� ] e r uint32 Description The version of the hosted cache server MinimumSmbLatencyInMilliseconds &
� � � � uint32 Description The minimum network latency, in milliseconds, before the SMB client will use BranchCache PreferredContentInformationVersion +
� � � � uint32 Description The content information version this client will request from content servers Values + 5 Windows7 Windows8 ServeDistributedCachingPeersOnBatteryPower
� � � � boolean Description Indicates if this client will serve other distributed caching peers when operating on battery power � M S F T _ N e t B r a n c h C a c h e S e t t i n g D a t a �vR|�C�� ( MSFT_NetBranchCacheSettingData ) - : } ��� � � � ��������������������4 � MSFT_NetBranchCacheContentServerSettingData Description Describes settings related to the BranchCache content server role AMENDMENT LOCALE MS_409 ContentServerIsEnabled
� � � � boolean Description Indicates if BranchCache content server functionality is enabled � M S F T _ N e t B r a n c h C a c h e C a c h e �vR|�C�� S " MSFT_NetBranchCacheCache ) ! . U ��` h p � ����������������������������������������������������������������������������������� � MSFT_NetBranchCachePrimaryCache Description Describes a BranchCache primary cache AMENDMENT LOCALE MS_409 CurrentActiveCacheSize F
� � � � uint64 Description The current size of the cached data, in bytes � M S F T _ N e t B r a n c h C a c h e P r i m a r y C a c h e �vR|�C�� W ) MSFT_NetBranchCachePrimaryCache ! ) + P ��[ c k � ��������������������������������������������������������������������������������������� � MSFT_NetBranchCacheDataCache Description Represents a BranchCache data cache AMENDMENT LOCALE MS_409 DataCacheExtensions
N
� � � � object:MSFT_NetBranchCacheDataCacheExtension Description DataCacheExtensions � M S F T _ N e t B r a n c h C a c h e C a c h e �vR|�C� K " MSFT_NetBranchCacheCache ) # 0 Y ��d l ���������������������������������������������������������������������������t � MSFT_NetBranchCacheSecondaryCache Description Describes a BranchCache secondary cache AMENDMENT LOCALE MS_409 �! M S F T _ N e t B r a n c h C a c h e S e c o n d a r y C a c h e �vR|�C�1 K + MSFT_NetBranchCacheSecondaryCache # ) ' 4 b ��m u ���������������������������������������������������������������������������} � MSFT_NetBranchCacheDataCacheExtension Description Describes a BranchCache data cache extension AMENDMENT LOCALE MS_409 � M S F T _ N e t B r a n c h C a c h e P r i m a r y C a c h e �vR|�C�$ S ) MSFT_NetBranchCachePrimaryCache ! ) + O ��Z b �����������������������������������������������������������������������������������j � MSFT_NetBranchCacheHashCache Description Describes a BranchCache hash cache AMENDMENT LOCALE MS_409 � M S F T _ N e t B r a n c h C a c h e S e t t i n g D a t a �vR|�C�; ( MSFT_NetBranchCacheSettingData ) 1 > � ��� � � � ] � ( �������������������������� � MSFT_NetBranchCacheHostedCacheServerSettingData Description Describes settings related to the BranchCache hosted cache server role AMENDMENT LOCALE MS_409 ClientAuthenticationMode +
� � � ; C uint32 Description The authentication mode for hosted cache clients Values O U None Domain HostedCacheScpRegistrationEnabled
� � � � boolean Description Indicates if BranchCache hosted cache server Scp registration is enabled HostedCacheServerIsEnabled
� T ] j boolean Description Indicates if BranchCache hosted cache server is enabled � M S F T _ N e t S e t t i n g D a t a �vR|�C�� $ MSFT_NetSettingData ) ) Z ��e m u } � � W b � � $ - � � �U���������������������������������� � MSFT_NetNatExternalAddress Description Configuration settings for NAT External Address AMENDMENT LOCALE MS_409 Active
� � � � uint8 Description Indicates if this instance is active ExternalAddressID
� " * 7 uint32 Description Identifier for ExternalAddress IPAddress
� � � � string Description IP Address NatName
� � � � string Description Name of NAT to which this address belongs PortEnd
� Y a n uint16 Description End port specifying the end of the port range PortStart
� � � � uint16 Description Start port specifying the beginning of the port range � 0,Ї� < ��`�� _ ���[ _ N�BT� P L[�|
P �L)Z
V He�� � [��I� b ���u� b 6M.MY # q�7| S A s p N e t T r a c e E v e n t �?�4 � AspNetTraceEvent C ( � ��= H T c x � � � � � _�������������������������` � AspNetPipelineModuleLeave Description PipelineModuleLeave EventType EventLevel EventTypeName PipelineModuleLeave ConnID 6
� � � � � � �� uint64 WmiDataId Description ConnID ContextId
N
� S [ f s � � �� � �� object WmiDataId Description Context ID extension Guid ActivityID ModuleName P
� & 2 E U ] � �� string WmiDataId Description ModuleName StringTermination NullTerminated format w � A s p N e t T r a c e E v e n t �?�4 �' AspNetTraceEvent C $ � ��5 @ L [ l t � � _��������������������� � AspNetMapHandlerEnter Description MapHandlerEnter EventType EventLevel EventTypeName MapHandlerEnter ConnID 6
� � � � � � �� uint64 WmiDataId Description ConnID ContextId
N
� G O Z g s ~ � �� � �� object WmiDataId Description Context ID extension Guid ActivityID � A s p N e t T r a c e E v e n t �?�4 �' AspNetTraceEvent C $ � ��5
@ L [ l t � � _��������������������� � AspNetMapHandlerLeave Description MapHandlerLeave EventType EventLevel EventTypeName MapHandlerLeave ConnID 6
� � � � � � �� uint64 WmiDataId Description ConnID ContextId
N
� G O Z g s ~ � �� � �� object WmiDataId Description Context ID extension Guid ActivityID � A s p N e t T r a c e E v e n t �?�4 � AspNetTraceEvent C � ��+ 6 B Q ] e � � _��������������������� � AspNetParseEnter Description ParseEnter EventType EventLevel EventTypeName ParseEnter ConnID 6
� � � � � � �� uint64 WmiDataId Description ConnID ContextId
N
� 8 @ K X d o u �� � �� object WmiDataId Description Context ID extension Guid ActivityID � A s p N e t T r a c e E v e n t �?�4 � AspNetTraceEvent C � ��+ 6 B Q ] e � � _��������������������� � AspNetParseLeave Description ParseLeave EventType EventLevel EventTypeName ParseLeave ConnID 6
� � � � � � �� uint64 WmiDataId Description ConnID ContextId
N
� 8 @ K X d o u �� � �� object WmiDataId Description Context ID extension Guid ActivityID � A s p N e t T r a c e E v e n t �?�4 � AspNetTraceEvent C ! � ��/ : F U c k � � _��������������������� � AspNetCompileEnter Description CompileEnter EventType EventLevel EventTypeName CompileEnter ConnID 6
� � � � � � �� uint64 WmiDataId Description ConnID ContextId
N
� > F Q ^ j u { �� � �� object WmiDataId Description Context ID extension Guid ActivityID � A s p N e t T r a c e E v e n t �?�4 �� AspNetTraceEvent C ! � ��/ : F U c k � � � � A I _������������������������������ � AspNetCompileLeave Description CompileLeave EventType EventLevel EventTypeName CompileLeave ConnID 6
� � � � � � �� uint64 WmiDataId Description ConnID ContextId
N
� > F Q ^ j u { �� � �� object WmiDataId Description Context ID extension Guid ActivityID Files P
� � � � & 6 > � �� string WmiDataId Description Files StringTermination NullTerminated format w Status P
� � � � � � � � � � �� string WmiDataId Description Status StringTermination NullTerminated format w � A s p N e t T r a c e E v e n t �?�4 �* AspNetTraceEvent C % � ��7 B N ] o w � � _��������������������� � AspNetHttpHandlerEnter Description HttpHandlerEnter EventType EventLevel EventTypeName HttpHandlerEnter ConnID 6
� � � � � � �� uint64 WmiDataId Description ConnID ContextId
N
� J R ] j v � � �� � �� object WmiDataId Description Context ID extension Guid ActivityID � A s p N e t T r a c e E v e n t �?�4 �* AspNetTraceEvent C % � ��7 B N ] o w � � _��������������������� � AspNetHttpHandlerLeave Description HttpHandlerLeave EventType EventLevel EventTypeName HttpHandlerLeave ConnID 6
� � � � � � �� uint64 WmiDataId Description ConnID ContextId
N
� J R ] j v � � �� � �� object WmiDataId Description Context ID extension Guid ActivityID � A s p N e t T r a c e E v e n t �?�4 �� AspNetTraceEvent C " / � ��K V b q � � � � y � _�����������������������������; � AspNetSessionStatePartitionStart Description SessionStatePartitionStart EventType EventLevel EventTypeName SessionStatePartitionStart ConnID 6
� � � � � � �� uint64 WmiDataId Description ConnID ContextId
N
� h p { � � � � �� � �� object WmiDataId Description Context ID extension Guid ActivityID ResolverType P
� % 0 = K ^ n v � �� string WmiDataId Description ResolverType StringTermination NullTerminated format w SessionId P
� � � �
0 8 � �� string WmiDataId Description SessionId StringTermination NullTerminated format w � A s p N e t T r a c e E v e n t �?�4 � AspNetTraceEvent C - � ��G R ^ m � � � � � _�������������������������w � AspNetSessionStatePartitionEnd Description SessionStatePartitionEnd EventType EventLevel EventTypeName SessionStatePartitionEnd ConnID 6
� � � � � � �� uint64 WmiDataId Description ConnID ContextId
N
� b j u � � � � �� � �� object WmiDataId Description Context ID extension Guid ActivityID ResolverResult P
� ! , 9 I \ l t � �� string WmiDataId Description ResolverResult StringTermination NullTerminated format w � �� Ӌ�~0 Wm��O ��H�k *�a3� �`7�� �o�� ;�|� hm�� %�Z6� �[�: " ��@z0 & T�
�V
� Y��B � >Q��� � ���>� � t�)ס � �mp� � Dv�,h 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 e=�4 �
͝��C�� * 9� (D� l � WDMClassesOfDriver ProcessorCStateEvent C:\Windows\System32\drivers\en-US\processr.sys.mui[PROCESSORWMI] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 u=�4 �
͝��C�� ' 9� (D� i � WDMClassesOfDriver PerformanceStates C:\Windows\System32\drivers\en-US\processr.sys.mui[PROCESSORWMI] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 v=�4 �
͝��C�� % 9� (D� g � WDMClassesOfDriver ProcessorStatus C:\Windows\System32\drivers\en-US\processr.sys.mui[PROCESSORWMI] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 w=�4 �
͝��C�� " 9� (D� d � WDMClassesOfDriver AcpiPssState C:\Windows\System32\drivers\en-US\processr.sys.mui[PROCESSORWMI] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 x=�4 �
͝��C�� 9� (D� _ � WDMClassesOfDriver AcpiPss C:\Windows\System32\drivers\en-US\processr.sys.mui[PROCESSORWMI] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 y=�4 �
͝��C�� ! 9� (D� c � WDMClassesOfDriver AcpiGenAddr C:\Windows\System32\drivers\en-US\processr.sys.mui[PROCESSORWMI] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 z=�4 �
͝��C�� ' 9� (D� i � WDMClassesOfDriver AcpiControlStatus C:\Windows\System32\drivers\en-US\processr.sys.mui[PROCESSORWMI] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 {=�4 �
͝��C�� 9� (D� _ � WDMClassesOfDriver AcpiPct C:\Windows\System32\drivers\en-US\processr.sys.mui[PROCESSORWMI] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 |=�4 �
͝��C�� ' 9� (D� i � WDMClassesOfDriver ProcessorBiosInfo C:\Windows\System32\drivers\en-US\processr.sys.mui[PROCESSORWMI] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 }=�4 �
͝��C�� - 9� (D� o � WDMClassesOfDriver ProcessorPerfStateEvent C:\Windows\System32\drivers\en-US\processr.sys.mui[PROCESSORWMI] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ~=�4 �
͝��C�� 1 9� (D� s � WDMClassesOfDriver ProcessorThrottleStateEvent C:\Windows\System32\drivers\en-US\processr.sys.mui[PROCESSORWMI] A N C M _ E v e n t s �5h�b ��
ANCM_Events
C � �� B M Y h � � _������������< � ANCMAsyncStart Description Starting inprocess async completion EventType EventLevel EventTypeName ANCM_INPROC_ASYNC_COMPLETION_START ContextId
N
� � � * 0 �� � �� object WmiDataId Description Context ID extension Guid ActivityID � A N C M _ E v e n t s �5h�b �k ANCM_Events
C � �� >
I U d � � = L _����������������� � ANCMAsyncEnd Description Ending inprocess async completion EventType EventLevel EventTypeName ANCM_INPROC_ASYNC_COMPLETION_COMPLETION ContextId
N
� � � + 1 �� � �� object WmiDataId Description Context ID extension Guid ActivityID requestStatus C
� � � � � � � � �� uint32 WmiDataId Description Notification status format d � A N C M _ E v e n t s �5h�b ��
ANCM_Events
C � �� " : E Q ` ~ � _������������. � ANCMRequestShutdown Description Inprocess app shutdown EventType EventLevel EventTypeName ANCM_INPROC_REQUEST_SHUTDOWN ContextId
N
� � � � " �� � �� object WmiDataId Description Context ID extension Guid ActivityID � A N C M _ E v e n t s �5h�b ��
ANCM_Events
C � �� $ B M Y h � � _������������8 � ANCMRequestDisconnect Description Inprocess request disconnect EventType EventLevel EventTypeName ANCM_INPROC_REQUEST_DISCONNECT ContextId
N
� � � & , �� � �� object WmiDataId Description Context ID extension Guid ActivityID � A N C M _ E v e n t s �5h�b ��
ANCM_Events
C � �� + N
Y e t � � _������������L � ANCMManagedRequestCompletion Description Indicate managed request complete EventType EventLevel EventTypeName ANCM_INPROC_MANAGED_REQUEST_COMPLETION ContextId
N
� # / : @ �� � �� object WmiDataId Description Context ID extension Guid ActivityID � A N C M _ E v e n t s �5h�b �� ANCM_Events
C � �� 0 ; G V k v ! � � ` f _�������������������������� � ANCMHRESULTFailed Description Failed HRESULT EventType EventLevel EventTypeName ANCM_HRESULT_FAILED ContextId
N
� � � � � � �� � �� object WmiDataId Description Context ID extension Guid ActivityID File C
� r z � � � � � �� string WmiDataId Description Failed source file location StringTermination NullTerminated HResult C
� , 4 ? L U ] � �� uint32 WmiDataId Description HResult format x Line C
� � � � � � � � �� uint32 WmiDataId Description Failed line number format d � A N C M _ E v e n t s �5h�b �� ANCM_Events
C � �� ' 9 D P _ v � & 3 � � � � _�������������������������6 � ANCMExceptionCaughFailed Description Caught exception EventType EventLevel EventTypeName ANCM_EXCEPTION_CAUGHT ContextId
N
� � � � � �� � �� object WmiDataId Description Context ID extension Guid ActivityID Description C
� � � � � � � � �� string WmiDataId Description Exception description StringTermination NullTerminated File C
� 5 = H U t � � �� string WmiDataId Description Exception catch file location StringTermination NullTerminated Line C
� � � + 3 � �� uint32 WmiDataId Description Exception catch line number format d ����� [ � WDMClassesOfDriver MSNdis C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] ernelbase.dll[MofResourceName] �H�"@ � v}�r� �V�� -H/�� �� � � 2�uM� � �.7�| � ew�Tz
= ���� S g {
, � ��6
��"�@ F �(q� � ��,�| �s� =( � � �sxʊ g H��� � aL�&� � 0 8 9 9 3 0 7 4 0 8 A 3 2 0 4 0 A 6 D A 1 9 C 0 B 1 E C 2 7 4 5 A 3 D 6 0 4 B A A 9 D F F E 8 E E 4 B 7 5 C 3 D 9 1 E 1 6 1 0 9 �Ν��C�ȝ��C� � � � __EventProviderRegistration ) select * from __InstanceModificationEvent where TargetInstance isa "Win32_LocalTime" select * from __InstanceModificationEvent where TargetInstance isa "Win32_UTCTime" __Win32Provider="Win32ClockProvider"
R O O T \ c i m v 2 _ _ E v e n t P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 6 8 5 7 7 3 7 2 C 6 6 A 7 B 2 0 6 5 8 4 8 7 F B D 9 5 9 A A 1 5 4 E F 5 4 B 5 F 9 3 5 D C C 5 6 6 3 E 9 2 2 8 B 4 4 3 2 2 8 0 5 \ K I _ 0 8 9 9 3 0 7 4 0 8 A 3 2 0 4 0 A 6 D A 1 9 C 0 B 1 E C 2 7 4 5 A 3 D 6 0 4 B A A 9 D F F E 8 E E 4 B 7 5 C 3 D 9 1 E 1 6 1 0 9 \ I _ 1 7 1 D F 7 1 A B D 7 C 6 A 7 D F 0 3 D 4 A F A 7 3 A 2 C E 1 B A 6 5 8 B 6 6 0 1 6 A 9 D F 4 D A B 1 4 8 F 7 8 1 B E 2 8 5 1 A E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C �Ν��C� ȝ��C�s � �� �� F � __InstanceProviderRegistration __Win32Provider="Win32ClockProvider"
R O O T \ c i m v 2 _ _ I n s t a n c e P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 6 8 5 7 7 3 7 2 C 6 6 A 7 B 2 0 6 5 8 4 8 7 F B D 9 5 9 A A 1 5 4 E F 5 4 B 5 F 9 3 5 D C C 5 6 6 3 E 9 2 2 8 B 4 4 3 2 2 8 0 5 \ K I _ E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C \ I _ 1 7 1 D F 7 1 A B D 7 C 6 A 7 D F 0 3 D 4 A F A 7 3 A 2 C E 1 B A 6 5 8 B 6 6 0 1 6 A 9 D F 4 D A B 1 4 8 F 7 8 1 B E 2 8 5 1 A _ _ E x t r i n s i c E v e n t ���C�O
__ExtrinsicEvent ������������ � RegistryEvent �
R e g i s t r y E v e n t ���C�� RegistryEvent E N _��������������������u � RegistryKeyChangeEvent Hive
� = string KeyPath
� m string �
R e g i s t r y E v e n t ���C�� RegistryEvent F P _��������������������w � RegistryTreeChangeEvent Hive
� > string RootPath
� o string �
R e g i s t r y E v e n t ���C� RegistryEvent G P w � _�������������������������� � RegistryValueChangeEvent Hive
� ? string KeyPath
� o string ValueName
� � string �5 7 E 5 F 3 A D D 9 E 2 4 2 C 4 E 9 F 9 E D F 7 9 A A 9 7 F 7 9 E 7 9 1 1 C 5 A 8 B 9 0 2 E C 1 5 0 D 6 4 4 2 E 3 B 8 5 A 5 A A �Ν��C�ȝ��C�� ���J 9 a � __Win32Provider {fa77a74e-e109-11d0-ad6e-00c04fd8fdff} LocalSystemHost RegistryEventProvider 0 8 9 9 3 0 7 4 0 8 A 3 2 0 4 0 A 6 D A 1 9 C 0 B 1 E C 2 7 4 5 A 3 D 6 0 4 B A A 9 D F F E 8 E E 4 B 7 5 C 3 D 9 1 E 1 6 1 0 9 �Ν��C�ȝ��C�� B � � __EventProviderRegistration % select * from RegistryEvent \\.\Root\Default:__Win32Provider.Name="RegistryEventProvider" R O O T \ D e f a u l t _ _ E v e n t P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 8 9 2 F 8 D B 6 9 C 4 E D F B C 6 8 1 6 5 C 9 1 0 8 7 B 7 A 0 8 3 2 3 F 6 C E 5 B 5 E F 3 4 2 C 0 F 9 3 E 0 2 A 0 5 9 0 B F C 4 \ K I _ 0 8 9 9 3 0 7 4 0 8 A 3 2 0 4 0 A 6 D A 1 9 C 0 B 1 E C 2 7 4 5 A 3 D 6 0 4 B A A 9 D F F E 8 E E 4 B 7 5 C 3 D 9 1 E 1 6 1 0 9 \ I _ D 9 8 0 E B 9 E 5 6 4 2 F 0 9 9 9 D C 4 A B 7 2 4 E 6 D 1 A B 5 B D 3 B F 3 2 E B 2 B 6 E D 1 2 3 0 F 2 B C E F 6 E 5 3 6 E 1 0 5 7 E 5 F 3 A D D 9 E 2 4 2 C 4 E 9 F 9 E D F 7 9 A A 9 7 F 7 9 E 7 9 1 1 C 5 A 8 B 9 0 2 E C 1 5 0 D 6 4 4 2 E 3 B 8 5 A 5 A A �Ν��C�ȝ��C�� �����K 9 T � __Win32Provider {fe9af5c0-d3b6-11ce-a5b6-00aa00680c3f} LocalServiceHost RegProv 7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D �Ν��C�
ȝ��C�f O � __MethodProviderRegistration \\.\Root\Default:__Win32Provider.Name="RegProv" R O O T \ D e f a u l t _ _ M e t h o d P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 8 9 2 F 8 D B 6 9 C 4 E D F B C 6 8 1 6 5 C 9 1 0 8 7 B 7 A 0 8 3 2 3 F 6 C E 5 B 5 E F 3 4 2 C 0 F 9 3 E 0 2 A 0 5 9 0 B F C 4 \ K I _ 7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D \ I _ 5 9 B F A F E B F 6 0 E 8 B 2 1 0 4 B 0 7 B A 7 F A D A F 4 F C F E B 1 8 9 9 9 F E 9 2 B 1 1 F 1 C 0 0 E 9 3 8 C B 4 B 9 3 A 6 E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C �Ν��C� ȝ��C�~ � ���� �� Q � __InstanceProviderRegistration \\.\Root\Default:__Win32Provider.Name="RegProv"
E v e n t T r a c e �ҝ��C�� EventTrace 6 � �� ) / W _ i � Bid2Etw_MSADCE_1 Description MSADCE.1 Guid {76DBA919-5A36-FC80-2CAD-3185532B7CB1} locale MS\0x409 B � �Ν��C�O + ��
& + � � # � � � � Y ` � � = E � � 2 8 UU������������������������������������������ � Win32_CurrentTime AMENDMENT LOCALE Day
� W _ l uint32 Description The current matching day (1-31) DayOfWeek
� � � � uint32 Description The current matching day of the current week (0-6, Sunday being 0) Hour
� O W d uint32 Description The current hour of the current day (0-23) Milliseconds $
� � � � uint32 Description (currently not used) Minute
� ) 1 > uint32 Description The current minute (0-59) Month
� � � � uint32 Description The current matching month (1-12) Quarter
� � uint32 Description The current quarter of the current year (1-4) Second
� q y � uint32 Description The current second of the current minute (0-59) WeekInMonth
� � � uint32 Description The current week in the current month (1-6) Year
� d l y uint32 Description The current matching year (4 digits) � W i n 3 2 _ C u r r e n t T i m e �Ν��C�� + Win32_CurrentTime ) * ��5 �������������������������������������������= � Win32_LocalTime Description Describes an instance in time as returned by Win32ClockProvider. When a query is submitted to the Win32LocalClockProvider, the results are returned as Win32_LocalTime objects with times matching the query. These are returned as part of __InstanceModificationEvents AMENDMENT LOCALE � W i n 3 2 _ C u r r e n t T i m e �Ν��C�� + Win32_CurrentTime ) $ ��/ �������������������������������������������7 � Win32_UTCTime Description Describes an instance in time as returned by Win32ClockProvider. When a query is submitted to the Win32UTCClockProvider, the results are returned as Win32_UTCTime objects with times matching the query. These are returned as part of __InstanceModificationEvents AMENDMENT LOCALE � � � B � �.)� � kƜhY R �] � �'��� k R�� � ��dH w �NF\� � $[��h D :\�� � �Н��C�j � �� � 5 � RsopLoggingModeProvider Rsop Logging Mode Provider C so ing B � � ggi � - \ ` �
� RsopCreateSession - ��5 �� static implemented � ae442007200009F ROOT\RSOP ���� � �1 �� * � � = ��������| � __PARAMETERS abstract flags uint32
� 1 in
� 1 X �� ID )
� � X ��� uint32 userSid string
� � in
� � �� ID )
� t ��9 string __ � ae442007200009F ROOT\RSOP ���� � ��
�� � � � C * � ������������; � __PARAMETERS abstract nameSpace string
� 5 out
� 5 \ �� ID )
� � \ ��� string hResult uint32
� � out
� � �� ID )
� z ��? uint32 ExtendedInfo uint32
� � out
� � � �� ID )
� 3 � ��� uint32 __ � RsopDeleteSession ��
�� static implemented � ae442007200009F ROOT\RSOP ���� � �� �� * � ����� � __PARAMETERS abstract nameSpace string
� 5 in
� 5 \ �� ID )
� � \ ��� string __ �� ae442007200009F ROOT\RSOP ���� � �� �� * � ����� � __PARAMETERS abstract hResult uint32
� 3 out
� 3 Z �� ID )
� � Z ��� uint32 __ � RsopEnumerateUsers G ��O �� static implemented � ae442007200009F ROOT\RSOP ���� � �9 �� � B * � ��������� � __PARAMETERS abstract userSids string
� 4 out
� 4 [ �� ID )
� � [ ��� string hResult uint32
� � out
� � �� ID )
� y ��> uint32 __ �5 7 E 5 F 3 A D D 9 E 2 4 2 C 4 E 9 F 9 E D F 7 9 A A 9 7 F 7 9 E 7 9 1 1 C 5 A 8 B 9 0 2 E C 1 5 0 D 6 4 4 2 E 3 B 8 5 A 5 A A �Н��C�ȝ��C�� ���C �� 9 ` � __Win32Provider {F0FF8EBB-F14D-4369-bd2e-d84fbf6122d6} SelfHost Rsop Planning Mode Provider 7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D �Н��C�
ȝ��C�w ` � __MethodProviderRegistration \\.\root\RSOP:__Win32Provider.Name="Rsop Planning Mode Provider" R O O T \ R S O P _ _ M e t h o d P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ B 9 F 1 5 E 9 C 0 9 5 5 B 8 4 B 8 B 7 E 8 4 0 A 8 7 8 C 2 9 2 A 9 4 8 3 B 5 5 C 2 B C 3 7 0 0 6 5 6 2 D C 7 6 2 D 4 6 6 1 0 2 F \ K I _ 7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D \ I _ F 7 2 5 5 4 2 B C C 5 E E 8 1 8 B B 3 2 6 8 E 2 A 3 9 F 3 A 5 3 C 7 8 7 2 F 2 7 4 E F A D 1 F D 9 3 5 D 8 C 2 E D 4 2 D 5 A 8 0 �Н��C�x
�� " 0 b k � � � � # / b g � � ��������� �� � � RSOP_GPLink Association Locale appliedOrder
� Z � �� uint32 enabled
� � � �� boolean GPO f '
� � � �� � �� ref:RSOP_GPO linkOrder
� � �� uint32 noOverride
� Y � �� boolean SOM f '
� � � �� � �� ref:RSOP_SOM somOrder '
� � � �� � �� uint32 � ���C�_ �� & 4 h o � � 9 E � � ������� � � ����� � RSOP_PolicySetting abstract Locale creationTime e
� ^ � �� datetime GPOID
� � � �� string id 2
� � � ��� �� � �� string Required Not_Null name
� 1 � �� string precedence 2
� � � ��� �� � �� uint32 Required Not_Null SOMID
� � � �� string � ���C�� " - _ h � � � � $ X \ � � U������������������������ � RSoP_PolicySettingStatus Locale errorCode
� W � �� uint32 eventID
� � � �� uint32 eventLogName
� � � �� string eventSource
� � �� string eventTime e
� N � �� datetime id '
� � � �� � �� string status )
� � � � � �� sint32 ValueMap 0 1 2 3 4 � ���C�, �� - 6 � � %��������� � RSoP_PolicySettingLink Locale Association setting f '
� k � �� � �� ref:RSOP_PolicySetting status f '
� � � �� � �� ref:RSoP_PolicySettingStatus � � ���C�� # ' < c w � � � � , S [ � � � �
$ UU���������������������������������L � RSOP_IESecurityContentRatings Locale alwaysViewableSites
� [ string neverViewableSites
� � string passwordOverrideEnabled
� � boolean ratingSystemFileNames
� string ratingSystems
� K string rsopID
� � � �� string rsopPrecedence
� � � �� sint32 selectedRatingsBureau
� string viewUnknownRatedSites
� C boolean � �� ��� m �k �nP � {�?b� & @�懸 p M��Y( � C I M _ S e t t i n g �ɝ��C�� k CIM_Setting
A �� � �� � ' / 5 ] x / � � x � & 6 � � � � ( � � b ~ $ 2 � � � � l � +
B
�
�
� � I W �
�
�
w � ( @ � � � � UUUQU����������������������������������������������������������������G ��������������������������������U � Win32_WMISetting Singleton WBEMCORE Locale UUID {A83EF166-CA8D-11d2-B33D-00104BCC4B4A} ASPScriptDefaultNamespace @ 4
� � � �� � ��� � string MappingStrings � Win32Registry|Software\Microsoft\WBEM\scripting|Default Namespace ASPScriptEnabled > 4
� q � �� � ��z � boolean MappingStrings � Win32Registry|Software\Microsoft\WBEM\scripting|Enable for ASP AutorecoverMofs )
� � ��" 2 string MappingStrings : Win32Registry|Software\Microsoft\WBEM\CIMOM|Autorecover MOFs AutoStartWin9X 4
� � � �� � ��� � uint32 MappingStrings � Win32Registry|Software\Microsoft\WBEM\CIMOM|AutostartWin9X BackupInterval 6 4
� x � �� � ��� � uint32 MappingStrings � Win32Registry|Software\Microsoft\WBEM\CIMOM|Backup Interval Threshold BackupLastTime e : 4
� 1 � �� � ��; K datetime MappingStrings S Win32API|Time Functions|GetTimeZoneInformation BuildVersion )
� � � ��� � string MappingStrings � Win32Registry|Software\Microsoft\WBEM|Build DatabaseDirectory . )
� _ � ��g w string MappingStrings Win32Registry|Software\Microsoft\WBEM\CIMOM|Repository Directory DatabaseMaxSize
2 )
� � �� ! uint32 MappingStrings ) Win32Registry|Software\Microsoft\WBEM\CIMOM|Max DB Size EnableAnonWin9xConnections 4
� � � �� � ��� � boolean MappingStrings � Win32Registry|Software\Microsoft\WBEM\CIMOM|EnableAnonConnections EnableEvents D 4
� t � �� � ��} � boolean MappingStrings � Win32Registry|Software\Microsoft\WBEM\CIMOM|EnableEvents EnableStartupHeapPreallocation ^ 4
� 1 � �� � ��: J boolean MappingStrings R Win32Registry|Software\Microsoft\WBEM\CIMOM|EnableStartupHeapPreallocation HighThresholdOnClientObjects F 4
� � � �� � �� uint32 MappingStrings Win32Registry|Software\Microsoft\WBEM\CIMOM|High Threshold On Client Objects HighThresholdOnEvents R 4
� � � �� � ��� � uint32 MappingStrings � Win32Registry|Software\Microsoft\WBEM\CIMOM|High Threshold On Events InstallationDirectory )
� y
� ���
�
string MappingStrings �
Win32Registry|Software\Microsoft\WBEM|Installation Directory LastStartupHeapPreallocation ` )
� , � ��4 D uint32 MappingStrings L Win32Registry|Software\Microsoft\WBEM\CIMOM|LastStartupHeapPreallocation LoggingDirectory * 4
� � � �� � ��� string MappingStrings
Win32Registry|Software\Microsoft\WBEM\CIMOM|Logging Directory LoggingLevel
& 4
� � � �� � ��� � uint32 MappingStrings � Win32Registry|Software\Microsoft\WBEM\CIMOM|Logging LowThresholdOnClientObjects J 4
� M
� �� � ��U
e
uint32 MappingStrings m
Win32Registry|Software\Microsoft\WBEM\CIMOM|Low Threshold On Client Objects LowThresholdOnEvents V 4
� � �� � �� * uint32 MappingStrings 2 Win32Registry|Software\Microsoft\WBEM\CIMOM|Low Threshold On Events MaxLogFileSize " 4
� � � �� � ��� � uint32 MappingStrings � Win32Registry|Software\Microsoft\WBEM\CIMOM|Log File Max Size MaxWaitOnClientObjects N 4
� � � �� � ��� � uint32 MappingStrings � Win32Registry|Software\Microsoft\WBEM\CIMOM|Max Wait On Events MaxWaitOnEvents Z 4
� 5 � �� � ��= M uint32 MappingStrings U Win32Registry|Software\Microsoft\WBEM\CIMOM|Max Wait On Events MofSelfInstallDirectory )
� � � ��� � string MappingStrings Win32Registry|Software\Microsoft\WBEM|MOF Self-Install Directory \\root\cimv2 � C I M _ E l e m e n t S e t t i n g �ɝ��C�1 CIM_ElementSetting 6 � �� � # + 1 Y b e��������� � Win32_WMIElementSetting WBEMCORE Locale UUID {A83EF167-CA8D-11d2-B33D-00104BCC4B4A} Element f@ A
� � � �� � ��� � � � ref:Win32_Service Override Element MappingStrings � WMI|Win32_Service Setting f@ A
� Z � �� � ��p z � � ref:Win32_WMISetting Override Setting MappingStrings � WMI|Win32_WMISetting RE � C I M _ L o g i c a l E l e m e n t �ɝ��C�� CIM_LogicalElement ) ��$ , 2 ����������������������Z � Win32_ProgramGroupOrItem Abstract Locale UUID {86E30E86-7DB2-11d2-90CB-0060081A46FD} � W i n 3 2 _ P r o g r a m G r o u p O r I t e m �ɝ��C�> " Win32_ProgramGroupOrItem C � �� � % 1 M U [ � � % � � ����������������������������� � Win32_LogicalProgramGroup CIMWin32 Privileges 9 SeRestorePrivilege Locale UUID {D52706F2-8045-11d2-90CE-0060081A46FD} GroupName )
� � � ��� � string MappingStrings � Win32API|CWbemProviderGlue Class Methods|GetAllInstances Name @ N
� � � ��� � � ��� � � string Override Name MaxLen MappingStrings � Win32API|CWbemProviderGlue Class Methods|GetAllInstances UserName )
� 4 � ��< L string MappingStrings T Win32API|CWbemProviderGlue Class Methods|GetAllInstances � W i n 3 2 _ P r o g r a m G r o u p O r I t e m �ɝ��C�� " Win32_ProgramGroupOrItem C � �� � ) 5 Q Y _ � � ���������������������F � Win32_LogicalProgramGroupItem CIMWin32 Privileges = SeRestorePrivilege Locale UUID {86E30E82-7DB2-11d2-90CB-0060081A46FD} Name @ A
� � � ��� � � ��� string Override Name MappingStrings Win32API|CWbemProviderGlue Class Methods|GetAllInstances � W i n 3 2 _ S y s t e m D e v i c e s �ɝ��C�2 Win32_SystemDevices 6 � �� � ) 1 7 _ o e��������� � Win32_ComputerSystemProcessor CIMWin32 Locale UUID {719A6839-C124-11d2-85E8-0000F8102E5F} GroupComponent f@ +
� � � � � � ref:Win32_ComputerSystem Override GroupComponent MappingStrings � WMI|Win32_ComputerSystem PartComponent f@ +
� V k u � � ref:Win32_Processor Override PartComponent MappingStrings � WMI|Win32_Processor �F D 1 C 1 D 4 1 4 B 7 1 B 5 0 8 2 C 2 6 6 A 6 5 0 E 3 1 E F 6 D 5 0 1 9 3 8 2 7 2 4 2 4 4 B 6 8 5 F 2 1 7 C 0 A A E 0 0 A 9 2 1 ֝��C�Cȝ��C�$ � __SystemSecurity ��ɡ � $z�4� L ��� � �Ca�� � ���~ 8 �ƺ� � ��1�j L ��s� [ =d: �T��
���� � ^�ʳ� � �{u��
� �1��h � e|� { �KD� / F D 1 C 1 D 4 1 4 B 7 1 B 5 0 8 2 C 2 6 6 A 6 5 0 E 3 1 E F 6 D 5 0 1 9 3 8 2 7 2 4 2 4 4 B 6 8 5 F 2 1 7 C 0 A A E 0 0 A 9 2 1 �Н��C�Cȝ��C�$ � __SystemSecurity 4 1 C 5 3 E 6 D B 1 A C F 2 4 5 3 C E F D 4 1 3 9 8 1 9 8 E 6 1 3 F 1 0 D F F 4 7 7 0 9 E C A B 1 D 7 F 0 3 7 7 5 6 A C 8 C E 7 �Н��C�ȝ��C�� � � __thisNAMESPACE � �p � \ ? ? ? # 6 4 6 5 9 A B 9 F 8 F 1 C 4 B 5 6 8 D B 6 4 3 8 B A E 1 1 B 2 6 E E 8 F 9 3 C B 5 F 8 1 9 5 E 2 1 E 8 C 3 8 3 D 6 C 4 4 C C 4 1 �Н��C�ȝ��C�*
� __NAMESPACE User F D 1 C 1 D 4 1 4 B 7 1 B 5 0 8 2 C 2 6 6 A 6 5 0 E 3 1 E F 6 D 5 0 1 9 3 8 2 7 2 4 2 4 4 B 6 8 5 F 2 1 7 C 0 A A E 0 0 A 9 2 1 �Н��C�Cȝ��C�$ � __SystemSecurity 4 1 C 5 3 E 6 D B 1 A C F 2 4 5 3 C E F D 4 1 3 9 8 1 9 8 E 6 1 3 F 1 0 D F F 4 7 7 0 9 E C A B 1 D 7 F 0 3 7 7 5 6 A C 8 C E 7 �Н��C�ȝ��C�� � � __thisNAMESPACE | �\ l H ? ? ? F D 1 C 1 D 4 1 4 B 7 1 B 5 0 8 2 C 2 6 6 A 6 5 0 E 3 1 E F 6 D 5 0 1 9 3 8 2 7 2 4 2 4 4 B 6 8 5 F 2 1 7 C 0 A A E 0 0 A 9 2 1 �Н��C�Cȝ��C�$ � __SystemSecurity 4 1 C 5 3 E 6 D B 1 A C F 2 4 5 3 C E F D 4 1 3 9 8 1 9 8 E 6 1 3 F 1 0 D F F 4 7 7 0 9 E C A B 1 D 7 F 0 3 7 7 5 6 A C 8 C E 7 �Н��C�ȝ��C�� � � __thisNAMESPACE � �p � \ ? ? ? ? 5 7 E 5 F 3 A D D 9 E 2 4 2 C 4 E 9 F 9 E D F 7 9 A A 9 7 F 7 9 E 7 9 1 1 C 5 A 8 B 9 0 2 E C 1 5 0 D 6 4 4 2 E 3 B 8 5 A 5 A A �Н��C�ȝ��C�� ���M �� 9 i � __Win32Provider {B3FF88A4-96EC-4cc1-983F-72BE0EBB368B} NetworkServiceHost Rsop Logging Mode Provider 7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D �Н��C�
ȝ��C�v _ � __MethodProviderRegistration \\.\root\RSOP:__Win32Provider.Name="Rsop Logging Mode Provider" R O O T \ R S O P _ _ M e t h o d P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ B 9 F 1 5 E 9 C 0 9 5 5 B 8 4 B 8 B 7 E 8 4 0 A 8 7 8 C 2 9 2 A 9 4 8 3 B 5 5 C 2 B C 3 7 0 0 6 5 6 2 D C 7 6 2 D 4 6 6 1 0 2 F \ K I _ 7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D \ I _ 5 3 A 1 D C 0 D D A 2 E 3 9 C 5 2 3 B 6 2 6 F E 8 E C D 0 5 C 3 7 B E C 4 2 0 D 5 9 2 C 1 B C 7 0 8 D 9 4 8 9 C 2 8 C 3 5 D E 9 z { F D 1 C 1 D 4 1 4 B 7 1 B 5 0 8 2 C 2 6 6 A 6 5 0 E 3 1 E F 6 D 5 0 1 9 3 8 2 7 2 4 2 4 4 B 6 8 5 F 2 1 7 C 0 A A E 0 0 A 9 2 1 |ѝ��C�Cȝ��C�C ��& � __SystemSecurity RequiresEncryption 6 4 6 5 9 A B 9 F 8 F 1 C 4 B 5 6 8 D B 6 4 3 8 B A E 1 1 B 2 6 E E 8 F 9 3 C B 5 F 8 1 9 5 E 2 1 E 8 C 3 8 3 D 6 C 4 4 C C 4 1 ӝ��C�ȝ��C�*
� __NAMESPACE RSOP 6 4 6 5 9 A B 9 F 8 F 1 C 4 B 5 6 8 D B 6 4 3 8 B A E 1 1 B 2 6 E E 8 F 9 3 C B 5 F 8 1 9 5 E 2 1 E 8 C 3 8 3 D 6 C 4 4 C C 4 1 ӝ��C�ȝ��C�.
� __NAMESPACE Computer C I M _ L o g i c a l E l e m e n t EtR|�C�b " CIM_LogicalElement ) " � ��� � � � � ) � � � � U b 4 C � UU��������������������������������� � Win32_ServerSession Description The Win32_ServerSession class represents the sessions that have been established with the local computer, by users on some remote computer. AMENDMENT LOCALE ActiveTime +
� y � uint32 Description The ActiveTime property indicates the number of seconds since this session was established. Units seconds ClientType
� � � � String Description The ClientType property indicates the type of the connected client. ComputerName )
� ` h u � �� String Description The ComputerName property indicates the name of the computer from which the session is established IdleTime +
� $ 1 � � uint32 Description The IdleTime property indicates the number of seconds that the session has been idle. Units seconds ResourcesOpened
� � � � uint32 Description The ResourcesOpened property indicates the number of files, devices and pipes opened during this session. SessionType +
� � � � uint32 Description The SessionType property indicates how the session was opened. Only on Win NT. Values - Guest NoEncryption Other TransportName
� o w � String Description The TransportName property specifies the name of the transport that the client is using to communicate with the server UserName )
� = E R � �� String Description The UserName property indicates the name of the user that established the session. � C I M _ L o g i c a l E l e m e n t �tR|�C�? CIM_LogicalElement ) % � ��� � � � � I W � � � � 8 C � � U����������������������������� � Win32_ServerConnection Description The Win32_ServerConnection class represents the connections made from a remote computer, to a shared resource on the local computer. AMENDMENT LOCALE ActiveTime +
� x uint32 Description The ActiveTime property indicates the number of seconds since this connection was established. Units seconds ComputerName )
� � � � � �� string Description The ComputerName property indicates the name of the computer from which the connection is established ConnectionID
� � � � uint32 Description The ConnectionID property indicates a unique ID for the connection. NumberOfFiles
� - uint32 Description The NumberOfFiles property indicates the number of open files associated with this connection. NumberOfUsers
� � � � uint32 Description The NumberOfUsers property indicates the number of users associated with this connection. ShareName )
� z � � � �� string Description The ShareName property indicates the share resource to which the connection is established UserName )
� , 4 A � �� string Description The UserName property indicates the name of the user that made a connection. � C I M _ D e p e n d e n c y ���C�� CIM_Dependency ) & � ��� � � � u��������� � Win32_SessionConnection Description The Win32_SessionConnection class represents an association between a session established with the local server, by a user on a remote machine, and the connections that depend on the session. AMENDMENT LOCALE Antecedent f@ )
� = V c � �� ref:Win32_ServerSession Description The Antecedent property references the session established to connect to the shared resource. Dependent f@ )
� - � �� ref:Win32_ServerConnection Description The Dependent property references a connection made to a shared resource on the local server. � � � �session. �nnection. � ��E�@ 2��R �
��T4 � C I M _ L o g i c a l D e v i c e ntR|�C�� c CIM_LogicalDevice )
� ��� � � , 7 R b , ; � � � � _ s ' 8 � � �
�
� � ���_UU���������������������������������������������������������������������������������������������� � CIM_Battery Description Capabilities and management of the battery logical device. This class applies to both batteries in laptop systems and other internal/external batteries, such as used in, or as UPSs. AMENDMENT LOCALE BatteryStatus . +
� , 4 A b j uint16 Description Description of the battery's charge status. Values such as "Fully Charged" (value=3) or "Partially Charged" (11) can be specified. The value, 10, is not valid in the CIM Schema since in DMI it represents that no battery is installed. In this case, this object should not be instantiated. Values � � � � � � � � � Other Unknown Fully Charged Low Critical Charging Charging and High Charging and Low Charging and Critical Undefined Partially Charged Chemistry 0 +
� p x � � � uint16 Description An enumeration that describes the battery's chemistry. Values � � � * 7 A Other Unknown Lead Acid Nickel Cadmium Nickel Metal Hydride Lithium-ion Zinc air Lithium Polymer DesignCapacity 2 +
� � � � uint32 Description The design capacity of the battery in milliwatt-hours. If this property is not supported, enter 0. Units milliwatt-hours DesignVoltage 6 +
� t | � � � uint64 Description The design voltage of the battery in millivolts. If this attribute is not supported, enter 0. Units millivolts EstimatedChargeRemaining > +
� N V c � � uint16 Description An estimate of the percentage of full charge remaining. Units percent EstimatedRunTime @ +
� � � � � uint32 Description EstimatedRunTime is an estimate in minutes of the time to battery charge depletion under the present load conditions if the utility power is off, or lost and remains off, or a Laptop is disconnected from a power source. Units minutes ExpectedLife D +
� @ H U O V uint32 Description Indicates the battery's expected lifetime in minutes, assuming that the battery is fully charged. This property represents the total expected life of the battery, not its current remaining life, which is indicated by the EstimatedRunTime property. Units minutes FullChargeCapacity H +
� � � � uint32 Description The full charge capacity of the battery in milliwatt-hours. Comparison of this value to the DesignCapacity property determines when the battery requires replacement. A battery's end of life is typically when the FullChargeCapacity property falls below 80% of the DesignCapacity property. If this property is not supported, enter 0. Units milliwatt-hours MaxRechargeTime L +
� q y � � � uint32 Description MaxRechargeTime indicates the maximum time, in minutes, to fully charge the battery. This property represents the time to recharge a fully depleted battery, not the current remaining charging time, which is indicated in the TimeToFullCharge property. Units minutes SmartBatteryVersion P
� � � � string Description The Smart Battery Data Specification version number supported by this battery. If the battery does not support this function, the value should be left blank. TimeOnBattery T +
� �
�
�
� � uint32 Description TimeOnBattery indicates the elapsed time in seconds since the computer system's UPS last switched to battery power, or the time since the system or UPS was last restarted, whichever is less. Zero shall be returned if the battery is 'on line'. Units seconds TimeToFullCharge X +
� 4 < I � � uint32 Description The remaining time to charge the battery fully in minutes at the current charging rate and usage. Units minutes � C I M _ L o g i c a l D e v i c e rtR|�C��
_ CIM_LogicalDevice ) _ ��j r � k ~ ( � � � � � � � � � � � r � Z
l
( > ���_UU������������������������������������������������������������������������������������������ � CIM_PowerSupply Description Capabilities and management of the power supply logical device. AMENDMENT LOCALE ActiveInputVoltage . +
� � � � uint16 Description ActiveInputVoltage indicates which input voltage range is currently in use. Range 1, 2 or both can be specified using the values 3, 4 or 5, respectively. If the Supply is not currently drawing power, the value 6 ("Neither") can be specified. This information is necessary in the case of a UPS, a subclass of PowerSupply. Values : A J S \ b Other Unknown Range 1 Range 2 Both Neither IsSwitchingSupply 0
� � � � boolean Description Boolean indicating that the power supply is a switching (vs. linear) supply. Range1InputFrequencyHigh 2 +
� a i v � � uint32 Description The frequency (in hertz) at the high end of this powersupply's input frequency range 1. A value of zero implies DC. Units hertz Range1InputFrequencyLow 6 +
� K S ` � � uint32 Description The frequency (in hertz) at the low end of this powersupply's input frequency range 1. A value of zero implies DC. Units hertz Range1InputVoltageHigh : +
� 3 ; H � � uint32 Description The high voltage of input voltage range 1 for this power supply, in millivolts. A value of 0 denotes 'unknown'. Units millivolts Range1InputVoltageLow > +
� $ 1 � � uint32 Description The low voltage of input voltage range 1 for this power supply, in millivolts. A value of 0 denotes 'unknown'. Units millivolts Range2InputFrequencyHigh B +
� � � uint32 Description The frequency (in hertz) at the high end of this powersupply's input frequency range 2. A value of zero implies DC. Units hertz Range2InputFrequencyLow F +
� � � z � uint32 Description The frequency (in hertz) at the low end of this powersupply's input frequency range 2. A value of zero implies DC. Units hertz Range2InputVoltageHigh J +
� � � � _ f uint32 Description The high voltage of input voltage range 2 for this power supply, in millivolts. A value of 0 denotes 'unknown'. Units millivolts Range2InputVoltageLow N +
� � � � G
N
uint32 Description The low voltage of input voltage range 2 for this power supply, in millivolts. A value of 0 denotes 'unknown'. Units millivolts TotalOutputPower R +
� �
�
�
uint32 Description Represents the total output power of the power supply in milliwatts. 0 denotes 'unknown'. Units milliwatts TypeOfRangeSwitching V +
� w � , 4 uint16 Description TypeOfRangeSwitching describes the kind of input voltage range switching implemented in this power supply. For example, Autoswitch can be specified (value=4). Values P W ` h t � Other Unknown Manual Autoswitch Wide Range Not Applicable � �wR|�C�� ) G ��R Z b � MsftSil_Data Description The base class for all the inventory data. AMENDMENT LOCALE MS_409 � � �juS� � Ѯ=?� F r$�` H g��c q J:��� � ��a%� � `���� J ò}[
H �)"�O � )>4� 2 �qD* c ��:� y %�½ � I I S _ T r a n s �=�4 �� IIS_Trans ) � ��
' 3 > � � _����������������Y � W3GeneralStaticFileHandler EventType EventLevel ContextId
A
� � � � � � �� � �� object WmiDataId extension Guid ActivityID FileName C
� + > N V � �� string WmiDataId StringTermination NullTerminated format w � I I S _ T r a n s �=�4 �
IIS_Trans ) � �� , 7 _������������� � W3GeneralCGIHandler EventType EventLevel ContextId
A
� � � � � � �� � �� object WmiDataId extension Guid ActivityID � I I S _ T r a n s �=�4 �
IIS_Trans ) � �� " . 9 _������������� � W3GeneralISAPIHandler EventType EventLevel ContextId
A
� � � � � � �� � �� object WmiDataId extension Guid ActivityID � I I S _ T r a n s �=�4 �G IIS_Trans ) � ��
% 1 < � � g r _�������������������������� � W3GeneralOopISAPIHandler EventType EventLevel ContextId
A
� � � � � � �� � �� object WmiDataId extension Guid ActivityID CurrentReqs )
� � � �� uint32 WmiDataId ProcessId )
� T \ � �� uint32 WmiDataId TotalReqs )
� � � � �� uint32 WmiDataId � I I S _ T r a n s �=�4 �� IIS_Trans ) � �� ( 4 ? � � _����������������_ � W3GeneralRedirectionHandler EventType EventLevel ContextId
A
� � � � � � �� � �� object WmiDataId extension Guid ActivityID RedirectedURL C
� & 1 D T \ � �� string WmiDataId StringTermination NullTerminated format w � I I S _ T r a n s �=�4 �� IIS_Trans ) � �� , 7 � � _����������������R � W3GeneralDavHandler EventType EventLevel ContextId
A
� � � � � � �� � �� object WmiDataId extension Guid ActivityID FileName C
� $ 7 G O � �� string WmiDataId StringTermination NullTerminated format w � I I S _ T r a n s �=�4 �
IIS_Trans ) � �� $ 0 ; _������������� � W3GeneralOptionsHandler EventType EventLevel ContextId
A
� � � � � � �� � �� object WmiDataId extension Guid ActivityID � I I S _ T r a n s �=�4 �
IIS_Trans ) � �� " . 9 _������������� � W3GeneralTraceHandler EventType EventLevel ContextId
A
� � � � � � �� � �� object WmiDataId extension Guid ActivityID � I I S _ T r a n s �=�4 � IIS_Trans ) � �� ! - 8 � � _����������������
� W3GeneralHstsHandler EventType EventLevel ContextId
A
� � � � � � �� � �� object WmiDataId extension Guid ActivityID HstsOperation R
� & . 9 G � � � � � uint32 WmiDataId DefineValues S p HSTS_REDIRECT_HTTP_TO_HTTPS HSTS_ADD_HSTS_RESPONSE_HEADER Values � � HSTS_REDIRECT_HTTP_TO_HTTPS HSTS_ADD_HSTS_RESPONSE_HEADER ValueMap � � 0 1 ValueType index � I I S _ A u t h e n t i c a t i o n _ T r a n s �=�4 �� " IIS_Authentication_Trans ) � �� 7 ! - ; � � $ / � � N V � � _U����������������������������< � W3AuthKerberosFailed EventType EventLevel ADConfigIsOK )
� r { � �� boolean WmiDataId APUserName C
� � � � ! � �� string WmiDataId StringTermination NullTerminated format w ContextId
A
� ~ � � � � �� � �� object WmiDataId extension Guid ActivityID KerberosInfo C
�
3 C K � �� string WmiDataId StringTermination NullTerminated format w KMUsed )
� � � � �� boolean WmiDataId SPNName C
� � ! 1 9 � �� string WmiDataId StringTermination NullTerminated format w � I I S _ T r a c e �5h�b �9 IIS_Trace [ � �� , 9 M S { � ��� � o��������� � IIS_Rewrite_Trans DisplayName IISRewrite Description IIS rewrite events Guid {0469ABFA-1BB2-466A-B645-E3E15A02F38B} EventVersion EventHttpRequest locale MS\0x409 � I I S _ R e w r i t e _ T r a n s �5h�b �? IIS_Rewrite_Trans ] � �� / < P [ j } � � � � K W G M _�������������������������x � UrlRewriteStart DisplayName UrlRewriteStart Description URL Rewrite starts EventType EventTypeName URL_REWRITE_START EventLevel locale MS\0x409 ContextId
N
�
" . 9 ? �� � �� object WmiDataId Description Context ID extension Guid ActivityID RequestURL P
� � � � � � �
� �� string WmiDataId Description Request URL StringTermination NullTerminated Format w Scope j
� � � � � � � � � 5 @ � �� uint32 WmiDataId Description Rules Scope ValueDescriptions � � Global Distributed ValueMap 0 1 Values ( Global Distributed ValueType index Type j
� � � � � � # - ? G f q � �� uint32 WmiDataId Description Rules Type ValueDescriptions Inbound Outbound ValueMap 9 < 0 1 Values S \ Inbound Outbound ValueType index � I I S _ R e w r i t e _ T r a n s �5h�b �� IIS_Rewrite_Trans ] � �� + 8 M X g x � � � � F R _���������������� � UrlRewriteEnd DisplayName UrlRewriteEnd Description URL Rewriting ended EventType EventTypeName URL_REWRITE_END EventLevel locale MS\0x409 ContextId
N
� � ) 4 : �� � �� object WmiDataId Description Context ID extension Guid ActivityID RequestURL P
� � � � � � � � �� string WmiDataId Description Request URL StringTermination NullTerminated Format w �oolean WmiDataId SPNName C
� � ! 1 9 � �� string WmiDataId StringTermination NullTerminated format w �em32\en-US\kernelbase.dll.mui[MofResourceName] ernelbase.dll[MofResourceName] ��˯� G�h�� � #�$}k
� ��v
� [g� � ���F � �ľT� � U%�� m UZ � k ��ub � eH*� � R S O P _ P o l i c y S e t t i n g B l o c k e d �uR|�C�� 1 # RSOP_PolicySettingBlocked ) # 0 � ��� � � � � @ D � � � � � � + 6 �_U����������������������������������������������� � RSOP_RegistryPolicySettingBlocked Description Policy object for registry or Administrative Templates extension.Policy settings in an .adm file involve settings values on registrykeys which is abstracted by this class. AMENDMENT LOCALE command * +
� 2 : G p } string Description Command being run on the key, or value. DisplayName Command deleted
( +
� � � � ' 4 boolean Description Indicates whether the registry key, or registry value has been deleted. DisplayName Is Deleted id @ 6
� � � � � � � �� string Description Inherited from RSOP_PolicySettingBlocked DisplayName ID precedence @ 6
� ( 0 = g t � �� uint32 Description Inherited from RSOP_PolicySettingBlocked DisplayName Precedence registryKey +
� � � � � string Description Name of the registry key, DisplayName Registry Key value $ +
� Q X e � � uint8 Description Value represented by an array of bytes DisplayName Value valueName +
� � � � string Description Name of registry value DisplayName Value Name valueType +
� o w � � � uint32 Description Data type of value, which corresponds to registry value types such as REG_SZ. DisplayName Type � R S O P _ P o l m k r P r o S e t t i n g �uR|�C�g 8 RSOP_PolmkrProSetting ) , u ��� � � ) ��������������������������������������������������������� � RSOP_PolmkrEnvironmentSetting Description Localized version of RSOP_PolmkrEnvironmentSetting for American English AMENDMENT LOCALE id @ 6
� � � � � �� string Description Inherited from RSOP_PolmkrProSetting. DisplayName Id precedence @ 6
� m u � � � � �� uint32 Description Inherited from RSOP_PolmkrProSetting. DisplayName Precedence � R S O P _ P o l m k r P r o S e t t i n g �uR|�C�Y 8 RSOP_PolmkrProSetting ) % g ��r z ~ ��������������������������������������������������������� � RSOP_PolmkrFileSetting Description Localized version of RSOP_PolmkrFileSetting for American English AMENDMENT LOCALE id @ 6
� � � � � � �� string Description Inherited from RSOP_PolmkrProSetting. DisplayName Id precedence @ 6
� _ g t � � � �� uint32 Description Inherited from RSOP_PolmkrProSetting. DisplayName Precedence � R S O P _ P o l m k r P r o S e t t i n g �uR|�C�] 8 RSOP_PolmkrProSetting ) ' k ��v ~ � ��������������������������������������������������������� � RSOP_PolmkrFolderSetting Description Localized version of RSOP_PolmkrFolderSetting for American English AMENDMENT LOCALE id @ 6
� � � � � �� string Description Inherited from RSOP_PolmkrProSetting. DisplayName Id precedence @ 6
� c k x � � � �� uint32 Description Inherited from RSOP_PolmkrProSetting. DisplayName Precedence � R S O P _ P o l m k r P r o S e t t i n g �uR|�C�_ 8 RSOP_PolmkrProSetting ) ( m ��x � � ! ��������������������������������������������������������� � RSOP_PolmkrIniFileSetting Description Localized version of RSOP_PolmkrIniFileSetting for American English AMENDMENT LOCALE id @ 6
� � � � � �� string Description Inherited from RSOP_PolmkrProSetting. DisplayName Id precedence @ 6
� e m z � � � �� uint32 Description Inherited from RSOP_PolmkrProSetting. DisplayName Precedence � R S O P _ P o l m k r P r o S e t t i n g �uR|�C�a 8 RSOP_PolmkrProSetting ) ) o ��z � � # ��������������������������������������������������������� � RSOP_PolmkrRegistrySetting Description Localized version of RSOP_PolmkrRegistrySetting for American English AMENDMENT LOCALE id @ 6
� � � � � �� string Description Inherited from RSOP_PolmkrProSetting. DisplayName Id precedence @ 6
� g o | � � � �� uint32 Description Inherited from RSOP_PolmkrProSetting. DisplayName Precedence � R S O P _ P o l m k r P r o S e t t i n g �uR|�C�_ 8 RSOP_PolmkrProSetting ) ( m ��x � � ! ��������������������������������������������������������� � RSOP_PolmkrPrinterSetting Description Localized version of RSOP_PolmkrPrinterSetting for American English AMENDMENT LOCALE id @ 6
� � � � � �� string Description Inherited from RSOP_PolmkrProSetting. DisplayName Id precedence @ 6
� e m z � � � �� uint32 Description Inherited from RSOP_PolmkrProSetting. DisplayName Precedence � R S O P _ P o l m k r P r i n t e r S e t t i n g �uR|�C�# 8 # RSOP_PolmkrPrinterSetting ) - w ��� ��������������������������������������������������������� � RSOP_PolmkrLocalPrinterSetting Description Localized version of RSOP_PolmkrLocalPrinterSetting for American English AMENDMENT LOCALE � R S O P _ P o l m k r P r i n t e r S e t t i n g �uR|�C�! 8 # RSOP_PolmkrPrinterSetting ) , u ��� ��������������������������������������������������������� � RSOP_PolmkrPortPrinterSetting Description Localized version of RSOP_PolmkrPortPrinterSetting for American English AMENDMENT LOCALE � R S O P _ P o l m k r P r o S e t t i n g �uR|�C�a 8 RSOP_PolmkrProSetting ) ) o ��z � � # ��������������������������������������������������������� � RSOP_PolmkrShortcutSetting Description Localized version of RSOP_PolmkrShortcutSetting for American English AMENDMENT LOCALE id @ 6
� � � � � �� string Description Inherited from RSOP_PolmkrProSetting. DisplayName Id precedence @ 6
� g o | � � � �� uint32 Description Inherited from RSOP_PolmkrProSetting. DisplayName Precedence � R S O P _ P o l m k r P r o S e t t i n g �uR|�C�e 8 RSOP_PolmkrProSetting ) + s ��~ � � ' ��������������������������������������������������������� � RSOP_PolmkrDataSourceSetting Description Localized version of RSOP_PolmkrDataSourceSetting for American English AMENDMENT LOCALE id @ 6
� � � �
� �� string Description Inherited from RSOP_PolmkrProSetting. DisplayName Id precedence @ 6
� k s � � � � �� uint32 Description Inherited from RSOP_PolmkrProSetting. DisplayName Precedence � }J�M` � ���_ ���k �#!� � G�f� L-�� /�&� �QӪ
3��z� �L���
� ��!� ɡP�� J�
u� U �� ��Dd �3& " 4�H
�3�~R ��=�b ����x ~t`~ 4 3 C 8 6 C 3 E 5 B 2 B 7 F 1 D D 0 4 4 3 A 6 D A 4 E 1 7 A A 9 5 D 6 5 F 5 6 E E 0 C 1 9 C F 4 F D 3 B 5 D 9 A 5 F 6 3 C 5 2 2 �"�U�T�u͝��C�o 0 9 �� N � HNet_Connection {047525BC-A893-436A-91E8-557852561637} Ethernet Instance 0 A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 �"�U�T�v͝��C�| �� Z � HNet_ConnectionProperties HNet_Connection.Guid="{047525BC-A893-436A-91E8-557852561637}" R O O T \ M i c r o s o f t \ H o m e N e t H N e t _ C o n n e c t i o n P r o p e r t i e s
C o n n e c t i o n � N S _ 5 1 1 6 2 6 F A E 4 F 5 7 D B D 2 0 D F 5 C D 4 4 A 4 1 D A E C E D 2 8 C F 7 B 3 F D 8 B 1 2 0 1 2 C 7 F 4 B 5 8 F 4 4 E 6 6 5 \ K I _ A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 \ I _ 5 A B E 0 A 3 C 0 3 A 4 B D C 6 C E 5 A C 2 2 6 1 4 4 B A 9 8 A B D 8 1 F C 1 9 0 5 8 9 D 6 1 F 4 F B 6 7 A 3 4 2 5 2 F 7 4 F D X 4 3 C 8 6 C 3 E 5 B 2 B 7 F 1 D D 0 4 4 3 A 6 D A 4 E 1 7 A A 9 5 D 6 5 F 5 6 E E 0 C 1 9 C F 4 F D 3 B 5 D 9 A 5 F 6 3 C 5 2 2 �"�U�T�u͝��C�f 0 9 �� E � HNet_Connection {D12DED2F-AEFC-4788-A733-FAA9E04B44C7} Ethernet 2 A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 �"�U�T�v͝��C�| �� Z � HNet_ConnectionProperties HNet_Connection.Guid="{D12DED2F-AEFC-4788-A733-FAA9E04B44C7}" R O O T \ M i c r o s o f t \ H o m e N e t H N e t _ C o n n e c t i o n P r o p e r t i e s
C o n n e c t i o n � N S _ 5 1 1 6 2 6 F A E 4 F 5 7 D B D 2 0 D F 5 C D 4 4 A 4 1 D A E C E D 2 8 C F 7 B 3 F D 8 B 1 2 0 1 2 C 7 F 4 B 5 8 F 4 4 E 6 6 5 \ K I _ A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 \ I _ 5 A 8 2 1 8 7 B A D F D 0 5 C B F 9 0 D D A D A B 6 2 8 3 3 2 B F 3 B 6 4 F E A B C 1 C 8 9 9 9 5 4 6 5 9 A 9 4 C F 1 2 8 C 8 1 ��4 3 C 8 6 C 3 E 5 B 2 B 7 F 1 D D 0 4 4 3 A 6 D A 4 E 1 7 A A 9 5 D 6 5 F 5 6 E E 0 C 1 9 C F 4 F D 3 B 5 D 9 A 5 F 6 3 C 5 2 2 �"�U�T�u͝��C�q 0 9 �� P � HNet_Connection {0A645F4E-68C0-4C76-B4A3-0921C9718BDD} Local Area Connection A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 �"�U�T�v͝��C�| �� Z � HNet_ConnectionProperties HNet_Connection.Guid="{0A645F4E-68C0-4C76-B4A3-0921C9718BDD}" R O O T \ M i c r o s o f t \ H o m e N e t H N e t _ C o n n e c t i o n P r o p e r t i e s
C o n n e c t i o n � N S _ 5 1 1 6 2 6 F A E 4 F 5 7 D B D 2 0 D F 5 C D 4 4 A 4 1 D A E C E D 2 8 C F 7 B 3 F D 8 B 1 2 0 1 2 C 7 F 4 B 5 8 F 4 4 E 6 6 5 \ K I _ A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 \ I _ 4 1 F 4 0 B 0 A E D 8 0 D A 6 4 6 B B 3 A 5 4 C 3 4 C B D A F 7 2 A D B 4 E 6 4 1 4 1 4 1 6 C 5 4 3 4 8 9 2 B 2 4 E B 7 F 4 2 9 ��4 3 C 8 6 C 3 E 5 B 2 B 7 F 1 D D 0 4 4 3 A 6 D A 4 E 1 7 A A 9 5 D 6 5 F 5 6 E E 0 C 1 9 C F 4 F D 3 B 5 D 9 A 5 F 6 3 C 5 2 2 �"�U�T�u͝��C�f 0 9 �� E � HNet_Connection {2DBE1C3C-12E7-4095-90AF-AC78BF10DD42} Ethernet 2 A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 �"�U�T�v͝��C�| �� Z � HNet_ConnectionProperties HNet_Connection.Guid="{2DBE1C3C-12E7-4095-90AF-AC78BF10DD42}" R O O T \ M i c r o s o f t \ H o m e N e t H N e t _ C o n n e c t i o n P r o p e r t i e s
C o n n e c t i o n � N S _ 5 1 1 6 2 6 F A E 4 F 5 7 D B D 2 0 D F 5 C D 4 4 A 4 1 D A E C E D 2 8 C F 7 B 3 F D 8 B 1 2 0 1 2 C 7 F 4 B 5 8 F 4 4 E 6 6 5 \ K I _ A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 \ I _ 6 3 1 0 7 F 0 6 1 0 D 2 0 6 9 9 8 9 5 2 C 3 8 8 A 6 8 4 3 8 6 1 6 0 A 4 D C D E F 3 7 F A 7 5 D A 7 E 7 E 7 9 4 B 0 0 5 E 0 3 5 9 A B 5 3 8 0 6 E 8 8 6 6 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0 �b��5� ͝��C�x �f3��5��� W � WMIBinaryMofResource C:\Windows\System32\drivers\en-US\ACPI.sys.mui[ACPIMOFResource] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �b��5�
͝��C�� �f3��5� ` � WDMClassesOfDriver ACPITrace C:\Windows\System32\drivers\en-US\ACPI.sys.mui[ACPIMOFResource] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4
�b��5�
͝��C�� # �f3��5� d � WDMClassesOfDriver AMLIEvalData1 C:\Windows\System32\drivers\en-US\ACPI.sys.mui[ACPIMOFResource] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �b��5�
͝��C�� . �f3��5� o � WDMClassesOfDriver AMLIEvalData1_TypeGroup1 C:\Windows\System32\drivers\en-US\ACPI.sys.mui[ACPIMOFResource] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ^�b��5�
͝��C�z " -e3 �5� W � WDMClassesOfDriver PortClsEvent C:\Windows\System32\Drivers\portcls.SYS[PortclsMof] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/pl\}�
͝��C�� ��
�S}� ] � WDMClassesOfDriver WMIEvent C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/pl\}�
͝��C�� $ ��
�S}� c � WDMClassesOfDriver MS_WmiInternal C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ͣn�^��
͝��C�v J.3�� S � WDMClassesOfDriver WMIEvent C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 Σn�^��
͝��C�| $ J.3�� Y � WDMClassesOfDriver MS_WmiInternal C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 9 A B 5 3 8 0 6 E 8 8 6 6 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0 �n�^�� ͝��C�l �2��2�� K � WMIBinaryMofResource C:\Windows\System32\drivers\monitor.sys[MonitorWMI] is.sys.mui[MofResourceName] 9 A B 5 3 8 0 6 E 8 8 6 6 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0 �n�^�� ͝��C�l �2��2�� K � WMIBinaryMofResource C:\Windows\System32\drivers\monitor.sys[MonitorWMI] [MofResourceName] 9 A B 5 3 8 0 6 E 8 8 6 6 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0 �n�^�� ͝��C�l �2��2�� K � WMIBinaryMofResource C:\Windows\System32\drivers\monitor.sys[MonitorWMI] \Windows\system32\kernelbase.dll[MofResourceName] ame] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 Σn�^��
͝��C�| $ J.3�� Y � WDMClassesOfDriver MS_WmiInternal C:\Windows\system32\kernelbase.dll[MofResourceName] �lP �
��e e �O�� 6 �Ԑ� � C I M _ P r o d u c t S o f t w a r e F e a t u r e s LН��C�� % CIM_ProductSoftwareFeatures C ' - � �� � U ^ n � � � � u��������1 � Win32_ProductSoftwareFeatures Locale UUID {80D071C8-DB33-11d2-85FC-0000F8102E5F} MSIProv MappingStrings v Microsoft.MSI Component f@ '
� � � �� � �� ref:Win32_SoftwareFeature Product f@ '
� � �� � �� ref:Win32_Product � C I M _ S t a t i s t i c a l I n f o r m a t i o n %ϝ��C� y $ CIM_StatisticalInformation ) + r ��} � � 8 M g { � � j � D X L _ B
]
= V / @ n � t � � � y � � � � � }UUU��������������������������������������������������������������������������������������������������������������������� � Win32_NamedJobObjectActgInfo Description This class represents the IO accounting information for a job object. AMENDMENT LOCALE ActiveProcesses 4
� � � � uint32 Description Specifies the total number of processes currently associated with the job. When a process is associated with a job, but the association fails because of a limit violation, this value is temporarily incremented. When the terminated process exits and all references to the process are released, this value is decremented. Name @ )
� V ^ k � �� string Description The Name property defines the label by which the statistic or metric is known. When subclassed, the property can be overridden to be a Key property.
As a Kernel object job object names are case sensitive. Because WMI keys are case insensitive, the name of the named job object must be decorated as follows: a capital letter should be preceded by a backslash. As a consequence of this convention, 'A' and 'a' are lower case and '\A' and '\a' are upper case. OtherOperationCount
L
� y � � uint64 Description Specifies the number of I/O operations performed, other than read and write operations, by all processes that have ever been associated with the job, in addition to all processes currently associated with the job. OtherTransferCount d
� � � � uint64 Description Specifies the number of bytes transferred during operations, other than read and write operations, by all processes that have ever been associated with the job, in addition to all processes currently associated with the job. PeakJobMemoryUsed p +
� � � � X _ uint32 Description Specifies the peak memory in kilobytes usage of all processes associated with the job. Units kilobytes PeakProcessMemoryUsed l +
� � � � 2 9 uint32 Description Specifies the most process memory in kilobytes used by any process ever associated with the job. Units kilobytes ReadOperationCount <
� � � � uint64 Description Specifies the number of read operations performed by all processes that have ever been associated with the job, in addition to all processes currently associated with the job. ReadTransferCount T
� � � � uint64 Description Specifies the number of bytes read by all processes that have ever been associated with the job, in addition to all processes currently associated with the job. ThisPeriodTotalKernelTime $ +
� �
�
�
% , uint64 Description Specifies the total amount of kernel-mode execution time, in 100 nanoseconds, for all active processes associated with the job (as well as all terminated processes no longer associated with the job) since the last call that set a per-job kernel-mode time limit. This property is set to 0 on creation of the job, and each time a per-job kernel-mode time limit is established. Units 100 nanoseconds ThisPeriodTotalUserTime +
� � � � uint64 Description Specifies the total amount of user-mode execution time, in 100 nanoseconds, for all active processes associated with the job (as well as all terminated processes no longer associated with the job) since the last call that set a per-job user-mode time limit. This property is set to 0 on creation of the job, and each time a per-job user-mode time limit is established Units 100 nanoseconds TotalKernelTime +
� y � � V ] uint64 Description Specifies the total amount of kernel-mode execution time, in 100 nanoseconds, for all active processes associated with the job, as well as all terminated processes no longer associated with the job. Units 100 nanoseconds TotalPageFaultCount ,
� � � � uint32 Description Specifies the total number of page faults encountered by all active processes associated with the job, as well as all terminated processes no longer associated with the job. TotalProcesses 0
� � � � uint32 Description Specifies the total number of processes associated with the job during its lifetime, including those that have terminated. For example, when a process is associated with a job, but the association fails because of a limit violation, this value is incremented. TotalTerminatedProcesses
8
� & uint32 Description Specifies the total number of processes terminated because of a limit violation. TotalUserTime +
� � � � � � uint64 Description Specifies the total amount of user-mode execution time, in 100 nanoseconds, for all active processes associated with the job, as well as all terminated processes no longer associated with the job. Units 100 nanoseconds WriteOperationCount D
� � �
uint64 Description Specifies the number of write operations performed by all processes that have ever been associated with the job, in addition to all processes currently associated with the job. WriteTransferCount \
� � uint64 Description Specifies the number of bytes written by all processes that have ever been associated with the job, in addition to all processes currently associated with the job. � W i n 3 2 _ C o l l e c t i o n S t a t i s t i c s &ϝ��C�� $ Win32_CollectionStatistics ) - � ��� � � � � ��������o � Win32_NamedJobObjectStatistics Description The Win32_NamedJobObjectStatistics association class relates a job object instance and the I/O accounting information instance containing accounting information for the job. AMENDMENT LOCALE Collection f@ )
� 2 L Y � �� ref:Win32_NamedJobObject Description This property is a reference to the instance of a job object. Stats f@ )
� � � � �� ref:Win32_NamedJobObjectActgInfo Description This property is a reference to the instance that contains statistical information about the job object. te � C I M _ C o l l e c t i o n S e t t i n g 'ϝ��C�� CIM_CollectionSetting ) ( � ��� � � Z c ���������, � Win32_NamedJobObjectLimit Description The Win32_NamedJobObjectLimit association class relates a job object and the job object limit settings for that job. AMENDMENT LOCALE Collection f@ )
� � � �� ref:Win32_NamedJobObject Description This property is a reference to the instance of a job object. Setting f@ )
� � � � � �� ref:Win32_NamedJobObjectLimitSetting Description This property is a reference to the instance that contains limit settings for the job object. _N � te � � � �k�� � �hk�� ) ��� ~ t��S ' ��+z
6 �栾�
m � �� � 7
vh� � ��[0< w Z� � %bd'\ D �:a� � ���C�� ' ( 3 e u � � � � ? G y � � � � � UU�������������������������������������+ � RSOP_IEAuthenticodeCertificate Locale certIndex
� ] � �� sint32 expirationDate e
� � datetime friendlyName
� � string intendedPurposes
� string issuerName
� 7 string rsopID
� q � �� string rsopPrecedence
� � � �� sint32 subjectName
� � string tabIndex
� # � �� sint32 � ���C� H P � � ����������� � RSOP_IEESC Locale EscEnabled
� ? boolean rsopID
� z � �� string rsopPrecedence
� � � �� sint32 � ���C�f ��% - ; o v � � @ L � � ������� � � ����� � RSOP_PolicySettingBlocked abstract Locale creationTime e
� e � �� datetime GPOID
� � � �� string id 2
� � � ��� �� � �� string Required Not_Null name
� 8 � �� string precedence 2
� � � ��� �� � �� uint32 Required Not_Null SOMID
� � � �� string � R S O P _ P o l i c y S e t t i n g B l o c k e d ���C�� 1 # RSOP_PolicySettingBlocked # + 4 f o � � � � , 9 k r � � � � ���������� � � ���� ! ���� # � RSOP_RegistryPolicySettingBlocked Locale command *
� ^ � �� string deleted
(
� � � �� boolean id @ '
� � � �� � �� string precedence @ '
� $ � �� � �� uint32 registryKey
� c � �� string value $
� � � �� uint8 valueName
� � � �� string valueType
� � �� uint32 � ���C� )
$ X _ � � � � L V � � � � �
< E E����� y w �������� ����������{ � RSOP_Session Locale creationTime e
� N � �� datetime flags
� � � �� uint32 id '
� � � �� � �� string SecurityGroups
� � �� string Site
� D � �� string slowLink $
� � � �� boolean SOM
� � � �� string targetName
� � � �� string ttlMinutes
� 4 � �� uint32 version
� o � �� uint32 � ���C�U
N X � � � � : D v | Q�� �������� � � RSOP_SOM Locale blocked
� E � �� boolean blocking
� � � �� boolean id '
� � � �� � �� string reason 4
� � �� ( � �� uint32 ValueMap 4 7 1 2 SOMOrder
� n � �� uint32 type )
� � � � � �� uint32 ValueMap � � � � 1 2 3 4 � ���C�w )
S \ � � � � S ] � � � � D X � � ����� � ������� � ������� � RSOP_GPO Locale accessDenied
� J � �� boolean enabled
� � � �� boolean extensionIds
"
� � � �� string fileSystemPath
� � �� string filterAllowed
� J � �� boolean filterId
� � � �� string guidName
� � � �� string id '
� � �� � �� string name
� < � �� string securityDescriptor
� � � �� uint8 version
� � � �� uint32 � ѝ��C�x
�� " 0 b k � � � � # / b g � � ��������� �� � � RSOP_GPLink Association Locale appliedOrder
� Z � �� uint32 enabled
� � � �� boolean GPO f '
� � � �� � �� ref:RSOP_GPO linkOrder
� � �� uint32 noOverride
� Y � �� boolean SOM f '
� � � �� � �� ref:RSOP_SOM somOrder '
� � � �� � �� uint32 � ѝ��C�_ �� & 4 h o � � 9 E � � ������� � � ����� � RSOP_PolicySetting abstract Locale creationTime e
� ^ � �� datetime GPOID
� � � �� string id 2
� � � ��� �� � �� string Required Not_Null name
� 1 � �� string precedence 2
� � � ��� �� � �� uint32 Required Not_Null SOMID
� � � �� string � ѝ��C�� " - _ h � � � � $ X \ � � U������������������������ � RSoP_PolicySettingStatus Locale errorCode
� W � �� uint32 eventID
� � � �� uint32 eventLogName
� � � �� string eventSource
� � �� string eventTime e
� N � �� datetime id '
� � � �� � �� string status )
� � � � � �� sint32 ValueMap 0 1 2 3 4 � ѝ��C�, �� - 6 � � %��������� � RSoP_PolicySettingLink Locale Association setting f '
� k � �� � �� ref:RSOP_PolicySetting status f '
� � � �� � �� ref:RSoP_PolicySettingStatus � � )ѝ��C�� # ' < c w � � � � , S [ � � � �
$ UU���������������������������������L � RSOP_IESecurityContentRatings Locale alwaysViewableSites
� [ string neverViewableSites
� � string passwordOverrideEnabled
� � boolean ratingSystemFileNames
� string ratingSystems
� K string rsopID
� � � �� string rsopPrecedence
� � � �� sint32 selectedRatingsBureau
� string viewUnknownRatedSites
� C boolean � �< C I M _ S t o r a g e V o l u m e \ѝ��C�� � CIM_StorageVolume ) � �� � ' 2 e q � � � � ) � � � � ; F � � = N � � � � * ] l � � � � ) 7 i } � � ������UUUUU������������������������������������������������������������������������������������������������������������������������������������������������������������B � Win32_Volume MSVDS__PROVIDER locale Automount " �
� \ � �� boolean BootVolume + �
� � � �� boolean Capacity \
� � � �� uint64 Compressed d
� � �� boolean DeviceID @ A
� x � �� � ��� � � � string Override DeviceId MappingStrings � WMI DirtyBitSet |
� � � �� boolean DriveLetter f '
� 3 � �� � �� string DriveType j )
� } � ��� � uint32 MappingStrings � Win32API|FileFunctions|GetDriveType FileSystem n
� � � �� string FreeSpace r
� 5 � �� uint64 IndexingEnabled z '
� � � �� � �� boolean Label ~ '
� � � �� � �� string MaximumFileNameLength ! �
� � �� uint32 PageFilePresent ) �
� T � �� boolean QuotasEnabled # �
� � � �� boolean QuotasIncomplete $ �
� � � �� boolean QuotasRebuilding % �
� � �� boolean SerialNumber & �
� a � �� uint32 SupportsDiskQuotas ' �
� � � �� boolean SupportsFileBasedCompression ( �
� � � �� boolean SystemVolume * �
� 9 � �� boolean �4 m % �
�
� � � w � � < D ` W! V$ f$ �$ �$ ) ) �) �+ - - �- �- / / �/ 52 �3 � Chkdsk $ ��1 A Implemented MappingStrings I Fmifs.dll | Method ChkDskExRoutine � ae442007200009F ROOT\CIMV2 ���� � �a �� * � ^ � � C � � � O ���� � � __PARAMETERS abstract FixErrors boolean
� 5 in
� 5 ] �� ID )
� � ] ��� boolean VigorousIndexCheck boolean
� � in
� � �� ID )
� � ��K boolean SkipFolderCycle boolean
� � in
� � � �� ID )
� C � �� boolean ForceDismount boolean
� m in
� m � �� ID )
� � � ��� boolean RecoverBadSectors boolean
� , in
� , T �� ID )
� � T ��� boolean
OkToRunAtBootUp boolean
� � in
� � �� ID
)
� z ��? boolean __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � ScheduleAutoChk ' �
���
���
�
Static Implemented MappingStrings Chkntfs.exe � ae442007200009F ROOT\CIMV2 ���� � �� �� * � ����� � __PARAMETERS abstract Volume string
� 2 in
� 2 Y �� ID )
� � Y ��� string __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � ExcludeFromAutoChk ' � ��� ��� � Static Implemented MappingStrings � Chkntfs.exe � ae442007200009F ROOT\CIMV2 ���� � �� �� * � ����� � __PARAMETERS abstract Volume string
� 2 in
� 2 Y �� ID )
� � Y ��� string __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � Format � ��� � Implemented MappingStrings � Fmifs.dll | Method FormatRoutine �
ae442007200009F ROOT\CIMV2 ���� � ��
�� � � � * L Q � � ' � � P] I � __PARAMETERS abstract FileSystem string
� 6 NTFS in
� 6 c �� '
� 6 c �� � �� � � � � � NTFS FAT32 FAT UDF EXFAT ValueMap 4
� 6 c �� � ��� � ID A
� � c �� � ��� � H string QuickFormat boolean
� � in '
� � � �� � �� ID 4
� i � �� � ��# boolean ClusterSize uint32
� � in '
� � � �� � �� ID 4
� 7 � �� � ��� uint32
���7` Y H��Z� � �t� #�[�� & ��V� (
E v e n t T r a c e �ӝ��C�- EventTrace 6 � �� ( < B j r | � ) 0 u��������� � MsftDiscFormat2StreamZero Description IMAPI2 Zero Stream guid {0e85a5a5-4d5c-44b7-8bda-5b7ab54f7e9b} locale MS\0x409 Flags R
� � � � � � T \ � � uint32 Description Enable Flags ValueDescriptions ) Z � MsftDiscFormat2StreamZero_DebugConstructor Flag MsftDiscFormat2StreamZero_DebugDestructor Flag MsftDiscFormat2StreamZero_DebugGeneral Flag DefineValues � , MsftDiscFormat2StreamZero_DebugConstructor MsftDiscFormat2StreamZero_DebugDestructor MsftDiscFormat2StreamZero_DebugGeneral Values l � � MsftDiscFormat2StreamZero_DebugConstructor MsftDiscFormat2StreamZero_DebugDestructor MsftDiscFormat2StreamZero_DebugGeneral ValueMap 0x00000001 0x00000002 0x00000004 Level _
� � � � � � � � # h r � � uint32 Description Levels ValueDescriptions � $ I c Abnormal exit or termination Severe errors that need logging Warnings such as allocation failure Includes non-error cases Detailed traces from intermediate steps DefineValues � � � � TRACE_LEVEL_FATAL TRACE_LEVEL_ERROR TRACE_LEVEL_WARNING TRACE_LEVEL_INFORMATION TRACE_LEVEL_VERBOSE Values ; B I R _ Fatal Error Warning Information Verbose ValueMap � � � � � 0x1 0x2 0x3 0x4 0x5 ValueType index �
E v e n t T r a c e �ӝ��C�� EventTrace 6 � �� # 9 ? g o y � � � u��������s � MsftDiscFormat2RawCD Description IMAPI2 Raw CD Writer guid {0e85a5a5-4d5c-44b7-8bda-5b7ab54f7e9a} locale MS\0x409 Flags R
� � � � � � ' / � � uint32 Description Enable Flags ValueDescriptions & P y MsftDiscFormat2Raw_DebugConstructor Flag MsftDiscFormat2Raw_DebugDestructor Flag MsftDiscFormat2Raw_DebugGeneral Flag DefineValues � � MsftDiscFormat2Raw_DebugConstructor MsftDiscFormat2Raw_DebugDestructor MsftDiscFormat2Raw_DebugGeneral Values ? d � MsftDiscFormat2Raw_DebugConstructor MsftDiscFormat2Raw_DebugDestructor MsftDiscFormat2Raw_DebugGeneral ValueMap � � � 0x00000001 0x00000002 0x00000004 Level _
� [ c p x � J X � � & 0 a l uint32 Description Levels ValueDescriptions � � � ! Abnormal exit or termination Severe errors that need logging Warnings such as allocation failure Includes non-error cases Detailed traces from intermediate steps DefineValues p � � � � TRACE_LEVEL_FATAL TRACE_LEVEL_ERROR TRACE_LEVEL_WARNING TRACE_LEVEL_INFORMATION TRACE_LEVEL_VERBOSE Values � Fatal Error Warning Information Verbose ValueMap H M R W \ 0x1 0x2 0x3 0x4 0x5 ValueType index e �
E v e n t T r a c e �ӝ��C�� EventTrace 6 � �� ! A G o w � � � � ���������{ � MsftDiscFormat2Tao Description IMAPI2 Track-at-Once CD Writer guid {0e85a5a5-4d5c-44b7-8bda-5b7ab54f7e99} locale MS\0x409 Flags R
� � � � � � / 7 � � uint32 Description Enable Flags ValueDescriptions . X � MsftDiscFormat2Tao_DebugConstructor Flag MsftDiscFormat2Tao_DebugDestructor Flag MsftDiscFormat2Tao_DebugGeneral Flag DefineValues � � MsftDiscFormat2Tao_DebugConstructor MsftDiscFormat2Tao_DebugDestructor MsftDiscFormat2Tao_DebugGeneral Values G l � MsftDiscFormat2Tao_DebugConstructor MsftDiscFormat2Tao_DebugDestructor MsftDiscFormat2Tao_DebugGeneral ValueMap � � � 0x00000001 0x00000002 0x00000004 Level _
� c k x � � R ` � � . 8 i t uint32 Description Levels ValueDescriptions � � � ) Abnormal exit or termination Severe errors that need logging Warnings such as allocation failure Includes non-error cases Detailed traces from intermediate steps DefineValues x � � � � TRACE_LEVEL_FATAL TRACE_LEVEL_ERROR TRACE_LEVEL_WARNING TRACE_LEVEL_INFORMATION TRACE_LEVEL_VERBOSE Values % Fatal Error Warning Information Verbose ValueMap P U Z _ d 0x1 0x2 0x3 0x4 0x5 ValueType index �
E v e n t T r a c e �ӝ��C�� EventTrace 6 � �� " ? E m u � � � u��������� � MsftDiscFormat2Data Description IMAPI2 Standard Data Writer guid {0e85a5a5-4d5c-44b7-8bda-5b7ab54f7e98} locale MS\0x409 Flags R
� � � � � � 3 ; � � uint32 Description Enable Flags ValueDescriptions , W � MsftDiscFormat2Data_DebugConstructor Flag MsftDiscFormat2Data_DebugDestructor Flag MsftDiscFormat2Data_DebugGeneral Flag DefineValues � � MsftDiscFormat2Data_DebugConstructor MsftDiscFormat2Data_DebugDestructor MsftDiscFormat2Data_DebugGeneral Values K q � MsftDiscFormat2Data_DebugConstructor MsftDiscFormat2Data_DebugDestructor MsftDiscFormat2Data_DebugGeneral ValueMap � � � 0x00000001 0x00000002 0x00000004 Level _
� j r � � Y g � � 5 ? p { uint32 Description Levels ValueDescriptions � � � 0 Abnormal exit or termination Severe errors that need logging Warnings such as allocation failure Includes non-error cases Detailed traces from intermediate steps DefineValues � � � � TRACE_LEVEL_FATAL TRACE_LEVEL_ERROR TRACE_LEVEL_WARNING TRACE_LEVEL_INFORMATION TRACE_LEVEL_VERBOSE Values , Fatal Error Warning Information Verbose ValueMap W \ a f k 0x1 0x2 0x3 0x4 0x5 ValueType index rm �
E v e n t T r a c e �ӝ��C�� EventTrace 6 � �� # 8 > f n x � � u��������� � MsftDiscFormat2Erase Description IMAPI2 Media Eraser guid {0e85a5a5-4d5c-44b7-8bda-5b7ab54f7e97} locale MS\0x409 Flags R
� � � � � � 2 : � � uint32 Description Enable Flags ValueDescriptions % Q | MsftDiscFormat2Erase_DebugConstructor Flag MsftDiscFormat2Erase_DebugDestructor Flag MsftDiscFormat2Erase_DebugGeneral Flag DefineValues � � MsftDiscFormat2Erase_DebugConstructor MsftDiscFormat2Erase_DebugDestructor MsftDiscFormat2Erase_DebugGeneral Values J q � MsftDiscFormat2Erase_DebugConstructor MsftDiscFormat2Erase_DebugDestructor MsftDiscFormat2Erase_DebugGeneral ValueMap � � � 0x00000001 0x00000002 0x00000004 Level _
� l t � � � [ i � � 7 A r } uint32 Description Levels ValueDescriptions � � � 2 Abnormal exit or termination Severe errors that need logging Warnings such as allocation failure Includes non-error cases Detailed traces from intermediate steps DefineValues � � � � � TRACE_LEVEL_FATAL TRACE_LEVEL_ERROR TRACE_LEVEL_WARNING TRACE_LEVEL_INFORMATION TRACE_LEVEL_VERBOSE Values
! . Fatal Error Warning Information Verbose ValueMap Y ^ c h m 0x1 0x2 0x3 0x4 0x5 ValueType index fo � ���` b �pK�� � �o>�� P i�m�� H �y<J9 [ R S O P _ P o l i c y S e t t i n g ZuR|�C�& U RSOP_PolicySetting ) & F ��Q Y d � � W [ � � c r � � � � � � 5 � � � � 9 L � � j p � � m z �_UUU��������������������������������������������������������������������������������� � RSOP_IPSECPolicySetting Description Policy object for IPSEC Policy AMENDMENT LOCALE ClassName +
� � � � � � string Description ClassName DisplayName ClassName description +
� # 0 = J string Description description DisplayName description id @ 6
� � � � � � � �� string Description Inherited from RSOP_PolicySetting DisplayName ID ipsecData , +
� , 3 @ K X uint8 Description ipsecData DisplayName ipsecData ipsecDataType
( +
� � � � � � uint32 Description ipsecDataType DisplayName ipsecDataType ipsecFilterReference L +
� : B O e r string Description ipsecFilterReference DisplayName ipsecFilterReference ipsecID $ +
� � � � � � string Description ipsecID DisplayName ipsecID ipsecISAKMPReference 0 +
� M U b x � string Description ipsecISAKMPReference DisplayName ipsecISAKMPReference ipsecName +
� � � � � string Description ipsecName DisplayName ipsecName ipsecNegotiationPolicyAction H +
� n v � � � string Description ipsecNegotiationPolicyAction DisplayName ipsecNegotiationPolicyAction ipsecNegotiationPolicyReference @ +
� & . ; \ i string Description ipsecNegotiationPolicyReference DisplayName ipsecNegotiationPolicyReference ipsecNegotiationPolicyType D +
� � � � string Description ipsecNegotiationPolicyType DisplayName ipsecNegotiationPolicyType ipsecNFAReference
4 +
� � � � � � string Description ipsecNFAReference DisplayName ipsecNFAReference ipsecOwnersReference < +
� $ 1 G T string Description ipsecOwnersReference DisplayName ipsecOwnersReference name @ +
� � � � � � string Description name DisplayName name precedence @ +
� $ 1 T a uint32 Description Inherited from RSOP_PolicySetting DisplayName Precedence whenChanged 8 +
� � � � � � uint32 Description whenChanged DisplayName whenChanged � R S O P _ P o l i c y S e t t i n g [uR|�C�� 8 RSOP_PolicySetting ) * U ��`
h s � � f j � � � " 1 � � < B � � ? L �_U������������������������������������������������������ � RSOP_IEEE80211PolicySetting Description Policy object for Wireless Network Policy AMENDMENT LOCALE ClassName +
� � � � � � string Description ClassName DisplayName ClassName description +
� * 2 ? L Y string Description description DisplayName description id @ 6
� � � � � � � �� string Description Inherited from RSOP_PolicySetting DisplayName ID msieee80211Data , +
� A H U g t uint8 Description msieee80211-Data DisplayName msieee80211-Data msieee80211DataType
( +
� � � � � uint32 Description msieee80211-DataType DisplayName msieee80211-DataType msieee80211ID $ +
� j r � � string Description msieee80211-ID DisplayName msieee80211-ID msieee80211Name +
� � � * string Description msieee80211-Name DisplayName msieee80211-Name name @ +
� { � � � � string Description name DisplayName name precedence @ +
� � � & 3 uint32 Description Inherited from RSOP_PolicySetting DisplayName Precedence whenChanged 0 +
� � � � � � uint32 Description whenChanged DisplayName whenChanged � R S O P _ P o l i c y S e t t i n g \uR|�C� + RSOP_PolicySetting ) " / ] ��h p } � � � � % @ � � ? K � � �_�����������������������������������������W � RSOP_IEEE80211GroupPolicySetting Description Policy object for IEEE 802.11 Network Policy AMENDMENT LOCALE description +
� � � � � � string Description description DisplayName description id @ 6
� : B O r � �� string Description Inherited from RSOP_PolicySetting DisplayName ID msieee80211PolicyData +
� � � �
string Description msieee80211-PolicyData DisplayName msieee80211-PolicyData msieee80211PolicyReserved +
� y � � � � uint8 Description msieee80211-PolicyReserved DisplayName msieee80211-PolicyReserved name @ +
� & , 9 string Description name DisplayName name precedence @ +
� � � � � � uint32 Description Inherited from RSOP_PolicySetting DisplayName Precedence whenChanged $ +
� # 0 = J uint32 Description whenChanged DisplayName whenChanged � R S O P _ P o l i c y S e t t i n g ]uR|�C� + RSOP_PolicySetting ) ! . [ ��f n { � � � � : � � 7 C � � �_�����������������������������������������O � RSOP_IEEE8023GroupPolicySetting Description Policy object for IEEE 802.3 Network Policy AMENDMENT LOCALE description +
� � � � � � string Description description DisplayName description id @ 6
� 8 @ M p } � �� string Description Inherited from RSOP_PolicySetting DisplayName ID msieee8023PolicyData +
� � � � � string Description msieee8023-PolicyData DisplayName msieee8023-PolicyData msieee8023PolicyReserved +
� s z � � � uint8 Description msieee8023-PolicyReserved DisplayName msieee8023-PolicyReserved name @ +
� $ 1 string Description name DisplayName name precedence @ +
� | � � � � uint32 Description Inherited from RSOP_PolicySetting DisplayName Precedence whenChanged $ +
� ( 5 B uint32 Description whenChanged DisplayName whenChanged �
E v e n t T r a c e �uR|�C�/ EventTrace ) * K ��V ^ e ! u��������� � TSClientActiveXControlTrace Description TS Client ActiveX Control Trace AMENDMENT LOCALE Flags +
� � � � � � uint32 Description Enable Flags Values � � TS_TRACE_LEVEL_NRM TS_TRACE_LEVEL_ERROR TS_TRACE_LEVEL_ASSERT Level +
� Z b o w uint32 Description Levels Values � � � � � Fatal Error Warning Information Verbose E_ � �.ӝP ��`;f R ��+� F {j� � _ _ E v e n t C o n s u m e r Q͝��C�� 8 __EventConsumer
$ k s � � K T � � � � ' 3 z � � � oUU���������� ���������������������������������������� � SMTPEventConsumer locale BccLine , '
� Y a �� � �� string Template CcLine
( '
� � � �� � �� string Template FromLine '
� � �� � �� string Template HeaderFields 0
� C � �� string Message '
� � � �� � �� string Template Name
� � � �� string ReplyToLine '
� �� � �� string Template SMTPServer '
� h p �� � �� string not_null Subject '
� � � �� � �� string Template ToLine $ '
� �� � �� string Template �5 7 E 5 F 3 A D D 9 E 2 4 2 C 4 E 9 F 9 E D F 7 9 A A 9 7 F 7 9 E 7 9 1 1 C 5 A 8 B 9 0 2 E C 1 5 0 D 6 4 4 2 E 3 B 8 5 A 5 A A R͝��C�ȝ��C�� ���M 9 ` � __Win32Provider {C7A3A54B-0250-11d3-9CD1-00105A1F4801} NetworkServiceHost SMTPEventConsumer _ _ E v e n t C o n s u m e r O͝��C� c __EventConsumer ) ' � ��� � � / A � � � 4 A N G W � � q � ' � � v | � � � �
�
�
B O �
n { �
�
�
� � * 1 oUUUUU��������� ��������������������������������������������������������������������������������� � CommandLineEventConsumer Description Executes command in response to an event, see the Win32 SDK documentation for CreateProcess for more complete description of properties. AMENDMENT LOCALE CommandLineTemplate
�
string Description Command line string CreateNewConsole
� m v � boolean Description The new process has a new console. Note: This property has been Deprecated in Windows XP and is no longer used. CreateNewProcessGroup
� 7 @ M boolean Description The new process is the root process of a new process group. CreateSeparateWowVdm
� � � � boolean Description The new process runs in a private Virtual DOS Machine (VDM). CreateSharedWowVdm
� ` i v boolean Description If the DefaultSeparateVDM switch in the Windows section of WIN.INI is TRUE, this flag causes the CreateProcess function to override the switch and run the new process in the shared Virtual DOS Machine. DesktopName
*
� z � � string Description Either the name of the desktop only or the name of both the desktop and window station for this process. Note: This property has been Deprecated in Windows XP and is no longer used. ExecutablePath
� � � � string Description Name of executable module FillAttribute J
� � � uint32 Description Specifies the initial text and background colors if a new console window is created in a console application ForceOffFeedback T
� � � � boolean Description Indicates that the feedback cursor is forced off while the process is starting. ForceOnFeedback R
� S \ i boolean Description Indicates that the cursor is in feedback mode for two seconds after CreateProcess is called. KillTimeout X
� uint32 description Number of seconds that child process is allowed to run; if zero, process will not be terminated Name )
� � � ��� � string Description A unique identifier for this instance Priority "
� % - : sint32 Description Used to determine the scheduling priorities of the process's threads RunInteractively V
� � � � boolean Description Indicates that the process has access to the desktop. ShowWindowCommand N
� K
S
`
uint32 Description The ShowWindowCommand can be any of the SW_ constants defined in WINUSER.H. UseDefaultErrorMode
� �
�
boolean Description New process inherits the error mode of the calling process. WindowTitle .
� { � � string Description For console processes, this is the title displayed in the title bar if a new console window is created WorkingDirectory &
� 6 > K string Description Default directory used by process XCoordinate 2
� � � � uint32 Description Specifies the x coordinate of the upper left corner of a window XNumCharacters B
� 9
A
N
uint32 Description For a console process, specifies the width of the window in characters XSize :
� �
�
�
uint32 Description Specifies the width of the window YCoordinate 6
� : B O uint32 Description Specifies the y coordinate of the upper left corner of a window YNumCharacters F
� � � � uint32 Description For a console process, specifies the height of the window in characters YSize >
� ] e r uint32 Description Specifies the height of the window � _ _ E v e n t C o n s u m e r P͝��C�� 6 __EventConsumer ) & � ���
� � # , � k � � � l � � � � � 1 = � � oUU���������� ��������������������������������������� � NTEventLogEventConsumer description Logs events into NT event log, see Win32 SDK documentation for more complete descriptions AMENDMENT LOCALE Category
� � � � uint16 Description Specifies the event category. This is source-specific information. EventID
� X ` m uint32 Description The event identifier specifies the message that goes with this event as an entry in the message file associated with the event source. EventType
� , 4 A uint32 Description Specifies the type of event being logged InsertionStringTemplates
&
� � � � string Description Strings to be inserted into the event text. Name )
� 0 � ��8 E string Description A unique identifier for this instance NameOfRawDataProperty *
� � � � string Description The NameOfRawDataProperty property is the name of the property in the event which contains a UserSID in string or array of bytes format. This will become the lpUserSid param in the ReportEvent API function. NameOfUserSIDProperty .
� � � � string Description The NameOfUserSIDProperty is the name of a property in the event which contains an array of bytes, or a string. This will become the lpRawData param in ReportEvent API function. NumberOfInsertionStrings "
� � � � uint32 Description Number of strings to be inserted into the event text. SourceName
� i q ~ string Description The source name must be a subkey of a logfile entry under the EventLog key in the registry. UNCServerName
� + string Description Universal Naming Convention (UNC) name of the server on which this operation is to be performed. If NULL, the operation is performed on the local computer. �� �-�G� c �5
� N)�� ) ��I
~ D3ޏ�
' �E�N�
n�])� ��'r� I ��� R S O P _ P o l i c y S e t t i n g +ѝ��C�' 4 RSOP_PolicySetting & / a n � � � � ) 5 r � � � � & 1 ����������� � � ������e g ���� c i � RSOP_IERegistryPolicySetting Locale command ,
� Y � �� string currentUser '
� � � �� � �� boolean deleted *
� � � �� boolean id @ '
� ! � �� � �� string precedence @ '
� j � �� � �� uint32 registryKey
� � � �� string value
&
� � � �� uint8 valueName
� � �� string valueType "
� [ � �� uint32 � ,ѝ��C�� ' ( 3 e u � � � � ? G y � � � � � UU�������������������������������������+ � RSOP_IEAuthenticodeCertificate Locale certIndex
� ] � �� sint32 expirationDate e
� � datetime friendlyName
� � string intendedPurposes
� string issuerName
� 7 string rsopID
� q � �� string rsopPrecedence
� � � �� sint32 subjectName
� � string tabIndex
� # � �� sint32 � -ѝ��C� H P � � ����������� � RSOP_IEESC Locale EscEnabled
� ? boolean rsopID
� z � �� string rsopPrecedence
� � � �� sint32 � .ѝ��C�f ��% - ; o v � � @ L � � ������� � � ����� � RSOP_PolicySettingBlocked abstract Locale creationTime e
� e � �� datetime GPOID
� � � �� string id 2
� � � ��� �� � �� string Required Not_Null name
� 8 � �� string precedence 2
� � � ��� �� � �� uint32 Required Not_Null SOMID
� � � �� string � R S O P _ P o l i c y S e t t i n g B l o c k e d /ѝ��C�� 1 # RSOP_PolicySettingBlocked # + 4 f o � � � � , 9 k r � � � � ���������� � � ���� ! ���� # � RSOP_RegistryPolicySettingBlocked Locale command *
� ^ � �� string deleted
(
� � � �� boolean id @ '
� � � �� � �� string precedence @ '
� $ � �� � �� uint32 registryKey
� c � �� string value $
� � � �� uint8 valueName
� � � �� string valueType
� � �� uint32 � R S O P _ P o l i c y S e t t i n g 0ѝ��C�� 1 RSOP_PolicySetting * 2 ? V f � � T X � � � � , 8 � � � �@��������� � � ���� ���� � RSOP_PushPrinterConnectionsPolicySetting Locale Description Policy object for PPc ConnectionType $ P
� � � � � � ! . � ��� � uint32 ValueMap � � 1 2 Values �
User connection Machine connection Description Whether the the connection is applied per machine, per user1 = User, 2 = Machine. DisplayName Connection Type deleted
( 6
� � � � ��; H boolean Description Indicates whether the print connectionhas been deleted. DisplayName Is deleted id @ A
� � � �� � ��� � � � string Description Inherited from RSOP_PolicySetting DisplayName ID precedence @ A
� K � �� � ��S ` � � uint32 Description Inherited from RSOP_PolicySetting DisplayName Precedence printerName 6
� � � � �� string Description Printer name, DisplayName Printer name PushResult * 6
� | � � � ��� � uint32 Description The final result of pushed printer connection. 0 indicate success DisplayName PushResult serverName 6
� = E R � ��e r string Description Short server name DisplayName Server name uncName 6
� � � � � ��� string Description Short server name DisplayName Network name � R S O P _ P o l i c y S e t t i n g 1ѝ��C�� 1 RSOP_PolicySetting * 2 ? V f � � T X � � � � , 8 � � � �@��������� � � ���� ���� � RSOP_PushPrinterConnectionsPolicySetting Locale Description Policy object for PPc ConnectionType $ P
� � � � � � ! . � ��� � uint32 ValueMap � � 1 2 Values �
User connection Machine connection Description Whether the the connection is applied per machine, per user1 = User, 2 = Machine. DisplayName Connection Type deleted
( 6
� � � � ��; H boolean Description Indicates whether the print connectionhas been deleted. DisplayName Is deleted id @ A
� � � �� � ��� � � � string Description Inherited from RSOP_PolicySetting DisplayName ID precedence @ A
� K � �� � ��S ` � � uint32 Description Inherited from RSOP_PolicySetting DisplayName Precedence printerName 6
� � � � �� string Description Printer name, DisplayName Printer name PushResult * 6
� | � � � ��� � uint32 Description The final result of pushed printer connection. 0 indicate success DisplayName PushResult serverName 6
� = E R � ��e r string Description Short server name DisplayName Server name uncName 6
� � � � � ��� string Description Short server name DisplayName Network name � C I M _ D e p e n d e n c y >ѝ��C�� CIM_Dependency ) � �� � , 4 @ � � U��������n � Win32_ShadowVolumeSupport MSVSS__PROVIDER Locale Antecedent f@ N
� � � �� � ��� � � � ref:Win32_ShadowProvider min max override Antecedent Dependent f@ N
� = � �� � ��O T Y c ref:Win32_Volume min max override Dependent � C I M _ D e p e n d e n c y ?ѝ��C�� CIM_Dependency ) � �� � 0 8 D � � U��������r � Win32_ShadowDiffVolumeSupport MSVSS__PROVIDER Locale Antecedent f@ N
� � � �� � ��� � � � ref:Win32_ShadowProvider min max override Antecedent Dependent f@ N
� A � �� � ��S X ] g ref:Win32_Volume min max override Dependent � ǒʏ� y�=� ) =o/ � !�x� � �z�� � S�T� � "!�� � �a'� � j?n� �J�� � ⯝ M M S N d i s ��jj��� n MSNdis A �� � �� � ' - U a r � � � N ] � � Q n � � " 6 � � � � 7 H � � � � I c UUU����������������������������������������������������������������������������������������������������������� � MSNdis_80211_Statistics WMI WMIProv guid {42bb73b0-2129-11d4-97eb-00c04f79c403} WmiExpense ACKFailureCount
B )
� � � ��� uint64 WmiDataId Active
� � � �� boolean FailedCount )
� ; � ��C uint64 WmiDataId FCSErrorCount b )
� � � ���
uint64 WmiDataId FrameDuplicateCount J )
� � � ���
uint64 WmiDataId InstanceName '
� I � �� � �� string MulticastReceivedFrameCount
Z )
� � � ��� uint64 WmiDataId MulticastTransmittedFrameCount )
� � �� uint64 WmiDataId MultipleRetryCount * )
� m � ��u uint64 WmiDataId ReceivedFragmentCount R )
� � � ��� uint64 WmiDataId RetryCount " )
� $ � ��, uint64 WmiDataId RTSFailureCount : )
� � ��� uint64 WmiDataId RTSSuccessCount 2 )
� � � ��� uint64 WmiDataId StatisticsLength )
� 6 � ��> uint32 WmiDataId TransmittedFragmentCount
)
� � � ��� uint64 WmiDataId � M S N d i s ��jj�� MSNdis A �� � �� � # ) Q ] e � � � � 7 B � �
U�����������������������W � MSNdis_80211_AddWEP WMI WMIProv guid {4307bff0-2129-11d4-97eb-00c04f79c403} WmiExpense Active
� � � �� boolean InstanceName '
� � � �� � �� string KeyIndex
)
� $ � ��, uint32 WmiDataId KeyLength )
� y � ��� uint32 WmiDataId KeyMaterial 6
� � � ��� � � uint8 WmiDataId WmiSizeIs KeyLength Length )
� D � ��L uint32 WmiDataId 1_ � M S N d i s ��jj��� MSNdis A �� � �� � & , T ` h � � � � U����������C � MSNdis_80211_RemoveWEP WMI WMIProv guid {433c345c-2129-11d4-97eb-00c04f79c403} WmiExpense Active
� � � �� boolean InstanceName '
� � � �� � �� string Ndis80211KeyIndex )
� 0 � ��8 uint32 WmiDataId se � M S N d i s ��jj��� MSNdis A �� � �� � ) / W c k � � � � U����������D � MSNdis_80211_Disassociate WMI WMIProv guid {43671f40-2129-11d4-97eb-00c04f79c403} WmiExpense Active
� � � �� boolean InstanceName '
� � � �� � �� string UnusedParameter )
� 1 � ��9 uint32 WmiDataId pe � M S N d i s ��jj��� MSNdis A �� � �� � ! * 0 X d l � � � � U����������E � MSNdis_80211_BssIdListScan WMI WMIProv guid {0d9e01e1-ba70-11d4-b675-002048570337} WmiExpense Active
� � � �� boolean InstanceName '
� � � �� � �� string UnusedParameter )
� 2 � ��: uint32 WmiDataId xp � M S N d i s ��jj��� MSNdis A ! �� � �� � & / 5 ] i q � � � U����������� � MSNdis_80211_AuthenticationMode WMI WMIProv guid {43920a24-2129-11d4-97eb-00c04f79c403} WmiExpense Active
� � � �� boolean InstanceName '
� � � �� � �� string Ndis80211AuthenticationMode C
� ] � ��e m � � � uint32 Values } � � Ndis802_11AuthModeOpen Ndis802_11AuthModeShared Ndis802_11AuthModeAutoSwitch ValueMap � � � 0 1 2 WmiDataId � M S N d i s ��jj��\ MSNdis A �� � �� � ! * 0 X d l � � � U����������� � MSNdis_80211_PrivacyFilter WMI WMIProv guid {6733c4e9-4792-11d4-97f1-00c04f79c403} WmiExpense Active
� � � �� boolean InstanceName '
� � � �� � �� string Ndis80211PrivacyFilter C
� S � ��[ c � � � uint32 Values o � Ndis802_11PrivFilterAcceptAll Ndis802_11PrivFilter8021xWEP ValueMap � � 0 1 WmiDataId � M S N d i s ��jj��� MSNdis A �� � �� � & , T ` h � � � � U���������� � MSNdis_80211_WEPStatus WMI WMIProv guid {b027a21f-3cfa-4125-800b-3f7a18fddcdc} WmiExpense Active
� � � �� boolean InstanceName '
� � � �� � �� string Ndis80211WEPStatus C
� K � ��S [ � � � uint32 Values o � � � Ndis802_11WEPEnabled Ndis802_11WEPDisabled Ndis802_11WEPKeyAbsent Ndis802_11WEPNotSupported ValueMap � � � � 0 1 2 3 WmiDataId � M S N d i s ��jj��� MSNdis A �� � �� � " + 1 Y e m � � � U����������p � MSNdis_80211_ReloadDefaults WMI WMIProv guid {748b14e8-32ee-4425-b91b-c9848c58b55a} WmiExpense Active
� � � �� boolean InstanceName '
� � � �� � �� string Ndis80211ReloadDefaults 6
� H � ��P Z e uint32 ValueMap b 0 WmiDataId � M S N d i s ��jj��� MSNdis �� & N f M����\ � MSNdis_PMAdminConfigState WMI guid {0cffd0fc-8333-4000-9a3b-200735d698f9} NdisPMAdminConfigState 8
� � � � . 8 Q uint32 Values � � NdisPMAdminConfigStateUnspecified NdisPMAdminConfigStateDisabled NdisPMAdminConfigStateEnabled ValueMap H K N 0 1 2 WmiDataId le � M S N d i s ��jj��) MSNdis A �� � �� � $ * R _ � � � � 1 ������������ � MSNdis_PMAdminConfig WMI WMIProv guid {1528D111-708A-4ca4-9215-C05771161CDA} Description Control power management related standardized keywords Active
� � � �� boolean InstanceName '
� � �� � �� string PMAdminConfigParam
4
� s � �� � ��� object:MSNdis_PMAdminConfigParam WmiDataId �aId �9 A B 5 3 8 0 6 E 8 8 6 6 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0 hJV�� ͝��C�l d�J�� K � WMIBinaryMofResource C:\Windows\System32\drivers\monitor.sys[MonitorWMI] Name] me] v� ` p M���� � ��W�� 4 Q��
7 -8ߎ � 4 1 C 5 3 E 6 D B 1 A C F 2 4 5 3 C E F D 4 1 3 9 8 1 9 8 E 6 1 3 F 1 0 D F F 4 7 7 0 9 E C A B 1 D 7 F 0 3 7 7 5 6 A C 8 C E 7 wѝ��C�ȝ��C�� � � __thisNAMESPACE � �� � � ? C I M _ C h e c k pН��C�� ! CIM_Check ) ( � ��� � � � ���������������������������������/ � Win32_ProgIDSpecification Description Instances of this class represent and ProgIDs that need to be registered durring a given installation. AMENDMENT LOCALE ms_409 Parent
� � � � string Description Contains the ProgID for any version independent programs. �
C I M _ A c t i o n q��C� 0 CIM_Action ) # a ��l t | � a m �� 6 @ � � ��U���������������������������������������������^ � Win32_RegistryAction Description The WriteRegistryValues action sets up registry information that the application desires in the system Registry. The registry information is gated by the Component class. A registry value is written to the system registry if the corresponding component has been set to be installed either locally or run from source. AMENDMENT LOCALE ms_409 EntryName
� � � � string Description This property contains the registry value name. If this is Null, then the data entered into the Value proeprty are written to the default registry key. EntryValue
"
� � � � string Description This property is the registry value. (
� string Description The key for the registry value. Registry
� l t � string Description The registry value name. If the Value column is null, then the following strings in the Name column have special significance. + The key is to be created, if absent upon the installation of the component. - The key is to be deleted, if present, with all its values and subkeys upon the uninstallation of the component. * The key is to be created, if absent upon the installation of the component AND the key is to be deleted, if present, with all its values and subkeys upon the uninstallation of the component. Root &
� � � � sint16 Values � + > R HKEY_CURRENT_USER HKEY_LOCAL_MACHINE HKEY_CLASSES_ROOT HKEY_CURRENT_USER HKEY_LOCAL_MACHINE HKEY_USERS �
C I M _ A c t i o n r��C� + CIM_Action ) $ N ��Y a i q �C � � ��U����������������������������������������n � Win32_RemoveIniAction Description The RemoveIniValues action deletes .INI file information that the application desires to delete from .INI files. The deletion of the information is gated by the Component class. A .INI value is deleted if the corresponding component has been set to be installed either locally or run from source. AMENDMENT LOCALE ms_409 Action &
� � � � uint16 Description The type of modification made.
Hexadecimal
Decimal
Meaning
0x002
2
Deletes .ini entry.
0x004
4
Deletes a tag from a .ini entry.
� o w � string Description The .ini file key below the section. Section
� � � � string Description The .ini file section. Value
"
� ? G T string Description The value to be deleted. � C I M _ C h e c k o��C�� C CIM_Check ) ) � ��� � � � � � ( 6 \ ` � � � � * \ g � � ��UU���������������������������������������������������������������� � Win32_ServiceSpecification Description Instances of this class represent the services that are to be installed along with an associated package. AMENDMENT LOCALE ms_409 Dependencies 2
� � � � string Description This column is a list of names of services or load ordering groups that the system must start before this service. Names in the list are separated by Nulls. If the service has no dependencies, then Null or an empty string is returned. Dependency on a group means that this service can run if at least one member of the group is running after an attempt to start all members of the group. DisplayName
� � � � string Description This property is the string that user interface programs use to identify the service. ErrorControl *
� b j w sint32 Description This column specifies the action taken by the startup program if the service fails to start during startup. One of the following error control flags must be specified in this column.
Adding the value 0x08000 to the flags in the following table specifies that the overall install will fail if the service cannot be installed into the system.
Value
Startup program's action
0x00000000
Logs the error and continues with the startup operation.
0x00000001
Logs the error, displays a message box and continues the startup operation.
0x00000003
Logs the error if it is possible and the system is restarted with the last configuration known to be good. If the last-known-good configuration is being started, the startup operation fails. ID
� � � � string Description A unique key identifying this service specification item within its product. LoadOrderGroup
.
� + 3 @ string Description This property contains the string that names the load ordering group of which this service is a member. Password :
� � � � string Description The password associated with StratName. ServiceType
"
� V ^ k sint32 Description This property is a set of bit flags that specify the type of service.
One of the following service types must be specified in this column.
Type of service
Value
Description
SERVICE_WIN32_OWN_PROCESS
0x00000010
A Microsoft Win32� service that runs its own process.
SERVICE_WIN32_SHARE_PROCESS
0x00000020
A Win32 service that shares a process.
SERVICE_INTERACTIVE_PROCESS
0x00000100A
Win32 service that interacts with the desktop. This value cannot be used alone and must be added to one of the two previous types.
The following types of service are unsupported.
Type of service
Value
Description
SERVICE_KERNEL_DRIVER
0x00000001
A driver service.
SERVICE_FILE_SYSTEM_DRIVER
0x00000002
A file system driver service. StartName 6
� � � � string Description The account name used to start this service. StartType &
�
" sint32 Description This property is a set of bit flags that specify when to start the service.
One of the following types of service start must be specified in this column.
Type of service start
Value
Description
SERVICE_AUTO_START
0x00000002
A service start during startup of the system.
SERVICE_DEMAND_START
0x00000003
A service start when the service control manager calls the StartService function.
SERVICE_DISABLED
0x00000004
Specifies a service that can no longer be started.
The following types of service starts are valid only for driver services.
Type of driver service start
ValueDescription
SERVICE_BOOT_START
0x00000000
A device driver started by the operating system loader.
SERVICE_SYSTEM_START
0x00000001
A device driver started by calling the IoInitSystem function. Use this in the ServiceControl Table, with the StartServices action put after the InstallServices action, to start a driver service during an install. �� 5���� �
�*�1� � �!�Q �mS�d � L��%
�}/ 4 ��Xc � 5Z\; � c�� � �1k � S��( U ��} � �l�a e ���C�| ' ) s ��~ � � � � _ m � � N V � � � � � � _ s UU�������������������������������������� � MSFT_SomFilter Description Provides a list of rules, expressed as queries which are evaluated on target machine AMENDMENT LOCALE Author
� � � � String Description Originator of this SOMFilter ChangeDate e
� % / < DateTime Description Last time this object was updated CreationDate e
� � � � DateTime Description Time that this object was created Description
� ! String Description Descriptive text describing this SOM Filter Domain )
� � � ��� � String Description Domain of this object, in DNS format: "redmond.corp.microsoft.com" ID )
� ! � ��) 6 string Description Unique identifier for this instance, expected to be a GUID in registry format Name
� � � � string Description A user-friendly name for this SOM Filter Rules
� ) ; H object:MSFT_Rule Description Rules to be evaluated SourceOrganization
� � � � String Description Author's organization I
� �
� Evaluate ( Description Determines whether the queries expressed in Rules apply to this machine. Returns S_OK (0) if all queries expressed in rules return results; S_FALSE (1) if they do not; and an applicable WMI error code if an error occurs. � ae442007200009F ROOT\Policy\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ Uint32 out
� ^ f �� __ � BatchEvaluate � � Description Evaluates a list of SOMs, returns array result codes matching result of evaluating each � ae442007200009F ROOT\Policy\ms_409 ���� � �� �� * � ����� � __PARAMETERS abstract f filters ref f
� 3 IN f
� 3 W �� ID f )
� � W ��� ref:MSFT_SomFilter __ �� ae442007200009F ROOT\Policy\ms_409 ���� � �� �� * � � ��������I � __PARAMETERS abstract results uint32
� 3 OUT
� 3 Z �� ID )
� � Z ��� Uint32 ReturnValue uint32
� Uint32 out
� �� __ � _ _ E x t r i n s i c E v e n t ���C�h
__ExtrinsicEvent ������������ � Win32_SystemTrace Locale � W i n 3 2 _ S y s t e m T r a c e ���C�� " Win32_SystemTrace - _ j � � � � _��������������������������������N � Win32_ProcessTrace Locale ParentProcessID
� W � �� uint32 ProcessID
� � � �� uint32 ProcessName
� � � �� string SessionID
� � �� uint32 Sid
� G � �� uint8 � W i n 3 2 _ P r o c e s s T r a c e ���C�� " Win32_ProcessTrace ����������������������������������! � Win32_ProcessStartTrace Locale � W i n 3 2 _ P r o c e s s T r a c e ���C�� & Win32_ProcessTrace , �������������������������������������^ � Win32_ProcessStopTrace Locale ExitStatus
� V � �� uint32 � W i n 3 2 _ S y s t e m T r a c e ���C�� Win32_SystemTrace & X b _��������������������� � Win32_ThreadTrace Locale ProcessID
� P � �� uint32 ThreadID
� � � �� uint32 � W i n 3 2 _ T h r e a d T r a c e ���C�| K Win32_ThreadTrace + ] i � � � � P Z � � �U������������������������������������������������������������������������� � Win32_ThreadStartTrace Locale StackBase
� U � �� uint64 StackLimit
� � � �� uint64 StartAddr 4
� � uint64 UserStackBase $
� � �� uint64 UserStackLimit ,
� H � �� uint64 WaitMode
D
� y uint32 Win32StartAddr <
� � uint64 � W i n 3 2 _ T h r e a d T r a c e ���C�u Win32_ThreadTrace ��������������������� � Win32_ThreadStopTrace Locale � W i n 3 2 _ S y s t e m T r a c e ���C�i
Win32_SystemTrace ������������ � Win32_ModuleTrace Locale � W i n 3 2 _ M o d u l e T r a c e ���C�� 7 Win32_ModuleTrace , ^ h � � � � # U ` � � _U������������������������������������������������������ � Win32_ModuleLoadTrace Locale DefaultBase ,
� V � �� uint64 FileName
� � � �� string ImageBase
� � � �� uint64 ImageChecksum $
� � �� uint32 ImageSize
� M � �� uint64 ProcessID
� � � �� uint32 TimeDateStamp (
� � � �� uint32 �5 7 E 5 F 3 A D D 9 E 2 4 2 C 4 E 9 F 9 E D F 7 9 A A 9 7 F 7 9 E 7 9 1 1 C 5 A 8 B 9 0 2 E C 1 5 0 D 6 4 4 2 E 3 B 8 5 A 5 A A �Ν��C�ȝ��C�� ���B 9 c � __Win32Provider {9877D8A7-FDA1-43F9-AEEA-F90747EA66B0} WmiCore WMI Kernel Trace Event Provider 0 8 9 9 3 0 7 4 0 8 A 3 2 0 4 0 A 6 D A 1 9 C 0 B 1 E C 2 7 4 5 A 3 D 6 0 4 B A A 9 D F F E 8 E E 4 B 7 5 C 3 D 9 1 E 1 6 1 0 9 �Ν��C�ȝ��C�T � 9 � __EventProviderRegistration 5 \ � � � select * from Win32_ProcessStartTrace select * from Win32_ProcessStopTrace select * from Win32_ThreadStartTrace select * from Win32_ThreadStopTrace select * from Win32_ModuleLoadTrace \\.\Root\CIMV2:__Win32Provider.Name="WMI Kernel Trace Event Provider" _ _ E x t r i n s i c E v e n t �Ν��C�-
__ExtrinsicEvent ) � ��� ������������� � Win32_SystemTrace Description The SystemTrace class is the base class for all system trace events. System trace events are fired by the kernel logger via the event tracing API. AMENDMENT LOCALE � � l&L�� � �f�m� � ˣ��: � �LV�� � ����� � @^�S � G��� � W��o � �� � ��=� � A�*^ g �p�� k 6��%0 e 6"� h R S O P _ P o l m k r P r o S e t t i n g �uR|�C�] 8 RSOP_PolmkrProSetting ) ' k ��v ~ � ��������������������������������������������������������� � RSOP_PolmkrDeviceSetting Description Localized version of RSOP_PolmkrDeviceSetting for American English AMENDMENT LOCALE id @ 6
� � � � � �� string Description Inherited from RSOP_PolmkrProSetting. DisplayName Id precedence @ 6
� c k x � � � �� uint32 Description Inherited from RSOP_PolmkrProSetting. DisplayName Precedence � R S O P _ P o l m k r P r o S e t t i n g �uR|�C�i 8 RSOP_PolmkrProSetting ) - w ��� � � + ��������������������������������������������������������� � RSOP_PolmkrDialupOptionSetting Description Localized version of RSOP_PolmkrDialupOptionSetting for American English AMENDMENT LOCALE id @ 6
� � � � � �� string Description Inherited from RSOP_PolmkrProSetting. DisplayName Id precedence @ 6
� o w � � � � �� uint32 Description Inherited from RSOP_PolmkrProSetting. DisplayName Precedence � R S O P _ P o l m k r P r o S e t t i n g �uR|�C�i 8 RSOP_PolmkrProSetting ) - w ��� � � + ��������������������������������������������������������� � RSOP_PolmkrFolderOptionSetting Description Localized version of RSOP_PolmkrFolderOptionSetting for American English AMENDMENT LOCALE id @ 6
� � � � � �� string Description Inherited from RSOP_PolmkrProSetting. DisplayName Id precedence @ 6
� o w � � � � �� uint32 Description Inherited from RSOP_PolmkrProSetting. DisplayName Precedence � R S O P _ P o l m k r P r o S e t t i n g �uR|�C�s 8 RSOP_PolmkrProSetting ) % 2 � ��� � � ) 5 ��������������������������������������������������������� � RSOP_PolmkrFolderOptionSettingVista Description Localized version of RSOP_PolmkrFolderOptionSettingVista for American English AMENDMENT LOCALE id @ 6
� � � � % � �� string Description Inherited from RSOP_PolmkrProSetting. DisplayName Id precedence @ 6
� y � � � � � �� uint32 Description Inherited from RSOP_PolmkrProSetting. DisplayName Precedence � R S O P _ P o l m k r P r o S e t t i n g �uR|�C�w 8 RSOP_PolmkrProSetting ) ' 4 � ��� � � - 9 ��������������������������������������������������������� � RSOP_PolmkrLocalUsersAndGroupsSetting Description Localized version of RSOP_PolmkrLocalUsersAndGroupsSetting for American English AMENDMENT LOCALE id @ 6
� � � � ) � �� string Description Inherited from RSOP_PolmkrProSetting. DisplayName Id precedence @ 6
� } � � � � � �� uint32 Description Inherited from RSOP_PolmkrProSetting. DisplayName Precedence �% R S O P _ P o l m k r L o c a l U s e r s A n d G r o u p s S e t t i n g �uR|�C�+ 8 / RSOP_PolmkrLocalUsersAndGroupsSetting ' ) + s ��~ ��������������������������������������������������������� � RSOP_PolmkrLocalUsersSetting Description Localized version of RSOP_PolmkrLocalUsersSetting for American English AMENDMENT LOCALE �% R S O P _ P o l m k r L o c a l U s e r s A n d G r o u p s S e t t i n g �uR|�C�- 8 / RSOP_PolmkrLocalUsersAndGroupsSetting ' ) , u ��� ��������������������������������������������������������� � RSOP_PolmkrLocalGroupsSetting Description Localized version of RSOP_PolmkrLocalGroupsSetting for American English AMENDMENT LOCALE � R S O P _ P o l m k r P r o S e t t i n g �uR|�C�k 8 RSOP_PolmkrProSetting ) ! . y ��� � � ! - ��������������������������������������������������������� � RSOP_PolmkrNetworkOptionSetting Description Localized version of RSOP_PolmkrNetworkOptionSetting for American English AMENDMENT LOCALE id @ 6
� � � � � �� string Description Inherited from RSOP_PolmkrProSetting. DisplayName Id precedence @ 6
� q y � � � � �� uint32 Description Inherited from RSOP_PolmkrProSetting. DisplayName Precedence � R S O P _ P o l m k r P r o S e t t i n g �uR|�C�c 8 RSOP_PolmkrProSetting ) * q ��| � � % ��������������������������������������������������������� � RSOP_PolmkrNtServiceSetting Description Localized version of RSOP_PolmkrNtServiceSetting for American English AMENDMENT LOCALE id @ 6
� � � � � �� string Description Inherited from RSOP_PolmkrProSetting. DisplayName Id precedence @ 6
� i q ~ � � � �� uint32 Description Inherited from RSOP_PolmkrProSetting. DisplayName Precedence � R S O P _ P o l m k r P r o S e t t i n g �uR|�C�[ 8 RSOP_PolmkrProSetting ) & i ��t | � ��������������������������������������������������������� � RSOP_PolmkrPowerSetting Description Localized version of RSOP_PolmkrPowerSetting for American English AMENDMENT LOCALE id @ 6
� � � �
� �� string Description Inherited from RSOP_PolmkrProSetting. DisplayName Id precedence @ 6
� a i v � � � �� uint32 Description Inherited from RSOP_PolmkrProSetting. DisplayName Precedence � R S O P _ P o l m k r P o w e r S e t t i n g �uR|�C�! 8 ! RSOP_PolmkrPowerSetting ) - w ��� ��������������������������������������������������������� � RSOP_PolmkrPowerOptionsSetting Description Localized version of RSOP_PolmkrPowerOptionsSetting for American English AMENDMENT LOCALE � R S O P _ P o l m k r P o w e r S e t t i n g �uR|�C�% 8 ! RSOP_PolmkrPowerSetting ) " / { ��� ��������������������������������������������������������� � RSOP_PolmkrPowerOptionsV2Setting Description Localized version of RSOP_PolmkrPowerOptionsV2Setting for American English AMENDMENT LOCALE � R S O P _ P o l m k r P o w e r S e t t i n g �uR|�C� 8 ! RSOP_PolmkrPowerSetting ) , u ��� ��������������������������������������������������������� � RSOP_PolmkrPowerSchemeSetting Description Localized version of RSOP_PolmkrPowerSchemeSetting for American English AMENDMENT LOCALE � �uR|�C�P ) & I ��T \ e � � & , z � U��������������� � MSiSCSIInitiator_Portal Description Microsoft iSCSI Initiator: Portal AMENDMENT LOCALE Address
� � � � string Description Portal Address Index )
� � � ��� uint32 Description Index number of this portal Port
� X ` m uint16 Description Portal Port SymbolicName
� � � � string Description Portal Symbolic Name � �7 �vR|�C��7 8 6 ) ! ��, 4 < K � � � � � � + 6 � �
� � O g � � L! Z! �" �" �' �' {5 �5 6 *6 UUU�����������������������������������������������������6 � CIM_Error Version 2.22.1 Description CIM_Error is a specialized class that contains information about the severity, cause, recommended actions and other data related to the failure of a CIM Operation. Instances of this type MAY be included as part of the response to a CIM Operation. AMENDMENT LOCALE MS_409 CIMStatusCode
, +
� � � � � � uint32 Description The CIM status code that characterizes this instance.
This property defines the status codes that MAY be return by a conforming CIM Server or Listener. Note that not all status codes are valid for each operation. The specification for each operation SHOULD define the status codes that may be returned by that operation.
The following values for CIM status code are defined:
1 - CIM_ERR_FAILED. A general error occurred that is not covered by a more specific error code.
2 - CIM_ERR_ACCESS_DENIED. Access to a CIM resource was not available to the client.
3 - CIM_ERR_INVALID_NAMESPACE. The target namespace does not exist.
4 - CIM_ERR_INVALID_PARAMETER. One or more parameter values passed to the method were invalid.
5 - CIM_ERR_INVALID_CLASS. The specified Class does not exist.
6 - CIM_ERR_NOT_FOUND. The requested object could not be found.
7 - CIM_ERR_NOT_SUPPORTED. The requested operation is not supported.
8 - CIM_ERR_CLASS_HAS_CHILDREN. Operation cannot be carried out on this class since it has instances.
9 - CIM_ERR_CLASS_HAS_INSTANCES. Operation cannot be carried out on this class since it has instances.
10 - CIM_ERR_INVALID_SUPERCLASS. Operation cannot be carried out since the specified superclass does not exist.
11 - CIM_ERR_ALREADY_EXISTS. Operation cannot be carried out because an object already exists.
12 - CIM_ERR_NO_SUCH_PROPERTY. The specified Property does not exist.
13 - CIM_ERR_TYPE_MISMATCH. The value supplied is incompatible with the type.
14 - CIM_ERR_QUERY_LANGUAGE_NOT_SUPPORTED. The query language is not recognized or supported.
15 - CIM_ERR_INVALID_QUERY. The query is not valid for the specified query language.
16 - CIM_ERR_METHOD_NOT_AVAILABLE. The extrinsic Method could not be executed.
17 - CIM_ERR_METHOD_NOT_FOUND. The specified extrinsic Method does not exist.
18 - CIM_ERR_UNEXPECTED_RESPONSE. The returned response to the asynchronous operation was not expected.
19 - CIM_ERR_INVALID_RESPONSE_DESTINATION. The specified destination for the asynchronous response is not valid.
20 - CIM_ERR_NAMESPACE_NOT_EMPTY. The specified Namespace is not empty.
21 - CIM_ERR_INVALID_ENUMERATION_CONTEXT. The enumeration context supplied is not valid.
22 - CIM_ERR_INVALID_OPERATION_TIMEOUT. The specified Namespace is not empty.
23 - CIM_ERR_PULL_HAS_BEEN_ABANDONED. The specified Namespace is not empty.
24 - CIM_ERR_PULL_CANNOT_BE_ABANDONED. The attempt to abandon a pull operation has failed.
25 - CIM_ERR_FILTERED_ENUMERATION_NOT_SUPPORTED. Filtered Enumeratrions are not supported.
26 - CIM_ERR_CONTINUATION_ON_ERROR_NOT_SUPPORTED. Continue on error is not supported.
27 - CIM_ERR_SERVER_LIMITS_EXCEEDED. The WBEM Server limits have been exceeded (e.g. memory, connections, ...).
28 - CIM_ERR_SERVER_IS_SHUTTING_DOWN. The WBEM Server is shutting down.
29 - CIM_ERR_QUERY_FEATURE_NOT_SUPPORTED. The specified Query Feature is not supported. Values w
�
�
�
�
�
�
1 N j � � � � � ( E k � � � � ? l � � � CIM_ERR_FAILED CIM_ERR_ACCESS_DENIED CIM_ERR_INVALID_NAMESPACE CIM_ERR_INVALID_PARAMETER CIM_ERR_INVALID_CLASS CIM_ERR_NOT_FOUND CIM_ERR_NOT_SUPPORTED CIM_ERR_CLASS_HAS_CHILDREN CIM_ERR_CLASS_HAS_INSTANCES CIM_ERR_INVALID_SUPERCLASS CIM_ERR_ALREADY_EXISTS CIM_ERR_NO_SUCH_PROPERTY CIM_ERR_TYPE_MISMATCH CIM_ERR_QUERY_LANGUAGE_NOT_SUPPORTED CIM_ERR_INVALID_QUERY CIM_ERR_METHOD_NOT_AVAILABLE CIM_ERR_METHOD_NOT_FOUND CIM_ERR_UNEXPECTED_RESPONSE CIM_ERR_INVALID_RESPONSE_DESTINATION CIM_ERR_NAMESPACE_NOT_EMPTY CIM_ERR_INVALID_ENUMERATION_CONTEXT CIM_ERR_INVALID_OPERATION_TIMEOUT CIM_ERR_PULL_HAS_BEEN_ABANDONED CIM_ERR_PULL_CANNOT_BE_ABANDONED CIM_ERR_FILTERED_ENUMERATION_NOT_SUPPORTED CIM_ERR_CONTINUATION_ON_ERROR_NOT_SUPPORTED CIM_ERR_SERVER_LIMITS_EXCEEDED CIM_ERR_SERVER_IS_SHUTTING_DOWN CIM_ERR_QUERY_FEATURE_NOT_SUPPORTED DMTF Reserved CIMStatusCodeDescription 0
� ' / < string Description A free-form string containing a human-readable description of CIMStatusCode. This description MAY extend, but MUST be consistent with, the definition of CIMStatusCode. ErrorSource
"
� & 3 string Description The identifying information of the entity (i.e., the instance) generating the error. If this entity is modeled in the CIM Schema, this property contains the path of the instance encoded as a string parameter. If not modeled, the property contains some identifying string that names the entity that generated the error. The path or identifying string is formatted per the ErrorSourceFormat property. ErrorSourceFormat & +
� $ � � uint16 Description The format of the ErrorSource property is interpretable based on the value of this property. Values are defined as:
0 - Unknown. The format is unknown or not meaningfully interpretable by a CIM client application.
1 - Other. The format is defined by the value of the OtherErrorSourceFormat property.2 - CIMObjectPath. A CIM Object Path as defined in the CIM Infrastructure specification. Note: CIM 2.5 and earlier used the term object names. Values �
Unknown Other CIMObjectPath DMTF Reserved ErrorType +
� o w � � � uint16 Description Primary classification of the error. The following values are defined:
2 - Communications Error. Errors of this type are principally associated with the procedures and/or processes required to convey information from one point to another.
3 - Quality of Service Error. Errors of this type are principally associated with failures that result in reduced functionality or performance.
4 - Software Error. Error of this type are principally associated with a software or processing fault.
5 - Hardware Error. Errors of this type are principally associated with an equipment or hardware failure.
6 - Environmental Error. Errors of this type are principally associated with a failure condition relating the to facility, or other environmental considerations.
7 - Security Error. Errors of this type are associated with security violations, detection of viruses, and similar issues.
8 - Oversubscription Error. Errors of this type are principally associated with the failure to allocate sufficient resources to complete the operation.
9 - Unavailable Resource Error. Errors of this type are principally associated with the failure to access a required resource.
10 -Unsupported Operation Error. Errors of this type are principally associated with requests that are not supported. Values � � � � $ 9 I a } � Unknown Other Communications Error Quality of Service Error Software Error Hardware Error Environmental Error Security Error Oversubscription Error Unavailable Resource Error Unsupported Operation Error DMTF Reserved Message
� � � � string Description The formatted message. This message is constructed by combining some or all of the dynamic elements specified in the MessageArguments property with the static elements uniquely identified by the MessageID in a message registry or other catalog associated with the OwningEntity. MessageArguments
� H P ] string Description An array containing the dynamic content of the message. MessageID
� � � � string ����` � �Q�% 6 [4 o[ m q��� \ =
�$ � ���C�l � �� � 7 � RsopPlanningModeProvider Rsop Planning Mode Provider M op ing B � � ann � � RsopCreateSession - ��5 �� static implemented { ae442007200009F ROOT\RSOP ���� � �) + ��
y � B J � � � * � � � X � - 1 � ~ � UU�����������������������������������������G � __PARAMETERS abstract flags uint32
� 1 in
� 1 X �� ID )
� � X ��� uint32 computerName string
� � in
� � �� ID )
� y ��> string computerSOM string
� � in
� � � �� ID )
� 0 � ��� string computerSecurityGroups string
� b in
� b � �� ID )
� � � ��� string computerGPOFilters string
� in
� G �� ID )
� � G ��u string userName string
� � in
� � � �� ID )
� d � ��) string userSOM string
� � in
� � � �� ID )
� � ��� string userSecurityGroups string
� E in
� E l �� ID )
� � l ��� string userGPOFilters string
� � in
� � & �� ID )
� � & ��T string $ site string $
� � in $
� � � �� ID $ )
� ? � �� string __ � ae442007200009F ROOT\RSOP ���� � ��
�� � � � C * � ������������; � __PARAMETERS abstract nameSpace string
� 5 out
� 5 \ �� ID )
� � \ ���
string hResult uint32
� � out
� � �� ID )
� z ��? uint32 ExtendedInfo uint32
� � out
� � � �� ID )
� 3 � ��� uint32 __ � RsopDeleteSession � �� �� static implemented � ae442007200009F ROOT\RSOP ���� � �� �� * � ����� � __PARAMETERS abstract namespace string
� 5 in
� 5 \ �� ID )
� � \ ��� string __ �� ae442007200009F ROOT\RSOP ���� � �� �� * � ����� � __PARAMETERS abstract hResult uint32
� 3 out
� 3 Z �� ID )
� � Z ��� uint32 __ � ���C� )
$ X _ � � � � L V � � � � �
< E E����� y w �������� ����������{ � RSOP_Session Locale creationTime e
� N � �� datetime flags
� � � �� uint32 id '
� � � �� � �� string SecurityGroups
� � �� string Site
� D � �� string slowLink $
� � � �� boolean SOM
� � � �� string targetName
� � � �� string ttlMinutes
� 4 � �� uint32 version
� o � �� uint32 � ���C�U
N X � � � � : D v | Q�� �������� � � RSOP_SOM Locale blocked
� E � �� boolean blocking
� � � �� boolean id '
� � � �� � �� string reason 4
� � �� ( � �� uint32 ValueMap 4 7 1 2 SOMOrder
� n � �� uint32 type )
� � � � � �� uint32 ValueMap � � � � 1 2 3 4 � ���C�D
# + 2 o ~ � � ������������� � RSOP_IEAdministrativeTemplateFile Locale GPOID '
� g � �� � �� string lastWriteTime e
� � � �� datetime name '
� � � �� � �� string Ad �
E v e n t T r a c e �sR|�C�� EventTrace ) < ��G O � CscApi Description Microsoft-Windows-OfflineFiles-CscApi AMENDMENT LOCALE � �"p � ��Ÿ$ p f\ � 6 ސ\-� � �al0� F ��y�� � F D 1 C 1 D 4 1 4 B 7 1 B 5 0 8 2 C 2 6 6 A 6 5 0 E 3 1 E F 6 D 5 0 1 9 3 8 2 7 2 4 2 4 4 B 6 8 5 F 2 1 7 C 0 A A E 0 0 A 9 2 1 >͝��C�Cȝ��C�$ � __SystemSecurity 4 1 C 5 3 E 6 D B 1 A C F 2 4 5 3 C E F D 4 1 3 9 8 1 9 8 E 6 1 3 F 1 0 D F F 4 7 7 0 9 E C A B 1 D 7 F 0 3 7 7 5 6 A C 8 C E 7 @͝��C�ȝ��C�� � � __thisNAMESPACE � �� � � ? _ _ E v e n t C o n s u m e r A͝��C� $ __EventConsumer g r � � � � & oE��������� �������������� ��� � LogFileEventConsumer Filename '
� U ] �� � �� string Not_Null IsUnicode
� � � �� boolean MaximumFileSize
� � � �� uint64 Name
� � �� string Text 2
� f n ��x �� � �� string Not_Null Template �6 4 6 5 9 A B 9 F 8 F 1 C 4 B 5 6 8 D B 6 4 3 8 B A E 1 1 B 2 6 E E 8 F 9 3 C B 5 F 8 1 9 5 E 2 1 E 8 C 3 8 3 D 6 C 4 4 C C 4 1 �sR|�C�ȝ��C�2
� __NAMESPACE subscription _ _ E v e n t C o n s u m e r ;͝��C� c __EventConsumer ) ' � ��� � � / A � � � 4 A N G W � � q � ' � � v | � � � �
�
�
B O �
n { �
�
�
� � * 1 oUUUUU��������� ��������������������������������������������������������������������������������� � CommandLineEventConsumer Description Executes command in response to an event, see the Win32 SDK documentation for CreateProcess for more complete description of properties. AMENDMENT LOCALE CommandLineTemplate
�
string Description Command line string CreateNewConsole
� m v � boolean Description The new process has a new console. Note: This property has been Deprecated in Windows XP and is no longer used. CreateNewProcessGroup
� 7 @ M boolean Description The new process is the root process of a new process group. CreateSeparateWowVdm
� � � � boolean Description The new process runs in a private Virtual DOS Machine (VDM). CreateSharedWowVdm
� ` i v boolean Description If the DefaultSeparateVDM switch in the Windows section of WIN.INI is TRUE, this flag causes the CreateProcess function to override the switch and run the new process in the shared Virtual DOS Machine. DesktopName
*
� z � � string Description Either the name of the desktop only or the name of both the desktop and window station for this process. Note: This property has been Deprecated in Windows XP and is no longer used. ExecutablePath
� � � � string Description Name of executable module FillAttribute J
� � � uint32 Description Specifies the initial text and background colors if a new console window is created in a console application ForceOffFeedback T
� � � � boolean Description Indicates that the feedback cursor is forced off while the process is starting. ForceOnFeedback R
� S \ i boolean Description Indicates that the cursor is in feedback mode for two seconds after CreateProcess is called. KillTimeout X
� uint32 description Number of seconds that child process is allowed to run; if zero, process will not be terminated Name )
� � � ��� � string Description A unique identifier for this instance Priority "
� % - : sint32 Description Used to determine the scheduling priorities of the process's threads RunInteractively V
� � � � boolean Description Indicates that the process has access to the desktop. ShowWindowCommand N
� K
S
`
uint32 Description The ShowWindowCommand can be any of the SW_ constants defined in WINUSER.H. UseDefaultErrorMode
� �
�
boolean Description New process inherits the error mode of the calling process. WindowTitle .
� { � � string Description For console processes, this is the title displayed in the title bar if a new console window is created WorkingDirectory &
� 6 > K string Description Default directory used by process XCoordinate 2
� � � � uint32 Description Specifies the x coordinate of the upper left corner of a window XNumCharacters B
� 9
A
N
uint32 Description For a console process, specifies the width of the window in characters XSize :
� �
�
�
uint32 Description Specifies the width of the window YCoordinate 6
� : B O uint32 Description Specifies the y coordinate of the upper left corner of a window YNumCharacters F
� � � � uint32 Description For a console process, specifies the height of the window in characters YSize >
� ] e r uint32 Description Specifies the height of the window � _ _ E v e n t C o n s u m e r <͝��C�� 6 __EventConsumer ) & � ���
� � # , � k � � � l � � � � � 1 = � � oUU���������� ��������������������������������������� � NTEventLogEventConsumer description Logs events into NT event log, see Win32 SDK documentation for more complete descriptions AMENDMENT LOCALE Category
� � � � uint16 Description Specifies the event category. This is source-specific information. EventID
� X ` m uint32 Description The event identifier specifies the message that goes with this event as an entry in the message file associated with the event source. EventType
� , 4 A uint32 Description Specifies the type of event being logged InsertionStringTemplates
&
� � � � string Description Strings to be inserted into the event text. Name )
� 0 � ��8 E string Description A unique identifier for this instance NameOfRawDataProperty *
� � � � string Description The NameOfRawDataProperty property is the name of the property in the event which contains a UserSID in string or array of bytes format. This will become the lpUserSid param in the ReportEvent API function. NameOfUserSIDProperty .
� � � � string Description The NameOfUserSIDProperty is the name of a property in the event which contains an array of bytes, or a string. This will become the lpRawData param in ReportEvent API function. NumberOfInsertionStrings "
� � � � uint32 Description Number of strings to be inserted into the event text. SourceName
� i q ~ string Description The source name must be a subkey of a logfile entry under the EventLog key in the registry. UNCServerName
� + string Description Universal Naming Convention (UNC) name of the server on which this operation is to be performed. If NULL, the operation is performed on the local computer. �� ̀��@ p ��7�� � 3��x6 � :>�| � �J� �G'�
� ٜ �� c ]�6�� � o�N� ��� � �I��� o F�?$ < ���` ��Y�~ | &`2�� f ���` L �u�� �+�%� � ���W J 4 1 C 5 3 E 6 D B 1 A C F 2 4 5 3 C E F D 4 1 3 9 8 1 9 8 E 6 1 3 F 1 0 D F F 4 7 7 0 9 E C A B 1 D 7 F 0 3 7 7 5 6 A C 8 C E 7 �Ν��C�ȝ��C�� � � __thisNAMESPACE � �� � � ? �Ν��C�n
����D � Uint8Array value
� = � �� uint8 � ���C�� L S ��������� � DN_With_String dnString
� D � �� string value
� } � �� string � ���C�� L S ��������� � DN_With_Binary dnString
� D � �� string value
� } � �� uint8 � ���C�� I ' �� � �� � ; W � � � � O ^ � � � � * \ u � � � � , ? q � � � � G ] � � UUUU���������������������������������������������������������������������� � RootDSE singleton Microsoft|DSLDAPInstanceProvider|V1.0 configurationNamingContext
� � � �� string currentTime
� � � �� string defaultNamingContext
� � �� string dnsHostName
(
� G � �� string dsServiceName ,
� � � �� string highestCommittedUSN 0
� � � �� string LDAPServiceName
4
� � �� string namingContexts
� T � �� string rootDomainNamingContext
� � � �� string schemaNamingContext
� � � �� string serverName
� $ � �� string subschemaSubentry
� i � �� string supportedCapabilities 8
� � � �� string supportedControl
� � � �� string supportedLDAPPolicies <
� ? � �� string supportedLDAPVersion $
� � � �� string supportedSASLMechanisms @
� � � �� string � ���C�� �� ( ����e � DS_LDAP_Root_Class Abstract ADSIPath '
� ] � �� � �� string �5 7 E 5 F 3 A D D 9 E 2 4 2 C 4 E 9 F 9 E D F 7 9 A A 9 7 F 7 9 E 7 9 1 1 C 5 A 8 B 9 0 2 E C 1 5 0 D 6 4 4 2 E 3 B 8 5 A 5 A A �Ν��C�ȝ��C�� �?����M �� 9 q � __Win32Provider {1EF94880-01A8-11d2-A90B-00AA00BF3363} NetworkServiceHost Microsoft|DSLDAPClassProvider|V1.0 D 8 9 0 A C 6 A 9 2 9 0 4 0 B 8 6 C 7 3 E D 7 0 7 F 7 1 F 3 B F 5 A 8 D 5 C 2 4 B 8 6 2 A B C F D 8 1 2 E 1 9 3 7 C 8 F B 0 B B �Ν��C�
ȝ��C�E �� �� �� p � � � __ClassProviderRegistration \\.\root\directory\LDAP:__Win32Provider.Name="Microsoft|DSLDAPClassProvider|V1.0" x Select * From meta_class Where __this isa "DS_LDAP_Root_Class" � Select * From meta_class Where __Class = "DS_LDAP_Root_Class" R O O T \ d i r e c t o r y \ L D A P _ _ C l a s s P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ E 0 0 9 0 7 4 6 5 8 6 F F 2 B 5 3 E 6 0 0 9 0 5 7 2 D 8 F 4 5 4 B 1 E F C E 8 4 D 6 4 7 0 F D D C 5 7 2 C 5 F 5 2 3 A 1 1 0 E F \ K I _ D 8 9 0 A C 6 A 9 2 9 0 4 0 B 8 6 C 7 3 E D 7 0 7 F 7 1 F 3 B F 5 A 8 D 5 C 2 4 B 8 6 2 A B C F D 8 1 2 E 1 9 3 7 C 8 F B 0 B B \ I _ 0 2 B 7 3 9 C 3 E D A E F 0 D 3 0 B F 4 3 5 D D E 3 3 9 8 C B 6 A 0 2 5 C 2 8 1 0 B B 0 F 2 F F 2 E 6 0 F B 5 8 D C E B 2 C 3 6 � �Ν��C�� 2 �� � ��( �� � 6 f r � � e��������Y � DS_LDAP_Class_Containment Association HasClassRefs Microsoft|DSLDAPClassAssociationsProvider|V1.0 ChildClass f 4
� � � �� � ��� � ref classref � DS_LDAP_Root_Class ParentClass f 4
� . � �� � ��3 = ref classref E DS_LDAP_Root_Class �5 7 E 5 F 3 A D D 9 E 2 4 2 C 4 E 9 F 9 E D F 7 9 A A 9 7 F 7 9 E 7 9 1 1 C 5 A 8 B 9 0 2 E C 1 5 0 D 6 4 4 2 E 3 B 8 5 A 5 A A �Ν��C�ȝ��C�� �?����M 9 } � __Win32Provider {33831ED4-42B8-11d2-93AD-00805F853771} NetworkServiceHost Microsoft|DSLDAPClassAssociationsProvider|V1.0 E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C �Ν��C� ȝ��C�� � �� �� � __InstanceProviderRegistration \\.\root\directory\LDAP:__Win32Provider.Name="Microsoft|DSLDAPClassAssociationsProvider|V1.0" R O O T \ d i r e c t o r y \ L D A P _ _ I n s t a n c e P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ E 0 0 9 0 7 4 6 5 8 6 F F 2 B 5 3 E 6 0 0 9 0 5 7 2 D 8 F 4 5 4 B 1 E F C E 8 4 D 6 4 7 0 F D D C 5 7 2 C 5 F 5 2 3 A 1 1 0 E F \ K I _ E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C \ I _ D D 1 6 9 C B A 4 B F 6 7 1 5 0 0 7 3 3 1 A C A 2 1 1 A C A 8 1 3 A 2 3 1 B 9 3 3 D C C 0 D 2 F 4 7 B 4 2 7 0 F 9 5 E B C 8 8 2 �Ν��C�d ' �� � �� � + R a � � U�������� � DS_LDAP_Instance_Containment Association Microsoft|DSLDAPInstanceProvider|V1.0 ChildInstance f '
� � � �� � �� ref:DS_LDAP_Root_Class ParentInstance f '
� � � �� � �� ref:DS_LDAP_Root_Class dI �5 7 E 5 F 3 A D D 9 E 2 4 2 C 4 E 9 F 9 E D F 7 9 A A 9 7 F 7 9 E 7 9 1 1 C 5 A 8 B 9 0 2 E C 1 5 0 D 6 4 4 2 E 3 B 8 5 A 5 A A �Ν��C�ȝ��C�� �?����M �� 9 t � __Win32Provider {AA527A40-4D9A-11d2-93AD-00805F853771} NetworkServiceHost Microsoft|DSLDAPInstanceProvider|V1.0 E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C �Ν��C� ȝ��C�� � ��������v � � __InstanceProviderRegistration \\.\root\directory\LDAP:__Win32Provider.Name="Microsoft|DSLDAPInstanceProvider|V1.0" ~ WQL:UnarySelect R O O T \ d i r e c t o r y \ L D A P _ _ I n s t a n c e P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ E 0 0 9 0 7 4 6 5 8 6 F F 2 B 5 3 E 6 0 0 9 0 5 7 2 D 8 F 4 5 4 B 1 E F C E 8 4 D 6 4 7 0 F D D C 5 7 2 C 5 F 5 2 3 A 1 1 0 E F \ K I _ E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C \ I _ 8 F 5 9 4 8 3 D 4 2 8 B 0 8 A E 2 A 1 7 7 F A F 7 7 6 7 5 A 7 7 C 8 5 F 8 8 D E 7 C 8 B 3 E B 6 E B F 4 9 A D E 5 8 E 2 4 1 B D �Ν��C�u
����K � DN_Class DN '
� C � �� � �� string � ���C�2 �� $ - � � %��������� � DSClass_To_DNInstance Association DSClass 4
� o � �� � ��w � string classref DS_LDAP_Root_Class RootDNForSearchAndQuery f '
� � � �� � �� ref:DN_Class _D � ��f8� � ���
T u��� )`�� ] OĽ�a � �T��X W ��F�� � z��&� 5 LiTg� o a̝9 � �Н��C�� � ! 0 ) : a x � � � � = G n ~ � � � � / V e � � � � � + C j t � � � � < D k � � � � % 0 W e � � � � ? Q x � � � � � ? M s � � � � � J Z � � � � � � , S c � � � � � � &
3
UUUUUUUUUUUU������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������Z
� RSOP_IEConnectionDialUpSettings Locale alternateOffset
� Y uint32 alternatePhoneNumbers
� � string areaCode
� � string autoDialDll
� � string autoDialFunction
� 5 string channels
� f uint32 connectionName
� � � �� string countryCode $
� � uint32 countryID
(
� uint32 customAuthenticationKey ,
� N uint32 customDialDll 0
� � string deviceName
4
� � string deviceType 8
� � string dialExtraPercent <
� # uint32 dialExtraSampleSeconds @
� b uint32 dialMode D
� � uint32 encryptionType H
� � uint32 frameSize L
� � uint32 framingProtocol P
� 4 uint32 guidID T
� c string hangUpExtraPercent X
� � uint32 hangUpExtraSampleSeconds \
� � uint32 idleDisconnectSeconds `
� uint32 ipAddress d
� O string ipDNSAddress h
� � string ipDNSAddressAlternate l
� � string ipWINSAddress p
� � string ipWINSAddressAlternate t
� 7 string localPhoneNumber x
� p string netProtocols |
� � uint32 options �
� � uint32 options2 ! �
� uint32 options3 " �
� 7 uint32 rasEntryData # �
� l uint8 rasEntryDataSize $ �
� � uint32 reserved1 % �
� � uint32 reserved2 & �
� uint32 rsopID
� B � �� string rsopPrecedence
� � � �� uint32 scriptFile ' �
� � string subEntries ( �
� � uint32 type ) �
� uint32 vpnStrategy * �
� K sint32 windowsVersion + �
� � uint32 x25Address , �
� � string x25Facilities - �
� � string x25PadType . �
�
string x25UserData / �
� R
string � ���C�< % - �� : J � � 5��������� � RSOP_IEConnectionDialUpSettingsLink Locale Association dialUpSettings f
� t � �� ref:RSOP_IEConnectionDialUpSettings policySetting f
� � � �� ref:RSOP_IEAKPolicySetting
� ���C� < $ , 8 _ o � � � � 9 C j w � � � � O _ � � � � � UUU���������������������������������������������������������* � RSOP_IEConnectionDialUpCredentials Locale callbackID
� W uint32 callbackNumber
� � string connectionName
� � � �� string domain
� � string entryName
� 1 string password
� b string phoneNumber
� � string rasDialParamsData $
� � uint8 rasDialParamsDataSize
(
�
uint32 rsopID
� G � �� string rsopPrecedence
� � � �� sint32 subEntry ,
� � uint32 userName 0
� � string windowsVersion
4
� " uint32 � ���C�E ( 0 �� = P � � 5��������� � RSOP_IEConnectionDialUpCredentialsLink Locale Association dialUpCredentials f
� z � �� ref:RSOP_IEConnectionDialUpCredentials policySetting f
� � � �� ref:RSOP_IEAKPolicySetting
� ���C�� " * : l � � � � 5 E U���������������������w � RSOP_IEConnectionWinINetSettings Locale connectionName
� d � �� string internetPerConnOptionListData
� � uint8 internetPerConnOptionListDataSize
� � uint32 rsopID
� - � �� string rsopPrecedence
� o � �� sint32 � ���C�? & . �� ; J � � 5��������� � RSOP_IEConnectionWinINetSettingsLink Locale Association policySetting f
� t � �� ref:RSOP_IEAKPolicySetting winINetSettings f
� � � �� ref:RSOP_IEConnectionWinINetSettings � ���C�� 6
% 3 Z p � � � � � - 7 ^ t � � � � & X a � � � � UUU��������������������������������������������������� � RSOP_IESecurityZoneSettings Locale actionValues .
� R string currentTemplateLevel "
� � uint32 description
� � string displayName
� � string flags
&
� % uint32 iconPath
� V string minimumTemplateLevel
� � uint32 recommendedTemplateLevel
� � uint32 rsopID
� � �� string rsopPrecedence
� P � �� sint32 useHKLM
� � � �� boolean zoneIndex
� � � �� uint32 zoneMappings *
� � string � R S O P _ I E S e c u r i t y Z o n e S e t t i n g s ���C�� 8 % RSOP_IESecurityZoneSettings ( 4 ��������������������������������������������������������\ � RSOP_IEESCSecurityZoneSettings Locale EscEnabled
2
� S boolean � ���C�W 7 ^ y � � � � 3 Z u � � U��������������������������� � RSOP_IEPrivacySettings Locale firstPartyPrivacyType
� V uint32 firstPartyPrivacyTypeText
� � string rsopID
� � � �� string rsopPrecedence
� � �� sint32 thirdPartyPrivacyType
� R uint32 thirdPartyPrivacyTypeText
� � string useAdvancedSettings
� � boolean �F D 1 C 1 D 4 1 4 B 7 1 B 5 0 8 2 C 2 6 6 A 6 5 0 E 3 1 E F 6 D 5 0 1 9 3 8 2 7 2 4 2 4 4 B 6 8 5 F 2 1 7 C 0 A A E 0 0 A 9 2 1 uR|�C�Cȝ��C�$ � __SystemSecurity �v� � �ޕz � �1Ÿ p uØ( � �T�7� � a~� � XK�^�
5 �Y�� � k �� � #�zYa � � �� E ���|& Et�2 �r�> � ��;2 $�#�: � W i n 3 2 _ S e s s i o n R e s o u r c e Xʝ��C�� Win32_SessionResource 6 � �� � ( . T ` � � U��������/ � Win32_SessionProcess CIMWin32 Locale UUID 9CD8E1CE-0D27-4a41-AADE-F8D200230FF4 Antecedent f@ )
� � � � � �� ref:Win32_LogonSession Override Antecedent Dependent f@ )
� $ � �� ref:Win32_Process Override Dependent en �F D 1 C 1 D 4 1 4 B 7 1 B 5 0 8 2 C 2 6 6 A 6 5 0 E 3 1 E F 6 D 5 0 1 9 3 8 2 7 2 4 2 4 4 B 6 8 5 F 2 1 7 C 0 A A E 0 0 A 9 2 1 Zʝ��C�Cȝ��C�$ � __SystemSecurity 4 1 C 5 3 E 6 D B 1 A C F 2 4 5 3 C E F D 4 1 3 9 8 1 9 8 E 6 1 3 F 1 0 D F F 4 7 7 0 9 E C A B 1 D 7 F 0 3 7 7 5 6 A C 8 C E 7 \ʝ��C�ȝ��C�� � � __thisNAMESPACE � �� � � ?
C I M _ A c t i o n 1��C�� 4 CIM_Action C $ � �� � L U e | � � � �� ) 3 e k ��W�������������������������������������������������� � Win32_RegistryAction Locale UUID {A3864E0E-DB33-11d2-85FC-0000F8102E5F} MSIProv MappingStrings m Microsoft.MSI EntryName
"
� � � �� string EntryValue &
� � � �� string
,
� ! � �� string Registry
� ] � �� string Root * )
� � � � � �� sint16 ValueMap �������� �F D 1 C 1 D 4 1 4 B 7 1 B 5 0 8 2 C 2 6 6 A 6 5 0 E 3 1 E F 6 D 5 0 1 9 3 8 2 7 2 4 2 4 4 B 6 8 5 F 2 1 7 C 0 A A E 0 0 A 9 2 1 �؝��C�Cȝ��C�C ��& � __SystemSecurity RequiresEncryption C I M _ C o n t r o l l e r �tR|�C�� A CIM_Controller ) # Y ��d l z ����������������������������������������������������������������� � CIM_PCMCIAController Description Capabilities and management of a PCMCIA controller. AMENDMENT LOCALE Manufacturer 8
� � � � string Description The Manufacturer property indicates the name of the PCMCIA controller manufacturer.
Example: Acme � C I M _ S y s t e m R e s o u r c e �tR|�C�� CIM_SystemResource ) N ��Y a o H [ � � A I � � E P � � ' UU������������������������E � CIM_IRQ Description The CIM_IRQ class represents an Intel architecture IRQ AMENDMENT LOCALE Availability +
� � � � � � uint16 Description Availability of the IRQ. Values � � ( Other Unknown Available In Use/Not Available In Use and Available/Shareable CreationClassName
� � � � string Description CreationClassName indicates the name of the class or the subclass used in the creation of an instance. When used with the other key properties of this class, this property allows all instances of this class and its subclasses to be uniquely identified. CSCreationClassName
� � � � string Description CSCreationClassName contains the scoping computer system's creation class name. CSName
� u } � string Description CSName contains the scoping computer system's name. IRQNumber )
� � �� uint32 Description A part of the object's key value, IRQ Number. Shareable
� | � � boolean Description Boolean indicating whether the IRQ can be shared. TriggerLevel +
� ! � � uint16 Description IRQ trigger level indicating whether the interrupt is triggered by the hardware signal going high (value=4) or low (value=3). Also, "Other" (1) and "Unknown" (2) may be defined. Values � �
Other Unknown Active Low Active High TriggerType +
� ` h u uint16 Description IRQ trigger type indicating whether edge (value=4) or level triggered (value=3) interrupts occur. Also, "Other" (1) and "Unknown" (2) may be defined. Values ( / 8 ? Other Unknown Level Edge � C I M _ L o g i c a l E l e m e n t �tR|�C�~ CIM_LogicalElement ) ! �� $ � CIM_SystemResource Description The CIM_SystemResource class is an entity managed by BIOS and/or an operating system which is available for use by software and/or logical devices. Examples of Resources in the x86 environment are IRQs, DMA channels and memory mapped I/O. AMENDMENT LOCALE � C I M _ M a n a g e d S y s t e m E l e m e n t uR|�C�z " CIM_ManagedSystemElement �� ' � CIM_LogicalElement AMENDMENT LOCALE � juR|�C�h ) ' { ��� � � Q ` ���������
� RSOP_IEToolbarButtonLink Description An association between an IEAK policy setting and a custom browser toolbar button. AMENDMENT LOCALE policySetting f 6
� � � ���
4 A ref:RSOP_IEAKPolicySetting Description Reference to the RSOP_IEAKPolicySetting. DisplayName Policy Setting toolbarButton f 6
� � � ��� � � � ref:RSOP_IEToolbarButton Description Reference to the IE toolbar button. DisplayName Toolbar Button t �5 7 E 5 F 3 A D D 9 E 2 4 2 C 4 E 9 F 9 E D F 7 9 A A 9 7 F 7 9 E 7 9 1 1 C 5 A 8 B 9 0 2 E C 1 5 0 D 6 4 4 2 E 3 B 8 5 A 5 A A Ԡn�^��ȝ��C�� �?����J �� 9 S � __Win32Provider {BE0A9830-2B8B-11d1-A949-0060181EBBAD} LocalSystemHost MSIProv E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C ՠn�^�� ȝ��C�| � �������� O � __InstanceProviderRegistration \\.\root\cimv2:__Win32Provider.Name="MSIProv"
R O O T \ c i m v 2 _ _ I n s t a n c e P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 6 8 5 7 7 3 7 2 C 6 6 A 7 B 2 0 6 5 8 4 8 7 F B D 9 5 9 A A 1 5 4 E F 5 4 B 5 F 9 3 5 D C C 5 6 6 3 E 9 2 2 8 B 4 4 3 2 2 8 0 5 \ K I _ E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C \ I _ 0 B 5 A C 8 3 F B 2 7 2 5 D 3 3 B 4 1 C F F 3 B 5 1 E F 3 3 4 6 7 B 9 6 0 F D 4 E 7 B 5 4 F 0 5 5 E D 5 8 0 C 6 4 C 0 8 6 2 7 0 7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D ֠n�^��
ȝ��C�d M � __MethodProviderRegistration \\.\root\cimv2:__Win32Provider.Name="MSIProv"
R O O T \ c i m v 2 _ _ M e t h o d P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 6 8 5 7 7 3 7 2 C 6 6 A 7 B 2 0 6 5 8 4 8 7 F B D 9 5 9 A A 1 5 4 E F 5 4 B 5 F 9 3 5 D C C 5 6 6 3 E 9 2 2 8 B 4 4 3 2 2 8 0 5 \ K I _ 7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D \ I _ 0 B 5 A C 8 3 F B 2 7 2 5 D 3 3 B 4 1 C F F 3 B 5 1 E F 3 3 4 6 7 B 9 6 0 F D 4 E 7 B 5 4 F 0 5 5 E D 5 8 0 C 6 4 C 0 8 6 2 7 0 6 4 6 5 9 A B 9 F 8 F 1 C 4 B 5 6 8 D B 6 4 3 8 B A E 1 1 B 2 6 E E 8 F 9 3 C B 5 F 8 1 9 5 E 2 1 E 8 C 3 8 3 D 6 C 4 4 C C 4 1 נn�^��ȝ��C�,
� __NAMESPACE ms_409 ��f8� F]� J X��� �m*�� ��� � ���q � c�m � L]�k
= #�/� S ]�� * �h n% � 6�+ F � �Sq � ok�e � m ly Û�� J �fG�� � ���s� y� � p (�εI � �]� � ��� * R O O T \ D e f a u l t _ _ I n s t a n c e P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 8 9 2 F 8 D B 6 9 C 4 E D F B C 6 8 1 6 5 C 9 1 0 8 7 B 7 A 0 8 3 2 3 F 6 C E 5 B 5 E F 3 4 2 C 0 F 9 3 E 0 2 A 0 5 9 0 B F C 4 \ K I _ E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C \ I _ 5 9 B F A F E B F 6 0 E 8 B 2 1 0 4 B 0 7 B A 7 F A D A F 4 F C F E B 1 8 9 9 9 F E 9 2 B 1 1 F 1 C 0 0 E 9 3 8 C B 4 B 9 3 A 6 s 5 7 E 5 F 3 A D D 9 E 2 4 2 C 4 E 9 F 9 E D F 7 9 A A 9 7 F 7 9 E 7 9 1 1 C 5 A 8 B 9 0 2 E C 1 5 0 D 6 4 4 2 E 3 B 8 5 A 5 A A �Ν��C�ȝ��C�� �?����K �� 9 X � __Win32Provider {72967901-68EC-11d0-B729-00AA0062CBB7} LocalServiceHost RegPropProv A 5 1 3 4 E A E 6 5 D 9 D D 0 2 F 6 C E 0 E 9 2 4 C 8 4 D 3 8 7 C 2 B C 7 6 C 9 4 0 9 B 3 E 6 C 9 F 5 8 6 6 1 9 D 3 5 E A 1 D A �Ν��C� ȝ��C�p ���� U � __PropertyProviderRegistration \\.\Root\Default:__Win32Provider.Name="RegPropProv" R O O T \ D e f a u l t _ _ P r o p e r t y P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 8 9 2 F 8 D B 6 9 C 4 E D F B C 6 8 1 6 5 C 9 1 0 8 7 B 7 A 0 8 3 2 3 F 6 C E 5 B 5 E F 3 4 2 C 0 F 9 3 E 0 2 A 0 5 9 0 B F C 4 \ K I _ A 5 1 3 4 E A E 6 5 D 9 D D 0 2 F 6 C E 0 E 9 2 4 C 8 4 D 3 8 7 C 2 B C 7 6 C 9 4 0 9 B 3 E 6 C 9 F 5 8 6 6 1 9 D 3 5 E A 1 D A \ I _ 2 B 4 2 5 B F 8 C E 8 7 3 2 B E B 1 8 2 F 0 B C 7 2 8 E 9 2 8 F F B 0 4 9 8 D F 8 A 9 F B A C A 0 C 5 1 4 5 1 8 9 6 1 A 5 4 6 0 _ _ E x t r i n s i c E v e n t �Ν��C�O
__ExtrinsicEvent ������������ � RegistryEvent �
R e g i s t r y E v e n t ���C�� RegistryEvent E N _��������������������u � RegistryKeyChangeEvent Hive
� = string KeyPath
� m string �
R e g i s t r y E v e n t ���C�� RegistryEvent F P _��������������������w � RegistryTreeChangeEvent Hive
� > string RootPath
� o string �
R e g i s t r y E v e n t ���C� RegistryEvent G P w � _�������������������������� � RegistryValueChangeEvent Hive
� ? string KeyPath
� o string ValueName
� � string �5 7 E 5 F 3 A D D 9 E 2 4 2 C 4 E 9 F 9 E D F 7 9 A A 9 7 F 7 9 E 7 9 1 1 C 5 A 8 B 9 0 2 E C 1 5 0 D 6 4 4 2 E 3 B 8 5 A 5 A A �Ν��C�ȝ��C�� ���J 9 a � __Win32Provider {fa77a74e-e109-11d0-ad6e-00c04fd8fdff} LocalSystemHost RegistryEventProvider 0 8 9 9 3 0 7 4 0 8 A 3 2 0 4 0 A 6 D A 1 9 C 0 B 1 E C 2 7 4 5 A 3 D 6 0 4 B A A 9 D F F E 8 E E 4 B 7 5 C 3 D 9 1 E 1 6 1 0 9 �Ν��C�ȝ��C�� B � __EventProviderRegistration % select * from RegistryEvent \\.\Root\cimv2:__Win32Provider.Name="RegistryEventProvider"
R O O T \ c i m v 2 _ _ E v e n t P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 6 8 5 7 7 3 7 2 C 6 6 A 7 B 2 0 6 5 8 4 8 7 F B D 9 5 9 A A 1 5 4 E F 5 4 B 5 F 9 3 5 D C C 5 6 6 3 E 9 2 2 8 B 4 4 3 2 2 8 0 5 \ K I _ 0 8 9 9 3 0 7 4 0 8 A 3 2 0 4 0 A 6 D A 1 9 C 0 B 1 E C 2 7 4 5 A 3 D 6 0 4 B A A 9 D F F E 8 E E 4 B 7 5 C 3 D 9 1 E 1 6 1 0 9 \ I _ E C 3 B 8 F D 7 1 7 A 7 3 8 4 2 5 E 0 1 5 9 2 6 8 8 8 3 F 2 0 6 D 4 8 9 A 3 D 7 2 0 1 9 8 C 6 9 7 1 8 F 0 1 A F 4 B 1 2 0 2 9 5 5 7 E 5 F 3 A D D 9 E 2 4 2 C 4 E 9 F 9 E D F 7 9 A A 9 7 F 7 9 E 7 9 1 1 C 5 A 8 B 9 0 2 E C 1 5 0 D 6 4 4 2 E 3 B 8 5 A 5 A A �Ν��C�ȝ��C�� �����K 9 T � __Win32Provider {fe9af5c0-d3b6-11ce-a5b6-00aa00680c3f} LocalServiceHost RegProv 7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D �Ν��C�
ȝ��C�d M � __MethodProviderRegistration \\.\Root\cimv2:__Win32Provider.Name="RegProv"
R O O T \ c i m v 2 _ _ M e t h o d P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 6 8 5 7 7 3 7 2 C 6 6 A 7 B 2 0 6 5 8 4 8 7 F B D 9 5 9 A A 1 5 4 E F 5 4 B 5 F 9 3 5 D C C 5 6 6 3 E 9 2 2 8 B 4 4 3 2 2 8 0 5 \ K I _ 7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D \ I _ 6 9 5 2 B C 8 C 6 1 8 7 4 1 2 B A 6 F 7 C A E E 5 6 3 2 8 B 9 D C A 8 A F F 6 1 5 B 1 8 B F 7 1 3 5 E B 8 A 9 1 F 5 1 7 2 9 F 6 E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C �Ν��C� ȝ��C�| � ���� �� O � __InstanceProviderRegistration \\.\Root\cimv2:__Win32Provider.Name="RegProv"
R O O T \ c i m v 2 _ _ I n s t a n c e P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 6 8 5 7 7 3 7 2 C 6 6 A 7 B 2 0 6 5 8 4 8 7 F B D 9 5 9 A A 1 5 4 E F 5 4 B 5 F 9 3 5 D C C 5 6 6 3 E 9 2 2 8 B 4 4 3 2 2 8 0 5 \ K I _ E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C \ I _ 6 9 5 2 B C 8 C 6 1 8 7 4 1 2 B A 6 F 7 C A E E 5 6 3 2 8 B 9 D C A 8 A F F 6 1 5 B 1 8 B F 7 1 3 5 E B 8 A 9 1 F 5 1 7 2 9 F 6 5 7 E 5 F 3 A D D 9 E 2 4 2 C 4 E 9 F 9 E D F 7 9 A A 9 7 F 7 9 E 7 9 1 1 C 5 A 8 B 9 0 2 E C 1 5 0 D 6 4 4 2 E 3 B 8 5 A 5 A A �Ν��C�ȝ��C�� �?����K �� 9 X � __Win32Provider {72967901-68EC-11d0-B729-00AA0062CBB7} LocalServiceHost RegPropProv A 5 1 3 4 E A E 6 5 D 9 D D 0 2 F 6 C E 0 E 9 2 4 C 8 4 D 3 8 7 C 2 B C 7 6 C 9 4 0 9 B 3 E 6 C 9 F 5 8 6 6 1 9 D 3 5 E A 1 D A �Ν��C� ȝ��C�n ���� S � __PropertyProviderRegistration \\.\Root\cimv2:__Win32Provider.Name="RegPropProv"
R O O T \ c i m v 2 _ _ P r o p e r t y P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 6 8 5 7 7 3 7 2 C 6 6 A 7 B 2 0 6 5 8 4 8 7 F B D 9 5 9 A A 1 5 4 E F 5 4 B 5 F 9 3 5 D C C 5 6 6 3 E 9 2 2 8 B 4 4 3 2 2 8 0 5 \ K I _ A 5 1 3 4 E A E 6 5 D 9 D D 0 2 F 6 C E 0 E 9 2 4 C 8 4 D 3 8 7 C 2 B C 7 6 C 9 4 0 9 B 3 E 6 C 9 F 5 8 6 6 1 9 D 3 5 E A 1 D A \ I _ A 4 F 6 4 0 E A 0 1 E 8 E 0 9 7 5 B A 8 B C 8 7 6 E C 6 4 4 C A B 5 7 0 7 4 4 2 F A 9 C A 6 E 8 B 0 C C D D F 9 D B F 7 2 4 D 5 4 1 C 5 3 E 6 D B 1 A C F 2 4 5 3 C E F D 4 1 3 9 8 1 9 8 E 6 1 3 F 1 0 D F F 4 7 7 0 9 E C A B 1 D 7 F 0 3 7 7 5 6 A C 8 C E 7 �Ν��C�ȝ��C�� � � __thisNAMESPACE � �� � � ? 6 4 6 5 9 A B 9 F 8 F 1 C 4 B 5 6 8 D B 6 4 3 8 B A E 1 1 B 2 6 E E 8 F 9 3 C B 5 F 8 1 9 5 E 2 1 E 8 C 3 8 3 D 6 C 4 4 C C 4 1 �Ν��C�ȝ��C�*
� __NAMESPACE LDAP F D 1 C 1 D 4 1 4 B 7 1 B 5 0 8 2 C 2 6 6 A 6 5 0 E 3 1 E F 6 D 5 0 1 9 3 8 2 7 2 4 2 4 4 B 6 8 5 F 2 1 7 C 0 A A E 0 0 A 9 2 1 �Ν��C�Cȝ��C�$ � __SystemSecurity
E v e n t T r a c e ;ҝ��C�� EventTrace 6 � �� $ * R Z d k e����� � NtfsLog Description Ntfs_NtfsLog guid {b2fc00c4-2941-4d11-983b-b16e8aa4e25d} locale MS\0x409 Flags
� � uint32 g � �<[� � �S�� Z �PY�o �s�#r � ��P4< N � @� � �UaA. ? �uR|�C�} / ) % 2 c ��n v � 9 E � � , > U c � z � � � s } � � M V UU��������������������������������������������� � MSiSCSIInitiator_TargetLoginOptions Description Microsoft iSCSI Initiator: Target Login Options AMENDMENT LOCALE AuthType +
� � � � � uint32 Description Flags to indicate login authentication type Values & , No Authentication CHAP Mutual CHAP DataDigest
� q y � uint32 Description Cyclic integrity checksums that can be negotiated for the data digests DefaultTime2Retain
� # uint32 Description The initiator and target negotiate the maximum time, in seconds after an initial wait (Time2Wait), before which an explicit/implicit connection Logout or active task reassignment is still possible after an unexpected connection termination or a connection reset. DefaultTime2Wait
� j r uint32 Description The initiator and target negotiate the minimum time, in seconds, to wait before attempting an explicit/implicit logout or active task reassignment after an unexpected connection termination or a connection reset. HeaderDigest
� � � � uint32 Description Cyclic integrity checksums that can be negotiated for the header digests InformationSpecified
� 0 8 E uint32 Description Bit field indicating which information is specified LoginFlags
� � � � uint32 Description Flags that affect how login occurs MaximumConnections
� + 3 @ uint32 Description Maximum number of connections, 0 implies no limit Password
(
� � � � uint8 Description Password for iSCSI authentication Username $
� * uint8 Description Username for iSCSI authentication Version
� � � � uint32 Description ISCSI Login Options Version � �uR|�C�B ) ( 5 h ��s { � � � : L � � ` l U���������������������� � MSiSCSIInitiator_ConnectionInformation Description Microsoft iSCSI Initiator: Connection Information AMENDMENT LOCALE CID
� � � � uint8 Description Connection ID token ConnectionID
� $ string Description Connection ID string InitiatorAddress
� x � � string Description Initiator Address InitiatorPort
� � � � uint16 Description Initiator Port TargetAddress
� ; C P string Description Target Address TargetPort
� � � � uint16 Description Target Port � �uR|�C�� ) 4 A � ��� � � X ` �� U�������������������������g � MSiSCSIInitiator_IKEPresharedKeyAuthenticationInfo Description Microsoft iSCSI Initiator: IKE Preshared Key Authentication Information AMENDMENT LOCALE AuthMethod
� � � � uint32 Description Authentication Method: Preshared Key Id
� @ G T uint8 Description ID IdType
� � � � uint32 Description IKE Identification Payload Type
� � � uint8 Description Key SecurityFlags
� B J W uint64 Description Security Flags � �uR|�C�� $ ) ' 4 g ��r z � � � O g � � \ f � � 1 = � � UU���������������������������������� � MSiSCSIInitiator_PersistentLoginClass Description Microsoft iSCSI Initiator: Persistent Login Class AMENDMENT LOCALE InitiatorInstance
� � � � string Description Initiator Instance InitiatorPortNumber
� # + 8 uint32 Description Initiator Port Number IsInformationalSession
� � � � boolean Description Indicates whether this is informational session LoginOptions
� @ M object:MSiSCSIInitiator_TargetLoginOptions Description Login Options Mappings
� � � � object:MSiSCSIInitiator_TargetMappings Description Mappings SecurityFlags
� ! uint64 Description Security Flags TargetName )
� t � ��| � string Description Target Name TargetPortal
� � � � object:MSiSCSIInitiator_Portal Description Target Portal � �uR|�C�3 ) " / ] ��h p � q����� � MSiSCSIInitiator_iSNSServerClass Description Microsoft iSCSI Initiator: iSNS Server Class AMENDMENT LOCALE iSNSServerAddress )
� � � ��� � string Description iSNS Server Address g rip e i � � Refresh ' Description Refresh the list of discovered targets from this iSNS server ~ a42c9160500003S ROOT\WMI\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � �uR|�C�� $ ) ( 5 j ��u } � � � V d � � 8 P � � $ { � UU����������������������������������� � MSiSCSIInitiator_SendTargetPortalClass Description Microsoft iSCSI Initiator: Send Target Portal Class AMENDMENT LOCALE InitiatorName
� � � � string Description Initiator Instance or Name InitiatorPortNumber
� * 2 ? uint32 Description Initiator Port Number LoginOptions
� � � � object:MSiSCSIInitiator_TargetLoginOptions Description Login Options PortalAddress
� ( string Description Portal Address PortalIdentifierString )
� � � ��� � string Description Portal Identifier String PortalPort
� � � uint16 Description Portal Port PortalSymbolicName
� P X e string Description Portal Symbolic Name SecurityFlags
� � � � uint64 Description Security Flags m q � � Refresh ' Description Refresh the list of discovered targets from this Send Targets portal ~ a42c9160500003S ROOT\WMI\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � �uR|�C�' ) ! . Z ��e m | m����� � MSiSCSIInitiator_InitiatorClass Description Microsoft iSCSI Initiator: Initiator Class AMENDMENT LOCALE InitiatorName )
� � � ��� � string Description Initiator Name ri � �� < ��� � 5
FΪ
� �[�n� P �i � � Spm � +��� �Im�
��1 � 0ws� f �L5 �
E v e n t T r a c e 2ѝ��C� EventTrace 6 � ��
> D l t ~ � u��������� � ObjectsGuid Description PrintFilterPipelineSvc_ObjectsGuid guid {aefe45f4-8548-42b4-b1c8-25673b07ad8b} locale MS\0x409 Flags R
� � � � � � � t ~ uint32 Description Enable Flags ValueDescriptions C [ o � � � � � � Generic_Exception Flag Generic_Error Flag Generic_Warn Flag PipeMgr_Trace Flag PipeMgr_Reach Flag PipeBuf_Trace Flag PTConv_Trace Flag Framework_Trace Flag Filter_Trace Flag DefineValues 0 C R ` o ~ � � � Generic_Exception Generic_Error Generic_Warn PipeMgr_Trace PipeMgr_Reach PipeBuf_Trace PTConv_Trace Framework_Trace Filter_Trace Values � � ) 8 G U f Generic_Exception Generic_Error Generic_Warn PipeMgr_Trace PipeMgr_Reach PipeBuf_Trace PTConv_Trace Framework_Trace Filter_Trace ValueMap � � � � � � � � 0x00000001 0x00000002 0x00000004 0x00000008 0x00000010 0x00000020 0x00000040 0x00000080 0x00000100 Level _
� � � � � � u � � K U � � uint32 Description Levels ValueDescriptions � �
2 L Abnormal exit or termination Severe errors that need logging Warnings such as allocation failure Includes non-error cases Detailed traces from intermediate steps DefineValues � � � � TRACE_LEVEL_FATAL TRACE_LEVEL_ERROR TRACE_LEVEL_WARNINGTRACE_LEVEL_INFORMATION TRACE_LEVEL_VERBOSE Values % , 5 B Fatal Error Warning Information Verbose ValueMap m r w | � 0x1 0x2 0x3 0x4 0x5 ValueType index uc �
E v e n t T r a c e 3ѝ��C�� EventTrace 6 � �� * K Q y � � � ~ � ���������
� TSClientActiveXControlTrace Description TS Client ActiveX Control Trace guid {DAA6CAF5-6678-43f8-A6FE-B40EE096E06E} locale MS\0x409 Flags R
� � � ( � � � � @ J uint32 Description Enable Flags ValueDescriptions 8 Q l TS_TRACE_LEVEL_NRM Flag TS_TRACE_LEVEL_ERROR Flag TS_TRACE_LEVEL_ASSERT Flag DefineValues � � � TS_TRACE_LEVEL_NRM TS_TRACE_LEVEL_ERROR TS_TRACE_LEVEL_ASSERT Values � ) TS_TRACE_LEVEL_NRM TS_TRACE_LEVEL_ERROR TS_TRACE_LEVEL_ASSERT ValueMap Z f r 0x00000001 0x00000002 0x00000004 Level _
� � � " � � p x � � � uint32 Description Levels ValueDescriptions : X y � � Abnormal exit or termination Severe errors that need logging Warnings such as allocation failure Includes non-error cases Detailed traces from intermediate steps DefineValues - B [ TRACE_LEVEL_FATAL TRACE_LEVEL_ERROR TRACE_LEVEL_WARNING TRACE_LEVEL_INFORMATION TRACE_LEVEL_VERBOSE Values � � � � � Fatal Error Warning Information Verbose ValueMap � � � � � 0x1 0x2 0x3 0x4 0x5 ValueType index �
E v e n t T r a c e 4ѝ��C�� EventTrace 6 � �� - 3 [ c m t m����` � TSClientTrace Description TS Client Trace guid {0C51B20C-F755-48a8-8123-BF6DA2ADC727} locale MS\0x409 Flags R
� � � � �
j x � � " , uint32 Description Enable Flags ValueDescriptions 3 N TS_TRACE_LEVEL_NRM Flag TS_TRACE_LEVEL_ERROR Flag TS_TRACE_LEVEL_ASSERT Flag DefineValues � � � TS_TRACE_LEVEL_NRM TS_TRACE_LEVEL_ERROR TS_TRACE_LEVEL_ASSERT Values � � TS_TRACE_LEVEL_NRM TS_TRACE_LEVEL_ERROR TS_TRACE_LEVEL_ASSERT ValueMap < H T 0x00000001 0x00000002 0x00000004 E �5 7 E 5 F 3 A D D 9 E 2 4 2 C 4 E 9 F 9 E D F 7 9 A A 9 7 F 7 9 E 7 9 1 1 C 5 A 8 B 9 0 2 E C 1 5 0 D 6 4 4 2 E 3 B 8 5 A 5 A A 5ѝ��C�ȝ��C�� �?"���M ��9 ^ � __Win32Provider {72970BEB-81F8-46d4-B220-D743F4E49C95} NetworkServiceHost MSVSS__PROVIDER 7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D 6ѝ��C�
ȝ��C�l U � __MethodProviderRegistration \\.\root\CIMV2:__Win32Provider.Name="MSVSS__PROVIDER"
R O O T \ C I M V 2 _ _ M e t h o d P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 6 8 5 7 7 3 7 2 C 6 6 A 7 B 2 0 6 5 8 4 8 7 F B D 9 5 9 A A 1 5 4 E F 5 4 B 5 F 9 3 5 D C C 5 6 6 3 E 9 2 2 8 B 4 4 3 2 2 8 0 5 \ K I _ 7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D \ I _ A 3 B F B E B E 2 3 4 E 4 6 5 8 C A F 2 F 8 8 1 D 4 1 0 7 E 9 2 5 E E 2 3 B C F F 1 0 D B 1 8 7 E 3 0 D C B C B C 9 3 7 4 0 3 E e c c f E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C 7ѝ��C� ȝ��C�� � �������� W � __InstanceProviderRegistration \\.\root\CIMV2:__Win32Provider.Name="MSVSS__PROVIDER"
R O O T \ C I M V 2 _ _ I n s t a n c e P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 6 8 5 7 7 3 7 2 C 6 6 A 7 B 2 0 6 5 8 4 8 7 F B D 9 5 9 A A 1 5 4 E F 5 4 B 5 F 9 3 5 D C C 5 6 6 3 E 9 2 2 8 B 4 4 3 2 2 8 0 5 \ K I _ E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C \ I _ A 3 B F B E B E 2 3 4 E 4 6 5 8 C A F 2 F 8 8 1 D 4 1 0 7 E 9 2 5 E E 2 3 B C F F 1 0 D B 1 8 7 E 3 0 D C B C B C 9 3 7 4 0 3 E c f 6 C I M _ L o g i c a l E l e m e n t 8ѝ��C�} + CIM_LogicalElement ) � �� � ' / 6 h l � � � � P Y � � W������������������������������������������ � Win32_ShadowProvider MSVSS__PROVIDER Locale CLSID
� ` � �� string ID '
� � � �� � �� string Name @
� � � �� string Type )
� & 0 � �� uint32 Valuemap D G J M 0 1 2 3 Version
� � � �� string VersionID $
� � � �� string � C I M _ S e t t i n g @ѝ��C�8 , CIM_Setting
/ b p � � � � * < o y � � � � 1 > q | � � � � ' 6 UUU����������������������������������������i � Win32_ShadowContext Locale ClientAccessible
� Y � �� boolean Differential
� � � �� boolean ExposedLocally &
� � � �� boolean ExposedRemotely $
� ! � �� boolean HardwareAssisted
� f � �� boolean Imported
"
� � � �� boolean Name '
� � � �� � �� string NoAutoRelease
� ( � �� boolean NotSurfaced
� h � �� boolean NoWriters
� � � �� boolean Persistent
� � � �� boolean Plex
� � �� boolean Transportable
� ` � �� boolean �
E v e n t T r a c e �sR|�C�� EventTrace ) : ��E M � CscUm Description Microsoft-Windows-OfflineFiles-CscUM AMENDMENT LOCALE �L|� @ *M� � ۭ�.� ; �m��� � [5-��
��#;� � � �<� t ��;I? � C I M _ C o n t r o l l e d B y a͝��C� CIM_ControlledBy C � �� � # 0 � � - 9 [ f ��������������������������������f � Win32_PrinterController CIMWin32 Description The Win32_PrinterController class represents an association between a printer and the local device to which the printer is connected. Note that this class only returns instances for local printers. Locale UUID {FAF76B5C-798C-11D2-AAD1-006008C78BC7} Antecedent f@ N
� � � �� � ��� � � � / ? ref:CIM_Controller Override Antecedent Description The CIM_Controller antecedent reference represents the local device associated with this printer. MappingStrings G CIM|CIM_Controller Dependent f@ N
� � � �� � ��� � � � ; K ref:Win32_Printer Override Dependent Description The Win32_Printer dependent reference represents the Win32_Printer MappingStrings S WMI|Win32_Printer � C I M _ D e p e n d e n c y b͝��C�� CIM_Dependency C � �� � " / � � � � � � � U��������� � Win32_PrinterDriverDll CIMWin32 Description The Win32_PrinterDriverDll class represents the association between a local printer and its driver file. Locale UUID {FAF76B5D-798C-11D2-AAD1-006008C78BC7} Antecedent f@ N
� 7 � �� � ��I S _ l � � ref:CIM_DataFile Override Antecedent Description The CIM_DataFile antecedent reference represents the driver file for this Win32 printer. MappingStrings � CIM|CIM_DataFile Dependent f@ N
� W � �� � ��j t � � � ref:Win32_Printer Override Dependent Description The Win32_Printer dependent reference represents the Win32_Printer. MappingStrings � WMI|Win32_Printer aF � C I M _ D e p e n d e n c y c͝��C� CIM_Dependency C � �� � + � � � � � : E U��������~ � Win32_PrinterShare CIMWin32 Description The Win32_PrinterShare class represents an association between a local printer and the share that represents it as it is viewed over a network. Locale UUID {FAF76B5E-798C-11D2-AAD1-006008C78BC7} Antecedent f@ N
� Z � �� � ��m w � � ref:Win32_Printer Override Antecedent Description The Win32_Printer antecedent reference indicates the Win32_Printer representing the local printer shared in this association. MappingStrings ' WMI|Win32_Printer Dependent f@ N
� � � �� � ��� � � � U e ref:Win32_Share Override Dependent Description The Win32_Share dependent referenceindicates the Win32_Share representing the network share of the printer in this association. MappingStrings m WMI|Win32_Share i � W i n 3 2 _ D e v i c e S e t t i n g s f͝��C�� Win32_DeviceSettings C � �� � - � � � � � � � e��������, � Win32_PrinterSetting CIMWin32 Description The Win32_PrinterSetting class represents an association between a printer and its configuration settings. Locale UUID {8502C500-5FBB-11D2-AAC1-006008C78BC7} Element f@ C
� ) � ��< F O _ z � ref:Win32_Printer Override Element MappingStrings g WMI|Win32_Printer Description The Element reference represents the printer that can be configured with the Settings member. Setting f@ C
� @ � ��` j s � � � ref:Win32_PrinterConfiguration Override Setting MappingStrings � WMI|Win32_PrinterConfiguration Description The Setting reference represents the printer configuration settings that can be applied to the associated printer. nt �
E v e n t T r a c e h͝��C�� EventTrace 6 � �� ) / W _ i p i����� � NETIO Description TCPIP Service Trace guid {eb004a05-9b1a-11d4-9123-0050047759bc} locale MS\0x409 Flags R
� � � � � � � � � � � uint32 Description Enable Flags ValueDescriptions j � � � � � � 3 L b { � � � � � � ( > T j � NETIO_TRACE_SEND Flag NETIO_TRACE_RECEIVE Flag NETIO_TRACE_INTERFACE Flag NETIO_TRACE_NMR Flag NETIO_TRACE_NSI Flag NETIO_TRACE_FRAMING Flag NETIO_TRACE_NETWORK Flag NETIO_TRACE_TRANSPORT Flag NETIO_TRACE_TUNNEL Flag NETIO_TRACE_TDX Flag NETIO_TRACE_LEGACY Flag NETIO_TRACE_PACER Flag WFP_TRACE_BASE Flag WFP_TRACE_FE Flag WFP_TRACE_STM Flag WFP_TRACE_IPSEC Flag WFP_TRACE_ALE Flag WFP_TRACE_OFFLOAD Flag NETIO_TRACE_EQOS Flag NETIO_TRACE_RSS Flag NETIO_TRACE_NRT Flag NETIO_TRACE_NCM Flag NETIO_TRACE_IPHLPAPI Flag NETIO_TRACE_IPSNPI Flag DefineValues " 7 N _ p � � � � � � �
* ; J ] o � � � � NETIO_TRACE_SEND NETIO_TRACE_RECEIVE NETIO_TRACE_INTERFACE NETIO_TRACE_NMR NETIO_TRACE_NSI NETIO_TRACE_FRAMING NETIO_TRACE_NETWORK NETIO_TRACE_TRANSPORT NETIO_TRACE_TUNNEL NETIO_TRACE_TDX NETIO_TRACE_LEGACY NETIO_TRACE_PACER WFP_TRACE_BASE WFP_TRACE_FE WFP_TRACE_STM WFP_TRACE_IPSEC WFP_TRACE_ALE WFP_TRACE_OFFLOAD NETIO_TRACE_EQOS NETIO_TRACE_RSS NETIO_TRACE_NRT NETIO_TRACE_NCM NETIO_TRACE_IPHLPAPI NETIO_TRACE_IPSNPI Values 8 J _ v � � � � � � � % 5 C R c r � � � � � � NETIO_TRACE_SEND NETIO_TRACE_RECEIVE NETIO_TRACE_INTERFACE NETIO_TRACE_NMR NETIO_TRACE_NSI NETIO_TRACE_FRAMING NETIO_TRACE_NETWORK NETIO_TRACE_TRANSPORT NETIO_TRACE_TUNNEL NETIO_TRACE_TDX NETIO_TRACE_LEGACY NETIO_TRACE_PACER WFP_TRACE_BASE WFP_TRACE_FE WFP_TRACE_STM WFP_TRACE_IPSEC WFP_TRACE_ALE WFP_TRACE_OFFLOAD NETIO_TRACE_EQOS NETIO_TRACE_RSS NETIO_TRACE_NRT NETIO_TRACE_NCM NETIO_TRACE_IPHLPAPI NETIO_TRACE_IPSNPI ValueMap b n z � � � � � � � � � � �
" . : F R ^ j v 0x00000001 0x00000002 0x00000004 0x00000008 0x00000010 0x00000020 0x00000040 0x00000080 0x00000100 0x00000200 0x00000400 0x00000800 0x00001000 0x00002000 0x00004000 0x00008000 0x00010000 0x00020000 0x00040000 0x00080000 0x00100000 0x00200000 0x00400000 0x00800000 �
E v e n t T r a c e i͝��C�� EventTrace 6 � �� E M W ^ U����Z � MMC Description MMC guid {9C88041D-349D-4647-8BFD-2C0A167BFE58} locale MS\0x409 Flags R
� � � � � � % - < F uint32 Description Enable Flags ValueDescriptions � DUMMY Flag DefineValues DUMMY Values 5 DUMMY ValueMap N 0x00000001 �4 1 C 5 3 E 6 D B 1 A C F 2 4 5 3 C E F D 4 1 3 9 8 1 9 8 E 6 1 3 F 1 0 D F F 4 7 7 0 9 E C A B 1 D 7 F 0 3 7 7 5 6 A C 8 C E 7 t͝��C�ȝ��C�� � � __thisNAMESPACE � �� � � ( ? P ����N������7�S+ ? u͝��C�� _ p � � � U��������������= � HNet_Connection Guid 2
� W � �� � �� � �� string IsLanConnection '
� � � �� � �� boolean Name '
� � � �� � �� string PhonebookPath '
� 5 � �� � �� string Ne � V��� � @P#�� � {^�� � ��R��
U ��y�� b �ZUB
J x Y� M ��3K� 6 �
Y� � �,�� !ؘ� m �=1 ��X[& C I M _ S e t t i n g ϝ��C�� D CIM_Setting
6 � �� � " B J P x � � � �
< H z � � � ! S l � � � � % 6 h s }UU������������������������������������������������������������������ � Win32_NamedJobObjectLimitSetting NamedJobObjectLimitSettingProv Locale UUID {F2D96E32-2A34-475b-878D-B0AE7657519F} ActiveProcessLimit
0
� � � �� uint32 Affinity 4
� � � �� uint32 JobMemoryLimit
� 4 � �� uint32 LimitFlags $
� r � �� uint32 MaximumWorkingSetSize ,
� � � �� uint32 MinimumWorkingSetSize (
� � �� uint32 PerJobUserTimeLimit
� K � �� uint64 PerProcessUserTimeLimit
� � � �� uint64 PriorityClass 8
� � � �� uint32 ProcessMemoryLimit
� � �� uint32 SchedulingClass
<
� ` � �� uint32 SettingID @ '
� � � �� � �� string � C I M _ C o l l e c t i o n S e t t i n g ϝ��C�� CIM_CollectionSetting 6 � � ��) 1 7 _ k � � 5��������! � Win32_NamedJobObjectSecLimit CIMWin32a Locale UUID {08E31939-FAAB-4a3b-9B10-50151D1B9D24} Collection f@ '
� � � �� � �� ref:Win32_NamedJobObject Setting f@ '
� � � �� � �� ref:Win32_NamedJobObjectSecLimitSetting ' � C I M _ S e t t i n g ϝ��C�� CIM_Setting
6 � �� � % H P V ~ � � � . B t � � }���������������������������� � Win32_NamedJobObjectSecLimitSetting NamedJobObjectSecLimitSettingProv Locale UUID {F2D96E32-2A34-475b-878D-B0AE7657519F} PrivilegesToDelete
� � � �� object:Win32_TokenPrivileges RestrictedSIDs
� � �� object:Win32_TokenGroups SecurityLimitFlags
� l � �� uint32 SettingID @ '
� � � �� � �� string SIDsToDisable
� � � �� object:Win32_TokenGroups � ϝ��C�= ) �� % + S _ � � U��������� � Win32_TokenGroups Abstract Locale UUID {6CDD7B40-369D-4725-AB7F-EFE53EE2C455} GroupCount
� � � �� uint32 Groups
� � � �� object:Win32_SIDandAttributes 2C � ϝ��C�J ) ��! ) / W g � � U��������� � Win32_TokenPrivileges Abstract Locale UUID {3559D159-47E8-4458-9B7E-5FD16D260B8D} PrivilegeCount
� � � �� uint32 Privileges
� � � �� object:Win32_LUIDandAttributes D2 � ϝ��C�2 ) ��" * 0 X d � � U��������� � Win32_SIDandAttributes Abstract Locale UUID {DE1B36A6-4157-43ed-937F-D90606C09216} Attributes
� � � �� uint32 SID
� � � �� object:Win32_SID ac � ϝ��C�5 ) ��# + 1 Y e � � U��������� � Win32_LUIDandAttributes Abstract Locale UUID {63021F4B-F377-4a88-ABD1-835D14142142} Attributes
� � � �� uint32 LUID
� � � �� object:Win32_LUID ra � ϝ��C� ) �� $ L V � � E��������� � Win32_LUID Abstract Locale UUID {0FF18C30-FA51-11d3-9C37-006008B088CE} HighPart
� � � �� uint32 LowPart
� � � �� uint32 U � _ _ E x t e n d e d S t a t u s !ϝ��C�S __ExtendedStatus % M d � � ������������������������������ � Win32_JobObjectStatus Locale UUID {7E6475FE-CF3C-4e22-892E-0E58482158E3} AdditionalDescription
� � � �� string Win32ErrorCode
� � � �� uint32 �
R O O T \ C I M V 2 _ _ I n s t a n c e P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 6 8 5 7 7 3 7 2 C 6 6 A 7 B 2 0 6 5 8 4 8 7 F B D 9 5 9 A A 1 5 4 E F 5 4 B 5 F 9 3 5 D C C 5 6 6 3 E 9 2 2 8 B 4 4 3 2 2 8 0 5 \ K I _ E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C \ I _ F 3 9 B E 2 F 2 C C 7 5 5 1 B D E 9 0 E 6 2 4 B 5 C 7 3 0 1 C 1 5 8 A 6 8 D 6 1 8 B 8 8 7 A 1 3 5 B 2 1 C 9 C B 3 C E F D 8 6 3 C I M _ C h e c k .��C�C - CIM_Check C # + 1 � Y � ��b r � � � � K Y ��W������������������������������������������� � Win32_ODBCDataSourceSpecification Locale UUID {1F20B83E-DB33-11d2-85FC-0000F8102E5F} MSIProv MappingStrings z Microsoft.MSI DataSource
� � � �� string Description @
� � � �� string DriverDescription
"
� C � �� string Registration &
� � � �� string � C I M _ C o l l e c t i o n O f M S E s #ϝ��C�� CIM_CollectionOfMSEs ) # �� ( = � � }����������������V � Win32_NamedJobObject Description The Win32_NamedJobObject class represents a kernel object that is used to group processes for the sake of controlling the life and resources of the processes within the job object. Only the job objects that have been named are instrumented. AMENDMENT LOCALE BasicUIRestrictions +
� v ~ � � � uint32 Description The UIRestrictions property indicates the restrictions on the job regarding the UI. Bitvalues * 8 F O _ r Desktop Display Settings Exit Windows Global Atoms Handles Read Clipboard System Parameters Write Clipboard CollectionID @ )
� � � � � �� string Description This property indicates a number that identifies the job object.
As a Kernel object job object names are case sensitive. Because WMI keys are case insensitive, the name of the named job object must be decorated as follows: a capital letter should be preceded by a backslash. As a consequence of this convention, 'A' and 'a' are lower case and '\A' and '\a' are upper case. � C I M _ C o l l e c t e d M S E s $ϝ��C�� CIM_CollectedMSEs ) * � ��� � � � � ���������j � Win32_NamedJobObjectProcess Description The Win32_NamedJobObjectProcess association class relates a job object and a process contained in the job object. A job can contain multiple processes. AMENDMENT LOCALE Collection f@ )
� 3 @ � �� ref:Win32_NamedJobObject Description This property is a reference to the instance of Win32_NamedJobObject in which the processes are contained. Member f@ )
� � � � �� ref:Win32_Process Description This property is a reference to the instance of Win32_Process that is part of the job object. r � � � ���0 � ?��� � E~<� � �i�� � "/�u � i�m)G � ��I�
��
�5 2 ��r�g
< ��l�� , ��\ � `
�,/ � �0n8� � � �� � �)� C J�w� � � �ON � -L�: � C I M _ M a n a g e d E l e m e n t �ѝ��C�� CIM_ManagedElement ) �� + @ H U � � }���������������� � CIM_SettingData Abstract UMLPackagePath CIM::Core::Settings locale ElementName @ )
� � � ��� � string Required Override ElementName InstanceID @ )
� � � ��
string Override InstanceID st � C I M _ S e t t i n g D a t a �ѝ��C�� CIM_SettingData ) � �� � & �����������������. � Win32_PowerSetting PowerWmiProvider Locale � C I M _ S e t t i n g D a t a �ѝ��C�� CIM_SettingData ) � �� � . �����������������6 � Win32_PowerSettingSubgroup PowerWmiProvider Locale � C I M _ S e t t i n g D a t a �ѝ��C�� CIM_SettingData ) � �� � # + 5 ��������������������h � Win32_PowerPlan PowerWmiProvider Locale IsActive
� _ � �� boolean �
& * � � Activate �� implemented � ae442007200009F ROOT\cimv2\power ���� � �( �� * m ��� � __PARAMETERS abstract ReturnValue boolean
� _ boolean out
� _ h �� __ � C I M _ M a n a g e d E l e m e n t �ѝ��C�� CIM_ManagedElement ) �� , E M Z � � }���������������� � CIM_Capabilities Abstract UMLPackagePath CIM::Core::Capabilities locale ElementName @ )
� � � ��� � string Required Override ElementName InstanceID @ )
� � � �� string Override InstanceID e � C I M _ C a p a b i l i t i e s �ѝ��C�� CIM_Capabilities ) � �� � 0 �����������������8 � Win32_PowerSettingDefinition PowerWmiProvider Locale � �ѝ��C�� ) ��% 5 J R ] � � � � � � 7 D U���������������� � CIM_ElementSettingData Association UMLPackagePath CIM::Core::Settings locale IsCurrent
� | uint16 IsDefault
� � uint16 IsNext
� � uint16 ManagedElement f
� � �� ref:CIM_ManagedElement SettingData f
� n � �� ref:CIM_SettingData � C I M _ S e t t i n g D a t a �ѝ��C�� CIM_SettingData ) � �� � / 7 J ����������������������� � Win32_PowerSettingDataIndex PowerWmiProvider Locale SettingIndexValue '
� � �� � �� uint32 � C I M _ E l e m e n t S e t t i n g D a t a �ѝ��C�� CIM_ElementSettingData 4 � ��+ �� � 8 J R _ � � � ������������������e � Win32_PowerSettingElementSettingDataIndex Association PowerWmiProvider Locale IsACSetting
� ~ uint16 ManagedElement f@
� � � � ref:Win32_PowerSetting Override ManagedElement SettingData f@
� - N X ref:Win32_PowerSettingDataIndex Override SettingData � C I M _ S e t t i n g D a t a �ѝ��C�� CIM_SettingData ) � �� � ' 9 A O ����������������������� � Win32_PowerSettingDefinitionRangeData PowerWmiProvider Locale SettingValue
� y � �� uint32 � C I M _ S e t t i n g D a t a �ѝ��C�* + CIM_SettingData ) � �� � + = E R � � � � A N �U������������������������������������������ � Win32_PowerSettingDefinitionPossibleValue PowerWmiProvider Locale BinaryValue $
� | � �� uint8 SettingIndex
� � � �� uint32 StringValue
� � � �� string UInt32Value
� 9 � �� uint32 UInt64Value
� x � �� uint64 � �ѝ��C��
) ��& 6 O W e � � � � U������������A � CIM_ElementCapabilities Association UMLPackagePath CIM::Core::Capabilities locale Capabilities f
� � � �� ref:CIM_Capabilities Characteristics
� � uint16 ManagedElement f )
� $ � ��< ref:CIM_ManagedElement Min � C I M _ E l e m e n t C a p a b i l i t i e s �ѝ��C��
! CIM_ElementCapabilities ) � �� � 2 ������������: � Win32_PowerSettingCapabilities PowerWmiProvider Locale � �ѝ��C�� ? �� ��& ��3 C \ d t � � e�������� � CIM_Component Association Abstract Aggregation UMLPackagePath CIM::Core::CoreElements locale GroupComponent f '
� � � ��� �� ref:CIM_ManagedElement Aggregate PartComponent f
� � �� ref:CIM_ManagedElement ti �
C I M _ C o m p o n e n t �ѝ��C� CIM_Component ) ��- = R Z j � � A Q � � ��������� � � CIM_SettingsDefineCapabilities Association UMLPackagePath CIM::Core::Settings locale GroupComponent f@ +
� � � � � ref:CIM_Capabilities Override GroupComponent Max PartComponent f@
� ( 2 ref:CIM_SettingData Override PartComponent PropertyPolicy )
� � � ��� � uint16 Required ModelCorrespondence � � CIM_SettingsDefineCapabilities.ValueRole CIM_SettingsDefineCapabilities.ValueRange ValueRange
� H P e uint16 ModelCorrespondence q � CIM_SettingsDefineCapabilities.PropertyPolicy CIM_SettingsDefineCapabilities.ValueRole ValueRole
� uint16 ModelCorrespondence * Y CIM_SettingsDefineCapabilities.PropertyPolicy CIM_SettingsDefineCapabilities.ValueRange � C I M _ S e t t i n g s D e f i n e C a p a b i l i t i e s �ѝ��C�6 ( CIM_SettingsDefineCapabilities ) � �� � & 8 @ P ���������� � � Win32_PowerSettingDefineCapabilities PowerWmiProvider Locale GroupComponent f@
� | � � ref:Win32_PowerSettingDefinition Override GroupComponent �
C I M _ C o m p o n e n t �ѝ��C�� CIM_Component ) ��$ 4 M U e � � e��������/ � CIM_ConcreteComponent Association UMLPackagePath CIM::Core::CoreElements locale GroupComponent f@
� � � � ref:CIM_ManagedElement Override GroupComponent PartComponent f@
� � ref:CIM_ManagedElement Override PartComponent mp �
E v e n t T r a c e �sR|�C�� EventTrace )
F ��Q Y � CscFastSync Description Microsoft-Windows-OfflineFiles-CscFastSync AMENDMENT LOCALE � 7�ϐ � S�s�F � KC�c� � 7Cm�~ 1 h�� � : ����� ; T�A�$ � �n}� � _ _ E x t r i n s i c E v e n t �̝��C�~
__ExtrinsicEvent �� ������������& � MSFT_WmiSelfEvent AMENDMENT LOCALE � C I M _ M e d i a A c c e s s D e v i c e utR|�C�P j CIM_MediaAccessDevice ) v ��� ����������������������������������������������������������������������������������������������������������� � CIM_DisketteDrive Description Capabilities and management of a diskette drive, a subtype of CIM_MediaAccessDevice. AMENDMENT LOCALE � C I M _ L o g i c a l D e v i c e |tR|�C�l j CIM_LogicalDevice ) $ � ���
� � � � � � = O
�
�
� � | � q
�
���_UU����������������������������������������������������������������������������������������������������Y � CIM_MediaAccessDevice Description CIM_MediaAccessDevice represents the ability to access one or more media and use this media to store and retrieve data. AMENDMENT LOCALE Capabilities . +
� � � � uint16 Description Capabilities of the media access device. For example, the device may support "Random Access", removable media and "Automatic Cleaning". In this case, the values 3, 7 and 9 would be written to the array.
Several of the enumerated values require some explanation: 1) Value 11, Supports Dual Sided Media, distinguishes a Device that can access both sides of dual sided Media, from a Device that reads only a single side and requires the Media to be flipped; and, 2) Value 12, Predismount Eject Not Required, indicates that Media does not have to be explicitly ejected from the Device before being accessed by a PickerElement. Values
� � � � � 7 H \ p � Unknown Other Sequential Access Random Access Supports Writing Encryption Compression Supports Removeable Media Manual Cleaning Automatic Cleaning SMART Notification Supports Dual Sided Media Predismount Eject Not Required CapabilityDescriptions 2
� � � string Description An array of free-form strings providing more detailed explanations for any of the access device features indicated in the Capabilities array. Note, each entry of this array is related to the entry in the Capabilities array that is located at the same index. CompressionMethod 6
� F N [ string Description A free form string indicating the algorithm or tool used by the device to support compression. If it is not possible or not desired to describe the compression scheme (perhaps because it is not known), recommend using the following words: "Unknown" to represent that it is not known whether the device supports compression capabilities or not, "Compressed" to represent that the device supports compression capabilities but either its compression scheme is not known or not disclosed, and "Not Compressed" to represent that the devices does not support compression capabilities. DefaultBlockSize : +
� � � � / 6 uint64 Description Default block size, in bytes, for this device. Units bytes ErrorMethodology B
� { � � string Description ErrorMethodology is a free-form string describing the type(s) of error detection and correction supported by this device. MaxBlockSize F +
� R
Z
g
�
�
uint64 Description Maximum block size, in bytes, for media accessed by this device. Units bytes MaxMediaSize N +
� �
� � uint64 Description Maximum size, in Kbytes, of media supported by this device. KBytes is interpreted as the number of bytes multiplied by 1000 (NOT the number of bytes multiplied by 1024). Units kilobytes MinBlockSize V +
� , n u uint64 Description Minimum block size, in bytes, for media accessed by this device. Units bytes NeedsCleaning ^
� � � � boolean Description Boolean indicating that the media access device needs cleaning. Whether manual or automatic cleaning is possible is indicated in the Capabilities array property. NumberOfMediaSupported `
� �
�
�
uint32 Description When the media access device supports multiple individual media, this property defines the maximum number which can be supported or inserted. � C I M _ C o o l i n g D e v i c e �tR|�C�� 4 CIM_CoolingDevice ) W ��b ����������������������������������������������������j � CIM_HeatPipe Description Capabilities and management of a heat pipe cooling device. AMENDMENT LOCALE � C I M _ C o o l i n g D e v i c e �tR|�C� 4 CIM_CoolingDevice ) ` ��k ����������������������������������������������������s � CIM_Refrigeration Description Capabilities and management of a refrigeration cooling device. AMENDMENT LOCALE � C I M _ C o o l i n g D e v i c e �tR|�C�5 ? CIM_CoolingDevice ) L ��W _ m ��������������������������������������������������������������� � CIM_Fan Description Capabilities and management of a fan cooling device. AMENDMENT LOCALE DesiredSpeed 0 +
� � � � � � uint64 Description DesiredSpeed is the currently requested fan speed, defined in revolutions per minute, when a variable speed fan is supported (VariableSpeed boolean = TRUE). The current speed is determined via a sensor (CIM_Tachometer) that is associated with the fan using the CIM_AssociatedSensor relationship. Units revolutions per minute VariableSpeed 8
� > G T boolean Description Indication of whether the fan supports variable speeds. �
0 � � SetSpeed ( Description Requests that the fan speed be set to the value specified in the method's input parameter. The return value should be 0 if the request was successfully executed, 1 if the request is not supported and some other value if an error occurred. a42c9160500003S ROOT\CIMV2\ms_409 ���� � �� �� * � ��������� � __PARAMETERS abstract DesiredSpeed uint64
� 8 IN
� 8 _ �� ID )
� � _ ��� uint64 __ �� a42c9160500003S ROOT\CIMV2\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � C I M _ L o g i c a l D e v i c e �tR|�C�� 4 CIM_LogicalDevice ) Q ��\ d s ���������������������������������������������������% � CIM_CoolingDevice Description Capabilities and management of cooling devices. AMENDMENT LOCALE ActiveCooling .
� � � � boolean Description ActiveCooling is a boolean indicating that the cooling device provides active (as opposed to passive) cooling. �F D 1 C 1 D 4 1 4 B 7 1 B 5 0 8 2 C 2 6 6 A 6 5 0 E 3 1 E F 6 D 5 0 1 9 3 8 2 7 2 4 2 4 4 B 6 8 5 F 2 1 7 C 0 A A E 0 0 A 9 2 1 vR|�C�Cȝ��C�$ � __SystemSecurity (�[*p ^ F �� ��Zb� G @wZZ* ��Z)J � b�7-" � �uR|�C�F " �� ' 1 � � � � � � � � � ' ; UU��������������������������������� � ISCSI_LoginOptions AMENDMENT LOCALE AuthType +
� j r � � uint32 Description Authentication method specified for login Values � � � No Authentication CHAP Mutual CHAP DataDigest
� ( 5 uint32 description cyclic integrity checksums that can be negotiated for the header digests DefaultTime2Retain
� � � � uint32 Description The initiator and target negotiate the maximum time, in seconds after an initial wait (Time2Wait), before which an explicit/implicit connection Logout or active task reassignment is still possible after an unexpected connection termination or a connection reset. DefaultTime2Wait
� # 0 uint32 Description The initiator and target negotiate the minimum time, in seconds, to wait before attempting an explicit/implicit logout or active task reassignment after an unexpected connection termination or a connection reset. HeaderDigest
� @ H U uint32 description cyclic integrity checksums that can be negotiated for the header digests InformationSpecified +
� � � C N uint32 description Bit flags that specify which login option values are specified BitValues f t � � � HeaderDigest DataDigest MaxConnections DefaultTime2Wait DefaultTime2Retain LoginFlags
� � � uint32 Description Flags that affect how login occurs MaximumConnections
� g o | uint32 Description Maximum number of connections, 0 implies no limit � �uR|�C�� ) b ��m u | � � : E U����������������� � ISCSI_LUNList description This class describes a mapping from a an OS LUN to target device LUN AMENDMENT LOCALE OSLUN
� � � � uint32 description OS Scsi bus number target is mapped to Reserved
� # 0 uint32 description Reserved TargetLUN
� q y � uint64 description Target LUN ti � �uR|�C�/ ( ) " q ��| � � } � � � � Z d � � UU��������������������������������������� � ISCSI_TargetMapping description This class describes a mapping from a target LUN to a Windows port driver LUN AMENDMENT LOCALE FromPersistentLogin
� � � � boolean Description TRUE if session created from a persistent login LUNCount
� B J W uint32 description Count of LUNs mapped for this target LUNList
"
� � � � object:ISCSI_LUNList description List of LUNs mapped for this target OSBus
� - 5 B uint32 description OS Scsi bus number target is mapped to. If 0xffffffff then any value can be picked by the miniport. OSTarget
� � � � uint32 description OS Scsi Target number target is mapped to. If 0xffffffff then any value can be picked by the miniport. Reserved
� � � � uint64 description Reserved TargetName
� � � � string description Target Name UniqueSessionId
� F N [ uint64 Description Unique Session ID for the target mapping � W i n 3 2 _ P e r f R a w D a t a �uR|�C�� � Win32_PerfRawData 6 # J W ~ ��� � � � q � � � 7 R � � S a � � W p �
� � ( > � � ' ? � � A V � � UUUU�������������������������������������������������������������������������������������������������������������������������������������������������[
� MSiSCSI_QMIPSECStats Description iSCSI HBA quick mode IPSEC Statistics DisplayName iSCSI HBA Quick Mode IPSEC Statistics AMENDMENT LOCALE ActiveSA
� � � � uint64 Description The number of active IPSEC SAs ActiveTunnels (
� 7 ? L uint64 Description The number of active IPSEC tunnels. AuthenticatedBytesReceived
h
� � � � uint64 Description The number of bytes received using the AH protocol. AuthenticatedBytesSent `
� G O \ uint64 Description The number of bytes sent using the AH protocol. BadSPIPackets 0
� � � � uint64 Description The total number of packets for which the Security Parameters Index (SPI) was incorrect. ConfidentialBytesReceived X
� ~ � � uint64 Description The number of bytes received using the ESP protocol. ConfidentialBytesSent
P
� ! uint64 Description The number of bytes sent using the ESP protocol. KeyAdditions
� � � � uint64 Description The total number of successful IPSEC SA negotiations KeyDeletions
� ' uint64 Description The total number of key deletions for IPSEC SA PacketsNotAuthenticated @
� � � � uint64 Description The total number of packets for which data could not be verified. PacketsNotDecrypted 8
� 6 > K uint64 Description The total number of packets that failed decryption. PacketsWithReplayDetection H
� � � � uint64 Description The total number of packets that contained a valid Sequence Number field. PendingKeyOperations
� j r uint64 Description The number of IPSEC key operations in progress ReKeys
� � � � uint64 Description The number of rekey operations for IPSEC SAs. TransportBytesReceived x
� k s � uint64 Description The number of bytes received using the IPSEC protocol. TransportBytesSent p
� �
uint64 Description The number of bytes sent using the IPSEC protocol. TunnelBytesReceived �
� � � � uint64 Description The number of bytes received using the IPSEC tunnel mode. TunnelBytesSent �
�
$
uint64 Description The number of bytes sent using the IPSEC tunnel mode. � �uR|�C�� ) + T ��_ g n � � e��������e � MSiSCSIInitiator_PortalGroup Description Microsoft iSCSI Initiator: Portal Group AMENDMENT LOCALE Index )
� � � ��� � uint32 Description Index number of this portal group Portals
� 2 ? object:MSiSCSIInitiator_Portal Description List of Portals in this Portal Group D � �uR|�C�� ) - X ��c k x � � @ M � � U����������������6 � MSiSCSIInitiator_TargetAddress Description Microsoft iSCSI Initiator: Target Address AMENDMENT LOCALE OSBusNumber
� � � � uint32 Description OS SCSI bus number target is mapped to OSDeviceName
� # 0 string Description OS Device Name OSLunNumber
� y � � uint32 Description OS SCSI LUN number target LUN is mapped to OSTargetNumber
� � � uint32 Description OS SCSI Target number target is mapped to es � ��` � ;c(b� � ��9� p �ɹ!> � ��� � C I M _ S e r v i c e ^͝��C�m Z CIM_Service
s � �� � , w � � ��� � � ��� �
� � � � � � � � � � � " /
> F � � �
�
�_UU������������������������������������������������������������������������������������� � Win32_PrinterDriver CIMWin32 Description The Win32_PrinterDriver class represents the drivers for a Win32_Printer. Locale UUID 522E1798-D74F-4516-94F5-C121B0F4A8CB SupportsCreate CreateBy AddPrinterDriver SupportsDelete DeleteBy DeleteInstance ConfigFile 4 6
� Q � ��Y f � � string Description The ConfigFile property contains the configuration file for this printer driver, (example: pscrptui.dll). MappingStrings � DataFile
0 C
� F � ��N [ � � � � string Description The DataFile property contains the data file for this printer driver, (example: qms810.ppd). ModelCorrespondence � CIM_DataFile.FileName MappingStrings DefaultDataType D 6
� \ � ��d q � � string Description The DefaultDataType property indicates the default data type for this printer driver, (example: EMF). MappingStrings � DependentFiles < 6
� F � ��N [ � � string Description The DependentFiles property contains a list of dependent files for this printer driver. MappingStrings � DriverPath , C
� + � ��3 @ � � � � string Description The DriverPath property contains the path for this printer driver, (example: C:\drivers\pscript.dll). ModelCorrespondence � CIM_DataFile.Path MappingStrings � FilePath L A
� J � �� � ��R _ � � string Description The FilePath property contains the path to the INF file being used, (Example: c:\temp\driver). MappingStrings � HelpFile 8 6
� ' � ��/ < � � string Description The HelpFile property contains the help file for this printer driver, (example: pscrptui.hlp). MappingStrings � InfName H A
� � �� � �� # string Description The InfName property contains the name of the INF file being used. The default is 'ntprint.INF'. This will only be different if the drivers are provided directly by the manufacturer of the printer and not the operating system. MappingStrings MonitorName @ 6
� s � ��{ � �
string Description The MonitorName property contains the name of the of the monitor for this printer driver, (example: PJL monitor). MappingStrings
Name @ C
� l
� ��t
~
�
�
$ 4 string Override Name Description The Name property indicates the driver name for this printer. This is a compound key composed of the Name, Version and SupportedPlatform values. MappingStrings < OEMUrl P )
� } � ��� � string Description The OEMUrl property provides a world wide web link to the printer manufacturer's web site. Note that this property is not populated when the Win32.INF file is used and is only applicable for drivers provided directly from the manufacturer. SupportedPlatform ( A
� � � �� � ��� � �
�
string Description The SupportedPlatform property indicates the operating environments that the driver is intended for. Examples are 'Windows NT x86' or 'Windows IA64'. MappingStrings �
Version
& [
� � �� � ��' 4 � � � � � � uint16 Description The Version property indicates the operating system version that the driver is intended for. MappingStrings � ValueMap � � � � 0 1 2 3 Values � � Win9x Win351 NT40 Win2k . j � � AddPrinterDriver L ^ ��f ��s ��� � � � � � Static Implemented Constructor Description The AddPrinterDriver method installs a printer driver. The method can return the following values:
0 - Success.
5 - Access denied.
1797 - The printer driver is unknown.
Other - For integer values other than those listed above, refer to the documentation on the Win32 error codes. ValueMap � � � � 0 5 1797 .. Values � � ' Success Access denied The printer driver is unknown Other 8 ae442007200009F ROOT\CIMV2 ���� � �� �� * � ����
� __PARAMETERS abstract
DriverInfo object
� 6 In
� 6 ] �� The DriverInfo parameter specifies the neccessary inforation needed in order to create the printer driver. Description
)
� 6 ] ��� � C MappingStrings
6
� 6 ] ��� � E ; ID
C
� � ] ��� � E ; � object:Win32_PrinterDriver __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � C I M _ D e p e n d e n c y _͝��C�� CIM_Dependency C � �� � ! . � � � �
U�������� � Win32_DriverForDevice CIMWin32 Description The Win32_DriverForDevice class represents an association between a printing device on a Win32 computer system and the driver that supports this device. Locale UUID {C2225311-00A1-47FC-B163-49006EDFD693} Antecedent f@ N
� f � �� � ��y � � � � � ref:Win32_Printer Override Antecedent Description The Antecedent reference represents the printing device controlled by the driver. MappingStrings Dependent f@ N
� p � �� � ��� � � � �
ref:Win32_PrinterDriver Override Dependent Description The Dependent reference represents the driver that supports the printing device. MappingStrings is �4 1 C 5 3 E 6 D B 1 A C F 2 4 5 3 C E F D 4 1 3 9 8 1 9 8 E 6 1 3 F 1 0 D F F 4 7 7 0 9 E C A B 1 D 7 F 0 3 7 7 5 6 A C 8 C E 7 p͝��C�ȝ��C�� � � __thisNAMESPACE � �� � � ? 6 4 6 5 9 A B 9 F 8 F 1 C 4 B 5 6 8 D B 6 4 3 8 B A E 1 1 B 2 6 E E 8 F 9 3 C B 5 F 8 1 9 5 E 2 1 E 8 C 3 8 3 D 6 C 4 4 C C 4 1 q͝��C�ȝ��C�-
� __NAMESPACE HomeNet F D 1 C 1 D 4 1 4 B 7 1 B 5 0 8 2 C 2 6 6 A 6 5 0 E 3 1 E F 6 D 5 0 1 9 3 8 2 7 2 4 2 4 4 B 6 8 5 F 2 1 7 C 0 A A E 0 0 A 9 2 1 r͝��C�Cȝ��C�$ � __SystemSecurity ;� C I M _ S e t t i n g %vR|�C�+, � CIM_Setting
) + 5 ��@ 0 H W � � � � : W � � t � 9 E � � � � l � �
g v � � e t � � �
�
� � o � " ? � � | � _ � a � A j � � � � � � � � i � < U . � � � � � � � j � $ 1 � � �! �! x" �" I# X# �# $ �$ �$ C% Y% F( V( �( �( UUUUUUUUUUUU�������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������) � Win32_TerminalServiceSetting Description The Win32_TerminalServiceSetting class defines the configuration for TerminalServerSetting. This includes capabilities such as Terminal Server Mode, Licensing, Active Desktop, Permissions Capability,Deletion of Temporary folders and Temporary folders per session. AMENDMENT LOCALE ActiveDesktop +
� � � � � � uint32 Description Active Desktop bit. Values � � TRUE FALSE AllowTSConnections 8 +
� ( 0 = p x uint32 Description Describes whether new TS connections are allowed. Values � � FALSE TRUE DeleteTempFolders
( +
� � � � ! uint32 Description Delete Temporary Folders on Exit bit. Values - 4 FALSE TRUE DirectConnectLicenseServers d
� � � � string Description DirectConnectLicenseServers property is deprecated. DisableForcibleLogoff p
� % uint32 Description Indicates whether an Administrator logged onto the console can be logged off. EnableAutomaticReconnection % �
� � � � uint32 Description Specifies whether to allow Remote Desktop Connection clients to automatically reconnect to sessions on an RD Session Host server if their network link is temporarily lost: (0) automatic reconnection of clients is prohibited, (1) automatic reconnection is attempted for all clients running Remote Desktop Connection whenever their network connection is lost. EnableDFSS ! �
� q y � uint32 Description Enables Dynamic Fair-Share Scheduling: (0) Dynamic Fair-Share Scheduling is disabled, (1) Dynamic Fair-Share Scheduling is enabled. EnableDiskFSS + �
� F N [ uint32 Description Enables Disk Fair-Share Scheduling: (0) Disk Fair-Share Scheduling is disabled, (1) Disk Fair-Share Scheduling is enabled. EnableNetworkFSS , �
� * uint32 Description Enables Network Fair-Share Scheduling: (0) Network Fair-Share Scheduling is disabled, (1) Network Fair-Share Scheduling is enabled. EnableRemoteDesktopMSI # �
� � � uint32 Description Enables Remote Desktop MSI: (0) Remote Desktop MSI is disabled, (1) Remote Desktop MSI is enabled. FallbackPrintDriverType t +
� � � �
uint32 Description Indicates which Printer driver to Fallback to. Values #
:
H
|
�
No fallback dirvers=0 Best guess=1 Best guess, if no match is found fallback to PCL=2 Best guess, if no match is found fallback to PS=3 Best guess, if no match is found show both PCL and PS drivers=4 GetCapabilitiesID
� / 7 D uint32 Description Reserved; Returns a value of one. HomeDirectory P
� � � � string Description Describes the Home Directory for the machine. LicensingDescription
� ( 0 = string Description A brief description for Licensing Mode LicensingName
� � � � string Description Name of Licensing Mode LicensingType +
�
*
H
P
uint32 Description Qualifier for Licensing Mode Values h
�
�
�
�
Personal Terminal Server Remote Desktop for Administration Per Device Per User Not Configured LimitedUserSessions �
� ! uint32 Description Limited Number of User Sessions: (0) feature is disabled , a value greater than 0 represents the number of sessions allowed per connection. Logons `
� � � � string Description Indicates whether new sessions are allowed.This setting will not affect existing sessions for Post Windows 2000 builds NetworkFSSCatchAllWeight / �
� � � � uint32 Description Default network fairshare weight for catch-all network traffic, valid number is 1 to 9 NetworkFSSLocalSystemWeight . �
� k s � uint32 Description Default network fairshare weight for local system process, valid number is 1 to 9 NetworkFSSUserSessionWeight - �
� $ 1 uint32 Description Default network fairshare weight for user session, valid number is 1 to 9 PolicySourceAllowTSConnections <
� � � � uint32 Description PolicySourceAllowTSConnections indicates whether the property AllowTSConnections is configured by Server(0) or Group Policy (1). PolicySourceConfiguredLicenseServers l
� � � � uint32 Description PolicySourceConfiguredLicenseServers indicates whether the license servers returned by GetSpecifiedLSList is configured by Server(0) or Group Policy (1). PolicySourceDeleteTempFolders ,
� � � � uint32 Description PolicySourceDeleteTempFolders indicates whether the property DeleteTempFolders is configured by Server(0) or Group Policy (1). PolicySourceDirectConnectLicenseServers h
� � � � uint32 Description PolicySourceDirectConnectLicenseServers property is deprected. PolicySourceEnableAutomaticReconnection & �
� @ H U uint32 Description PolicySourceEnableAutomaticReconnection indicates whether the property EnableAutomaticReconnection is configured by Server(0) or Group Policy (1). PolicySourceEnableDFSS " �
� - 5 B uint32 Description PolicySourceEnableDFSS indicates whether the property EnableDFSS is configured by Server(0) or Group Policy (1). PolicySourceEnableRemoteDesktopMSI $ �
� uint32 Description PolicySourceEnableRemoteDesktopMSI indicates whether the property EnableRemoteDesktopMSI is configured by Server(0) or Group Policy (1). PolicySourceFallbackPrintDriverType x
� � � uint32 Description PolicySourceFallbackPrintDriverType indicates whether the property FallbackPrintDriverType is configured by Server(0) or Group Policy (1). PolicySourceHomeDirectory T
� � � � uint32 Description PolicySourceHomeDirectory indicates whether the property HomeDirectory is configured by Server(0) or Group Policy (1). PolicySourceLicensingType
� � � � uint32 Description PolicySourceLicensingType indicates whether the property LicensingType is configured by Server(0) or Group Policy (1) PolicySourceProfilePath L
� � � � uint32 Description PolicySourceProfilePath indicates whether the propertyProfilePath is configured by,Group Policy (1) or the Server (0). PolicySourceRedirectSmartCards * �
� Z b o uint32 Description PolicySourceRedirectSmartCards indicates whether the property RedirectSmartCards is configured by Server(0) or Group Policy (1). PolicySourceSingleSession D
� 8 @ M uint32 Description PolicySourceSingleSession indicates whether the property SingleSession is configured by Server(0) or Group Policy (1). PolicySourceTimeZoneRedirection \
� ' uint32 Desc�_3@ I �ԉ � ��D09 � C I M _ S e t t i n g �ɝ��C� < CIM_Setting
A & �� � �� � 2 < D J r � ) 6 � � � � \ r � � Y w " 8 � � � � UU��������������������������������������������������������� � Win32_DisplayControllerConfiguration DEPRECATED CIMWin32 Locale UUID {8502C4E5-5FBB-11D2-AAC1-006008C78BC7} BitsPerPixel 4
� � � �� � ��� � uint32 DEPRECATED MappingStrings � Win32API|Device Context Functions|GetDeviceCaps|BITSPIXEL ColorPlanes 4
� x � �� � ��� � uint32 DEPRECATED MappingStrings � Win32API|Device Context Functions|GetDeviceCaps|PLANES DeviceEntriesInAColorTable 4
� : B �� � ��N ^ uint32 DEPRECATED MappingStrings f Win32API|Device Context Functions|GetDeviceCaps|NUMCOLORS DeviceSpecificPens 4
� � � �� � �� uint32 DEPRECATED MappingStrings # Win32API|Device Context Functions|GetDeviceCaps|NUMPENS HorizontalResolution 4
� � � �� � ��� � uint32 DEPRECATED MappingStrings � Win32API|Device Context Functions|GetDeviceCaps|HORZRES Name ?
� l t �� � �� � ��� � string DEPRECATED MappingStrings � WMI RefreshRate $ 4
� � � �� � �� sint32 DEPRECATED MappingStrings Win32API|Device Context Functions|GetDeviceCaps|HORZRESVREFRESH ReservedSystemPaletteEntries
( 4
� � � �� � ��� � uint32 DEPRECATED MappingStrings � Win32API|Device Context Functions|GetDeviceCaps|NUMRESERVED SystemPaletteEntries , 4
� z � �� � ��� � uint32 DEPRECATED MappingStrings � Win32API|Device Context Functions|GetDeviceCaps|NUMRESERVED VerticalResolution 0 4
� 9 A �� � ��M ] uint32 DEPRECATED MappingStrings e Win32API|Device Context Functions|GetDeviceCaps|VERTRES VideoMode
4 4
� � � �� � ��� string DEPRECATED MappingStrings WMI � C I M _ S e t t i n g �ɝ��C�� � CIM_Setting
) ��& . 4 \ s , � � � � J ^ � � � � X f � � ~ � 9 E
� � �
�
= V � � T
Z
�
� � o | $ . � � � � [ q 0 UUUUUU�������������������������������������������������������������������������������������������������������������������������� � Win32_VideoConfiguration DEPRECATED Locale UUID {8502C4ED-5FBB-11D2-AAC1-006008C78BC7} ActualColorResolution 4
� � � �� � ��� � uint32 DEPRECATED MappingStrings � Win32API|Device Context Functions|GetDeviceCaps|COLORRES AdapterChipType 4
� n v �� � ��� � string DEPRECATED MappingStrings � Win32Registry|System\CurrentControlSet\Services\Class\Info|ChipType AdapterCompatibility L
� O W �� � �� � ��c k { string DEPRECATED MaxLen MappingStrings � WMI AdapterDACType 4
� � � �� � ��� � string DEPRECATED MappingStrings Win32Registry|System\CurrentControlSet\Services\Class\Info|DACType AdapterDescription 4
� � � �� � ��� � string DEPRECATED MappingStrings � WMI AdapterRAM 4
� ' �� � ��3 C uint32 DEPRECATED MappingStrings K Win32Registry|System\CurrentControlSet\Services\Class\Info|VideoMemory AdapterType $ 4
� � � �� � ��� string DEPRECATED MappingStrings Win32Registry|HARDWARE\Description\System\DisplayController\0\Identifier BitsPerPixel
( 4
� � � �� � ��� � uint32 DEPRECATED MappingStrings � Win32API|Device Context Functions|GetDeviceCaps|BITSPIXEL ColorPlanes , 4
� ^ f �� � ��r � uint32 DEPRECATED MappingStrings � Win32API|Device Context Functions|GetDeviceCaps|PLANES ColorTableEntries 0 4
� �� � ��+ ; uint32 DEPRECATED MappingStrings C Win32API|Device Context Functions|GetDeviceCaps|NUMCOLORS DeviceSpecificPens
4 4
� � � �� � ��� � uint32 DEPRECATED MappingStrings Win32API|Device Context Functions|GetDeviceCaps|NUMPENS DriverDate e 8 4
� � � �� � ��� � datetime DEPRECATED MappingStrings � Win32Registry|System\CurrentControlSet\Services\Class\AdapterDescription|DriverDate HorizontalResolution < 4
� b j �� � ��v � uint32 DEPRECATED MappingStrings � Win32API|Device Context Functions|GetDeviceCaps|HORZRES InfFilename @ 4
�
�� � ��*
:
string DEPRECATED MappingStrings B
Win32Registry|System\CurrentControlSet\Services\Class|InfPath InfSection D 4
� �
�
�� � ���
�
string DEPRECATED MappingStrings �
Win32Registry|System\CurrentControlSet\Services\Class|InfSection InstalledDisplayDrivers H 4
� � � �� � ��� � string DEPRECATED MappingStrings � Win32Registry|System\CurrentControlSet\Services\Class\Defaule|drv MonitorManufacturer L 4
� ^ f �� � ��r � string DEPRECATED MappingStrings � WMI MonitorType P 4
� � � �� � ���
string DEPRECATED MappingStrings
Win32Registry|HARDWARE\Description\System\MonitorPeripheral\0|Identifier Name T L
� �
�
�� � �� � ���
�
�
string DEPRECATED MaxLen MappingStrings �
WMI PixelsPerXLogicalInch X 4
� F N �� � ��Z j uint32 DEPRECATED MappingStrings r Win32API|Device Context Functions|GetDeviceCaps|LOGPIXELSX PixelsPerYLogicalInch \ 4
� �� � �� + uint32 DEPRECATED MappingStrings 3 Win32API|Device Context Functions|GetDeviceCaps|LOGPIXELSY RefreshRate ` 4
� � � �� � ��� � uint32 DEPRECATED MappingStrings � Win32API|Device Context Functions|GetDeviceCaps|VREFRESH ScanMode d 4
� p x �� � ��� � string DEPRECATED MappingStrings � Win32Registry|System\CurrentControlSet\Services|Device0|DefaultSettings.Interlaced ScreenHeight h 4
� @ H �� � ��T d uint32 DEPRECATED MappingStrings l Win32API|Device Context Functions|GetDeviceCaps|VERTSIZE ScreenWidth l 4
� � � �� � �� uint32 DEPRECATED MappingStrings ! Win32API|Device Context Functions|GetDeviceCaps|HORZSIZE SystemPaletteEntries p 4
� � � �� � ��� � uint32 DEPRECATED MappingStrings � Win32API|Device Context Functions|GetDeviceCaps|SIZEPALETTE VerticalResolution t 4
� r z �� � ��� � uint32 DEPRECATED MappingStrings � Win32API|Device Context Functions|GetDeviceCaps|VERTRES �6 4 6 5 9 A B 9 F 8 F 1 C 4 B 5 6 8 D B 6 4 3 8 B A E 1 1 B 2 6 E E 8 F 9 3 C B 5 F 8 1 9 5 E 2 1 E 8 C 3 8 3 D 6 C 4 4 C C 4 1 �xR|�C�ȝ��C�,
� __NAMESPACE MS_409 cڭY� õ!�� � ��Zϊ �0�#� <ᛖ� ���
� �+倘 � �o�� � -���t � �y9�2 � r�/�
R O O T \ C I M V 2 _ _ I n s t a n c e P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 6 8 5 7 7 3 7 2 C 6 6 A 7 B 2 0 6 5 8 4 8 7 F B D 9 5 9 A A 1 5 4 E F 5 4 B 5 F 9 3 5 D C C 5 6 6 3 E 9 2 2 8 B 4 4 3 2 2 8 0 5 \ K I _ E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C \ I _ 3 B F 0 E D 8 8 A 4 A 3 B 5 0 8 4 9 F B 1 4 D 3 6 2 B 4 9 9 D 7 F 4 5 6 C 1 3 1 0 5 F 6 7 4 E 9 C F B 8 3 E 8 7 7 7 3 B 4 9 A 7 c 3 a mѝ��C�� " � �� � & � � � � J Y � � " - _ v � � TU� ���������������������������� � Win32_WinSAT Win32_WinSAT CPUScore )
� ] � ��e v real32 PropertyContext CPUScore D3DScore )
� � � ��� � real32 PropertyContext D3DScore DiskScore )
� & � ��. ? real32 PropertyContext DiskScore GraphicsScore )
� � � ��� � real32 PropertyContext GraphicsScore MemoryScore )
� � � �� real32 PropertyContext MemoryScore TimeTaken
� W � �� string WinSATAssessmentState C
� � � ��� � � � " * uint32 PropertyContext AssessmentState ValueMap 0 1 2 3 4 Values B P W o � StateUnknown Valid IncoherentWithHardware NoAssessmentAvailable Invalid WinSPRLevel )
� � � ��� � real32 PropertyContext WinSPRLevel MostRecentAssessment �
E v e n t T r a c e nѝ��C�� EventTrace 6 � �� ' - U ] g n e����j � FDCtlGuid Description FD Core Trace guid {480217a9-f824-4bd4-bbe8-f371caaf9a0d} locale MS\0x409 Flags R
� � � � � & 5 = L V uint32 Description Enable Flags ValueDescriptions DUMMY Flag DefineValues . DUMMY Values E DUMMY ValueMap ^ 0x00000001 �
E v e n t T r a c e oѝ��C�� EventTrace 6 � �� , 2 Z b l s m����o � CtlGuidFDWSD Description FD WSDAPI Trace guid {7e2dbfc7-41e8-4987-bca7-76cadfad765f} locale MS\0x409 Flags R
� � � � � + : B Q [ uint32 Description Enable Flags ValueDescriptions DUMMY Flag DefineValues 3 DUMMY Values J DUMMY ValueMap c 0x00000001 �
E v e n t T r a c e pѝ��C�� EventTrace 6 � �� + 1 Y a k r i����n � CtlGuidFDSSDP Description FD SSDP Trace guid {db1d0418-105a-4c77-9a25-8f96a19716a4} locale MS\0x409 Flags R
� � � � � * 9 A P Z uint32 Description Enable Flags ValueDescriptions DUMMY Flag DefineValues 2 DUMMY Values I DUMMY ValueMap b 0x00000001 �
E v e n t T r a c e qѝ��C�� EventTrace 6 � �� $ * R Z d k e����g � CtlGuidUMB Description UMB Trace guid {96ab095a-9519-4f5c-81ee-c510b0a45463} locale MS\0x409 Flags R
� � � � � # 2 : I S uint32 Description Enable Flags ValueDescriptions DUMMY Flag DefineValues + DUMMY Values B DUMMY ValueMap [ 0x00000001 �
E v e n t T r a c e rѝ��C�� EventTrace 6 � �� ( . V ^ h o � � e��������I � UMBus Description UmBus Driver Trace guid {f9be9c98-10db-4318-bb61-cb0ddea08bf7} locale MS\0x409 Flags R
� � � � � � � ~ � % / uint32 Description Enable Flags ValueDescriptions - B S h x � � � � TraceEntryExit Flag TraceIoctl Flag TraceParameter Flag TraceInit Flag TraceInfo Flag TraceDriver Flag TraceCreateClose Flag TracePower Flag TracePnP Flag DefineValues # 3 > I V h t TraceEntryExit TraceIoctl TraceParameter TraceInit TraceInfo TraceDriver TraceCreateClose TracePower TracePnP Values � � � � � � � TraceEntryExit TraceIoctl TraceParameter TraceInit TraceInfo TraceDriver TraceCreateClose TracePower TracePnP ValueMap W c o { � � � � � 0x00000001 0x00000002 0x00000004 0x00000008 0x00000010 0x00000020 0x00000040 0x00000080 0x00000100 Level _
� 7 ? L T g & 4 � � � 7 B uint32 Description Levels ValueDescriptions � � � � Abnormal exit or termination Severe errors that need logging Warnings such as allocation failure Includes non-error cases Detailed traces from intermediate steps DefineValues H [ n � TRACE_LEVEL_FATAL TRACE_LEVEL_ERROR TRACE_LEVEL_WARNINGTRACE_LEVEL_INFORMATION TRACE_LEVEL_VERBOSE Values � � � � � Fatal Error Warning Information Verbose ValueMap # ( - 2 0x1 0x2 0x3 0x4 0x5 ValueType index me �
E v e n t T r a c e sѝ��C�� EventTrace 6 � �� * 0 X ` j q � � e��������K � UmPass Description UMPass Driver Trace guid {FF9E2BDD-0E24-437c-84BE-7CFCAE635808} locale MS\0x409 Flags R
� � � � � � � � � ' 1 uint32 Description Enable Flags ValueDescriptions / D U j z � � � � TraceEntryExit Flag TraceIoctl Flag TraceParameter Flag TraceInit Flag TraceInfo Flag TraceDriver Flag TraceCreateClose Flag TracePower Flag TracePnP Flag DefineValues % 5 @ K X j v TraceEntryExit TraceIoctl TraceParameter TraceInit TraceInfo TraceDriver TraceCreateClose TracePower TracePnP Values � � � � � � � TraceEntryExit TraceIoctl TraceParameter TraceInit TraceInfo TraceDriver TraceCreateClose TracePower TracePnP ValueMap Y e q } � � � � � 0x00000001 0x00000002 0x00000004 0x00000008 0x00000010 0x00000020 0x00000040 0x00000080 0x00000100 Level _
� 9 A N V i ( 6 � � � 9 D uint32 Description Levels ValueDescriptions � � � � � Abnormal exit or termination Severe errors that need logging Warnings such as allocation failure Includes non-error cases Detailed traces from intermediate steps DefineValues J ] p � TRACE_LEVEL_FATAL TRACE_LEVEL_ERROR TRACE_LEVEL_WARNINGTRACE_LEVEL_INFORMATION TRACE_LEVEL_VERBOSE Values � � � � � Fatal Error Warning Information Verbose ValueMap % * / 4 0x1 0x2 0x3 0x4 0x5 ValueType index er �6 4 6 5 9 A B 9 F 8 F 1 C 4 B 5 6 8 D B 6 4 3 8 B A E 1 1 B 2 6 E E 8 F 9 3 C B 5 F 8 1 9 5 E 2 1 E 8 C 3 8 3 D 6 C 4 4 C C 4 1 tѝ��C�ȝ��C�.
� __NAMESPACE Security F D 1 C 1 D 4 1 4 B 7 1 B 5 0 8 2 C 2 6 6 A 6 5 0 E 3 1 E F 6 D 5 0 1 9 3 8 2 7 2 4 2 4 4 B 6 8 5 F 2 1 7 C 0 A A E 0 0 A 9 2 1 uѝ��C�Cȝ��C�$ � __SystemSecurity E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C M՝��C� ȝ��C�� � �������� X � __InstanceProviderRegistration \\.\root\StandardCimv2:__Win32Provider.Name="NetNcCim" �F C I M _ P r o d u c t _Н��C�
o CIM_Product
) � ��� � � � m w � � S ` u � # � � r � �
� � ! . � � � q { � � S
a
�
�
A L �UUUU��������������������������������������������������������������������������������������������������������� � Win32_Product Description Instances of this class represent products as they are installed by MSI. A product generally correlates to a single installation package. AMENDMENT LOCALE ms_409 AssignmentType 6 +
� ! B J uint16 Description Assignment type of the product. Values V ` Per-user Per-machine HelpLink H
� � � � string Description The support link for the product. HelpTelephone L
� + string Description The support telephone for the product. InstallDate "
� � � � string Description The installation date. The InstallDate property has been deprecated in favor of the InstallDate2 property which is of type DateTime rather than String. New implementations should use the InstallDate2 property. InstallDate2 e
&
� � � � datetime Description The InstallDate2 property represents the installation date of the product. InstallLocation
2
� O W d string Description The location of the installed product. InstallSource D
� � � � string Description The installation source directory of the product. InstallState +
� V ^ k � � sint16 Description The installed state of the product. Values � � � � � � Bad Configuration Invalid Argument Unknown Package Advertised Absent Installed Language *
� ? G T string Description The language of the product. LocalPackage \
� � � � string Description The location of the locally cached package for this product. PackageCache
� 9 A N string Description The location of the locally cached package for this product. PackageCode X
� � � � string Description The identifier for the package from which this product was installed. PackageName `
� Z b o string Description The original package name for the product. ProductID @
� � � � string Description The product ID. RegCompany <
� 0 8 E string Description The company registered to use the product. RegOwner 8
� � � � string Description The owner registered to use the product. Transforms .
�
&
3
string Description The transforms of the product. URLInfoAbout P
� �
�
�
string Description The URL information for the product. URLUpdateInfo T
� string Description The URL update information the product. WordCount d
� x � � uint32 Description Summary information word count for the product �9 �
O � ! 8 � < G $ �# % % 1' �* `, k, I. 44 �5 �5 x7 |7 9 � Install ' 4 � � Description This method Will install an associated Win32_Product using the installation package provided through PackageLocation and any command line options that are supplied. The method can return the following values:
0 - Success.
2147549445 - RPC Server Fault Error.
Other - For integer values other than those listed above, refer to the documentation on error codes returned by the Windows Installer API and the Win32 error codes. Values � � Success RPC Server Fault Error Other p WIN-F6NF7R6I6PJ ROOT\cimv2\ms_409 ���� � � �� � � g i * ����������� � __PARAMETERS abstract PackageLocation string
� ; in
� ; b �� The path to the package that is to be installed Description )
� ; b ��� � ID 6
� M b ��� � string Options string
� p in
� p � �� The command line options for the install. These should be in the form of property=setting Description )
� p � ��! � ID 6
� � � ��! � e string AllUsers boolean
� � in
� � � �� DEPRECATED. The AllUsers input parameter has been deprecated as the functionality implied is not supported. The operation will effect all users on the machine.
Indicates whether the operation should be applied to the current user (FALSE) or all users on the machine (TRUE). Description )
� � � ��< ' ID 6
� � � ��< ' � boolean __ �� WIN-F6NF7R6I6PJ ROOT\cimv2\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � Admin ;
H
Description This method will preform an administrative install of an associated Win32_Product using the installation package provided through PackageLocation and any command line options that are supplied. The method can return the following values:
0 - Success.
2147549445 - RPC Server Fault Error.
Other - For integer values other than those listed above, refer to the documentation on error codes returned by the Windows Installer API and the Win32 error codes. Values ' 0 H Success RPC Server Fault Error Other ? WIN-F6NF7R6I6PJ ROOT\cimv2\ms_409 ���� � ��
�� � � * e Q ������������� � __PARAMETERS abstract PackageLocation string
� ; in
� ; b �� The path to the package that is to be admined Description )
� ; b ��� � ID 6
� K b ��� � string TargetLocation string
� u in
� u � �� The location for the administrative image to be installed at. Description )
� u � �� � ID 6
� � � �� � M string Options string
� � in
� � � �� The command line options for the upgrade. These should be in the form of property=setting Description )
� � � ��i
ID 6
� � � ��i
� string Label string
� X in
'
� X � �� � �� ID
4
� � �� � ��� string EnableCompression boolean
� - in '
� - U �� � �� ID 4
� � U �� � ��� boolean Version uint32
� � in '
� � �� � �� | � � � � � � 0 256 257 258 336 513 514 592 ValueMap 4
� � �� � ��� X ID A
� A �� � ��� X � uint32 __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � Defrag S �� Implemented � ae442007200009F ROOT\CIMV2 ���� � �� �� * � � � __PARAMETERS abstract Force boolean
� 1 in
� 1 Y �� ID )
� � Y ��� boolean __ �� ae442007200009F ROOT\CIMV2 ���� � �� �� * � � & ��������P � __PARAMETERS abstract
DefragAnalysis object
� : out
� : a �� ID
)
� � a ��� object ReturnValue uint32
� uint32 out
� ! �� __ � DefragAnalysis u$ �� Implemented � ae442007200009F ROOT\CIMV2 ���� � �2 �� � T * � � � ���������� � __PARAMETERS abstract DefragRecommended boolean
� = out
� = e �� ID )
� � e ��� boolean
DefragAnalysis object
� � out
� � ! �� ID
)
� � ! ��P object ReturnValue uint32
� � uint32 out
� � � �� __ � AddMountPoint :) ��G) W) Implemented MappingStrings _) Win32API|File System Functions|SetVolumeMountPoint � ae442007200009F ROOT\CIMV2 ���� � �� �� * � ����� � __PARAMETERS abstract Directory string
� 5 in
� 5 \ �� ID )
� � \ ��� string __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � Mount 6- ��C- S- Implemented MappingStrings [- Win32API|File System Functions|IOCTRL_VOLUME_ONLINE y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � Dismount 7/ ��D/ T/ Implemented MappingStrings \/ Win32API|File System Functions|FSCTRL_DISMOUNT_VOLUME,IOCTL_VOLUME_OFFLINE � ae442007200009F ROOT\CIMV2 ���� � �6 �� * � � B � � __PARAMETERS abstract Force boolean
� 1 in
� 1 Y �� ID )
� � Y ��� boolean Permanent boolean
� � in
� � �� ID )
� y ��> boolean __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � �� boolean HardwareAssisted
� f � �� boolean Imported
"
� � � �� boolean Name '
� � � �� � �� string NoAutoRelease
� ( � �� boolean NotSurfaced
� h � �� boolean NoWriters
� � � �� boolean Persistent
� � � �� boolean Plex
� � �� boolean Transportable
� ` � �� boolean �tNamespace
� K object:__Namespace � Z��0 c b@��� d v� � �B1�� . H3 c X�F�|
d ��� � ��)�
. d�Y c 2��/e d ���� � ���e� . ��)�� c ��k�N d �'in� � ��jY� ( � � � ^ �RCf* � B i d 2 E t w _ M S A D C E _ 1 _ T r a c e �ҝ��C� Bid2Etw_MSADCE_1_Trace C � �� + J U d k s } � � � u��������� � Bid2Etw_MSADCE_1_Trace_TextA Description MSADCE.1 formatted output (A) EventType EventTypeName TextA locale MS\0x409 ModID 6
� � � � � � �� uint32 WmiDataId Description Module ID msgStr
C
� L T _ l z � � �� object WmiDataId Description Text StringA extension RString m � B i d 2 E t w _ M S A D C E _ 1 _ T r a c e �ҝ��C� Bid2Etw_MSADCE_1_Trace C � �� + J U d k s } � � � u��������� � Bid2Etw_MSADCE_1_Trace_TextW Description MSADCE.1 formatted output (W) EventType EventTypeName TextW locale MS\0x409 ModID 6
� � � � � � �� uint32 WmiDataId Description Module ID msgStr
C
� L T _ l z � � �� object WmiDataId Description Text StringW extension RWString sg �
E v e n t T r a c e �ҝ��C�� EventTrace 6 � �� ) / W _ i � Bid2Etw_MSADCF_1 Description MSADCF.1 Guid {101C0E21-EBBA-A60A-EC3D-58797788928A} locale MS\0x409 B � B i d 2 E t w _ M S A D C F _ 1 �ҝ��C�� Bid2Etw_MSADCF_1 C � �� % / 5 ] j r z � � Bid2Etw_MSADCF_1_Trace Description MSADCF.1 Guid {101C0E22-EBBA-A60A-EC3D-58797788928A} DisplayName MSADCF locale MS\0x409 � B i d 2 E t w _ M S A D C F _ 1 _ T r a c e �ҝ��C� Bid2Etw_MSADCF_1_Trace C � �� + J U d k s } � � � u��������� � Bid2Etw_MSADCF_1_Trace_TextA Description MSADCF.1 formatted output (A) EventType EventTypeName TextA locale MS\0x409 ModID 6
� � � � � � �� uint32 WmiDataId Description Module ID msgStr
C
� L T _ l z � � �� object WmiDataId Description Text StringA extension RString m � B i d 2 E t w _ M S A D C F _ 1 _ T r a c e �ҝ��C� Bid2Etw_MSADCF_1_Trace C � �� + J U d k s } � � � u��������� � Bid2Etw_MSADCF_1_Trace_TextW Description MSADCF.1 formatted output (W) EventType EventTypeName TextW locale MS\0x409 ModID 6
� � � � � � �� uint32 WmiDataId Description Module ID msgStr
C
� L T _ l z � � �� object WmiDataId Description Text StringW extension RWString sg �
E v e n t T r a c e �ҝ��C�� EventTrace 6 � �� ) / W _ i � Bid2Etw_MSADCO_1 Description MSADCO.1 Guid {5C6CE734-1B3E-705E-C2AB-B272D99AAF8F} locale MS\0x409 B � B i d 2 E t w _ M S A D C O _ 1 �ҝ��C�� Bid2Etw_MSADCO_1 C � �� % / 5 ] j r z � � Bid2Etw_MSADCO_1_Trace Description MSADCO.1 Guid {5C6CE735-1B3E-705E-C2AB-B272D99AAF8F} DisplayName MSADCO locale MS\0x409 � B i d 2 E t w _ M S A D C O _ 1 _ T r a c e �ҝ��C� Bid2Etw_MSADCO_1_Trace C � �� + J U d k s } � � � u��������� � Bid2Etw_MSADCO_1_Trace_TextA Description MSADCO.1 formatted output (A) EventType EventTypeName TextA locale MS\0x409 ModID 6
� � � � � � �� uint32 WmiDataId Description Module ID msgStr
C
� L T _ l z � � �� object WmiDataId Description Text StringA extension RString m � B i d 2 E t w _ M S A D C O _ 1 _ T r a c e �ҝ��C� Bid2Etw_MSADCO_1_Trace C � �� + J U d k s } � � � u��������� � Bid2Etw_MSADCO_1_Trace_TextW Description MSADCO.1 formatted output (W) EventType EventTypeName TextW locale MS\0x409 ModID 6
� � � � � � �� uint32 WmiDataId Description Module ID msgStr
C
� L T _ l z � � �� object WmiDataId Description Text StringW extension RWString sg �
E v e n t T r a c e �ҝ��C�� EventTrace 6 � �� ) / W _ i � Bid2Etw_MSADDS_1 Description MSADDS.1 Guid {13CD7F92-5BAA-8C7C-3D72-B69FAC139A46} locale MS\0x409 B � B i d 2 E t w _ M S A D D S _ 1 �ҝ��C�� Bid2Etw_MSADDS_1 C � �� % / 5 ] j r z � � Bid2Etw_MSADDS_1_Trace Description MSADDS.1 Guid {13CD7F93-5BAA-8C7C-3D72-B69FAC139A46} DisplayName MSADDS locale MS\0x409 � B i d 2 E t w _ M S A D D S _ 1 _ T r a c e �ҝ��C� Bid2Etw_MSADDS_1_Trace C � �� + J U d k s } � � � u��������� � Bid2Etw_MSADDS_1_Trace_TextA Description MSADDS.1 formatted output (A) EventType EventTypeName TextA locale MS\0x409 ModID 6
� � � � � � �� uint32 WmiDataId Description Module ID msgStr
C
� L T _ l z � � �� object WmiDataId Description Text StringA extension RString m � B i d 2 E t w _ M S A D D S _ 1 _ T r a c e �ҝ��C� Bid2Etw_MSADDS_1_Trace C � �� + J U d k s } � � � u��������� � Bid2Etw_MSADDS_1_Trace_TextW Description MSADDS.1 formatted output (W) EventType EventTypeName TextW locale MS\0x409 ModID 6
� � � � � � �� uint32 WmiDataId Description Module ID msgStr
C
� L T _ l z � � �� object WmiDataId Description Text StringW extension RWString sg �
E v e n t T r a c e �ҝ��C�� EventTrace 6 � �� ' - U ] g � Bid2Etw_ADODB_1 Description ADODB.1 Guid {04C8A86F-3369-12F8-4769-24E484A9E725} locale MS\0x409 B � B i d 2 E t w _ A D O D B _ 1 �ҝ��C�� Bid2Etw_ADODB_1 C � �� $ - 3 [ h o w � � Bid2Etw_ADODB_1_Trace Description ADODB.1 Guid {04C8A870-3369-12F8-4769-24E484A9E725} DisplayName ADODB locale MS\0x409 � B i d 2 E t w _ A D O D B _ 1 _ T r a c e �ҝ��C� Bid2Etw_ADODB_1_Trace C � �� * H S b i q { � � � u��������� � Bid2Etw_ADODB_1_Trace_TextA Description ADODB.1 formatted output (A) EventType EventTypeName TextA locale MS\0x409 ModID 6
� � � � � � �� uint32 WmiDataId Description Module ID msgStr
C
� J R ] j x � � �� object WmiDataId Description Text StringA extension RString gS �
E v e n t T r a c e �sR|�C�� EventTrace ) D ��O W � CscService Description Microsoft-Windows-OfflineFiles-CscService AMENDMENT LOCALE � ���~p < r,��� I ��� 4 zM}) 2 �L��[ � 7^�p p P r o t e c t i o n T e c h n o l o g y S t a t u s ;ݝ��C�� k $ ProtectionTechnologyStatus 4 & � t � �� � �� � � 8 � � b
� �
/ � � g � � t � � m � - � � � � >
X
�
� � � � � � F
X
�
� � % 4 u � m y � � ( �/ + - 8 � AntimalwareHealthStatus Description This is a singleton that represents the Microsoft Antimalware service status AntimalwareHealthStatusProv singleton AntispywareEnabled ! )
� � � � � �� boolean Description Antispyware component is enabled AntispywareSignatureAge M )
� o w � � �� uint32 Description Antispyware signaturen age in days AntispywareSignatureUpdateDateTime E )
� � �� string Description Antispyware signature update date and time (using round-trip UTC format) AntispywareSignatureVersion U )
� � � � � �� string Description Antispyware signature version (major, minor, build, revision) AntivirusEnabled )
� S \ i � �� boolean Description Antivirus component is enabled AntivirusSignatureAge I )
� � � � � �� uint32 Description Antivirus signature age in days AntivirusSignatureUpdateDateTime A )
� f n { � �� string Description Antivirus signature update date and time (using round-trip UTC format) AntivirusSignatureVersion Q )
� * � �� string Description Antivirus signature version (major, minor, build, revision) BehaviorMonitorEnabled
)
� � � � � �� boolean Description Behavior monitor is enabled EngineVersion
# )
� / 7 D � �� string Description Engine version (major, minor, build, revision) IoavProtectionEnabled )
� � � � � �� boolean Description IOAV protection is enabled LastFullScanAge 7 )
� < D Q � �� uint32 Description Last full scan age in days LastFullScanDateTimeEnd 3 )
� � � � � �� string Description Last full scan date end and time (using round-trip UTC format) LastFullScanDateTimeStart + )
� d l y � �� string Description Last full scan start date and time (using round-trip UTC format) LastFullScanSource @ C
� ' 4 � ��K U | � uint8 Description Last full scan source ValueMap m p s v y 0 1 2 3 4 Values � � � � � Unknown User System Realtime IOAV LastQuickScanAge ; )
�
!
� �� uint32 Description Last quick scan age in days LastQuickScanDateTimeEnd / )
� �
�
�
� �� string Description Last quick scan end date and time (using round-trip UTC format) LastQuickScanDateTimeStart ' )
� 8 @ M � �� string Description Last quick scan start date and time (using round-trip UTC format) LastQuickScanSource ? C
� � �
� ��" , S [ uint8 Description Last quick scan source ValueMap D G J M P 0 1 2 3 4 Values s | � � � Unknown User System Realtime IOAV Name @
� � string NisEnabled Y )
�
� �� boolean Description Network Inspection System is enabled NisEngineVersion [ )
� �
�
�
� �� string Description Network Inspection System engine version (major, minor, build, revision) NisSignatureVersion _ )
� : B O � �� string Description Network Inspection System signature version (major, minor, build, revision) OnAccessProtectionEnabled )
� � � � �� boolean Description On-access protection is enabled ProductStatus C
� � � � � ��� � & . uint32 Description Overall product status (MPSTATUS_FLAG enumeration bitmask) ValueMap @ J T ^ h r | � � � � � � � � � � � � � 0x000000 0x000001 0x000002 0x000004 0x000008 0x000010 0x000020 0x000040 0x000080 0x000100 0x000200 0x000400 0x000800 0x001000 0x002000 0x004000 0x008000 0x010000 0x020000 0x040000 0x080000 0x100000 0x200000 Values � � � � � � ! 3 C R j � � � � � � � 0 D Y NONE SERVICE_UNAVAILABLE MPENGINE_UNAVAILABLE THREAT_FULLSCAN_REQUIRED THREAT_REBOOT_REQUIRED THREAT_MANUAL_STEPS_REQUIRED DUE_AV_SIGNATURE DUE_AS_SIGNATURE DUE_QUICK_SCAN DUE_FULL_SCAN INPROGRESS_SYSTEM_SCAN INPROGRESS_ROUTINE_CLEANING DUE_SAMPLES EVALUATION_MODE NONGENUINE PRODUCT_EXPIRED THREAT_CALLISTO_REQUIRED SERVICE_ON_SYSTEM_SHUTDOWN SERVICE_CRITICAL_FAILURE SERVICE_NON_CRITICAL_FAILURE HEALTH_INITIALIZED DUE_PLATFORM_UPDATE INPROGRESS_PLATFORM_UPDATE RealTimeScanDirection C
� � � � � �� ! : B uint8 Description Real-time scan direction enumeration ValueMap 1 4 7 0 1 2 Values R X b Both Incoming Outcoming RtpEnabled )
� � � � � �� boolean Description Rtp is enabled SchemaVersion @
� string Antimalware 1.0.0.1 �2 C 1 F A B C 8 7 2 8 F 9 E 0 7 6 F 6 7 2 7 D B B 7 B A 1 3 5 8 C 4 F 0 1 0 4 0 7 3 5 6 D E B 9 8 3 B F 7 6 9 E 4 1 D 5 8 4 8 D <ݝ��C�5ݝ��C�� P! ���: �� �� W � Win32_ProviderEx {8a696d12-576b-422e-9712-01b9dd84b446} AntimalwareHealthStatusProv E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C =ݝ��C� ȝ��C�� � �� �� w � __InstanceProviderRegistration \\.\root\Microsoft\SecurityClient:Win32_ProviderEx.Name="AntimalwareHealthStatusProv" R O O T \ M i c r o s o f t \ S e c u r i t y C l i e n t _ _ I n s t a n c e P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 3 C E 8 5 8 2 E E 8 F F A 9 2 8 E 4 2 F 8 4 B 5 C D F 7 2 4 1 A 2 5 C 3 C 4 6 3 C 6 F 6 E 6 8 C 9 E F B 4 7 A 5 6 0 B A D 8 7 2 \ K I _ E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C \ I _ 0 1 0 F E 0 8 C C 1 5 3 D C 1 1 B 4 9 7 1 C 1 8 A A 2 5 B 4 2 6 D A 1 6 6 8 4 1 A 5 3 0 7 4 8 D 5 F 8 B 5 C 0 F 7 F A 9 9 E 8 E 0 M S F T _ P r i n t e r P o r t Sݝ��C�� C MSFT_PrinterPort 6 % � �� � > L T ^ � � �������������������������������������������������������������������� � MSFT_LprPrinterPort UMLPackagePath CIM::Core::CoreElements MSFT_Printer locale HostName 6
� � � �� string PrinterName :
� � � �� string �4 1 C 5 3 E 6 D B 1 A C F 2 4 5 3 C E F D 4 1 3 9 8 1 9 8 E 6 1 3 F 1 0 D F F 4 7 7 0 9 E C A B 1 D 7 F 0 3 7 7 5 6 A C 8 C E 7 uR|�C�ȝ��C�� � � __thisNAMESPACE � �� � � ? ? ? �-}�� 1�4G � c��� � �L� 3 �#p� ���3� H ����$ E q�b@i
N R⺷ � �Ǔ�B ) N�Ґk � Ҫ�� G �W�N � ��� R R O O T \ S t a n d a r d C i m v 2 _ _ I n s t a n c e P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ B 5 E C 8 A D F 9 6 E 5 E 6 0 6 4 A D 9 E B 0 B 1 3 7 0 F D B D 6 6 4 E 0 B 0 E 7 8 0 2 B 6 A 2 A 5 7 9 6 B 5 F A F 2 2 A F E E \ K I _ E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C \ I _ 5 3 A F 8 6 0 8 C 1 0 4 F 8 6 6 5 5 F 4 2 A 8 8 7 1 E 5 F 7 3 2 2 5 A 8 D 6 8 1 F 6 6 B 8 1 5 1 B 7 C 2 0 0 C 4 6 C 5 1 8 C 5 0 C I M _ S e t t i n g D a t a 5՝��C�� CIM_SettingData % : �����������������B � MSFT_NetSettingData UMLPackagePath CIM::Core::Settings locale � �՝��C�� ) ��% 5 J R ] � � | � � � U��������������� � CIM_ElementSettingData Association UMLPackagePath CIM::Core::Settings locale IsCurrent
� � � � uint16 ValueMap � � � 0 1 2 IsDefault
� � � � uint16 ValueMap
0 1 2 IsNext
� J R \ uint16 ValueMap p s v y 0 1 2 3 ManagedElement f
� � � �� ref:CIM_ManagedElement SettingData f
� � �� ref:CIM_SettingData ti �E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C s֝��C� ȝ��C�� � ��������] v � __InstanceProviderRegistration \\.\Root\StandardCimv2:__Win32Provider.Name="NetSwitchTeam" e WQL:UnarySelect R O O T \ S t a n d a r d C i m v 2 _ _ I n s t a n c e P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ B 5 E C 8 A D F 9 6 E 5 E 6 0 6 4 A D 9 E B 0 B 1 3 7 0 F D B D 6 6 4 E 0 B 0 E 7 8 0 2 B 6 A 2 A 5 7 9 6 B 5 F A F 2 2 A F E E \ K I _ E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C \ I _ F D F F 3 C 9 B 0 6 6 4 E 0 F A F 2 8 4 B F A 1 2 A E 8 B 9 7 8 2 E 6 E 9 9 E 4 B A E A 0 5 A B 7 8 5 1 7 3 0 A F E 4 0 F 0 9 2 + R O O T \ M i c r o s o f t \ W i n d o w s \ S t o r a g e \ P r o v i d e r s _ v 2 _ _ E v e n t P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ F E 3 E A 0 0 6 C 3 2 9 2 9 5 0 A 7 6 C 2 B 5 A 0 1 8 5 D 7 D F 9 9 A D D 6 F D 6 5 0 2 E 0 A C 0 7 9 E 3 A 8 6 5 0 E 7 6 E 3 A \ K I _ 0 8 9 9 3 0 7 4 0 8 A 3 2 0 4 0 A 6 D A 1 9 C 0 B 1 E C 2 7 4 5 A 3 D 6 0 4 B A A 9 D F F E 8 E E 4 B 7 5 C 3 D 9 1 E 1 6 1 0 9 \ I _ 4 B D 7 0 4 E F D 8 2 E 9 0 D 5 8 D 3 C 4 0 6 9 7 8 C 7 C 0 4 4 F 0 1 3 A 6 4 5 1 8 E 8 C 5 4 7 8 5 1 9 5 D 2 3 5 8 D 9 C F A E E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C �֝��C� ȝ��C�� � ��������o � � __InstanceProviderRegistration \\.\root\Microsoft\Windows\Storage\Providers_v2:__Win32Provider.Name="wsp_fs" w WQL:UnarySelect + R O O T \ M i c r o s o f t \ W i n d o w s \ S t o r a g e \ P r o v i d e r s _ v 2 _ _ I n s t a n c e P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ F E 3 E A 0 0 6 C 3 2 9 2 9 5 0 A 7 6 C 2 B 5 A 0 1 8 5 D 7 D F 9 9 A D D 6 F D 6 5 0 2 E 0 A C 0 7 9 E 3 A 8 6 5 0 E 7 6 E 3 A \ K I _ E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C \ I _ 4 B D 7 0 4 E F D 8 2 E 9 0 D 5 8 D 3 C 4 0 6 9 7 8 C 7 C 0 4 4 F 0 1 3 A 6 4 5 1 8 E 8 C 5 4 7 8 5 1 9 5 D 2 3 5 8 D 9 C F A E 5 2 1 3 �֝��C�s 4 ��% 3 8 ��B O � � � � ���������
� MSFT_VolumeToFileShare Association ClassVersion 1.0 Abstract Description Association between a volume and its file shares FileShare f
� � � �� ref:MSFT_FileShare Volume f
� � � �� ref:MSFT_Volume Ab � C I M _ M a n a g e d S y s t e m E l e m e n t (՝��C�� 2 " CIM_ManagedSystemElement ) $ = ��G ��������������������������������������������������O � CIM_LogicalElement UMLPackagePath CIM::Core::CoreElements Abstract locale � C I M _ L o g i c a l P o r t ��C�f � CIM_LogicalPort ! 5 = \ � � � � �
I ^ � � � � � � � ���������UU����������������������������������������������� ���� �������� ������������������������������������������������������������������������������������������������������������������������������������������������� � CIM_NetworkPort UMLPackagePath CIM::Device::Ports locale ActiveMaximumTransmissionUnit , �
� � � � uint64 PUnit byte AutoSense - �
� � boolean FullDuplex . �
� � boolean LinkTechnology / � +
� M U j � � uint16 ModelCorrespondence r CIM_NetworkPort.OtherLinkTechnology ValueMap � � � � � � � � � � � � 0 1 2 3 4 5 6 7 8 9 10 11 NetworkAddresses 0 �
� 9 A @ string MaxLen OtherLinkTechnology 1 �
� � � � string ModelCorrespondence � CIM_NetworkPort.LinkTechnology OtherNetworkPortType 2 � +
� & 2 Y n string Deprecated : CIM_NetworkPort.OtherPortType ModelCorrespondence v CIM_LogicalPort.PortType PermanentAddress 3 �
� � � @ string MaxLen PortNumber 4 �
� uint16 Speed @ * � +
� Q Y ` n x uint64 PUnit bit / second Override Speed SupportedMaximumTransmissionUnit 5 �
� � � � uint64 PUnit byte � C I M _ P r o t o c o l E n d p o i n t ,��C� j CIM_ProtocolEndpoint + ) J W \ e h z � � ������������������������������������������������������ ���� �������� ��������������������������������/ � CIM_DNSProtocolEndpoint UMLPackagePath CIM::Network::ProtocolEndpoints Description 654 Version 5 DHCPOptionsToUse Z E
� � � � � � W a � � uint16 Description 650 ModelCorrespondence 2 CIM_DHCPProtocolEndpoint.OptionsReceived CIM_DNSSettingData.DHCPOptionsToUse ValueMap y | � � � 8 14 17 18..32767 32768..65535 Values � � � � � 651 652 653 29 30 Hostname ^ )
� * � �� string Description 649 � C I M _ M a n a g e d E l e m e n t 4՝��C�� CIM_ManagedElement ) ! 6 ��@ H U � � }���������������� � CIM_SettingData UMLPackagePath CIM::Core::Settings Abstract locale ElementName @ )
� � � ��� � string Required Override ElementName InstanceID @ )
� � � ��
string Override InstanceID �5 7 E 5 F 3 A D D 9 E 2 4 2 C 4 E 9 F 9 E D F 7 9 A A 9 7 F 7 9 E 7 9 1 1 C 5 A 8 B 9 0 2 E C 1 5 0 D 6 4 4 2 E 3 B 8 5 A 5 A A ��1��ȝ��C�� �����M @ 9 ` � __Win32Provider {71F3A4A2-DC3F-4AD1-A1AD-81E2109D4414} NetworkServiceHost Win32_DeviceGuard ame ^ )
� * � �� string Description 649 �ring Description 649 �ceGuard �i�"� ;S� � �0�� A
�� ɮ-�5 � �Kc �I�
� ��E
� � ����� � �Jw 7#�/� ! tZ��� �~x� =]kk� � I I S _ A u t h e n t i c a t i o n _ T r a n s �>�4 �� " IIS_Authentication_Trans 6 # P _ u ��� � � �
_ j � � & . � � _U���������������������������� � W3AuthKerberosFailed Description Unable to negotiate Kerberos authentication EventTypeName AUTH_KERBEROS_FAILED AMENDMENT LOCALE ADConfigIsOK
� � � � boolean Description Active directory configured properly APUserName
� 6 > K string Description App pool user name ContextId
� � � � object Description Context ID KerberosInfo
� � � string Description Kerberos configuration details KMUsed
� Z c p boolean Description Kernel mode is used during SSPI authentication SPNName
� � � � string Description Service principal name � I I S _ A u t h e n t i c a t i o n _ T r a n s �>�4 �w
" IIS_Authentication_Trans 6 + [ j � ��� � � ������������� � W3AuthAnonPasswdChangeNeeded Description Anonymous account password needs to be changed EventTypeName AUTH_ANON_PASSWD_CHANGE_NEEDED AMENDMENT LOCALE ContextId
� � � � object Description Context ID � I I S _ A u t h e n t i c a t i o n _ T r a n s �>�4 �� " IIS_Authentication_Trans 6 $ H W o ��z � � � � _����������������, � W3AuthRequestAuthType Description Authentication type in the request EventTypeName AUTH_REQUEST_AUTH_TYPE AMENDMENT LOCALE ContextId
� � � � object Description Context ID RequestAuthType +
� $ , 9 S f uint32 Description Auth type of the request ValueDescriptions � � � � � Anonymous authentication Basic authentication Windows integrated authentication Digest authenticaion Passport authentication SSL Certificate mapping authentication ti � I I S _ A u t h e n t i c a t i o n _ T r a n s �>�4 �7
" IIS_Authentication_Trans 6 1 @ J ��U ] h ������������� � W3AuthEnd Description IIS authentication ends EventTypeName AUTH_END AMENDMENT LOCALE ContextId
� � � � object Description Context ID � I I S _ T r a c e �>�4 �� IIS_Trace ) ! 6 ��A ��������I � IIS_Security_Trans Description IIS security events AMENDMENT LOCALE � I I S _ S e c u r i t y _ T r a n s �>�4 �� IIS_Security_Trans 6 ( A P q ��| � � � � _����������������@ � W3SecIllegalShortFilename Description Illegal short file name EventTypeName SECURITY_ILLEGAL_SHORT_FILENAME AMENDMENT LOCALE ContextId
� � � � object Description Context ID FileName
� ' string Description Illegal short file name � I I S _ S e c u r i t y _ T r a n s �>�4 �� IIS_Security_Trans 6 2 A W ��b j u � � _����������������# � W3SecRejectedIP Description Remote IP rejected EventTypeName SECURITY_REJECTED_IP AMENDMENT LOCALE ContextId
� � � � object Description Context ID IPAddress
� � string Description Rejected IP address � I I S _ S e c u r i t y _ T r a n s �>�4 �� IIS_Security_Trans 6 $ 7 F b ��m u � � � _����������������, � W3SecRejectedHostname Description Hostname rejected EventTypeName SECURITY_REJECTED_HOSTNAME AMENDMENT LOCALE ContextId
� � � � object Description Context ID HostName
� string Description Rejected host name � I I S _ S e c u r i t y _ T r a n s �>�4 �^
IIS_Security_Trans 6 ! E T w ��� � � ������������� � W3SecRequireSSL128 Description IIS requires 128bit SSL Encryption EventTypeName SECURITY_REJECTED_REQUIRE_SSL_128 AMENDMENT LOCALE ContextId
� � � � object Description Context ID � I I S _ S e c u r i t y _ T r a n s �>�4 �� IIS_Security_Trans 6 $ ; J g ��r z � � � J V � � _�������������������������? � W3SecFileAccessDenied Description File access is denied EventTypeName SECURITY_FILE_ACCESS_DENIED AMENDMENT LOCALE AccountName
� � � � string Description The account name used to access the file ContextId
� ) 1 > object Description Context ID DomainName
� � � � string Description The domain name of the account used to access the file FileName
�
string Description The name of the file being accessed � I I S _ S e c u r i t y _ T r a n s �>�4 �� IIS_Security_Trans 6 # M \ x ��� � � � � _����������������] � W3SecDeniedByMimemap Description File access is denied by mime map policy EventTypeName SECURITY_DENIED_BY_MIMEMAP AMENDMENT LOCALE ContextId
� � � � object Description Context ID FileName
� ! . string Description The name of the file being denied by mime map Mi � I I S _ S e c u r i t y _ T r a n s �>�4 �� IIS_Security_Trans 6 , S b � ��� � � � � _����������������W � W3SecDeniedByISAPIRestriction Description Access is denied by ISAPI restriction EventTypeName SECURITY_DENIED_BY_ISAPI_RESTRICTION AMENDMENT LOCALE ContextId
� � � � object Description Context ID ImageName
� * 2 ? string Description The gateway image name � I I S _ S e c u r i t y _ T r a n s �>�4 �� IIS_Security_Trans 6 * O ^ � ��� � � � � _����������������Q � W3SecDeniedByCGIRestriction Description Access is denied by CGI restriction EventTypeName SECURITY_DENIED_BY_CGI_RESTRICTION AMENDMENT LOCALE ContextId
� � � � object Description Context ID ImageName
� $ , 9 string Description The gateway image name � I I S _ S e c u r i t y _ T r a n s �>�4 �J IIS_Security_Trans 6 ' I X y ��� � � � � M Z _���������������������� � W3SecDeniedByAccessFlags Description Access is denied by access flags EventTypeName SECURITY_DENIED_BY_ACCESS_FLAGS AMENDMENT LOCALE ContextId
� � � � object Description Context ID CurrentFlags
� & 3 uint32 Description Flags from configuration NeededFlags
� � � � uint32 Description Flags needed to continue � ofResourceName] � �ѝ��C�M % ' �� � �� �
) C � � ) � � � ^ s � � D ] � � 0 = UU������������������������������������ � Win32_Tpm Singleton Win32_TpmProvider IsActivated_InitialValue )
� z � � � �� boolean Description Implemented IsEnabled_InitialValue )
� � � �� boolean Description Implemented IsOwned_InitialValue )
� ` i v x �� boolean Description Implemented ManufacturerId )
� � � � � �� uint32 Description Implemented ManufacturerIdTxt )
� : B O Q �� string Description Implemented ManufacturerVersion )
� � � � � �� string Description Implemented ManufacturerVersionFull20 )
� ( 5 7 �� string Description Implemented ManufacturerVersionInfo )
� � � � � �� string Description Implemented PhysicalPresenceVersionInfo )
� ! # �� string Description Implemented SpecVersion )
� t | � � �� string Description Implemented �� / C G T ] � � � � � � �
M
Q
z
�
�
�
� J N � � � � � D l � � � � B! K! �! k# �$ % S% W% �( �( �( �( q* �* �* �, 3. :. r. Z0 �1 2 :2 >2 _5 m5 �5 �7 9 19 i9 �< F> P> �> �> �A �A �A D G ;G sG 'J �K �K L L O 8O pO tO �R �R �R �R WW jW �W �Y ][ s[ �[ �] f_ x_ �_ �a �d e ;e #g �h �h �h �h l l Pl Tl �p 32_ �p ,q 0q ]t _Tp ut �t �t Dv d_I ]v �v �x Wz ez �z �z �} �} �} � ool �� 0� I� ܇ mpl � ;� T� q� iti �� �� ō � ) � ,� a� t� � �� �� �� an ՙ
� � � men 5� m� q� � alu � K� d� �� � � C� G� ^� x f� �� �� �� scr Ȭ � � � M "� Z� ^� � �� .� 2� C� � IsEnabled ' 4 6 �� Description Implemented ae442007200009F ROOT\CIMV2\Security\MicrosoftTpm ���� � �� �� * � � # ������M � __PARAMETERS abstract IsEnabled boolean
� 5 OUT
� 5 ] �� ID )
� � ] ��� boolean ReturnValue uint32
� uint32 out
� �� __ � IsOwned y � � �� Description Implemented ae442007200009F ROOT\CIMV2\Security\MicrosoftTpm ���� � �� �� * � � ! ������K � __PARAMETERS abstract IsOwned boolean
� 3 OUT
� 3 [ �� ID )
� � [ ��� boolean ReturnValue uint32
� uint32 out
� �� __ � IsActivated � � � �� Description Implemented
ae442007200009F ROOT\CIMV2\Security\MicrosoftTpm ���� � �� �� * � � % ������O � __PARAMETERS abstract IsActivated boolean
� 7 OUT
� 7 _ �� ID )
� � _ ��� boolean ReturnValue uint32
� uint32 out
� �� __ � IsPhysicalClearDisabled 1
>
@
�� Description Implemented % ae442007200009F ROOT\CIMV2\Security\MicrosoftTpm ���� � �� �� * � � 1 ������[ � __PARAMETERS abstract IsPhysicalClearDisabled boolean
� C OUT
� C k �� ID )
� � k ��� boolean ReturnValue uint32
� $ uint32 out
� $ , �� __ � IsOwnerClearDisabled �
�
�
�� Description Implemented ae442007200009F ROOT\CIMV2\Security\MicrosoftTpm ���� � �� �� * � � . ������X � __PARAMETERS abstract IsOwnerClearDisabled boolean
� @ OUT
� @ h �� ID )
� � h ��� boolean ReturnValue uint32
� ! uint32 out
� ! ) �� __ � IsPhysicalPresenceHardwareEnabled . ; = �� Description Implemented 9 ae442007200009F ROOT\CIMV2\Security\MicrosoftTpm ���� � �� �� * � � ; ������e � __PARAMETERS abstract IsPhysicalPresenceHardwareEnabled boolean
� M OUT
� M u �� ID )
� � u ��� boolean ReturnValue uint32
� . uint32 out
� . 6 �� __ � IsOwnershipAllowed � � � �� Description Implemented ae442007200009F ROOT\CIMV2\Security\MicrosoftTpm ���� � �� �� * � � , ������V � __PARAMETERS abstract IsOwnershipAllowed boolean
� > OUT
� > f �� ID��ԣ ���4 S k4ɒ_ � �DE �H� Z ��?r � 9Z4QS 2 ?�`ʅ �&X�� S �� 0 -c y��� [ ��b�u 8 |Sw#� � ��sD w
R O O T \ C I M V 2 _ _ I n s t a n c e P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 6 8 5 7 7 3 7 2 C 6 6 A 7 B 2 0 6 5 8 4 8 7 F B D 9 5 9 A A 1 5 4 E F 5 4 B 5 F 9 3 5 D C C 5 6 6 3 E 9 2 2 8 B 4 4 3 2 2 8 0 5 \ K I _ E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C \ I _ 8 3 0 6 F 1 3 5 4 8 6 4 A E 1 F 5 B 3 2 8 7 2 4 7 4 B 7 6 E B 9 7 8 2 0 F B B 1 C 9 E E F 8 B 0 3 6 9 4 6 C B 0 E D 5 E 5 3 1 E 5 5 8 E 5 7 E 5 F 3 A D D 9 E 2 4 2 C 4 E 9 F 9 E D F 7 9 A A 9 7 F 7 9 E 7 9 1 1 C 5 A 8 B 9 0 2 E C 1 5 0 D 6 4 4 2 E 3 B 8 5 A 5 A A ϝ��C�ȝ��C�� ���M 9 a � __Win32Provider {6D7A4B0E-66D5-4ac3-A7ED-0189E8CF5E77} NetworkServiceHost RouteEventProvider C I M _ L o g i c a l E l e m e n t ϝ��C�j M CIM_LogicalElement q � �� � $ ��4 > K ��[ e u ��� � �
� � � � G T � � � � , 5 r { � � � D M � � � � � � �WUU������������������������������������������������������������������������� � Win32_IP4RouteTable RouteProvider SupportsCreate CreateBy PutInstance SupportsDelete DeleteBy DeleteInstance SupportsUpdate Locale UUID {ABEE8C61-A43F-4088-0081-9D00B3FF6545} Age ,
� � � �� uint32 Destination 2
� ? � �� � �� � �� string Information D
� ~ � �� string InterfaceIndex 2
� � � �� � �� � �� sint32 Mask 2
� $ � �� � �� � �� string Metric1 0 '
� j � �� � �� sint32 Metric2
4 '
� � � �� � �� sint32 Metric3 8 '
� � � �� � �� sint32 Metric4 < '
� < � �� � �� sint32 Metric5 @ '
� � � �� � �� sint32 NextHop 2
� � � �� � �� � �� string Protocol
( )
� � ��$ . uint32 ValueMap j m p s v y | � � � � � � 1 2 3 4 5 6 7 8 9 10 11 12 13 14 Type $ 4
� � � �� � ��� � uint32 ValueMap
1 2 3 4 � C I M _ L o g i c a l E l e m e n t ϝ��C�� ' CIM_LogicalElement f � �� � - 5 ; c ��s } � ��� � � � W ` � � �W�������������������������������������� � Win32_IP4PersistedRouteTable RouteProvider Locale UUID {2CAF4666-AC9B-45AB-00A6-AF8C537794C2} SupportsCreate CreateBy PutInstance SupportsDelete DeleteBy DeleteInstance Destination 2
� � �� � �� � �� string Mask 2
� O � �� � �� � �� string Metric1 2
� � � �� � �� � �� sint32 NextHop 2
� � � �� � �� � �� string � C I M _ L o g i c a l I d e n t i t y ϝ��C� CIM_LogicalIdentity 6 � �� � " * 0 X e � 5��������� � Win32_ActiveRoute RouteProvider Locale UUID {7BA1437A-C51C-421B-A359-2906AF2BDD9F} SameElement f@ 6
� � � ��� � � � ref:Win32_IP4PersistedRouteTable Override SameElement MappingStrings � SystemElement f@ 6
� O � ��h r � � ref:Win32_IP4RouteTable Override SystemElement MappingStrings � � _ _ E x t r i n s i c E v e n t ϝ��C��
__ExtrinsicEvent " ( ������������O � Win32_IP4RouteTableEvent Locale UUID {1C385E29-A5B4-40F0-96CF-929FC00958B} �0 8 9 9 3 0 7 4 0 8 A 3 2 0 4 0 A 6 D A 1 9 C 0 B 1 E C 2 7 4 5 A 3 D 6 0 4 B A A 9 D F F E 8 E E 4 B 7 5 C 3 D 9 1 E 1 6 1 0 9 ϝ��C�ȝ��C�� M � � __EventProviderRegistration % select * from Win32_IP4RouteTableEvent \\.\Root\CIMV2:__Win32Provider.Name="RouteEventProvider"
R O O T \ C I M V 2 _ _ E v e n t P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 6 8 5 7 7 3 7 2 C 6 6 A 7 B 2 0 6 5 8 4 8 7 F B D 9 5 9 A A 1 5 4 E F 5 4 B 5 F 9 3 5 D C C 5 6 6 3 E 9 2 2 8 B 4 4 3 2 2 8 0 5 \ K I _ 0 8 9 9 3 0 7 4 0 8 A 3 2 0 4 0 A 6 D A 1 9 C 0 B 1 E C 2 7 4 5 A 3 D 6 0 4 B A A 9 D F F E 8 E E 4 B 7 5 C 3 D 9 1 E 1 6 1 0 9 \ I _ C 2 E E B A 8 5 1 C 3 4 6 D F 3 4 F 8 6 1 C 4 2 E 7 F A 8 E C B D D B 6 2 8 8 8 3 2 5 1 D E 3 7 9 8 4 D 2 F 4 D A 2 9 D 2 6 0 F 5 7 E 5 F 3 A D D 9 E 2 4 2 C 4 E 9 F 9 E D F 7 9 A A 9 7 F 7 9 E 7 9 1 1 C 5 A 8 B 9 0 2 E C 1 5 0 D 6 4 4 2 E 3 B 8 5 A 5 A A ϝ��C�ȝ��C�� �?����M 9 a � __Win32Provider {7FB1D98A-F895-4761-8DC2-774969C84D10} NetworkServiceHost NamedJobObjectProv E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C
ϝ��C� ȝ��C�� � ��������Z s � __InstanceProviderRegistration \\.\Root\CIMV2:__Win32Provider.Name="NamedJobObjectProv" b WQL:UnarySelect
R O O T \ C I M V 2 _ _ I n s t a n c e P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 6 8 5 7 7 3 7 2 C 6 6 A 7 B 2 0 6 5 8 4 8 7 F B D 9 5 9 A A 1 5 4 E F 5 4 B 5 F 9 3 5 D C C 5 6 6 3 E 9 2 2 8 B 4 4 3 2 2 8 0 5 \ K I _ E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C \ I _ 0 A B 5 F E 8 B 8 2 0 2 5 A B 1 3 1 1 A 7 2 2 A D B C A B A 3 9 5 4 8 B D 0 6 B 6 E 3 E E 3 F D C 2 7 2 C 8 8 E E D C F 6 5 D C 5 5 7 E 5 F 3 A D D 9 E 2 4 2 C 4 E 9 F 9 E D F 7 9 A A 9 7 F 7 9 E 7 9 1 1 C 5 A 8 B 9 0 2 E C 1 5 0 D 6 4 4 2 E 3 B 8 5 A 5 A A ϝ��C�ȝ��C�� �?����M 9 i � __Win32Provider {C0AA9D93-2EF5-47fb-960C-F90FC644B48E} NetworkServiceHost NamedJobObjectActgInfoProv E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C ϝ��C� ȝ��C�� � ��������b { � __InstanceProviderRegistration \\.\Root\CIMV2:__Win32Provider.Name="NamedJobObjectActgInfoProv" j WQL:UnarySelect C I M _ L o g i c a l I d e n t i t y
ϝ��C�Y CIM_LogicalIdentity ) � ��� � � G V ���������� � Win32_ActiveRoute Description The ActiveRoute class assoctiates the current IP4 Route being used with the persisted IP route table. AMENDMENT LOCALE SameElement f@
� � � ref:Win32_IP4PersistedRouteTable Description The SameElement represents persistent IP route in thisrelationship. SystemElement f@
� � � � ref:Win32_IP4RouteTable Description The SystemElement represents the active IP route beingused. � _ _ E x t r i n s i c E v e n t ϝ��C�?
__ExtrinsicEvent ) ' � ��� ������������� � Win32_IP4RouteTableEvent Description The Win32_IP4RouteTableEvent class represents IP route change events resulting from the addition, removal or modification of IP routes on the computer system. AMENDMENT LOCALE � �ySelect ��@ � $ �� � ��D�� Xݝ��C�� 6 � �� � ' 5 : B � MSFT_PrinterNfcTagTasks MSFT_Printer ClassVersion 1.0 locale K T � Nfc � � r � � � �
� WriteByManualSpecification 6 ��C �� implemented static ae442007200009F ROOT\StandardCimV2 ���� � �� �� � � * � � D ����������5 � __PARAMETERS abstract SharePath string
� 5 In
� 5 \ �� ID )
� � \ ��� string WsdAddress string
� � In
� � �� ID )
� { ��@ string Lock boolean
� � In
� � � �� ID )
� , � ��� boolean __ �� ae442007200009F ROOT\StandardCimV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � WriteByPrinterNfcTag �� �� implemented static � ae442007200009F ROOT\StandardCimV2 ���� � �� �� * � ����L � __PARAMETERS abstract
InputObject object
� 7 In
� 7 ^ �� MSFT_PrinterNfcTag EmbeddedInstance
)
� 7 ^ ��� � ID
6
� 1 ^ ��� � � object:MSFT_PrinterNfcTag __ �� ae442007200009F ROOT\StandardCimV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � Read � ��� �� implemented static � ae442007200009F ROOT\StandardCimV2 ���� � �� �� * � ` � ��������� � __PARAMETERS abstract
cmdletOutput object
� 8 Out
� 8 _ �� MSFT_PrinterNfcTag EmbeddedInstance
)
� 8 _ ��� � ID
6
� 3 _ ��� � � object:MSFT_PrinterNfcTag ReturnValue uint32
� � uint32 out
� � � �� __ � C I M _ P h y s i c a l P a c k a g e 7tR|�C�� V CIM_PhysicalPackage ) ( �� & 0 " / � � � � � � � � � � ����W��������������������������������������������������������������������������������� � Win32_PhysicalMemoryArray Description The Win32_PhysicalMemoryArray class represents details about the computer system's physical memory. This includes the number of memory devices, memory capacity available, and memory type (for example, system memory or video memory). AMENDMENT LOCALE Location < +
� i q ~ � � uint16 Description The Location property indicates the physical location of the memory array. Values # , I Z l } � � � � � � Reserved Other Unknown System board or motherboard ISA add-on card EISA add-on card PCI add-on card MCA add-on card PCMCIA add-on card Proprietary add-on card NuBus PC-98/C20 add-on card PC-98/C24 add-on card PC-98/E add-on card PC-98/Local bus add-on card MaxCapacity >
� [ c p uint32 Description This property is deprecated, please use MaxCapacityEx MaxCapacityEx B +
� � � � � uint64 Description The MaxCapacity property indicates the maximum memory size (in bytes) installable for this particular memory array. If the size is unknown, the property is given a value of 0. Units kilobytes MemoryDevices J
�
uint16 Description The MemoryDevices property indicates the number of physical slots or sockets available in this memory array. MemoryErrorCorrection L +
� � � � O W uint16 Description The MemoryErrorCorrection property indicates the type of error correction used by the memory array. Values { � � � � � � � Reserved Other Unknown None Parity Single-bit ECC Multi-bit ECC CRC Tag @ )
� � �� string Description The Tag property contains a string that uniquely identifies the physical memory array.
Example: Physical Memory Array 1 Use N +
� � � � / 7 uint16 Description The Use property indicates how the memory is used in the computer system. Values [ e l u � � � � Reserved Other Unknown System memory Video memory Flash memory Non-volatile RAM Cache memory � uR|�C�� ) ) { ���
� � * 1 � � % � � 4 > � � i u � � � UU���������������������������������������> � RSOP_Session Description This describes a single RSOP session. Currently there can be only one of these per namespace. AMENDMENT LOCALE creationTime e +
� � � � datetime Description Time this namespace was created. DisplayName Creation Time flags +
� j r � � uint32 Description Flags. DisplayName Flags id 6
� � � ��� � string Description Session ID DisplayName ID SecurityGroups +
� ^ f s � � string Description Security IDs of the new groups for target. DisplayName Security Groups Site +
� � ! . string Description Site of target DisplayName Site slowLink $ +
� w � � � � boolean Description Flag that indicates whether the policy was applied over a slow link. DisplayName Is Slow Link SOM +
� , 4 A W d string Description New group of target. DisplayName SOM targetName +
� � � � � � string Description Target user or computer. DisplayName Target Name ttlMinutes +
� < D Q � � uint32 Description Time after lastPolicyApplicationTime when this namespace can be deleted. DisplayName Time to Live version +
� �
( 5 uint32 Description Version number of schema. DisplayName Version � �6��� ~ rH3 h 3gjv > hδ P ���= � ��Cݺ x �]��2 H L��z l X e S o s P k g _ s p i n l o c k _ b a c k o f f �^��7 �4 ? # XeSosPkg_spinlock_backoff ) � �� + 7 � � 5 ? � � < F � � � � ( � � � � WUU������������������������������������������������������������< � spinlock_backoff EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid backoffs )
� " * � �� uint64 WmiDataId category
0 P
� � �
� ��� � � � � uint64 WmiDataId XEMapId ValueMap � � � � � � 2 1 5 0 4 3 Values / F i � � SOS_INTERNAL_RW_SPINLOCK SOS_INTERNAL_SPINLOCK SOS_SPINLOCK_CATEGORY_MAX_INVALID SOS_SPINLOCK_CATEGORY_MIN_INVALID SQLSERVR_RW_SPINLOCK SQLSERVR_SPINLOCK description 8 6
� � �� , string WmiDataId StringTermination NullTerminated duration $ )
� } � � �� uint32 WmiDataId FragmentId 6
� � � � � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� a i t � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � �� uint32 WmiDataId Description SequenceNumber spinlock_address
4
� j r � ��} �� object WmiDataId Pointer type ( )
� � � � �� uint64 WmiDataId worker
4
� ( � ��3 �� object WmiDataId Pointer � X e S o s P k g �^��7 �@ XeSosPkg
C � ��# 0 j p � � � � _����� � XeSosPkg_spinlock_backoff_warning Description Occurs when spinlock backoff warning is sent to errorlog Guid {b76a6cc7-030f-4f40-a4a1-64560c516177} locale MS\0x409 DisplayName spinlock_backoff_warning �! X e S o s P k g _ s p i n l o c k _ b a c k o f f _ w a r n i n g �^��7 �� ; + XeSosPkg_spinlock_backoff_warning # ) � �� %
3 ? � � = G � � D P � � F V � � : @ � � WU��������������������������������������������������������� � spinlock_backoff_warning EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid backoffs )
� * 2 � �� uint64 WmiDataId category , P
� � � � ��� � � � uint64 WmiDataId XEMapId ValueMap � � � � � � 2 1 5 0 4 3 Values 7 N q � � SOS_INTERNAL_RW_SPINLOCK SOS_INTERNAL_SPINLOCK SOS_SPINLOCK_CATEGORY_MAX_INVALID SOS_SPINLOCK_CATEGORY_MIN_INVALID SQLSERVR_RW_SPINLOCK SQLSERVR_SPINLOCK description
4 6
�
� ��! 4 string WmiDataId StringTermination NullTerminated FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� ( 5 � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber spinlock_address
4
� & � ��1 �� object WmiDataId Pointer type $ )
� w � �� uint64 WmiDataId worker
4
� � � � ��� �� object WmiDataId Pointer � X e S o s P k g �^��7 �( XeSosPkg
C � ��& 3 O U } � � � _����� � XeSosPkg_set_abort_callback_executed Description SetAbort callback executed Guid {c500feaf-dd92-4177-a9ab-5813b759f090} locale MS\0x409 DisplayName set_abort_callback_executed �$ X e S o s P k g _ s e t _ a b o r t _ c a l l b a c k _ e x e c u t e d �^��7 �V . XeSosPkg_set_abort_callback_executed & ) � �� ( 6 B � � h p & 7 � � 0 > W����������������������������� � set_abort_callback_executed EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid FragmentId 6
� < D O \ � �� uint32 WmiDataId Description FragmentId opcode P
� � � � ��� � � uint32 WmiDataId XEMapId ValueMap 0 1 Values ! Begin End RemainingLength 6
� { � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � �� uint32 WmiDataId Description SequenceNumber task_address
4
� � � � ��� �� object WmiDataId Pointer � X e S o s P k g �^��7 �P XeSosPkg
C � ��3 @ j p � � � � _����� � XeSosPkg_non_yielding_scheduler_callback_executed Description Non-yielding scheduler callback executed Guid {7d8e980c-d523-4955-934d-879742fbff2c} locale MS\0x409 DisplayName non_yielding_scheduler_callback_executed �1 X e S o s P k g _ n o n _ y i e l d i n g _ s c h e d u l e r _ c a l l b a c k _ e x e c u t e d �^��7 �� " ; XeSosPkg_non_yielding_scheduler_callback_executed 3 ) � ��* 5 C O � u } 3 ; � � � � WU��������������������������������� � non_yielding_scheduler_callback_executed EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid FragmentId 6
� I Q \ i � �� uint32 WmiDataId Description FragmentId opcode P
� � � � ��� � uint32 WmiDataId XEMapId ValueMap
0 1 Values ' . Begin End passes )
� r z � �� uint32 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� _ g r � �� uint32 WmiDataId Description SequenceNumber task_address
4
� � � � ��� �� object WmiDataId Pointer � X e S o s P k g �^��7 �D XeSosPkg
C � ��/ < b h � � � � _����� � XeSosPkg_deadlock_scheduler_callback_executed Description Deadlock scheduler callback executed Guid {579e97b9-8ac6-4ed2-b2a2-b9f55d179a28} locale MS\0x409 DisplayName deadlock_scheduler_callback_executed �ted �9 A B 5 3 8 0 6 E 8 8 6 6 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0 � ���� ͝��C�x :�� (D� W � WMIBinaryMofResource C:\Windows\system32\drivers\en-US\ndis.sys.mui[MofResourceName] �% ��j���% $ A �� ��& / 7 G S ` ~ � � � V l F V � � � � � � } � UU�����������������������������������$ � CIM_Indication Indication Abstract Version 2.24.0 UMLPackagePath CIM::Event Description CIM_Indication is the abstract root class for all notifications about changes in schema, objects and their data, and about events detected by providers and instrumentation. Subclasses represent specific types of notifications.
To receive an Indication, a consumer (or subscriber) must create an instance of CIM_IndicationFilter describing the criteria of the notification, an instance of CIM_ListenerDestination describing the delivery of the notification, and an instance of CIM_IndicationSubscription associating the Filter and Handler. CorrelatedIndications 8
� � � � P ` � � string Description A list of IndicationIdentifiers whose notifications are correlated with (related to) this one. MappingStrings h Recommendation.ITU|X733.Correlated notifications ModelCorrespondence � CIM_Indication.IndicationIdentifier IndicationFilterName +
� + 3 @ 3 string Description An identifier for the indication filter that selects this indication and causes it to be sent. This property is to be filled out by the indication sending service. The value shall be correlatable with the Name property of the instance of CIM_IndicationFilter describing the criteria of the indication. The value of the IndicationFilterName should be formatted using the following algorithm: < OrgID > : < LocalID >, where < OrgID > and < LocalID > are separated by a colon (:) and < OrgID > shall include a copyrighted, trademarked, or otherwise unique name that is owned by the business entity that is creating or defining the value or that is a registered ID assigned to the business entity by a recognized global authority. In addition, to ensure uniqueness, < OrgID > shall not contain a colon (:).When using this algorithm, the first colon to appear in the value shall appear between < OrgID > and < LocalID >. < LocalID > is chosen by the business entity and shall be used uniquely. ModelCorrespondence ; CIM_IndicationFilter.Name IndicationIdentifier +
� � � � �
string Description An identifier for the Indication. This property is similar to a key value in that it can be used for identification, when correlating Indications (see the CorrelatedIndications array). Its value SHOULD be unique as long as correlations are reported, but MAY be reused or left NULL if no future Indications will reference it in their CorrelatedIndications array.To ensure uniqueness, the value of IndicationIdentifier should be constructed using the following "preferred" algorithm:
<OrgID>:<LocalID>
Where <OrgID> and <LocalID> are separated by a colon (:), and where <OrgID> must include a copyrighted, trademarked, or otherwise unique name that is owned by the business entity that is creating or defining the IndicationIdentifier or that is a recognized ID that is assigned to the business entity by a recognized global authority. (This requirement is similar to the <Schema Name>_<Class Name> structure of Schema class names.) In addition, to ensure uniqueness <OrgID> must not contain a colon (:). When using this algorithm, the first colon to appear in IndicationIdentifier must appear between <OrgID> and <LocalID>.
<LocalID> is chosen by the business entity and should not be re-used to identify different underlying (real-world) elements.
If the above "preferred" algorithm is not used, the defining entity should assure that the resulting IndicationIdentifier is not re-used across any IndicationIdentifiers that are produced by this or other providers for the NameSpace of this instance.
For DMTF-defined instances, the "preferred" algorithm should be used with the <OrgID> set to CIM. MappingStrings Recommendation.ITU|X733.Notification identifier IndicationTime e
� � � � datetime Description The time and date of creation of the Indication. The property may be set to NULL if the entity creating the Indication is not capable of determining this information. Note that IndicationTime may be the same for two Indications that are generated in rapid succession. OtherSeverity +
� � � ` u string Description Holds the value of the user defined severity value when 'PerceivedSeverity' is 1 ("Other"). ModelCorrespondence } CIM_AlertIndication.PerceivedSeverity PerceivedSeverity E
�
� � � � � uint16 Description An enumerated value that describes the severity of the Indication from the notifier's point of view:
1 - Other, by CIM convention, is used to indicate that the Severity's value can be found in the OtherSeverity property.
3 - Degraded/Warning should be used when its appropriate to let the user decide if action is needed.
4 - Minor should be used to indicate action is needed, but the situation is not serious at this time.
5 - Major should be used to indicate action is needed NOW.
6 - Critical should be used to indicate action is needed NOW and the scope is broad (perhaps an imminent outage to a critical resource will result).
7 - Fatal/NonRecoverable should be used to indicate an error occurred, but it's too late to take remedial action.
2 and 0 - Information and Unknown (respectively) follow common usage. Literally, the Indication is purely informational or its severity is simply unknown. ValueMap � � � � � � � � � 0 1 2 3 4 5 6 7 .. Values * 3 : G Y ` g q � Unknown Other Information Degraded/Warning Minor Major Critical Fatal/NonRecoverable DMTF Reserved MappingStrings � Recommendation.ITU|X733.Perceived severity SequenceContext +
� $ , 9 A V string Description The sequence context portion of a sequence identifier for the indication. The sequence number portion of the sequence identifier is provided by the SequenceNumber property. The combination of both property values represents the sequence identifier for the indication.
The sequence identifier for the indication enables a CIM listener to identify duplicate indications when the CIM service attempts the delivery retry of indications, to reorder indications that arrive out-of-order, and to detect lost indications.
If a CIM service does not support sequence identifiers for indications, this property shall be NULL.
If a CIM service supports sequence identifiers for indications, this property shall be maintained by the CIM service for each registered listener destination, and its value shall uniquely identify the CIM service and the indication service within the CIM service such that restarts of the CIM service and deregistration of listener destinations to the CIM service cause the value to change, without reusing earlier values for a sufficiently long time.
When retrying the delivery of an indication, this property shall have the same value as in the original delivery.
To guarantee this uniqueness, the property value should be constructed using the following format (defined in ABNF): sequence-context = indication-service-name "#" cim-service-start-id "#" listener-destination-creation-time
Where: indication-service-name is the value of the Name property of the CIM_IndicationService instance responsible for delivering the indication. cim-service-start-id is an identifier that uniquely identifies the CIM service start, for example via a timestamp of the start time, or via a counter that increases for each start or restart. listener-destination-creation-time is a timestamp of the creation time of the CIM_ListenerDestination instance representing the listener destination.
Since this format is only a recommendation, CIM clients shall treat the value as an opaque identifier for the sequence 9 A B 5 3 8 0 6 E 8 8 6 6 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0 ��^\A� ͝��C�l Xѣ� D� K � WMIBinaryMofResource C:\Windows\System32\drivers\monitor.sys[MonitorWMI] is.sys.mui[MofResourceName] 9 A B 5 3 8 0 6 E 8 8 6 6 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0 ��^\A� ͝��C�l Xѣ� D� K � WMIBinaryMofResource C:\Windows\System32\drivers\monitor.sys[MonitorWMI] [MofResourceName] 9 A B 5 3 8 0 6 E 8 8 6 6 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0 ��^\A� ͝��C�l Xѣ� D� K � WMIBinaryMofResource C:\Windows\System32\drivers\monitor.sys[MonitorWMI] C:\Windows\system32\kernelbase.dll[MofResourceName] rceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 /h�b �
͝��C�| $ )ߝ�t � Y � WDMClassesOfDriver SampledProfile C:\Windows\system32\kernelbase.dll[MofResourceName] dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 /h�b �
͝��C�| $ )ߝ�t � Y � WDMClassesOfDriver SampledProfile C:\Windows\system32\kernelbase.dll[MofResourceName] elbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 /h�b �
͝��C�| $ )ߝ�t � Y � WDMClassesOfDriver SampledProfile C:\Windows\system32\kernelbase.dll[MofResourceName] se.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 /h�b �
͝��C�| $ )ߝ�t � Y � WDMClassesOfDriver SampledProfile C:\Windows\system32\kernelbase.dll[MofResourceName] l[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 /h�b �
͝��C�| $ )ߝ�t � Y � WDMClassesOfDriver SampledProfile C:\Windows\system32\kernelbase.dll[MofResourceName] esourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 /h�b �
͝��C�| $ )ߝ�t � Y � WDMClassesOfDriver SampledProfile C:\Windows\system32\kernelbase.dll[MofResourceName] rnelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 /h�b �
͝��C�| $ )ߝ�t � Y � WDMClassesOfDriver SampledProfile C:\Windows\system32\kernelbase.dll[MofResourceName] lbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 /h�b �
͝��C�| $ )ߝ�t � Y � WDMClassesOfDriver SampledProfile C:\Windows\system32\kernelbase.dll[MofResourceName] esourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 /h�b �
͝��C�| $ )ߝ�t � Y � WDMClassesOfDriver SampledProfile C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 /h�b �
͝��C�� / )ߝ�t � d � WDMClassesOfDriver SampledProfileInterval_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 /h�b �
͝��C�� / )ߝ�t � d � WDMClassesOfDriver SampledProfileInterval_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] ll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 /h�b �
͝��C�� / )ߝ�t � d � WDMClassesOfDriver SampledProfileInterval_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] ourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 /h�b �
͝��C�� / )ߝ�t � d � WDMClassesOfDriver SampledProfileInterval_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 /h�b �
͝��C�� / )ߝ�t � d � WDMClassesOfDriver SampledProfileInterval_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] ] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 /h�b �
͝��C�� / )ߝ�t � d � WDMClassesOfDriver SampledProfileInterval_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] esourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 /h�b �
͝��C�� / )ߝ�t � d � WDMClassesOfDriver SampledProfileInterval_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] ll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 /h�b �
͝��C�� / )ߝ�t � d � WDMClassesOfDriver SampledProfileInterval_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 /h�b �
͝��C�� / )ߝ�t � d � WDMClassesOfDriver SampledProfileInterval_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] rceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 /h�b �
͝��C�� / )ߝ�t � d � WDMClassesOfDriver SampledProfileInterval_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 /h�b �
͝��C�� / )ߝ�t � d � WDMClassesOfDriver SampledProfileInterval_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 /h�b �
͝��C�� / )ߝ�t � d � WDMClassesOfDriver SampledProfileInterval_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] e] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 /h�b �
͝��C�� / )ߝ�t � d � WDMClassesOfDriver SampledProfileInterval_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] ceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 /h�b �
͝��C�� / )ߝ�t � d � WDMClassesOfDriver SampledProfileInterval_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] ourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 /h�b �
͝��C�� / )ߝ�t � d � WDMClassesOfDriver SampledProfileInterval_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] ceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 /h�b �
͝��C�� / )ߝ�t � d � WDMClassesOfDriver SampledProfileInterval_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] � �n ID � w�e�` � _tN�� � �u.�� ] ���=� T ���9 � �ԝ��C�w L �� ��, 9 � �� � T b h � � Q Z ���������� � ServiceAppDomain Aggregation Association Description Map service to app domain ServiceModel UUID {E989AF08-2217-4d67-8E20-282594606E80} AppDomainInfo f A
� � 5 B � �� � �� ref:AppDomainInfo Description Contains properties of the appdomain. DisplayName AppDomainInfo Service f A
� � � � � � � �� � �� ref:Service Description The service of this appdomain. DisplayName Service � �ԝ��C�� L ��+ ��8 E � �� � ^ l r � � P Y ��������� � ServiceToEndpointAssociation Aggregation Association Description Map service to endpoint ServiceModel UUID {B454051D-0A85-4346-A55B-7BDA5189A405} Endpoint f A
� � 9 F � �� � �� ref:Endpoint Description The endpoint associated with the service. DisplayName Endpoint Service f A
� � � � � � � �� � �� ref:Service Description The service associated with the endpoint. DisplayName Service � �ԝ��C�� 3 6
� �� � . < B j s $ � � � � G R � � T b $ 9 � � � 5 @ UUU������������������������������������������������� � Endpoint Description ServiceModel Endpoint ServiceModel UUID {712A0B9F-4AA8-418a-823E-6421E1A895AD} Address 6
� � � � � � �� string Description A Uri that contains the address of the endpoint. DisplayName Address AddressHeaders 6
� h p } � � � �� string Description The collection of address headers attached to this endpoint. DisplayName AddressHeaders AddressIdentity 6
� . 6 C b o � �� string Description The identity of the endpoint. DisplayName AddressIdentity AppDomainId A
� � � � - : � �� � �� sint32 Description The appdomain id of the appdomain that hosts the endpoint. DisplayName AppDomainId Behaviors
6
� � � � � � � �� object:Behavior Description The collection of behaviors implemented by this endpoint. DisplayName Behaviors Binding
6
� T d q � � � �� object:Binding Description The binding used by this endpoint. DisplayName Binding Contract f $ 6
� � = J � �� ref:Contract Description The contract this endpoint is exposing. DisplayName Contract ContractName A
� � � � � �� � �� string Description A string that specifies which contract this endpoint is exposing. DisplayName ContractName CounterInstanceName
( 6
� } � � � � � �� string Description The name of the instance of performance counters of the endpoint. DisplayName CounterInstanceName ListenUri A
� Q Y f � � � �� � �� string Description The Uri the endpoint listens on. DisplayName ListenUri Name , 6
� � � � " / � �� string Description The unique name of this endpoint. DisplayName Name ProcessId A
� � � � � � � �� � �� sint32 Description The process Id of the process that hosts the endpoint. DisplayName ProcessId { ! � � W � GetOperationCounterInstanceName ) J W x ��� � DisplayName GetOperationCounterInstanceName Implemented Description Retrieves operation performance counter instance name ae442007200009F ROOT\ServiceModel ���� � �� �� * � ����� � __PARAMETERS abstract Operation string
� 5 In
� 5 \ �� ID )
� � \ ��� string __ �� ae442007200009F ROOT\ServiceModel ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue string
� ^ string out
� ^ f �� __ � �ԝ��C�< 6 � �� � , : @ h v � � � � # ) U���������������������� � Channel Description ServiceModel Channel ServiceModel UUID {3EC525AF-3189-4ea1-966E-B6F437F5D289} LocalAddress 6
� � � � � � �� string Description The local endpoint for the channel. DisplayName LocalAddress RemoteAddress 6
� b j w � � � �� string Description The remote address associated with the channel. DisplayName RemoteAddress RemoteEndpoint f 6
� & 3 i v � �� ref:Endpoint Description A reference to the endpoint the channel connects to. DisplayName RemoteEndpoint SessionId 6
� � � � � �� string Description The current session Id, if any. DisplayName SessionId Type 6
� m u � � � � �� string Description The type of the channel. DisplayName Type � �ԝ��C�� ' 6
� �� � . < B j w 1 < � � � � R ] � � i v U [ UU�������������������������������������� � Contract Description ServiceModel Contract ServiceModel UUID {BFDB09BA-5A7A-47ad-86BD-ACF6E55AA864} AppDomainId A
� � � � $ � �� � �� sint32 Description The appdomain id of the appdomain that hosts the contract. DisplayName AppDomainId Behaviors
6
� � � � � � � �� object:Behavior Description The behaviors associated with this contract. DisplayName Behaviors CallbackContract f 6
� : H U � � � �� ref:Contract Description The type of callback when the contract is a duplex contract. DisplayName CallbackContract Name A
� ? L � �� � �� string Description The name of the contract in WSDL. DisplayName Name Namespace 6
� � � � � � � �� string Description The namespace of the <portType> element in WSDL. DisplayName Namespace Operations
6
� P b o � � � �� object:Operation Description The operations of this contract. DisplayName Operations ProcessId A
� Q ^ � �� � �� sint32 Description The process Id of the process that hosts the contract. DisplayName ProcessId SessionMode 6
� � � � ; H � �� string Description Indicates whether the contract requires the binding associated with this contract to use channel sessions. DisplayName SessionMode Type 6
� � � � � � � �� string Description The type of the contract. DisplayName Type � ~�S� ��n|� � �C�S _ �o�4� M ñ��� C PxB c �cȝ� T R S O P _ P o l i c y S e t t i n g �Н��C�� � RSOP_PolicySetting ) ) 1 A t � � � Q a � � G a � � A N � � / 3 p � � � * \ k � � I _ � � � � + ] n � � Q c � � " T c � � (
5
�
�
�
�
0 < n � � � � � / C v � � �
Q
b
�^UUUUUUUUU���������� � � �����������������������������������������������������������������������������������������������������������������������������������������������������
� RSOP_ApplicationManagementPolicySetting Locale AllowX86OnIA64 f
� k � �� boolean ApplicationId '
� � � �� � �� string ApplyCause % � )
� � �� uint32 ValueMap 9 < ? B E H K N 1 2 3 4 5 6 7 8 AssignmentType \ )
� � � � � �� uint32 ValueMap � � � 1 2 3 Categories
4
� � � �� string DemandInstallable d
� > � �� boolean DeploymentLastModifyTime e H
� � � �� datetime DeploymentType X )
� � � � � �� uint32 ValueMap � � 1 2 DisplayInARP n
� 8 � �� boolean Eligibility $ � )
� � � � � �� uint32 ValueMap � � � � 1 2 3 4 EntryType 4
� � �� � �� uint32 ValueMap & ) , 1 2 3 id @ '
� h � �� � �� string IgnoreLanguage p
� � � �� boolean InstallationUI ` )
� � � �� uint32 ValueMap 1 2 LanguageId T
� T � �� uint32 LanguageMatch & � )
� � � � � �� uint32 ValueMap � � � � � 1 2 3 4 5 LossOfScopeAction h )
� % - 7 � �� uint32 ValueMap C F 1 2 MachineArchitectures P
� � � �� uint32 OnDemandClsid ( �
� � � �� string OnDemandFileExtension ' �
� � �� string OnDemandProgId ) �
� U � �� string PackageLocation ,
� � � �� string PackageType )
� � � � � �� uint32 ValueMap 1 2 precedence @ '
� I � �� � �� uint32 PrecedenceReason 8 )
� � � � � �� uint32 ValueMap � � � � � � 1 2 3 4 5 6 ProductId $
� � �� string Publisher
(
� L � �� string RedeployCount D
� � � �� uint32 RemovalCause * � )
� � � � � �� uint32 ValueMap
"
%
1 2 3 4 5 6 7 8 RemovalType + � )
� l
t
~
� �� uint32 ValueMap �
�
�
�
1 2 3 4 RemovingApplication , �
� �
� �� string ReplaceableApplications ! z
� ( � �� string ScriptFile 0
� f � �� string SecurityDescriptor L
� � � �� uint8 SupportURL v
� � � �� string Transforms r
� ' � �� string UninstallUnmanaged l
� m � �� boolean UpgradeableApplications " ~
� � � �� string UpgradeSettingsMandatory # �
�
� �� boolean VersionNumberHi @
� I
� �� uint32 VersionNumberLo <
� �
� �� uint32 � R S O P _ P o l i c y S e t t i n g ���C�� I RSOP_PolicySetting % - C � � � � / � � � � s � � @ Q � � � � L \ �^UU���������� � � ������������������������������������������������� � RSOP_FolderRedirectionPolicySetting Locale configurationControl @ )
� z � ��� � uint32 ValueMap � � 0 1 grantType ,
� � � �� boolean id @ '
� � �� � �� string installationType )
� f n x � �� uint32 ValueMap � � 1 2 moveType .
� � � �� boolean parentFolderId 8
� � �� string policyRemoval
0 )
� O W a � �� uint32 ValueMap m p 1 2 precedence @ '
� � � �� � �� uint32 primaryComputerEvaluation < )
� � �� uint32 ValueMap 4 7 : = 1 2 3 4 redirectedPaths
(
� { � �� string redirectingGroup
� � � �� string redirectionFlags 4
� � �� uint32 resultantPath
� D � �� string securityGroups $
� � � �� string � ���C�G ) ] j � � � � ! ^ m P`� � �������� � � RSOP_ExtensionStatus Locale beginTime e
� S � �� datetime displayName
� � � �� string endTime e
� � � �� datetime error
�
� �� uint32 extensionGuid '
� V � �� � �� string loggingStatus )
� � � � � �� uint32 ValueMap � � � 1 2 3 � ���C�5
# 1 c s � � ������������� � RSOP_ExtensionEventSource Locale eventLogName
� [ � �� string eventLogSource
� � � �� string id '
� � � �� � �� string P_ � ���C�+ ' 4 � � %��������� � RSOP_ExtensionEventSourceLink Locale eventSource f '
� i � �� � �� ref:RSOP_ExtensionEventSource extensionStatus f '
� � � �� � �� ref:RSOP_ExtensionStatus � R S O P _ P o l i c y S e t t i n g ���C�' 4 RSOP_PolicySetting & / a n � � � � ) 5 r � � � � & 1 ����������� � � ������e g ���� c i � RSOP_IERegistryPolicySetting Locale command ,
� Y � �� string currentUser '
� � � �� � �� boolean deleted *
� � � �� boolean id @ '
� ! � �� � �� string precedence @ '
� j � �� � �� uint32 registryKey
� � � �� string value
&
� � � �� uint8 valueName
� � �� string valueType "
� [ � �� uint32 �4 1 C 5 3 E 6 D B 1 A C F 2 4 5 3 C E F D 4 1 3 9 8 1 9 8 E 6 1 3 F 1 0 D F F 4 7 7 0 9 E C A B 1 D 7 F 0 3 7 7 5 6 A C 8 C E 7 {ѝ��C�ȝ��C�� � � __thisNAMESPACE � �x � 0 � H ? h| C I M _ S t o r a g e V o l u m e �tR|�C�o � CIM_StorageVolume ) � ��� � � T ` 6 @ � � � � � � � � P
\
% � � � � �
�
�
� � � � � � � � � � � ����UUUU����������������������������������������������������������������������������������������������������������������������������������������� � Win32_Volume Description The Win32_Volume class represents an area of storage on a hard disk. The class returns local volumes that are formatted, unformatted, mounted or offline. A volume is formatted by using a file system, such as FAT or NTFS, and may have a drive letter assigned to it. A single hard disk can have multiple volumes, and volumes can also span multiple disks. The Win32_Volume class does not support diskette drive management. AMENDMENT LOCALE Automount r +
� - A N boolean DisplayName Auto Mount Enabled Description If TRUE, the Automount property indicates that the volume will be mounted to the file system automatically when the first I/O is issued. Otherwise it will not be mounted until explicitly mounted with the Mount method or by adding a drive letter or mount point. BootVolume & � +
� � � � � � boolean DisplayName Boot Volume Description The BootVolume property indicates whether the volume contains the currently running operating system files. Capacity H +
� y � � � � uint64 DisplayName Capacity Description The Capacity property indicates in bytes, the size of the volume. Compressed P +
� - 6 C O \ boolean DisplayName Compressed Description If TRUE, the volume exists as a single compressed entity, such as a DoubleSpace volume.If file based compression is supported (such as on NTFS), this property will be FALSE. DeviceID @ 6
� Y a n � ��� � string Description The DeviceID property contains a string uniquely identifying the volume on the system. DisplayName ID DirtyBitSet h +
� & 3 B O boolean DisplayName Dirty Bit Set Description Indicates if the ChkDsk method should be run at next boot up. DriveLetter R +
� � � � � string DisplayName Drive Letter Description The DriveLetter property indicates the drive letter assigned to the volume. This property is NULL for volumes without drive letters. DriveType V +
� � � � � � uint32 Description The DriveType property contains a numeric value corresponding to the type of disk drive this logical disk represents. Please refer to the Platform SDK documentation for additional values.
Example: A CD-ROM drive would return 5. Values � �
)
8
F
Unknown No Root Directory Removable Disk Local Disk Network Drive Compact Disc RAM Disk FileSystem Z +
� �
�
�
�
�
string DisplayName File System Description The FileSystem property indicates the file system on the logical disk. Example: NTFS FreeSpace ^ +
� ^ f s � uint64 DisplayName Free Space Description The FreeSpace property indicates in bytes how much free space is available on the volume. IndexingEnabled f +
� 1 : G Y f boolean DisplayName Indexing Enabled Description If context indexing is enabled this property will be TRUE Label j +
� � � � �
string DisplayName Label Description The Label property indicates the volume name of the logical disk. Constraints: Maximum 32 characters. This property is NULL for a volume without a label. MaximumFileNameLength n +
� �
�
$ 1 uint32 DisplayName Maximum File Name Length Description Maximum length of a filename component supported by the Windows drive. A filename component is that portion of a filename between backslashes. The value can be used to indicate that long names are supported by the specified file system. For example, for a FAT file system supporting long names, the function stores the value 255, rather than the previous 8.3 indicator. Long names can also be supported on systems that use the NTFS file system. Example: 255 PageFilePresent $ � +
� F O \ o | boolean DisplayName Page File Present Description The PageFilePresent property indicates whether the volume contains a system memory paging file. QuotasEnabled t +
� % . ; K X boolean DisplayName Quotas Enabled Description The QuotasEnabled property indicates that quota management is enabled for this volume. QuotasIncomplete v +
� � $ 1 boolean DisplayName Quotas Incomplete Description The QuotasIncomplete property indicates that quota management was used but has been disabled. Incomplete refers to the information left in the file system after quota management was disabled. QuotasRebuilding x +
� = F S f s boolean DisplayName Quotas Rebuilding Description The QuotasRebuilding property indicates that the file system is in the active process of compiling information and setting the disk up for quota management. SerialNumber ! z +
� X ` m | � uint32 DisplayName Serial Number Description The SerialNumber property indicates the serial number of the volume. Example: A8C3D032 SupportsDiskQuotas " ~ +
� . 7 D Z g boolean DisplayName Supports Disk Quotas Description The SupportsDiskQuotas property indicates if the volume supports disk quotas. SupportsFileBasedCompression # � +
�
# D Q boolean DisplayName Supports File Based Compression Description The SupportsFileBasedCompression property indicates if the volume supports file based compression as is the case with the NTFS file system. SystemVolume % � +
� % . ; J W boolean DisplayName System Volume Description The SystemVolume property indicates whether the volume contains the hardware specific files required to start the operating system. �b � � 1 � ` � � � � �" l< �= �= �? �A nF ~F HH LH �O �O �Q �S YU `U V V �W �W �X c` �a � Chkdsk & 3
Description This method invokes the chkdsk operation on the volume. The method is applicable to only those volume instances that represent a physical disk in the machine. It is not applicable to mapped logical drives. Values & / g � � � Success Success - Volume locked and chkdsk scheduled on reboot Unsupported file system Unknown file system No media in drive Unknown error � a42c9160500003S ROOT\CIMV2\ms_409 ���� � �� �� * > k s k � � � � U�������������0 � __PARAMETERS abstract FixErrors boolean
� 5 in
� 5 ] �� This parameter indicates what should be done to errors found on the disk. If true, then errors are fixed. Description )
� 5 ] ��� � ID 6
� � ] ��� � : boolean VigorousIndexCheck boolean
� � in
� � � �� This parameter indicates whether a vigorous check of index entries should be performed. Description )
� � � ��` ID 6
� � � ��` � boo
�� k ��� � Z� � 8iV^� � UDِ� � I�ԣs g i7� i ��WC e E��n� I
E v e n t T r a c e �ӝ��C�? EventTrace � �� G N E����� � MSNT_FileBaseTrace_Set1 Guid {D75D8303-6C21-4bde-9C98-ECC6320F9291} Flags 8
� � � � T \ ) uint32 DefineValues 7 Y q � � � � � 5 T q � � � � 6 P q � � � � # > EVENT_TRACE_FLAG_CREATE EVENT_TRACE_FLAG_CREATENAMEDPIPE EVENT_TRACE_FLAG_CLOSE EVENT_TRACE_FLAG_READ EVENT_TRACE_FLAG_WRITE EVENT_TRACE_FLAG_QUERYINFORMATION EVENT_TRACE_FLAG_SETINFORMATION EVENT_TRACE_FLAG_QUERYEA EVENT_TRACE_FLAG_SETEA EVENT_TRACE_FLAG_FLUSHBUFFERS EVENT_TRACE_FLAG_QUERYVOLINFO EVENT_TRACE_FLAG_SETVOLINFO EVENT_TRACE_FLAG_DIRECTORYCONTROL EVENT_TRACE_FLAG_FILESYSCONTROL EVENT_TRACE_FLAG_DEVICECONTROL EVENT_TRACE_FLAG_INTERNALDEVICECONTROL EVENT_TRACE_FLAG_SHUTDOWN EVENT_TRACE_FLAG_LOCKCONTROL EVENT_TRACE_FLAG_CLEANUP EVENT_TRACE_FLAG_CREATEMAILSLOT EVENT_TRACE_FLAG_QUERYSECURITY EVENT_TRACE_FLAG_SETSECURITY EVENT_TRACE_FLAG_POWER EVENT_TRACE_FLAG_SYSTEMCONTROL EVENT_TRACE_FLAG_DEVICECHANGE EVENT_TRACE_FLAG_QUERYQUOTA EVENT_TRACE_FLAG_SETQUOTA EVENT_TRACE_FLAG_PNP Values � � � � � � ! / = I [ n } � � � � � � � � � create createnamedpipe close read write queryinfo setinfo queryea setea flushbuffers queryvolinfo setvolinfo directorycontrol filesystemcontrol devicecontrol internaldevicecontrol shutdown lockcontrol cleanup createmailslot querysecurity setsecurity power systemcontrol devicechange queryquota setquota pnp ValueMap � � � � � � � � � ! - 9 E Q ] i u � � � � � � � � � 0x00000001 0x00000002 0x00000004 0x00000008 0x00000010 0x00000020 0x00000040 0x00000080 0x00000100 0x00000200 0x00000400 0x00000800 0x00001000 0x00002000 0x00004000 0x00008000 0x00010000 0x00020000 0x00040000 0x00080000 0x00100000 0x00200000 0x00400000 0x00800000 0x01000000 0x02000000 0x04000000 0x08000000 AG �
E v e n t T r a c e �ӝ��C�� EventTrace � �� G N E����` � MSNT_FileBaseTrace_Set2 Guid {058DD951-7604-414d-A5D6-A56D35367A46} Flags 8
� � � � � � b l uint32 DefineValues � 6 X z � � �
- G i � � � EVENT_TRACE_FLAG_ACQUIRESECTIONSYNCH EVENT_TRACE_FLAG_RELEASESECTIONSYNCH EVENT_TRACE_FLAG_ACQUIREMODWRITE EVENT_TRACE_FLAG_RELEASEMODWRITE EVENT_TRACE_FLAG_ACQUIRECCFLUSH EVENT_TRACE_FLAG_RELEASECCFLUSH EVENT_TRACE_FLAG_NOTIFYSTREAMFILEOBJ EVENT_TRACE_FLAG_FASTIOCHECKIFPOSSIBLE EVENT_TRACE_FLAG_NETWORKQUERYOPEN EVENT_TRACE_FLAG_MDLREAD EVENT_TRACE_FLAG_MDLREADCOMPLETE EVENT_TRACE_FLAG_PREPAREMDLWRITE EVENT_TRACE_FLAG_MDLWRITECOMPLETE EVENT_TRACE_FLAG_VOLUMEMOUNT EVENT_TRACE_FLAG_VOLUMEDISMOUNT Values 5 W y � � � � � � " 3 E R acquireforsectionsynchronization releaseforsectionsynchronization acquireformodwrite releaseformodwrite acquireforccflush releaseforccflush notifystreamfileobject fastiocheckifpossible networkqueryopen mdlread mdlreadcomplete preparemdlwrite mdlwritecomplete volumemount volumedismount ValueMap � � � � � � � $ 0 < H T 0x00000001 0x00000002 0x00000004 0x00000008 0x00000010 0x00000020 0x00000040 0x00001000 0x00002000 0x00004000 0x00008000 0x00010000 0x00020000 0x00040000 0x00080000 ef �
E v e n t T r a c e �ӝ��C�� EventTrace � ��! ' O V M����c � MSNT_FileBaseTrace_OptionalData Guid {7DA1385C-F8F5-414d-B9D0-02FCA090F1EC} Flags 8
� � � � � � uint32 DefineValues � � 5 V w � � � EVENT_TRACE_FLAG_USERCONTEXT EVENT_TRACE_FLAG_SESSIONID EVENT_TRACE_FLAG_LASTACCESSTIME EVENT_TRACE_FLAG_CALLPARAMETERS EVENT_TRACE_FLAG_CALLRESULTDATA EVENT_TRACE_FLAG_PREVIOUSDATA EVENT_TRACE_FLAG_CREATEONEXISTINGFILE EVENT_TRACE_FLAG_PROCESSWINDOWSTATION EVENT_TRACE_FLAG_BLOCKPAGINGIO Values 4 A L \ l | � � � usercontext sessionid lastaccesstime callparameters callresultdata previousdata createonexistingfile processwindowstation blockpagingio ValueMap � ' 3 ? K W 0x00000001 0x00000002 0x00000004 0x00000008 0x00000010 0x00000020 0x00000040 0x00000080 0x00000100 �
E v e n t T r a c e �ӝ��C�� EventTrace � �� & N U M����: � MSNT_FileBaseTrace_VolumeToLog Guid {127D46AF-4AD3-489f-9165-F00BA64D5467} Flags 8
� � � � y � \ f uint32 DefineValues ) = Q e y � � � � � � - A U i } � � � � � � 1 G _ EVENT_TRACE_FLAG_A EVENT_TRACE_FLAG_B EVENT_TRACE_FLAG_C EVENT_TRACE_FLAG_D EVENT_TRACE_FLAG_E EVENT_TRACE_FLAG_F EVENT_TRACE_FLAG_G EVENT_TRACE_FLAG_H EVENT_TRACE_FLAG_I EVENT_TRACE_FLAG_J EVENT_TRACE_FLAG_K EVENT_TRACE_FLAG_L EVENT_TRACE_FLAG_M EVENT_TRACE_FLAG_N EVENT_TRACE_FLAG_O EVENT_TRACE_FLAG_P EVENT_TRACE_FLAG_Q EVENT_TRACE_FLAG_R EVENT_TRACE_FLAG_S EVENT_TRACE_FLAG_T EVENT_TRACE_FLAG_U EVENT_TRACE_FLAG_V EVENT_TRACE_FLAG_W EVENT_TRACE_FLAG_X EVENT_TRACE_FLAG_Y EVENT_TRACE_FLAG_Z EVENT_TRACE_FLAG_ALL EVENT_TRACE_FLAG_LOCAL EVENT_TRACE_FLAG_NETWORK Values � � � # & ) , / 2 5 8 ; > A D G L S a b c d e f g h i j k l m n o p q r s t u v w x y z all local network ValueMap � � � & 2 > J V b n z � � � � � � � � � � �
" . 0x00000001 0x00000002 0x00000004 0x00000008 0x00000010 0x00000020 0x00000040 0x00000080 0x00000100 0x00000200 0x00000400 0x00000800 0x00001000 0x00002000 0x00004000 0x00008000 0x00010000 0x00020000 0x00040000 0x00080000 0x00100000 0x00200000 0x00400000 0x00800000 0x01000000 0x02000000 0x04000000 0X08000000 0X10000000 x0 � M S N T _ F i l e B a s e T r a c e _ S e t 1 �ӝ��C�� ! MSNT_FileBaseTrace_Set1 ) � �� 9 G����G � FileTrace Guid {F681E6CC-EC6C-4ee9-90A6-C0C4E83276C2} EventVersion � R S O P _ P o l m k r P r o S e t t i n g ԝ��C�% 8 RSOP_PolmkrProSetting $ ( Z f ������������, * . ��������������������������������� � RSOP_PolmkrShortcutSetting Locale id @
� R � �� string precedence @
� � � �� uint32 � R S O P _ P o l m k r P r o S e t t i n g ԝ��C�' 8 RSOP_PolmkrProSetting & * \ h ������������, * . ��������������������������������� � RSOP_PolmkrDataSourceSetting Locale id @
� T � �� string precedence @
� � � �� uint32 � R S O P _ P o l m k r P r o S e t t i n g ԝ��C�# 8 RSOP_PolmkrProSetting " & X d ������������, * . ��������������������������������� � RSOP_PolmkrDeviceSetting Locale id @
� P � �� string precedence @
� � � �� uint32 �5 7 E 5 F 3 A D D 9 E 2 4 2 C 4 E 9 F 9 E D F 7 9 A A 9 7 F 7 9 E 7 9 1 1 C 5 A 8 B 9 0 2 E C 1 5 0 D 6 4 4 2 E 3 B 8 5 A 5 A A #՝��C�ȝ��C�� �����M @ 9 W � __Win32Provider {43D7FDB4-B94D-4415-8792-54AF9FBEBB82} NetworkServiceHost NetTtCim )
� � f ��� boolean ReturnValue uint32
� uint32 out
� ' �� __ � IsCommandPresent ( 5 7 �� Description Implemented $ ae442007200009F ROOT\CIMV2\Security\MicrosoftTpm ���� � �� �� * � ����� � __PARAMETERS abstract CommandOrdinal uint32
� : IN
� : a �� ID )
� � a ��� uint32 __ � ae442007200009F ROOT\CIMV2\Security\MicrosoftTpm ���� � �� �� * � � * ������T � __PARAMETERS abstract IsCommandPresent boolean
� < OUT
� < d �� ID )
� � d ��� boolean ReturnValue uint32
� uint32 out
� % �� __ � Enable � � � �� Description Implemented � ae442007200009F ROOT\CIMV2\Security\MicrosoftTpm ���� � �{ �� * � ���� � __PARAMETERS abstract OwnerAuth string
� 5 IN
� 5 \ �� optional '
� 5 \ ��� �� ID 4
� \ ��� ��� string __ �� ae442007200009F ROOT\CIMV2\Security\MicrosoftTpm ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � Disable g! t! v! �� Description Implemented � ae442007200009F ROOT\CIMV2\Security\MicrosoftTpm ���� � �{ �� * � ���� � __PARAMETERS abstract OwnerAuth string
� 5 IN
� 5 \ �� optional '
� 5 \ ��� �� ID 4
� \ ��� ��� string __ �� ae442007200009F ROOT\CIMV2\Security\MicrosoftTpm ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � IsEndorsementKeyPairPresent 7% D% F% �� Description Implemented - ae442007200009F ROOT\CIMV2\Security\MicrosoftTpm ���� � �� �� * � � 5 ������_ � __PARAMETERS abstract IsEndorsementKeyPairPresent boolean
� G OUT
� G o �� ID )
� � o ��� boolean ReturnValue uint32
� ( uint32 out
� ( 0 �� __ � CreateEndorsementKeyPair �( �( �( �� Description Implemented � ae442007200009F ROOT\CIMV2\Security\MicrosoftTpm ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � TakeOwnership �* �* �* �� Description Implemented � ae442007200009F ROOT\CIMV2\Security\MicrosoftTpm ���� � �{ �� * � ���� � __PARAMETERS abstract OwnerAuth string
� 5 IN
� 5 \ �� optional '
� 5 \ ��� �� ID 4
� \ ��� ��� string __ �� ae442007200009F ROOT\CIMV2\Security\MicrosoftTpm ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � Clear V. c. e. �� Description Implemented � ae442007200009F ROOT\CIMV2\Security\MicrosoftTpm ���� � �{ �� * � ���� � __PARAMETERS abstract OwnerAuth string
� 5 IN
� 5 \ �� optional '
� 5 \ ��� �� ID 4
� \ ��� ��� string __ �� ae442007200009F ROOT\CIMV2\Security\MicrosoftTpm ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � IsSrkAuthCompatible 2 +2 -2 �� Description Implemented ae442007200009F ROOT\CIMV2\Security\MicrosoftTpm ���� � �� �� * � � - ������W � __PARAMETERS abstract IsSrkAuthCompatible boolean
� ? OUT
� ? g �� ID )
� � g ��� boolean ReturnValue uint32
� uint32 out
� ( �� __ � ResetSrkAuth �5 �5 �5 �� Description Implemented � ae442007200009F ROOT\CIMV2\Security\MicrosoftTpm ���� � �{ �F� � T ^�I � x�,B
j W*d�� ���� � Rr3� = �� � 4o� � �ca� � 5��� #
E v e n t T r a c e j͝��C�m EventTrace 6 � ��
G M u } � � ����� � NCSICtlGuid Description Microsoft-Windows-NetworkConnectivityStatus guid {014DE49F-CE63-4779-BA2B-D616F6963A87} locale MS\0x409 Flags R
� � � $ � � " * � � uint32 Description Enable Flags ValueDescriptions @ U k z � � TM_NLAPROVIDER Flag TM_INTERFACEHOP Flag TM_MEDIA Flag TM_WEBPROBE Flag TM_SUPPORT Flag TM_LOCK Flag DefineValues � � �
TM_NLAPROVIDER TM_INTERFACEHOP TM_MEDIA TM_WEBPROBE TM_SUPPORT TM_LOCK Values F V g q ~ � TM_NLAPROVIDER TM_INTERFACEHOP TM_MEDIA TM_WEBPROBE TM_SUPPORT TM_LOCK ValueMap � � � � � � 0x00000001 0x00000002 0x00000004 0x00000008 0x00000010 0x00000020 @ �
E v e n t T r a c e k͝��C�� EventTrace 6 � �� ! C I q y � � �����a � NlaSvcTraceCtlGuid Description Network Location Awareness Trace guid {1ac55562-d4ff-4bc5-8ef3-a18e07c4668e} locale MS\0x409 Flags R
� � � �
G U � � � � uint32 Description Enable Flags ValueDescriptions � � � � � � � �
0 < K Y h { � � � � � � � � ) : TM_LIST Flag TM_LOCK Flag TM_MEMORY Flag TM_REFOBJ Flag TM_HANDLE Flag TM_FSM Flag TM_TRIEMAP Flag TM_CACHE Flag TM_UNITTEST Flag TM_DLLMAIN Flag TM_ME Flag TM_STORE Flag TM_PMUX Flag TM_FUSER Flag TM_PLGWORKER Flag TM_PLGEXT Flag TM_PLGINT Flag TM_IPPC Flag TM_APPSRV Flag TM_NLAAPI Flag TM_PNP Flag TM_INTRANET Flag TM_INTERNET Flag TM_ARPND Flag TM_COMPCLNT Flag TM_ICSC Flag TM_NLAWPLG Flag TM_BWC Flag DefineValues � � � � � � ' 3 : D M W e p { � � � � � � � � � � TM_LIST TM_LOCK TM_MEMORY TM_REFOBJ TM_HANDLE TM_FSM TM_TRIEMAP TM_CACHE TM_UNITTEST TM_DLLMAIN TM_ME TM_STORE TM_PMUX TM_FUSER TM_PLGWORKER TM_PLGEXT TM_PLGINT TM_IPPC TM_APPSRV TM_NLAAPI TM_PNP TM_INTRANET TM_INTERNET TM_ARPND TM_COMPCLNT TM_ICSC TM_NLAWPLG TM_BWC Values l u ~ � � � � � � � � � � � � ' 2 = E R _ i v � TM_LIST TM_LOCK TM_MEMORY TM_REFOBJ TM_HANDLE TM_FSM TM_TRIEMAP TM_CACHE TM_UNITTEST TM_DLLMAIN TM_ME TM_STORE TM_PMUX TM_FUSER TM_PLGWORKER TM_PLGEXT TM_PLGINT TM_IPPC TM_APPSRV TM_NLAAPI TM_PNP TM_INTRANET TM_INTERNET TM_ARPND TM_COMPCLNT TM_ICSC TM_NLAWPLG TM_BWC ValueMap ) 5 A M Y e q } � � � � � � � � � �
% 1 = I U 0x00000001 0x00000002 0x00000004 0x00000008 0x00000010 0x00000020 0x00000040 0x00000080 0x00000100 0x00000200 0x00000400 0x00000800 0x00001000 0x00002000 0x00004000 0x00008000 0x00010000 0x00020000 0x00040000 0x00080000 0x00200000 0x00400000 0x00800000 0x01000000 0x02000000 0x04000000 0x08000000 0x10000000 G � v͝��C�R ' | � � � ^ l � � U���������������� � HNet_ConnectionProperties Connection f 2
� g � �� � �� � �� ref:HNet_Connection IsBridge '
� � � �� � �� boolean IsBridgeMember
'
� � �� � �� boolean IsFirewalled '
� U � �� � �� boolean IsIcsPrivate '
� � � �� � �� boolean IsIcsPublic '
� � � �� � �� boolean � w͝��C� �� ( r z %��������� � HNet_BridgeMember Association Bridge f '
� ] � �� � �� ref:HNet_Connection Member f '
� � � �� � �� ref:HNet_Connection � � x͝��C�� " _ o � � � H N U������������������ � HNet_FirewallLoggingSettings Id '
� W � �� � �� string LogConnections '
� � � �� � �� boolean LogDroppedPackets '
� � � �� � �� boolean MaxFileSize '
� @ � �� � �� uint32 Path '
� � � �� � �� string � y͝��C�% Z f � � ������ � HNet_ResponseRange EndPort '
� R � �� � �� uint16 IPProtocol '
� � � �� � �� uint8 StartPort '
� � � �� � �� uint16 t � z͝��C�� # a j � � � � , @ | � � � & 5 UU���������������������r � HNet_ApplicationProtocol BuiltIn
'
� X � �� � �� boolean Enabled '
� � � �� � �� boolean Id '
� � � �� � �� string Name '
� $ � �� � �� string OutgoingIPProtocol '
� u � �� � �� uint8 OutgoingPort
'
� � � �� � �� uint16 ResponseArray
'
� � �� � �� object:HNet_ResponseRange ResponseCount '
� j � �� � �� uint16 � {͝��C�� # a e � � � � - 3 U��������������p � HNet_PortMappingProtocol BuiltIn '
� X � �� � �� boolean Id '
� � � �� � �� string IPProtocol
'
� � � �� � �� uint8 Name '
� % � �� � �� string Port '
� h � �� � �� uint16 � |͝��C�� �� * 6 � � � � n � � U����������������������N � HNet_ConnectionPortMapping2 Association Connection f '
� k � �� � �� ref:HNet_Connection Enabled '
� � � �� � �� boolean NameActive
'
� � �� � �� boolean Protocol f '
� P � �� � �� ref:HNet_PortMappingProtocol TargetIPAddress '
� � � �� � �� uint32 TargetName '
� � � �� � �� string TargetPort '
� F � �� � �� uint16 � }͝��C�
. l � � � : x � � � 8 S � � � � 7 = UU������������������������ � HNet_FwIcmpSettings AllowInboundEchoRequest
'
� c � �� � �� boolean AllowInboundMaskRequest '
� � � �� � �� boolean AllowInboundRouterRequest '
� � �� � �� boolean AllowInboundTimestampRequest '
� o � �� � �� boolean AllowOutboundDestinationUnreachable '
� � � �� � �� boolean AllowOutboundParameterProblem '
� / � �� � �� boolean AllowOutboundSourceQuench '
� � � �� � �� boolean AllowOutboundTimeExceeded '
� � � �� � �� boolean AllowRedirect '
� . � �� � �� boolean Name 2
� } � �� � �� � �� String � �� * � ���� � __PARAMETERS abstract OwnerAuth string
� 5 IN
� 5 \ �� optional '
� 5 \ ��� �� ID 4
� \ ��� ��� string __ �� ae442007200009F ROOT\CIMV2\Security\MicrosoftTpm ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � ChangeOwnerAuth M9 Z9 \9 �� Description Implemented F ae442007200009F ROOT\CIMV2\Security\MicrosoftTpm ���� � �� �� , � * � �������� � __PARAMETERS abstract OldOwnerAuth string
� 8 IN
� 8 _ �� optional '
� 8 _ ��� �� ID 4
� _ ��� ��� string NewOwnerAuth string
� : IN
� : a �� optional '
� : a ��� �� ID 4
� a ��� ��� string __ �� ae442007200009F ROOT\CIMV2\Security\MicrosoftTpm ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � SelfTest l> y> {> �� Description Implemented
ae442007200009F ROOT\CIMV2\Security\MicrosoftTpm ���� � �� �� � $ * � ��������N � __PARAMETERS abstract SelfTestResult uint8
� : OUT
� : ` �� ID )
� � ` ��� uint8 ReturnValue uint32
� uint32 out
� �� __ � ConvertToOwnerAuth �A �A �A �� Description Implemented ' ae442007200009F ROOT\CIMV2\Security\MicrosoftTpm ���� � �� �� * � ����� � __PARAMETERS abstract OwnerPassPhrase string
� ; IN
� ; b �� ID )
� � b ��� string __ � ae442007200009F ROOT\CIMV2\Security\MicrosoftTpm ���� � �� �� * � � ! ��������K � __PARAMETERS abstract OwnerAuth string
� 5 OUT
� 5 \ �� ID )
� � \ ��� string ReturnValue uint32
� uint32 out
� �� __ � SetPhysicalPresenceRequest WG dG fG �� Description Implemented � ae442007200009F ROOT\CIMV2\Security\MicrosoftTpm ���� � �G �� * � � � ��������� � __PARAMETERS abstract Request uint32
� 3 IN
� 3 Z �� ID )
� � Z ��� uint32 RequestParameter uint32
� � IN
� � �� optional '
� � ��D �� ID 4
� � ��D ��� uint32 __ �� ae442007200009F ROOT\CIMV2\Security\MicrosoftTpm ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � GetPhysicalPresenceRequest �K �K L �� Description Implemented ae442007200009F ROOT\CIMV2\Security\MicrosoftTpm ���� � �� �� * � � ��������I � __PARAMETERS abstract Request uint32
� 3 OUT
� 3 Z �� ID )
� � Z ��� uint32 ReturnValue uint32
� uint32 out
� �� __ � GetPhysicalPresenceTransition TO aO cO �� Description Implemented ae442007200009F ROOT\CIMV2\Security\MicrosoftTpm ���� � �� �� � " * � ��������L � __PARAMETERS abstract Transition uint32
� 6 OUT
� 6 ] �� ID )
� � ] ��� uint32 ReturnValue uint32
� uint32 out
� �� __ � GetPhysicalPresenceResponse �R �R �R �� Description Implemented y ae442007200009F ROOT\CIMV2\Security\MicrosoftTpm ���� � �
�� * � � B � � ������������� � __PARAMETERS abstract Request uint32
� 3 OUT
� 3 Z �� ID )
� � Z ��� uint32 Response uint32
� � OUT
� � �� ID )
� y ��> uint32 ReturnValue uint32
� � uint32 out
� � � �� __ � AddBlockedCommand �W �W �W �� Description Implemented $ ae442007200009F ROOT\CIMV2\Security\MicrosoftTpm ���� � �� �� * � ����� � __PARAMETERS abstract CommandOrdinal uint32
� : IN
� : a �� ID )
� � a ��� uint32 __ �� ae442007200009F ROOT\CIMV2\Security\MicrosoftTpm ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � RemoveBlockedCommand �[ �[ �[ �� Description Implemented $ ae442007200009F ROOT\CIMV2\Security\MicrosoftTpm ���� � �� �� * � ����� � __PARAMETERS abstract CommandOrdinal uint32
� : IN
� : a �� ID )
� � a ��� uint32 __ �� ae442007200009F ROOT\CIMV2\Security\MicrosoftTpm ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � IsCommandBlocked �_ �_ �_ �� Description Implemented $ ae442007200009F ROOT\CIMV2\Security\MicrosoftTpm ���� � �� �� * � ����� � __PARAMETERS abstract CommandOrdinal uint32
� : IN
� : a �� ID )
� � a ��� uint32 __ � ae442007200009F ROOT\CIMV2\Security\MicrosoftTpm ���� � �� �� * � � ( ��������R � __PARAMETERS abstract IsCommandBlocked uint32
� < OUT
� < c �� ID )
� � c ��� uint32 ReturnValue uint32
� uint32 out
� # �� __ � ResetAuthLockOut e ,e .e �� Description Implemented � ae442007200009F ROOT\CIMV2\Security\MicrosoftTpm ���� � �{ �� * � ���� � __PARAMETERS abstract OwnerAuth string
� 5 IN
� 5 \ �� optional '
� 5 \ ��� �� ID 4
� \ ��� ��� string __ �� ae442007200009F ROOT\CIMV2\Security\MicrosoftTpm ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � IsReady �h �h �h �� Description Implemented ae442007200009F ROOT\CIMV2\Security\MicrosoftTpm ���� � �� �� * � � ! ������K � __PARAMETERS abstract IsReady boolean
� 3 OUT
� 3 [ �� ID )
� � [ ��� boolean ReturnValue uint32
� uint32 out
� �� __ � IsReadyInformation 4l Al Cl �� Description Implemented � ae442007200009F ROOT\CIMV2\Security\MicrosoftTpm ���� � � �� � G * � � � ���������� � __PARAMETERS abstract IsReady boolean
� 3 OUT
� 3 [ �� ID )
� � [ ��� boolean Information uint32
� � OUT
� � �� ID )
� ~ ��C uint32 ReturnValue uint32
� � uint32 out
� � � �� __ � IsAutoProvisioningEnabled q q q �� Description Implemented ) ae442007200009F ROOT\CIMV2\Security\MicrosoftTpm ���� � �� �� * � � 3 ������] � __PARAMETERS abstract IsAutoProvisioningEnabled boolean
� E OUT
� E m �� ID )
� � m ��� boolean ReturnValue uint32
� & uint32 out
� & . �� __ � EnableAutoProvisioning �t �t �t �� Description Implemented � ae442007200009F ROOT\CIMV2\Security\MicrosoftTpm ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � DisableAutoProvisioning yv �v �v �� Description Implemented + ae442007200009F ROOT\CIMV2\Security\MicrosoftTpm ���� � �� �� * � �� � __PARAMETERS abstract OnlyForNextBoot boolean
� ; IN
� ; c �� optional '
� ; c ��� �� ID 4
� c ��� ��� boolean __ �� ae442007200009F ROOT\CIMV2\Security\MicrosoftTpm ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � GetOwnerAuth �z �z �z �� Description Implemented ae442007200009F ROOT\CIMV2\Security\MicrosoftTpm ���� � �� �� * � � ! ��������K � __PARAMETERS abstract OwnerAuth string
� 5 OUT
� 5 \ �� ID )
� � \ ��� string ReturnValue uint32
� uint32 out
� �� __ � Provision �} �} �} �� Description Implemented � ae442007200009F ROOT\CIMV2\Security\MicrosoftTpm ���� � �| �� * � � e ����� � __PARAMETERS abstract ForceClear_Allowed boolean
� > IN
� > f �� ID )
� � f ��� boolean PhysicalPresencePrompts_Allowed boolean
� IN
� 3 �� ID )
� � 3 ��a boolean __ � ae442007200009F ROOT\CIMV2\Security\MicrosoftTpm ���� � �� �� * � � # ��������M � __PARAMETERS abstract Information uint32
� 7 OUT
� 7 ^ �� ID )
� � ^ ��� uint32 ReturnValue uint32
� uint32 out
� �� __ � ImportOwnerAuth � !� #� �� Description Implemented ae442007200009F ROOT\CIMV2\Security\MicrosoftTpm ���� � �� �� * � ����� � __PARAMETERS abstract OwnerAuth string
� 5 IN
� 5 \ �� ID )
� � \ ��� string __ �� ae442007200009F ROOT\CIMV2\Security\MicrosoftTpm ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � GetPhysicalPresenceConfirmationStatus � ,� .� �� Description Implemented ae442007200009F ROOT\CIMV2\Security\MicrosoftTpm ���� � �� �� * � ����� � __PARAMETERS abstract Operation uint32
� 5 IN
� 5 \ �� ID )
� � \ ��� uint32 __ � ae442007200009F ROOT\CIMV2\Security\MicrosoftTpm ���� � �� �� * � � * ��������T � __PARAMETERS abstract ConfirmationStatus uint32
� > OUT
� > e �� ID )
� � e ��� uint32 ReturnValue uint32
� uint32 out
� % �� __ � GetSrkPublicKeyModulus �� �� �� �� Description Implemented ae442007200009F ROOT\CIMV2\Security\MicrosoftTpm ���� � �� �� � ) * � ��������S � __PARAMETERS abstract SrkPublicKeyModulus uint8
� ? OUT
� ? e �� ID )
� � e ��� uint8 ReturnValue uint32
� uint32 out
� $ �� __ � GetSrkADThumbprint � � � �� Description Implemented 1 ae442007200009F ROOT\CIMV2\Security\MicrosoftTpm ���� � �� �� * � ����� � __PARAMETERS abstract SrkPublicKeyModulus uint8
� ? IN
� ? e �� ID )
� � e ��� uint8 __ � ae442007200009F ROOT\CIMV2\Security\MicrosoftTpm ���� � �� �� � % * � ��������O � __PARAMETERS abstract SrkADThumbprint uint8
� ; OUT
� ; a �� ID )
� � a ��� uint8 ReturnValue uint32
� uint32 out
� �� __ � GetTcgLog �� �� �� �� Description Implemented � ae442007200009F ROOT\CIMV2\Security\MicrosoftTpm ���� � �� �� � * � ��������F � __PARAMETERS abstract TcgLog uint8
� 2 OUT
� 2 X �� ID )
� � X ��� uint8 ReturnValue uint32
� uint32 out
� �� __ � IsKeyAttestationCapable � �� � �� Description Implemented ae442007200009F ROOT\CIMV2\Security\MicrosoftTpm ���� � �� �� � " * � ��������L � __PARAMETERS abstract TestResult uint32
� 6 OUT
� 6 ] �� ID )
� � ] ��� uint32 ReturnValue uint32
� uint32 out
� �� __ � GetOwnerAuthForEscrow Q� ^� `� �� Description Implemented � ae442007200009F ROOT\CIMV2\Security\MicrosoftTpm ���� � �"
�� � K * � � � ������������ � __PARAMETERS abstract OwnerAuthStatus uint32
� ; OUT
� ; b �� ID )
� � b ��� uint32 OwnerAuth string
� � OUT
� � �� ID )
� � ��G string ReturnValue uint32
� � uint32 out
� � � �� __ � OwnerAuthEscrowed /� <� >� �� Description Implemented ae442007200009F ROOT\CIMV2\Security\MicrosoftTpm ���� � �� �� * � ����� � __PARAMETERS abstract OwnerAuth string
� 5 IN
� 5 \ �� ID )
� � \ ��� string __ �� ae442007200009F ROOT\CIMV2\Security\MicrosoftTpm ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � GetOwnerAuthStatus '� 4� 6� �� Description Implemented ae442007200009F ROOT\CIMV2\Security\MicrosoftTpm ���� � �� �� * � � ' ��������Q � __PARAMETERS abstract OwnerAuthStatus uint32
� ; OUT
� ; b �� ID )
� � b ��� uint32 ReturnValue uint32
� uint32 out
� " �� __ � IsFIPS �� �� �� �� Description Implemented ae442007200009F ROOT\CIMV2\Security\MicrosoftTpm ���� � �� �� * � � ������J � __PARAMETERS abstract IsFIPS boolean
� 2 OUT
� 2 Z �� ID )
� � Z ��� boolean ReturnValue uint32
� uint32 out
� �� __ � GetDictionaryAttackParameters � � � �� Description Implemented ae442007200009F ROOT\CIMV2\Security\MicrosoftTpm ���� � �� �� � * � � G T � U����������������� � __PARAMETERS abstract MaxTries uint32
� 4 OUT
� 4 [ �� ID )
� � [ ��� uint32 RecoveryTime uint32
� � OUT
� � �� ID )
� ~ ��C uint32 LockoutRecovery uint32
� � OUT
� � � �� ID )
� : � ��� uint32 ReturnValue uint32
� � uint32 out
� � � �� __ � GetCapLockoutInfo >� K� M� �� Description Implemented � ae442007200009F ROOT\CIMV2\Security\MicrosoftTpm ���� � �
�� * � � I � � ������������ � __PARAMETERS abstract LockoutCounter uint32
� : OUT
� : a �� ID )
� � a ��� uint32 MaxTries uint32
� � OUT
� � �� ID )
� � ��E uint32 ReturnValue uint32
� � uint32 out
� � � �� __ � IsLockedOut � � !� �� Description Implemented
ae442007200009F ROOT\CIMV2\Security\MicrosoftTpm ���� � �� �� * � � % ������O � __PARAMETERS abstract IsLockedOut boolean
� 7 OUT
� 7 _ �� ID )
� � _ ��� boolean ReturnValue uint32
� uint32 out
� �� __ �e local machine with a drive letter or mount point. If this flag and the ExposedRemotely flag is not set, the shadow copy is hidden. ExposedRemotely $ +
� � � � � � boolean DisplayName Exposed Remotely Description The ExposedRemotely property indicates whether the shadow copy is exposed on a remote machine with a network share. If this flag and the ExposedLocally flag is not set, the shadow copy is hidden. HardwareAssisted
+
� � � � � boolean DisplayName Hardware Assisted Description The HardwareAssisted property indicates whether the shadow copy was created by a hardware shadow copy provider. Imported
" +
� � � � � � boolean DisplayName Imported Description The Imported property indicates whether the shadow copy was imported onto this machine using the Import method rather than created using the ShadowCopy create method. Name 6
� � � � � ��� � string DisplayName Name Description The name of the context NoAutoRelease +
� ] f s � � boolean DisplayName No Auto Release Description The NoAutoRelease property indicates whether the shadow copy is automatically deleted when the shadow copy requestor process ends. If this property is TRUE, the shadow copy is retained after the requestor process ends. NotSurfaced +
� � � � � � boolean DisplayName Not Surfaced Description The shadow copy is not currently in the device namespace of the local machine. NoWriters +
� y
�
�
�
�
boolean DisplayName No Writers Description The NoWriters property indicates whether the shadow copy was created with the involvement of shadow copy writer components. Persistent +
� j s � � � boolean DisplayName Persistent Description The Persistent property indicates whether the shadow copy is persistent across reboots. Plex +
� 1 : G M Z boolean DisplayName Plex Description The Plex property indicates whether the shadow copy was created by a split mirror shadow copy provider. The provider can be implemented in hardware or software. Transportable +
� E
N
[
j
w
boolean DisplayName Transportable Description The Transportable property indicates whether the shadow copy can be surfaced on another machine. If this property is FALSE and the volumes are surfaced locally, it may not be possible to surface them later on a different machine. �E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C Zѝ��C� ȝ��C�� � �������� W � __InstanceProviderRegistration \\.\root\CIMV2:__Win32Provider.Name="MSVDS__PROVIDER"
R O O T \ C I M V 2 _ _ I n s t a n c e P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 6 8 5 7 7 3 7 2 C 6 6 A 7 B 2 0 6 5 8 4 8 7 F B D 9 5 9 A A 1 5 4 E F 5 4 B 5 F 9 3 5 D C C 5 6 6 3 E 9 2 2 8 B 4 4 3 2 2 8 0 5 \ K I _ E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C \ I _ 8 1 E 1 B 4 4 7 1 1 5 A A 4 9 5 1 6 9 E 9 6 8 D 7 2 9 B 8 0 8 E 6 A F A A A 8 9 0 4 F 1 D 6 E C C F 6 F 1 7 B C 5 C B 9 9 8 8 C 8 7 d C I M _ S t o r a g e E x t e n t [ѝ��C�� b CIM_StorageExtent �������������������������������������������������������������������������������������������������� � CIM_StorageVolume � ]ѝ��C�v � ' Y r � � � � 0 G y � � �
G Y � � � = N � � � � / a m � � � � ' > p � � � �
V q � � > J | � UUUUUU������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������� � Win32_DefragAnalysis AverageFileSize
<
� Q � �� uint64 AverageFragmentsPerFile
T
� � � �� real64 AverageFreeSpacePerExtent �
� � � �� uint64 ClusterSize
� ( � �� uint64 ExcessFolderFragments |
� q � �� uint64 FilePercentFragmentation ,
� � � �� uint32 FragmentedFolders t
� � �� uint64 FreeSpace
� ? � �� uint64 FreeSpacePercent $
� � � �� uint32 FreeSpacePercentFragmentation 0 '
� � � �� � �� uint32 Deprecated LargestFreeSpaceExtent �
� 5 � �� uint64 MFTPercentInUse �
� x � �� uint32 MFTRecordCount �
� � � �� uint64 PageFileSize \ '
�
�� � �� uint64 Deprecated TotalExcessFragments L
� Y � �� uint64 TotalFiles 4
� � � �� uint64 TotalFolders l
� � � �� uint64 TotalFragmentedFiles D
� � �� uint64 TotalFreeSpaceExtents �
� h � �� uint64 TotalMFTFragments �
� � � �� uint64 TotalMFTSize �
� � � �� uint64 TotalPageFileFragments d '
� B J �� � �� uint64 Deprecated TotalPercentFragmentation ( '
� � � �� � �� uint32 Deprecated TotalUnmovableFiles �
� � � �� uint64 UsedSpace
� 6 � �� uint64 VolumeName
� t � �� string VolumeSize
� � � �� uint64 � ^ѝ��C�B 4 �� � �� � 0 8 C � � 5��������� � Win32_MountPoint Association MSVDS__PROVIDER Locale Directory f '
� x � �� � �� ref:Win32_Directory Volume f '
� � � �� � �� ref:Win32_Volume � }1� � ]<%�~ P $��� [ � 5�) � ��< � � ,8� = ���� ��jj��� 4 � �� � �� H P � � � � � U�������������������] � MSAcpiInfo WMIProv WMI guid {5DAF38AE-F6F8-4d90-8199-EBDE6800EC3B} Active
� z � �� boolean BootArchitecture +
� � � � � uint32 WmiDataId ValueMap � � 1 2 Capabilities +
� D L W _ uint32 WmiDataId BitMap
� � � � � � � � � � � � � 0 1 2 3 4 5 6 7 8 9 10 11 12 InstanceName '
� � �� � �� string PreferredProfile
� J R uint32 WmiDataId � ��jj��8 �� � WHEA abstract W � W H E A �jj��j WHEA A �� � �� � ) 1 ; A i q � � e������� � WHEAErrorInjectionMethods WMI WMIProv Locale MS\0x409 guid {e808ff73-2093-472a-a5cc-df24f031b035} Active
� � � �� boolean InstanceName '
� � � �� � �� string � W v " � � % d 5 � �
� � GetErrorInjectionCapabilitiesRtn ) K X ��e q WmiMethodId Implemented HeaderName GET_INJECTION_CAPABILITIES � WIN-F6NF7R6I6PJ ROOT\wmi ���� � �? �� � E * � ��������� � __PARAMETERS abstract Status uint32
� 2 out
� 2 Y �� ID )
� � Y ��� uint32 Capabilities uint32
� � out
� � �� ID )
� | ��A uint32 __ � InjectErrorRtn ) ^ k ��x � WmiMethodId Implemented HeaderName INJECT_HARDWARE_ERROR WIN-F6NF7R6I6PJ ROOT\wmi ���� � �� & �� * � � D � � K � f U�������������������������������������� � __PARAMETERS abstract ErrorType uint32
� 5 in
� 5 \ �� ID )
� � \ ��� uint32 Parameter1 uint64
� � in
� � �� ID )
� { ��@ uint64 Parameter2 uint64
� � in
� � � �� ID )
� 1 � ��� uint64 Parameter3 uint64
� W in
� W ~ �� ID )
� � ~ ��� uint64 Parameter4 uint64
�
in
�
4 �� ID )
� � 4 ��b uint64 __ �� WIN-F6NF7R6I6PJ ROOT\wmi ���� � �� �� * � ����� � __PARAMETERS abstract Status uint32
� 2 out
� 2 Y �� ID )
� � Y ��� uint32 __ � M S _ S m B i o s �jj��� MS_SmBios 4 � �� � # ��( . V ^ � � � � 2 8 � � � R f � � UU������������������� � MSSmBios_RawSMBiosTables WMIProv WMI guid {8F680850-A584-11d1-BF38-00A0C9062910} Active
� � � �� boolean DmiRevision
)
� � � � �� uint8 WmiDataId InstanceName '
� * � �� � �� string Size )
� o w � �� uint32 WmiDataId SMBiosData 6
� � � � � � �� uint8 WmiDataId WmiSizeIs Size SmbiosMajorVersion )
� @ G � �� uint8 WmiDataId SmbiosMinorVersion )
� � � � �� uint8 WmiDataId Used20CallingMethod )
� � � �� boolean WmiDataId � M S _ S m B i o s �jj��} + MS_SmBios 4 � �� � " ��' - U c � � F T � � � v � � H X � � � Z k � � b u � � % UUUU���������������������������������������n � MSSmBios_SMBiosEventlog WMIProv WMI guid {8F680851-A584-11d1-BF38-00A0C9062910} AccessMethod )
� � � � �� uint8 WmiDataId AccessMethodAddress )
� �
� �� uint32 WmiDataId Active
� = � �� boolean InstanceName '
� � � �� � �� string LengthEachLogTypeDesc )
� � �
� �� uint8 WmiDataId ListLogTypeDesc 6
� F M X c � �� uint8 WmiDataId WmiSizeIs LogTypeDescLength LogArea " 6
� � � � � � �� uint8 WmiDataId WmiSizeIs LogAreaLength LogAreaLength )
� 5 = � �� uint16 WmiDataId LogChangeToken
)
� � � � �� uint32 WmiDataId LogDataStart )
� � � � �� uint16 WmiDataId LogHeaderDescExists )
� F O � �� boolean WmiDataId LogHeaderFormat )
� � � � �� uint8 WmiDataId LogHeaderStart
)
� � � �� uint16 WmiDataId LogStatus )
� P W � �� uint8 WmiDataId LogTypeDescLength )
� � � � �� uint16 WmiDataId NumberLogTypeDesc
)
� � �� uint8 WmiDataId Reserved
)
� \ c � �� uint8 WmiDataId � M S _ S m B i o s �jj�� MS_SmBios ) �� G S _ e ]����� � MSSmBios_SysidUUID WMI guid {8F680852-A584-11d1-BF38-00A0C9062910} HeaderName SYSID_UUID Uuid +
� � � � uint8 WmiDataId MAX �9 A B 5 3 8 0 6 E 8 8 6 6 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0 X=�4 � ͝��C�y 9� (D��� X � WMIBinaryMofResource C:\Windows\System32\drivers\en-US\processr.sys.mui[PROCESSORWMI] |�DO� � �ؼ#d � ����� ���� � p\ � ;�o� � (ڦ�N � �DpN p �V��r Fm.G� | �1� S \_��Y �|`�o 2 C I M _ P o l i c y A c t i o n K��C�L e CIM_PolicyAction C $ 1 ? F � �� � N X l � � / L � � � � � , � � 4 p � � � 7 t � � � V o � � � H b � � ) � � E Q ���WUUUUU��������������������������������������������������������������������������������������������� � MSFT_NetTCPSetting UMLPackagePath CIM::Policy ClassVersion 1.0.0 locale nettcpip AutomaticUseCustom T 4
� � � ��� � � �� uint8 ValueMap � � 0 1 AutoReusePortRangeNumberOfPorts # Z '
� ' � �� � �� uint16 AutoReusePortRangeStartPort " X '
� � � �� � �� uint16 AutoTuningLevelEffective N )
� � � ��� � uint8 ValueMap � � 0 1 AutoTuningLevelGroupPolicy M )
� P � ��W a uint8 ValueMap y | � � 0 1 2 3 4 AutoTuningLevelLocal A 4
� � � ��� � � �� uint8 ValueMap 0 1 2 3 4 CongestionProvider @ 4
� n � �� � ��u uint8 ValueMap � � � � � � 0 1 2 3 4 5 CwndRestart > 4
� � � �� � ��
uint8 ValueMap 0 1 DelayedAckFrequency S '
� i � �� � �� uint8 DelayedAckTimeout O '
� � � �� � �� uint32 DynamicPortRangeNumberOfPorts K '
� � �� � �� uint16 DynamicPortRangeStartPort I '
� l � �� � �� uint16 EcnCapability B 4
� � � ��� � � �� uint8 ValueMap � � 0 1 ForceWS V 4
� 3 � ��: D � �� uint8 ValueMap P S 0 1 InitialCongestionWindow : '
� � � �� � �� uint32 InitialRto D '
� � � �� � �� uint32 MaxSynRetransmissions ! W '
� A � �� � �� uint8 MemoryPressureProtection ? 4
� � � ��� � � �� uint8 ValueMap � � � 0 1 2 MinRto 6 '
� � �� � �� uint32 NonSackRttResiliency U 4
� k � ��r | � �� uint8 ValueMap � � 0 1 ScalingHeuristics H 4
� � � ��� � � �� uint8 ValueMap 0 1 SettingName
2
� = � �� string Timestamps C 4
� � � ��� � � �� uint8 ValueMap � � � 0 1 2 � C I M _ F i l t e r E n t r y B a s e L��C�P U CIM_FilterEntryBase C ) B P W � �� � _ i | � � � � 0 : � � � � ����_U�������������������������������������������������������������������������������N � MSFT_NetTransportFilter UMLPackagePath CIM::Network::Filtering ClassVersion 1.0.0 locale nettcpip DestinationPrefix F
� � � �� string LocalPortEnd @
� � � �� uint16 LocalPortStart >
� ( � �� uint16 Protocol < )
� q � ��y � uint16 ValueMap � � 6 17 RemotePortEnd D
� � � �� uint16 RemotePortStart B
� uint16 SettingName J
� F � �� string � C I M _ D e p e n d e n c y M��C�� CIM_Dependency N # 3 L ��Y g n � �� � v � � � � U��������O � MSFT_NetTransportFilterTCPSetting UMLPackagePath CIM::Core::CoreElements Association ClassVersion 1.0.0 locale nettcpip Antecedent f@
� � � � ref:MSFT_NetTransportFilter Override Antecedent Dependent f@
� " : D ref:MSFT_NetTCPSetting Override Dependent et � M S F T _ N e t T r a n s p o r t C o n n e c t i o n N��C�9 [ % MSFT_NetTransportConnection C % : H O � �� � W ����������������������������������������������������� ���� �������� ������������������a � MSFT_NetUDPEndpoint UMLPackagePath CIM::Network::Pipes ClassVersion 1.0.0 locale nettcpip � C I M _ P o l i c y A c t i o n O��C�� : CIM_PolicyAction C $ 1 ? F � �� � N X w � � ��������������������������������������������������������� � MSFT_NetUDPSetting UMLPackagePath CIM::Policy ClassVersion 1.0.0 locale nettcpip DynamicPortRangeNumberOfPorts 4 '
� � � �� � �� uint16 DynamicPortRangeStartPort
2 '
� � �� � �� uint16 �6 4 6 5 9 A B 9 F 8 F 1 C 4 B 5 6 8 D B 6 4 3 8 B A E 1 1 B 2 6 E E 8 F 9 3 C B 5 F 8 1 9 5 E 2 1 E 8 C 3 8 3 D 6 C 4 4 C C 4 1 P��C�ȝ��C�.
� __NAMESPACE Defender F D 1 C 1 D 4 1 4 B 7 1 B 5 0 8 2 C 2 6 6 A 6 5 0 E 3 1 E F 6 D 5 0 1 9 3 8 2 7 2 4 2 4 4 B 6 8 5 F 2 1 7 C 0 A A E 0 0 A 9 2 1 Q��C�Cȝ��C�$ � __SystemSecurity 4 1 C 5 3 E 6 D B 1 A C F 2 4 5 3 C E F D 4 1 3 9 8 1 9 8 E 6 1 3 F 1 0 D F F 4 7 7 0 9 E C A B 1 D 7 F 0 3 7 7 5 6 A C 8 C E 7 S��C�ȝ��C�� � � __thisNAMESPACE � �� � � ? E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C ���C� ȝ��C�� � �������� [ � __InstanceProviderRegistration \\.\root\cimv2\mdm:__Win32Provider.Name="MDMSettingsProv" W M I E v e n t �jj��T WMIEvent
4 �� � �� � $ - 3 [ c � � _������������������� � MSMCAEvent_SwitchToCMCPolling WMI WmiProv guid {39C14290-F036-4999-B8A1-B6F871FB329E} Active
� � boolean InstanceName '
� � � �� � �� string �5 7 E 5 F 3 A D D 9 E 2 4 2 C 4 E 9 F 9 E D F 7 9 A A 9 7 F 7 9 E 7 9 1 1 C 5 A 8 B 9 0 2 E C 1 5 0 D 6 4 4 2 E 3 B 8 5 A 5 A A Ӧn�^��ȝ��C�� �����K @ 9 a � __Win32Provider {A7C452EF-8E9F-42EB-9F2B-245613CA0DC9} LocalServiceHost ProtectionManagement 7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D Ԧn�^��
ȝ��C�� o � __MethodProviderRegistration \\.\root\Microsoft\Windows\Defender:__Win32Provider.Name="ProtectionManagement" R O O T \ M i c r o s o f t \ W i n d o w s \ D e f e n d e r _ _ M e t h o d P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 1 A 8 9 B 5 7 D F A 9 2 6 F A B 2 8 E F D 5 C 7 F C 8 2 B 0 7 8 C 2 A 1 2 3 A 4 6 0 0 4 B C 2 9 9 B 2 1 4 E F E C 4 2 4 D 2 B 0 \ K I _ 7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D \ I _ C 2 E 2 D 7 F 2 9 4 A 3 9 E 9 5 0 F C B 0 F E 9 1 E B 4 1 D 6 C 6 6 6 3 0 2 7 3 B 2 E F 4 9 9 0 C 9 7 F 6 0 D B 5 8 2 F 2 E 1 7 bject:MSFT_CliProperty �
� � MSFT_CliFormat BRIEF ' % � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � & 4 � MSFT_CliProperty FriendlyName The FriendlyName string provides the name for the alias. The name will be unique in the context of the namespace in which the alias is defined. Note CLASS, QUERY, PATH and RESTORE cannot be used as alias names as they appear in the same location in the syntax. FriendlyName 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � 8 @ � MSFT_CliProperty PWhere The PWhere property defines a from/where clause (i.e. a WQL query without the Select clause). The query string may contain substitution parameters (tokens preceded by a '#' mark) indicating where values may be substituted into the query string. The parameter values are taken from the tokens immediately after the alias if the token cannot be resolved to a switch or verb - this allows for example a command such as 'w KillProcess 154' where the PWhere value for the KillProcess alias would be 'From Win32_process Where ProcessId = #ProcId' PWhere � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � � MSFT_CliProperty Target The Target string defines the object to be operated on through the Alias. The string may be a simple class name or a WQL query. If the Target property is empty only verbs based on commandline utilities may be used by the alias Target � �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � 1 � MSFT_CliFormat LIST SYSTEM
J � � [ � h
�
~ � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty __CLASS __CLASS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __DERIVATION __DERIVATION � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __DYNASTY __DYNASTY � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty __GENUS __GENUS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier t � , � MSFT_CliProperty __NAMESPACE __NAMESPACE � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o � " � MSFT_CliProperty __PATH __PATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier y � $ 6 � MSFT_CliProperty __PROPERTY_COUNT __PROPERTY_COUNT � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __RELPATH __RELPATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier q � & � MSFT_CliProperty __SERVER __SERVER � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __SUPERCLASS __SUPERCLASS ��@ � <�W7 9 �,0�p � �� : ��: w �W�
� �"|�p
� ��+Z f em��� j ���* r ���Ȝ P `J�� Q &o��= k �w��� d Sr� g ���s i HT7� g ���C g �˧� l ���j��� " * : l � � � � 5 E U���������������������w � RSOP_IEConnectionWinINetSettings Locale connectionName
� d � �� string internetPerConnOptionListData
� � uint8 internetPerConnOptionListDataSize
� � uint32 rsopID
� - � �� string rsopPrecedence
� o � �� sint32 � ���j��!
# U d � � ������������� � RSOP_ScriptCmd Locale arguments
� M � �� string executionTime e
� � � �� datetime script
� � � �� string � ���j��x
�� " 0 b k � � � � # / b g � � ��������� �� � � RSOP_GPLink Association Locale appliedOrder
� Z � �� uint32 enabled
� � � �� boolean GPO f '
� � � �� � �� ref:RSOP_GPO linkOrder
� � �� uint32 noOverride
� Y � �� boolean SOM f '
� � � �� � �� ref:RSOP_SOM somOrder '
� � � �� � �� uint32 � ���j��" ! �� . < � %��������� � RSOP_IEFavoriteItemLink Locale Association favoriteItem f
� f � �� ref:RSOP_IEFavoriteItem policySetting f
� � � �� ref:RSOP_IEAKPolicySetting � ���j��_ �� & 4 h o � � 9 E � � ������� � � ����� � RSOP_PolicySetting abstract Locale creationTime e
� ^ � �� datetime GPOID
� � � �� string id 2
� � � ��� �� � �� string Required Not_Null name
� 1 � �� string precedence 2
� � � ��� �� � �� uint32 Required Not_Null SOMID
� � � �� string � R S O P _ P o l i c y S e t t i n g ���j��� 8 RSOP_PolicySetting �� & 9 ` s � � � � % L c � � �^U���������R P T ��������������������������������� � RSOP_PolmkrSetting Abstract Locale polmkrBaseCseGuid
� X string polmkrBaseGpeGuid $
� � string polmkrBaseGpoDisplayName
� � string polmkrBaseGpoGuid
�
string polmkrBaseHash
(
� D string polmkrBaseInstanceXml 0
� � string polmkrBaseKeyValues ,
� � string es � R S O P _ P o l m k r S e t t i n g
���j��� 8 RSOP_PolmkrSetting ��! ������������U S W ��������������������������������) � RSOP_PolmkrProSetting Abstract Locale � R S O P _ P o l m k r P r o S e t t i n g ���j��$ 8 RSOP_PolmkrProSetting # ' Y e ������������e c g ��������������������������������� � RSOP_PolmkrProfileSetting Locale id @
� Q � �� string precedence @
� � � �� uint32 tt � R S O P _ P o l m k r P r o S e t t i n g ���j��( 8 RSOP_PolmkrProSetting ' + ] i ������������i g k ��������������������������������� � RSOP_PolmkrApplicationSetting Locale id @
� U � �� string precedence @
� � � �� uint32 tt � R S O P _ P o l m k r P r o S e t t i n g
���j��0 8 RSOP_PolmkrProSetting ' / 3 e q ������������q o s ��������������������������������� � RSOP_PolmkrLocalUsersAndGroupsSetting Locale id @
� ] � �� string precedence @
� � � �� uint32 tt �% R S O P _ P o l m k r L o c a l U s e r s A n d G r o u p s S e t t i n g ���j��� 8 / RSOP_PolmkrLocalUsersAndGroupsSetting ' & 2 ������������h f j ��������������������������������Y � RSOP_PolmkrLocalUsersSetting Locale precedence @
� Q uint32 �% R S O P _ P o l m k r L o c a l U s e r s A n d G r o u p s S e t t i n g ���j��� 8 / RSOP_PolmkrLocalUsersAndGroupsSetting ' ' 3 ������������i g k ��������������������������������Z � RSOP_PolmkrLocalGroupsSetting Locale precedence @
� R uint32 � R S O P _ P o l m k r P r o S e t t i n g ���j��) 8 RSOP_PolmkrProSetting ( , ^ j ������������j h l ��������������������������������� � RSOP_PolmkrRegionOptionSetting Locale id @
� V � �� string precedence @
� � � �� uint32 tt � R S O P _ P o l m k r P r o S e t t i n g ���j��" 8 RSOP_PolmkrProSetting ! % W c ������������c a e ��������������������������������� � RSOP_PolmkrDriveSetting Locale id @
� O � �� string precedence @
� � � �� uint32 tt � R S O P _ P o l m k r P r o S e t t i n g ���j��% 8 RSOP_PolmkrProSetting $ ( Z f ������������f d h ��������������������������������� � RSOP_PolmkrInternetSetting Locale id @
� R � �� string precedence @
� � � �� uint32 tt � R S O P _ P o l m k r P r o S e t t i n g ���j��' 8 RSOP_PolmkrProSetting & * \ h ������������h f j ��������������������������������� � RSOP_PolmkrDataSourceSetting Locale id @
� T � �� string precedence @
� � � �� uint32 tt � R S O P _ P o l m k r P r o S e t t i n g ���j��% 8 RSOP_PolmkrProSetting $ ( Z f ������������f d h ��������������������������������� � RSOP_PolmkrShortcutSetting Locale id @
� R � �� string precedence @
� � � �� uint32 tt � R S O P _ P o l m k r P r o S e t t i n g ���j��% 8 RSOP_PolmkrProSetting $ ( Z f ������������f d h ��������������������������������� � RSOP_PolmkrRegistrySetting Locale id @
� R � �� string precedence @
� � � �� uint32 tt � R S O P _ P o l m k r P r o S e t t i n g ���j��* 8 RSOP_PolmkrProSetting ! ) - _ k ������������k i m ��������������������������������� � RSOP_PolmkrNetworkOptionSetting Locale id @
� W � �� string precedence @
� � � �� uint32 tt � �%� � !�)� ? m��; � 5��
, ���R ~ 6s?
� ] -m�� V ��16E � &=Hw� U @A* � �#;& ���_8 . �(��f 6 R O O T \ S t a n d a r d C i m v 2 _ _ I n s t a n c e P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ B 5 E C 8 A D F 9 6 E 5 E 6 0 6 4 A D 9 E B 0 B 1 3 7 0 F D B D 6 6 4 E 0 B 0 E 7 8 0 2 B 6 A 2 A 5 7 9 6 B 5 F A F 2 2 A F E E \ K I _ E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C \ I _ 7 D 7 2 6 A 5 3 C 2 E 1 0 9 A 7 1 0 2 A A 0 7 3 3 A F 1 5 E 0 A B E D D F C E A 1 6 9 F D 7 5 0 A A C B D 3 7 7 D 8 D 2 9 F 5 6 C I M _ D N S G e n e r a l S e t t i n g D a t a �ڝ��C�� , # CIM_DNSGeneralSettingData C - @ M R ` � �� � g u � � � P _ � � ��W����������������� ����������������������. � MSFT_DNSClientGlobalSetting UMLPackagePath CIM::Network::DNS Description 706 ClassVersion 1.0.0 dnsclientcim DevolutionLevel $ 4
� � � � � �� � �� uint32 Description 705 SuffixSearchList 4
� 6 > K � �� � �� string Description 704 UseDevolution
4
� � � � � �� � �� boolean Description 703 UseSuffixSearchList 4
� ) � �� � �� boolean Description 702 � C I M _ L o g i c a l D e v i c e
��C�s � CIM_LogicalDevice ! 5 = G � �
� � � � � � �������_U���������������������������������������������� ���� �������� ��������������������������������������������������������������������������������������������������������@ � CIM_LogicalPort UMLPackagePath CIM::Device::Ports locale MaxSpeed & �
� s { � uint64 PUnit bit / second OtherPortType ' �
� � � � string ModelCorrespondence � CIM_LogicalPort.PortType PortType ( � +
� M U j � � uint16 ModelCorrespondence r CIM_NetworkPort.OtherNetworkPortType ValueMap � � � � � 0 1 2 3..15999 16000..65535 RequestedSpeed ) � 6
� / 7 L k r � �� uint64 ModelCorrespondence T CIM_LogicalPort.Speed PUnit bit / second Speed * �
� � � � uint64 PUnit bit / second UsageRestriction + �
� uint16 ValueMap 4 7 : = 0 2 3 4 � C I M _ P r o t o c o l E n d p o i n t *��C�� } CIM_ProtocolEndpoint ! B J Z � � � � L U q } � � � � �������U���������������������������������������������� ���� �������� ��������������������������������������������������� � CIM_LANEndpoint UMLPackagePath CIM::Network::ProtocolEndpoints locale AliasAddresses Z
� y string GroupAddresses ^
� � string LANID b
� � � string ModelCorrespondence 6 CIM_LANConnectivitySegment.LANID CIM_LANSegment.LANID LANType f 8
� � � � � � @ J uint16 Deprecated � CIM_ProtocolEndpoint.ProtocolType ModelCorrespondence � ( CIM_LANConnectivitySegment.ConnectivityType CIM_LANSegment.LANType ValueMap b e h k n 0 1 2 3 4 MACAddress h
� � � string MaxLen MaxDataSize ! l
� � uint32 OtherLANType " p +
� 4 < H { � string Deprecated P CIM_ProtocolEndpoint.OtherTypeDescription ModelCorrespondence � � CIM_LANConnectivitySegment.OtherTypeDescription CIM_LANEndpoint.LANType � C I M _ R e m o t e S e r v i c e A c c e s s P o i n t 7��C�. s & CIM_RemoteServiceAccessPoint C 0 D R Y f � �� � k y � � � T a � � �����W����������������������������������������������� ���� �������� ���������������������� ���������������� � MSFT_DNSClientDohServerAddress UMLPackagePath CIM::Core::Service ClassVersion 1.0.0 Description 753 dnsclientcim AllowFallbackToUdp ^ 4
� � � � � �� � �� boolean Description 751 AutoUpgrade ` 4
� 9 B O � �� � �� boolean Description 752 DohTemplate b 4
� � � � � �� � �� string Description 750 ServerAddress f )
� � �� string Description 749 � C I M _ R e m o t e S e r v i c e A c c e s s P o i n t 8��C�
u & CIM_RemoteServiceAccessPoint C - A O V c � �� � h v � � � 7 G � � �����W����������������������������������������������� ���� �������� ���������������������� ������������������� � MSFT_DNSClientServerAddress UMLPackagePath CIM::Core::Service ClassVersion 1.0.0 Description 748 dnsclientcim AddressFamily ^ )
� � � � � �� uint16 Description 747 InterfaceAlias ` )
� % 2 � �� string Description 656 InterfaceIndex d )
� ~ � � � �� uint32 Description 655 ServerAddresses h )
� � � � � �� string Description 746 � X��C�> � BaseStatus locale as � M S _ S m B i o s �jj��f MS_SmBios A � �� � ! ��& , T _ u } � � L R U��������������� � MSSmBios_Sysid1394List WMIProv WMI guid {8F680855-A584-11d1-BF38-00A0C9062910} GuidName1 SYSID_1394_DATA_GUID Active
� � � �� boolean Count )
� � � � �� uint32 WmiDataId InstanceName '
� D � �� � �� string List
6
� � � � � � �� object:MSSmBios_Sysid1394 WmiDataId WmiSizeIs Count oo � �jj��= �� � MSMCAInfo abstract AI �9 A B 5 3 8 0 6 E 8 8 6 6 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0 S�b��5� ͝��C�l -e3 �5��� K � WMIBinaryMofResource C:\Windows\System32\Drivers\portcls.SYS[PortclsMof] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� % *!!�2�� _ � WDMClassesOfDriver HDAudioBus_Enum C:\Windows\System32\drivers\HDAudBus.sys[HDAudioMofName] E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C ֦n�^�� ȝ��C�� � �������� q � __InstanceProviderRegistration \\.\root\Microsoft\Windows\Defender:__Win32Provider.Name="ProtectionManagement" R O O T \ M i c r o s o f t \ W i n d o w s \ D e f e n d e r _ _ I n s t a n c e P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 1 A 8 9 B 5 7 D F A 9 2 6 F A B 2 8 E F D 5 C 7 F C 8 2 B 0 7 8 C 2 A 1 2 3 A 4 6 0 0 4 B C 2 9 9 B 2 1 4 E F E C 4 2 4 D 2 B 0 \ K I _ E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C \ I _ C 2 E 2 D 7 F 2 9 4 A 3 9 E 9 5 0 F C B 0 F E 9 1 E B 4 1 D 6 C 6 6 6 3 0 2 7 3 B 2 E F 4 9 9 0 C 9 7 F 6 0 D B 5 8 2 F 2 E 1 7 [MofResourceName] 2 F 2 E 1 7 7 4 9 9 0 C 9 7 F 6 0 D B 5 8 2 F 2 E 1 7 �L �ѝ��C�( � �� � = ' = o � � � K Z � � �
< e � � � : e � � � ; J | � � � = A ~ � � � # G y � � � % B t � � � / U � � � � + M � � � .
@
r
�
�
�
�
7 L ~ � � � � = P � � � �
G
V
�
�
�
�
+ ] r � � � M i � � � � * 7 k z � � � 5 G y � � � UUUUUUUUUUUUUUU��������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������� � SoftwareLicensingProduct SppProvider ADActivationCsvlkPid 5 �
� g � �� string ADActivationCsvlkSkuId 6 �
� � � �� string ADActivationObjectDN 4 �
� � � �� string ADActivationObjectName 3 �
� C � �� string ApplicationID
� � � �� string AutomaticVMActivationHostDigitalPid2 < �
� � � �� string AutomaticVMActivationHostMachineName : �
� 4 � �� string AutomaticVMActivationLastActivationTime e ; �
� � � �� datetime Description
� � � �� string DiscoveredKeyManagementServiceMachineIpAddress n
� 2 � �� string DiscoveredKeyManagementServiceMachineName j
� � � �� string DiscoveredKeyManagementServiceMachinePort r
� � � �� uint32 EvaluationEndDate e 0
� 1 � �� datetime ExtendedGrace * �
� t � �� uint32 GenuineStatus ) �
� � � �� uint32 GracePeriodRemaining ,
� � � �� uint32 IAID 9 �
� 5 � �� string ID '
� v � �� � �� string IsKeyManagementServiceMachine v
� � � �� uint32 KeyManagementServiceCurrentCount z
� � �� uint32 KeyManagementServiceFailedRequests ' �
� q � �� uint32 KeyManagementServiceLicensedRequests " �
� � � �� uint32 KeyManagementServiceLookupDomain f
� � �� string KeyManagementServiceMachine ^
� l � �� string KeyManagementServiceNonGenuineGraceRequests % �
� � � �� uint32 KeyManagementServiceNotificationRequests ( �
� ' � �� uint32 KeyManagementServiceOOBGraceRequests # �
� � �� uint32 KeyManagementServiceOOTGraceRequests $ �
� � � �� uint32 KeyManagementServicePort b
� # � �� uint32 KeyManagementServiceProductKeyID Z
� w � �� string KeyManagementServiceTotalRequests & �
� � � �� uint32 KeyManagementServiceUnlicensedRequests ! �
� &
� �� uint32 LicenseDependsOn L
� j
� �� string LicenseFamily H
� �
� �� string LicenseIsAddon P
� �
� �� boolean LicenseStatus $
� / � �� uint32 LicenseStatusReason
(
� v � �� uint32 MachineURL
� � � �� string Name
� � � �� string OfflineInstallationId
4
� 5 � �� string PartialProductKey 8
� z � �� string ProcessorURL
� � � �� string ProductKeyChannel D
� � � �� string ProductKeyID <
� ?
� �� string ProductKeyID2 @
� �
� �� string ProductKeyURL
� �
� �� string RemainingAppReArmCount 8 �
� � �� uint32 RemainingSkuReArmCount 7 �
� U � �� uint32 RequiredClientCount ~
� � � �� uint32 TokenActivationAdditionalInfo / �
� � � �� string TokenActivationCertificateThumbprint . �
� E � �� string TokenActivationGrantNumber - �
� � � �� uint32 TokenActivationILID + �
� � � �� string TokenActivationILVID , �
� " � �� uint32 TrustedTime e 0 �
� a � �� datetime UseLicenseURL
� � � �� string ValidationURL
� � � �� string VLActivationInterval R
� - � �� uint32 VLActivationType 1 �
� q � �� uint32 VLActivationTypeEnabled 2 �
� � � �� uint32 VLRenewalInterval V
� � �� uint32 �7 1 5 � � � � Y w � ; � � � � �
&
, % E a j � % ) � � � � b � � � C _ k � ! +! /! �" �" �" �" �% �% & & ) ,) H) P- �. �. / 1 �2 �2 �2 �2 O4 Y4 u4 y4 �5 � UninstallProductKey $ �� Implemented y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � Activate � �� implemented y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � DepositOfflineConfirmationId � �� implemented � ae442007200009F ROOT\CIMV2 ���� � �Q �� � M * � ��������� � __PARAMETERS abstract InstallationId string
� : in
� : a �� ID )
� � a ��� string ConfirmationId string
� � in
� � �� ID )
� � ��I string __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � GetPolicyInformationDWord � �� implemented ae442007200009F ROOT\CIMV2 ���� � �� �� * � ����� � __PARAMETERS abstract PolicyName string
� 6 in
� 6 ] �� ID )
� � ] ��� string __ �� ae442007200009F ROOT\CIMV2 ���� � �� �� * � � # ��������M � __PARAMETERS abstract PolicyValue uint32
� 7 out
� 7 ^ �� ID )
� � ^ ��� uint32 ReturnValue uint32
� uint32 out
� �� __ � GetPolicyInformationString
�� implemented ae442007200009F ROOT\CIMV2 ���� � �� �� * � ����� � __PARAMETERS abstract PolicyName string
� 6 in
� 6 ] �� ID )
� � ] ��� string __ �� ae442007200009F ROOT\CIMV2 ���� � �� �� * � � # ��������M � __PARAMETERS abstract PolicyValue string
� 7 out
� 7 ^ �� ID )
� � ^ ��� string ReturnValue uint32
� uint32 out
� �� __ � SetKeyManagementServiceMachine T �� implemented ae442007200009F ROOT\CIMV2 ���� � �� �� * � ����� � __PARAMETERS abstract MachineName string
� 7 in
� 7 ^ �� ID )
� � ^ ��� string __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � ClearKeyManagementServiceMachine �� implemented y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � SetKeyManagementServicePort � �� implemented ae442007200009F ROOT\CIMV2 ���� � �� �� * � ����� � __PARAMETERS abstract PortNumber uint32
� 6 in
� 6 ] �� ID )
� � ] ��� uint32 __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � ClearKeyManagementServicePort � �� implemented y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � SetKeyManagementServiceLookupDomain R �� implemented ae442007200009F ROOT\CIMV2 ���� � �� �� * � ����� � __PARAMETERS abstract LookupDomain string
� 8 in
� 8 _ �� ID )
� � _ ��� string __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � ClearKeyManagementServiceLookupDomain ! �� implemented y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � GetTokenActivationGrants �" �� implemented � ae442007200009F ROOT\CIMV2 ���� � �� �� * � � ��������H � __PARAMETERS abstract Grants string
� 2 out
� 2 Y �� ID )
� � Y ��� string ReturnValue uint32
� uint32 out
� �� __ � GenerateTokenActivationChallenge & �� implemented � ae442007200009F ROOT\CIMV2 ���� � �� �� * � � ! ��������K � __PARAMETERS abstract Challenge string
� 5 out
� 5 \ �� ID )
� � \ ��� string ReturnValue uint32
� uint32 out
� �� __ � DepositTokenActivationResponse ;) �� implemented ae442007200009F ROOT\CIMV2 ���� � ��
�� � � * � � B ������������6 � __PARAMETERS abstract Challenge string
� 5 in
� 5 \ �� ID )
� � \ ��� string Response string
� � in
� � �� ID )
� y ��> string CertChain string
� � in
� � � �� ID )
� . � ��� string __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � SetVLActivationTypeEnabled �. �� implemented ae442007200009F ROOT\CIMV2 ���� � �� �� * � ����� � __PARAMETERS abstract ActivationType uint32
� : in
� : a �� ID )
� � a ��� uint32 __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � ClearVLActivationTypeEnabled �2 �� implemented y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � ReArmSku h4 �� implemented y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ �isplayName Percent File Fragmentation Description Percentage of files that are fragmented on the volume. FragmentedFolders t +
� � � � � � uint64 DisplayName Fragmented Folders Description The total number fragmented folders on the volume. FreeSpace +
� < D Q ] j uint64 DisplayName Free Space Description The space currently free on the volume. FreeSpacePercent $ +
� � � � uint32 DisplayName Free Space Percent Description The percentage free space on the volume. FreeSpacePercentFragmentation 0 +
� � � � � � uint32 DisplayName Percent Free Space Fragmentation Description Percentage of freespace that is fragmented on the volume. This property is deprecated because the computed value is unreliable. Use AverageFreeSpacePerExtent, LargestFreeSpaceExtent and TotalFreeSpaceExtents to evaluate the fragmentation of volume free space. LargestFreeSpaceExtent � +
� 1 9 F a n uint64 DisplayName Largest Free Space Extent Description The size of the largest free space extent on the volume. MFTPercentInUse � +
� � �
,
9
uint32 DisplayName Master File Table In Use Percentage Description The percentage of the Master File Table that is in use. MFTRecordCount � +
� �
�
�
�
�
uint64 DisplayName Master File Table Record Count Description The number of records in the Master File Table. PageFileSize \ +
� u } � � � uint64 DisplayName Page File Size Description The size of the page file on the volume. If there is no page file on the volume this property will be NULL. This property is deprecated because page file fragmentation is no longer available. The value returned for this property will always be zero. TotalExcessFragments L +
� � �
,
uint64 DisplayName Total Excess Fragments Description The total number excess file fragments on the volume. TotalFiles 4 +
� �
�
�
�
�
uint64 DisplayName Total Files Description Total number of files on the volume. TotalFolders l +
� D L Y h u uint64 DisplayName Total Folders Description The total number folders on the volume. TotalFragmentedFiles D +
� � � ' uint64 DisplayName Total Fragmented Files Description The total number of fragmented files on the volume. TotalFreeSpaceExtents � +
� � � � � � uint64 DisplayName Total Free Space Extents Description The total number of free space extents on the volume. TotalMFTFragments � +
� k s � � � uint64 DisplayName Total Master File Table Fragments Description The total number of Master File Table fragments on the volume. TotalMFTSize � +
� 7 ? L j w uint64 DisplayName Total Master File Table Size Description The total size of the Master File Table on the volume. TotalPageFileFragments d +
� 0 = uint64 DisplayName Total Page File Fragments Description The total number of fragments for the page file. If there is no page file on the volume this property will be NULL. This property is deprecated because page file fragmentation is no longer available. The value returned for this property will always be zero. TotalPercentFragmentation ( +
� � � � � � uint32 DisplayName Total Percent Fragmentation Description Total percent fragmentation on the volume. This property is deprecated because the computed value is unreliable. Use FilePercentFragmentation to evaluate the fragmentation of the volume. TotalUnmovableFiles � +
� � � � uint64 DisplayName Total Unmovable Files Description The total number of unmovable files on the volume. UsedSpace +
� � � � � � uint64 DisplayName Used Space Description The space currently used on the volume. VolumeName +
� , 4 A N [ string DisplayName Volume Name Description The name of the volume for which this report is generated. This property can the the volume drive letter, a mount point or the volume GUID name. VolumeSize +
� 3 ; H U b uint64 DisplayName Volume Size Description Total size of the volume. � %�� ^ ꓜ � % F�S �B�
�ݕm �Z< $ �,�% � 5 7 E 5 F 3 A D D 9 E 2 4 2 C 4 E 9 F 9 E D F 7 9 A A 9 7 F 7 9 E 7 9 1 1 C 5 A 8 B 9 0 2 E C 1 5 0 D 6 4 4 2 E 3 B 8 5 A 5 A A �֝��C�ȝ��C�� �?����J �� 9 l � __Win32Provider {20E25881-F081-448e-85C9-4707A9400593} LocalSystemHost UserProfileConfigurationProvider E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C �֝��C� ȝ��C�� � �������� h � __InstanceProviderRegistration \\.\ROOT\CIMV2:__Win32Provider.Name="UserProfileConfigurationProvider"
R O O T \ C I M V 2 _ _ I n s t a n c e P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 6 8 5 7 7 3 7 2 C 6 6 A 7 B 2 0 6 5 8 4 8 7 F B D 9 5 9 A A 1 5 4 E F 5 4 B 5 F 9 3 5 D C C 5 6 6 3 E 9 2 2 8 B 4 4 3 2 2 8 0 5 \ K I _ E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C \ I _ C A 7 C E 6 F F A F 4 3 B 5 6 9 2 6 F 2 0 9 A 3 3 1 3 6 2 C C 1 9 4 A D C 0 7 8 7 8 E 9 B C C A 1 1 3 7 E 8 8 6 9 3 0 0 A A 6 7 _7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D �֝��C�
ȝ��C�} f � __MethodProviderRegistration \\.\ROOT\CIMV2:__Win32Provider.Name="UserProfileConfigurationProvider"
R O O T \ C I M V 2 _ _ M e t h o d P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 6 8 5 7 7 3 7 2 C 6 6 A 7 B 2 0 6 5 8 4 8 7 F B D 9 5 9 A A 1 5 4 E F 5 4 B 5 F 9 3 5 D C C 5 6 6 3 E 9 2 2 8 B 4 4 3 2 2 8 0 5 \ K I _ 7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D \ I _ C A 7 C E 6 F F A F 4 3 B 5 6 9 2 6 F 2 0 9 A 3 3 1 3 6 2 C C 1 9 4 A D C 0 7 8 7 8 E 9 B C C A 1 1 3 7 E 8 8 6 9 3 0 0 A A 6 7 PyR|�C�� 6 & 4 9 F ��� � � � MSFT_VirtualDiskToStorageFaultDomain ClassVersion 1.0 Description Association between VirtualDisk and StorageFaultDomain. AMENDMENT LOCALE MS_409 � � �֝��C�� + ) { ��� � � 9 I � � l t � � � � � � 8 E � � q v
� � UUU����������������������������������������� � Win32_UserProfile Description The Win32_UserProfile class contains information about user profiles on a Windows system. AMENDMENT LOCALE LastDownloadTime e
� � � � DATETIME Description This property indicates when a roaming profile was downloaded from server last time. LastUploadTime e $
� u � DATETIME Description This property indicates when a roaming profile was uploaded to server last time. LastUseTime e
� ! . DATETIME Description This property indicates when this profile is used last time. Loaded
� � � � boolean Description This property indicates whether this profile is loaded. LocalPath
� & . ; string Description This property contains the user profile's path on the local computer. RefCount
� � � � uint32 Description This property indicates the ref count of the profile. If the profile is loaded, the ref count is at least 1.
Higher values indicates there are more than one applications or services has loaded the profile and using it.
RoamingConfigured
� � � � boolean Description This property indicates whether the user has a roaming profile configured.
NOTE: User has a roaming profile configured does not mean that this profile is indeed roaming.
There are other policies and user preference can prevent the profile from roaming.
Please refer to the RoamingPreference and Status property. RoamingPath
� q y � string Description This property contains the user's roaming profile path if RoamingConfigured is true. RoamingPreference
� $ 1 boolean Description This property indicates whether the user prefer to roam this profile if RoamingConfigured is true.
By default, this property will be true to let the roaming profile roam between the local computer and the server.
User can set this property to false to prevent roaming, then the profile will work like a local profile.
SID )
� � � ��� � string Description This property contains the SID of the user who owns this user profile. Special
� ? H U boolean Description This property indicates whether this profile belongs to a special system service. Status
� � � � uint32 Description May be one or more of the following:
0x00000001 - Indicate the profile is a temporary profile, it will be deleted at user logoff.
0x00000002 - Indicate the profile is now set to roaming, if this bit is not set, then it is set to local.
0x00000004 - Indicate the profile is a mandatory profile.
0x00000008 - Indicate the profile is a corrupted profile, and not in use, user or administrator must fix
the corruption in order to use this profile again.
5
w �
� ChangeOwner + Description Change a user profile's owner to another user, the result value is HRESULT a42c9160500003S ROOT\CIMV2\ms_409 ���� � �� �� H � * � ��������% � __PARAMETERS abstract NewOwnerSID string
� 7 In
� 7 ^ �� The new owner's SID. Description )
� 7 ^ ��� � ID 6
� . ^ ��� � � string Flags uint32
� O In
� O v �� May be one or more of the following:
0x00000001 - If the new owner already has a profile, calling this method with this flag will replace
the existing profile. If the new owner already has a profile, calling this method
without this flag will fail and return HRESULT_FROM_WIN32(ERROR_ALREADY_EXISTS).
0x00000002 - If the new owner already has a profile, and ReplaceNewOwnerProfile is specified, then
specify this flag will delete the replaced profile. Without this flag, the replaced
profile is left alone, no user will use that profile automatically, it will not be
enumerated either. If ReplaceNewOwnerProfile is not specified, this flag will have
no effect.
Description )
� O v ��� � ID 6
� v ��� � � uint32 __ �� a42c9160500003S ROOT\CIMV2\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � � � G�x` [��4r 8Td,w
� �Y��* o ��;� � C I M _ C h e c k /��C�� G CIM_Check C $ * � R � ��[ k
� � � � A E w � � � � � - : l w � � ��WU�������������������������������������������������������������������� � Win32_ServiceSpecification Locale UUID {DBAD0F60-DB34-11d2-85FC-0000F8102E5F} MSIProv MappingStrings s Microsoft.MSI Dependencies 6
� � � �� string DisplayName
"
� � � �� string ErrorControl
.
� 9 � �� sint32 ID
� o � �� string LoadOrderGroup 2
� � � �� string Name @
� � � �� string Password >
� % � �� string ServiceType &
� d � �� sint32 StartName :
� � � �� string StartType *
� � � �� sint32 � C I M _ D e p e n d e n c y �ʝ��C�� CIM_Dependency ) $ � ��
� � g r � � � � � � U�����������������������������- � CIM_ProcessExecutable Description A link between a process and a data file indicating that the file participates in the execution of the process.
Note: In order to receive all possible instances of this class, the SE_DEBUG_PRIVILEGE should be enabled. AMENDMENT LOCALE Antecedent f@ )
� U g t � �� ref:CIM_DataFile Description The data file participating in the execution of the process. BaseAddress
� � � uint64 Description BaseAddress represents the base address of the module in the address space of the associated process. Dependent f@ )
� � � � � �� ref:CIM_Process Description The process. GlobalProcessCount
� * uint32 Description GlobalProcessCount is the current number of processes that have the file loaded in memory. ModuleInstance
� � � � uint32 Description ModuleInstance represents the Win32 instance handle.The ModuleInstance property has been deprecated. There is no replacement value and this property is now considered obsolete. ProcessCount
� � � � uint32 Description ProcessCount represents the reference count of the file in the associated process. � C I M _ L o g i c a l D e v i c e �tR|�C�y W CIM_LogicalDevice ) Z ��e m { � � � ' �
�
w � - *
0
�
�
� � T c ���_UU���������������������������������������������������������������������������������q � CIM_Processor Description Capabilities and management of the processor logical device. AMENDMENT LOCALE AddressWidth . +
� � � � � � uint16 Description Processor address width in bits. Units bits CurrentClockSpeed 0 +
� D L Y � � uint32 Description The current speed (in MHz) of this processor. Units megahertz DataWidth 4 +
� � � � uint16 Description Processor data width in bits. Units bits Family 6 +
� ` h u � � uint16 Description The processor family type. For example, values include "Pentium(R) processor with MMX(TM) technology" (14) and "68040" (96). Values l � � � � � � � � � � � & T a y � � � � � � � � � ' 5 C R ` n } � � � � � � � � � ( 4 A O [ j { � � � � � � � � � � � ! ; W _ v � � � � � � � & ? � � � � � �
3
7
F
J
N
R
g
m
s
y
�
�
�
�
�
�
�
Other Unknown 8086 80286 80386 80486 8087 80287 80387 80487 Pentium(R) brand Pentium(R) Pro Pentium(R) II Pentium(R) processor with MMX(TM) technology Celeron(TM) Pentium(R) II Xeon(TM) Pentium(R) III M1 Family M2 Family K5 Family K6 Family K6-2 K6-3 AMD Athlon(TM) Processor Family AMD(R) Duron(TM) Processor AMD29000 Family K6-2+ Power PC Family Power PC 601 Power PC 603 Power PC 603+ Power PC 604 Power PC 620 Power PC X704 Power PC 750 Alpha Family Alpha 21064 Alpha 21066 Alpha 21164 Alpha 21164PC Alpha 21164a Alpha 21264 Alpha 21364 MIPS Family MIPS R4000 MIPS R4200 MIPS R4400 MIPS R4600 MIPS R10000 SPARC Family SuperSPARC microSPARC II microSPARC IIep UltraSPARC UltraSPARC II UltraSPARC IIi UltraSPARC III UltraSPARC IIIi 68040 68xxx Family 68000 68010 68020 68030 Hobbit Family Crusoe(TM) TM5000 Family Crusoe(TM) TM3000 Family Efficeon(TM) TM8000 Family Weitek Itanium(TM) Processor AMD Athlon(TM) 64 Processor Family AMD Opteron(TM) Family PA-RISC Family PA-RISC 8500 PA-RISC 8000 PA-RISC 7300LC PA-RISC 7200 PA-RISC 7100LC PA-RISC 7100 V30 Family Pentium(R) III Xeon(TM) Pentium(R) III Processor with Intel(R) SpeedStep(TM) Technology Pentium(R) 4 Intel(R) Xeon(TM) AS400 Family Intel(R) Xeon(TM) processor MP AMD AthlonXP(TM) Family AMD AthlonMP(TM) Family Intel(R) Itanium(R) 2 Intel Pentium M Processor K7 IBM390 Family G4 G5 G6 z/Architecture base i860 i960 SH-3 SH-4 ARM StrongARM 6x86 MediaGX MII WinChip DSP Video Processor LoadPercentage 8 +
� g n uint16 Description Loading of this processor, averaged over the last minute, in percent. Units percent MaxClockSpeed : +
� � � �
uint32 Description The maximum speed (in MHz) of this processor. Units megahertz OtherFamilyDescription >
� Y a n string Description A string describing the processor family type - used when the family property is set to 1 ("Other"). This string should be set to NULL when the family property is any value other than 1. Role B
� \
d
q
string Description A free form string describing the role of the processor - for example, "Central Processor"' or "Math Processor" Stepping F
� - string Description Stepping is a free-form string indicating the revision level of the processor within the processor family. UniqueId J
� � � � string Description A globally unique identifier for the processor. This identifier may only be unique within a processor family. UpgradeMethod N +
� � � � D L uint16 Description CPU socket information including data on how this Processor can be upgraded (if upgrades are supported). This property is an integer enumeration. Values � � � � � � � � � � * A M Y e Other Unknown Daughter Board ZIF Socket Replacement/Piggy Back None LIF Socket Slot 1 Slot 2 370 Pin Socket Slot A Slot M Socket 423 Socket A (Socket 462) Socket 478 Socket 754 Socket 940 Socket 939 � C I M _ L o g i c a l F i l e uR|�C�9 CIM_LogicalFile 6 �� ' � � � � � CIM_Directory AMENDMENT Description Directory is a type of file that logically groups data files 'contained' in it, and provides path information for the grouped files. DisplayName Directories (CIM) LOCALE � �vR|�C�� 6 - ` ��k s { � MSFT_MpHeartBeat Version 1.0 Description The Microsoft Defender Antivirus Heart Beat Class AMENDMENT LOCALE MS_409 � �it, and provides path information for the grouped files. AMENDMENT DisplayName Directories (CIM) LOCALE ms_409 � �dz� � �N� � �4ΫF � >�L� � ��Y�� � {ߌA
� �)�T� � �� } � W� �" � � I� g ���~& k ��� � e ��Zp� � ��j� . R S O P _ P o l m k r P r o S e t t i n g �uR|�C�i 8 RSOP_PolmkrProSetting ) - w ��� � � + ��������������������������������������������������������� � RSOP_PolmkrDialupOptionSetting Description Localized version of RSOP_PolmkrDialupOptionSetting for American English AMENDMENT LOCALE id @ 6
� � � � � �� string Description Inherited from RSOP_PolmkrProSetting. DisplayName Id precedence @ 6
� o w � � � � �� uint32 Description Inherited from RSOP_PolmkrProSetting. DisplayName Precedence � R S O P _ P o l m k r P r o S e t t i n g �uR|�C�i 8 RSOP_PolmkrProSetting ) - w ��� � � + ��������������������������������������������������������� � RSOP_PolmkrFolderOptionSetting Description Localized version of RSOP_PolmkrFolderOptionSetting for American English AMENDMENT LOCALE id @ 6
� � � � � �� string Description Inherited from RSOP_PolmkrProSetting. DisplayName Id precedence @ 6
� o w � � � � �� uint32 Description Inherited from RSOP_PolmkrProSetting. DisplayName Precedence � R S O P _ P o l m k r P r o S e t t i n g �uR|�C�s 8 RSOP_PolmkrProSetting ) % 2 � ��� � � ) 5 ��������������������������������������������������������� � RSOP_PolmkrFolderOptionSettingVista Description Localized version of RSOP_PolmkrFolderOptionSettingVista for American English AMENDMENT LOCALE id @ 6
� � � � % � �� string Description Inherited from RSOP_PolmkrProSetting. DisplayName Id precedence @ 6
� y � � � � � �� uint32 Description Inherited from RSOP_PolmkrProSetting. DisplayName Precedence � R S O P _ P o l m k r P r o S e t t i n g �uR|�C�w 8 RSOP_PolmkrProSetting ) ' 4 � ��� � � - 9 ��������������������������������������������������������� � RSOP_PolmkrLocalUsersAndGroupsSetting Description Localized version of RSOP_PolmkrLocalUsersAndGroupsSetting for American English AMENDMENT LOCALE id @ 6
� � � � ) � �� string Description Inherited from RSOP_PolmkrProSetting. DisplayName Id precedence @ 6
� } � � � � � �� uint32 Description Inherited from RSOP_PolmkrProSetting. DisplayName Precedence �% R S O P _ P o l m k r L o c a l U s e r s A n d G r o u p s S e t t i n g �uR|�C�+ 8 / RSOP_PolmkrLocalUsersAndGroupsSetting ' ) + s ��~ ��������������������������������������������������������� � RSOP_PolmkrLocalUsersSetting Description Localized version of RSOP_PolmkrLocalUsersSetting for American English AMENDMENT LOCALE �% R S O P _ P o l m k r L o c a l U s e r s A n d G r o u p s S e t t i n g �uR|�C�- 8 / RSOP_PolmkrLocalUsersAndGroupsSetting ' ) , u ��� ��������������������������������������������������������� � RSOP_PolmkrLocalGroupsSetting Description Localized version of RSOP_PolmkrLocalGroupsSetting for American English AMENDMENT LOCALE � R S O P _ P o l m k r P r o S e t t i n g �uR|�C�k 8 RSOP_PolmkrProSetting ) ! . y ��� � � ! - ��������������������������������������������������������� � RSOP_PolmkrNetworkOptionSetting Description Localized version of RSOP_PolmkrNetworkOptionSetting for American English AMENDMENT LOCALE id @ 6
� � � � � �� string Description Inherited from RSOP_PolmkrProSetting. DisplayName Id precedence @ 6
� q y � � � � �� uint32 Description Inherited from RSOP_PolmkrProSetting. DisplayName Precedence � R S O P _ P o l m k r P r o S e t t i n g �uR|�C�c 8 RSOP_PolmkrProSetting ) * q ��| � � % ��������������������������������������������������������� � RSOP_PolmkrNtServiceSetting Description Localized version of RSOP_PolmkrNtServiceSetting for American English AMENDMENT LOCALE id @ 6
� � � � � �� string Description Inherited from RSOP_PolmkrProSetting. DisplayName Id precedence @ 6
� i q ~ � � � �� uint32 Description Inherited from RSOP_PolmkrProSetting. DisplayName Precedence � R S O P _ P o l m k r P r o S e t t i n g �uR|�C�[ 8 RSOP_PolmkrProSetting ) & i ��t | � ��������������������������������������������������������� � RSOP_PolmkrPowerSetting Description Localized version of RSOP_PolmkrPowerSetting for American English AMENDMENT LOCALE id @ 6
� � � �
� �� string Description Inherited from RSOP_PolmkrProSetting. DisplayName Id precedence @ 6
� a i v � � � �� uint32 Description Inherited from RSOP_PolmkrProSetting. DisplayName Precedence � R S O P _ P o l m k r P o w e r S e t t i n g �uR|�C�! 8 ! RSOP_PolmkrPowerSetting ) - w ��� ��������������������������������������������������������� � RSOP_PolmkrPowerOptionsSetting Description Localized version of RSOP_PolmkrPowerOptionsSetting for American English AMENDMENT LOCALE � R S O P _ P o l m k r P o w e r S e t t i n g �uR|�C�% 8 ! RSOP_PolmkrPowerSetting ) " / { ��� ��������������������������������������������������������� � RSOP_PolmkrPowerOptionsV2Setting Description Localized version of RSOP_PolmkrPowerOptionsV2Setting for American English AMENDMENT LOCALE � R S O P _ P o l m k r P o w e r S e t t i n g �uR|�C� 8 ! RSOP_PolmkrPowerSetting ) , u ��� ��������������������������������������������������������� � RSOP_PolmkrPowerSchemeSetting Description Localized version of RSOP_PolmkrPowerSchemeSetting for American English AMENDMENT LOCALE � R S O P _ P o l m k r P r o S e t t i n g �uR|�C�i 8 RSOP_PolmkrProSetting ) - w ��� � � + ��������������������������������������������������������� � RSOP_PolmkrRegionOptionSetting Description Localized version of RSOP_PolmkrRegionOptionSetting for American English AMENDMENT LOCALE id @ 6
� � � � � �� string Description Inherited from RSOP_PolmkrProSetting. DisplayName Id precedence @ 6
� o w � � � � �� uint32 Description Inherited from RSOP_PolmkrProSetting. DisplayName Precedence �
E v e n t T r a c e fvR|�C� EventTrace �� ! ( � � E��������� � qoswmiQOSWMI AMENDMENT LOCALE Flags +
� a i v � � uint32 Description Enable Flags ValueMap � � � 0x00000001 0x00000002 0x00000004 Level +
�
2 uint32 Description Levels ValueDescriptions J h w � � Abnormal exit or termination Severe errors Warnings Information Detailed information � � �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � ! " � MSFT_CliFormat TABLE INSTANCE ) � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � & 4 � MSFT_CliProperty FriendlyName The FriendlyName string provides the name for the alias. The name will be unique in the context of the namespace in which the alias is defined. Note CLASS, QUERY, PATH and RESTORE cannot be used as alias names as they appear in the same location in the syntax. FriendlyName Alias Where FriendlyName = '#' Select * from Msft_CliAlias lJ � � A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 � �3 ( C L � MSFT_CliVerb wmic Alias #__PATH assoc Shows any related aliases SeeAlso � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __DERIVATION __DERIVATION � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __DYNASTY __DYNASTY � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty __GENUS __GENUS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier t � , � MSFT_CliProperty __NAMESPACE __NAMESPACE � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o � " � MSFT_CliProperty __PATH __PATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier y � $ 6 � MSFT_CliProperty __PROPERTY_COUNT __PROPERTY_COUNT � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __RELPATH __RELPATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier q � & � MSFT_CliProperty __SERVER __SERVER � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __SUPERCLASS __SUPERCLASS �i�� � ���� � �v� ' �H&ۭ c !�
r �`�1� W ���[� 5 %�� u m���� M =� j� *�.� K ׇ�\5 � C I M _ D e p e n d e n c y �ʝ��C�� CIM_Dependency ) ! �� * � � u��������/ � CIM_PackageCooling Description Often, a cooling device is installed in a package such as a chassis or a rack, not for a specific device, but to assist in the cooling of the package in general. This relationship is described by the CIM_PackageCooling association. AMENDMENT LOCALE Antecedent f@
� V m z ref:CIM_CoolingDevice Description The cooling device for the package. Dependent f@
� � � � ref:CIM_PhysicalPackage Description The physical package whose environment is cooled. � C I M _ D e p e n d e n c y �ʝ��C�� CIM_Dependency ) $ �� % 1 � � u��������A � CIM_PackageTempSensor Description Often, a temperature sensor is installed in a package such as a chassis or a rack, not to measure any particular device, but the package's environment in general. This relationship is described by the CIM_PackageTempSensor association. AMENDMENT LOCALE Antecedent f@
� ] x � ref:CIM_TemperatureSensor Description The temperature sensor for the package. Dependent f@
� � � ref:CIM_PhysicalPackage Description The physical package whose environment is monitored. � C I M _ D e p e n d e n c y �ʝ��C�� CIM_Dependency ) I ��T \ h � � u��������� � CIM_PackageAlarm Description Often, an alarm device is installed as part of a package, not to indicate issues with any particular logical device or physical component, but with the package's environment in general, its security state or its overall health. This relationship is described by the CIM_PackageAlarm association. AMENDMENT LOCALE Antecedent f@
� � � � ref:CIM_AlarmDevice Description The alarm device for the package. Dependent f@
� * 7 ref:CIM_PhysicalPackage Description The physical package whose health, security, environment, etc. is alarmed. � �ʝ��C�K ) � ��� � � 6 = ����������� � CIM_ActsAsSpare Description The CIM_ActsAsSpare association indicates which elements can spare or replace the other aggregated elements. The fact that a spare can operate in "hot standby" mode is specified on an element by element basis. AMENDMENT LOCALE Group f
� 8 L Y ref:CIM_SpareGroup Description The Group reference represents the CIM_SpareGroup. HotStandby
� � � � BOOLEAN Description HotStandby property is a boolean indicating that the spare is operating as a hot standby. Spare f
� i � � ref:CIM_ManagedSystemElement Description A managed system element acting as a spare and participating in the spare group. an � �ʝ��C�Z
) $ � ��� � � g p ������������� � CIM_CompatibleProduct Description CIM_CompatibleProduct is an association between products that can indicate a wide variety of information. For example, it can indicate that the two referenced products interoperate, that they can be installed together, that one can be the physical container for the other, etc. The string property, CompatibilityDescription, defines how the products interoperate or are compatible, any limitations regarding interoperability or installation, ... AMENDMENT LOCALE CompatibilityDescription
� < D Q STRING Description CompatibilityDescription is a free-form string defining how the two referenced products interoperate or are compatible, any limitations to compatibility, etc. CompatibleProduct f
� 0 A N ref:CIM_Product Description The compatible product. Product f
� � � � ref:CIM_Product Description The product for which compatible offerings are defined. io �
C I M _ C o m p o n e n t �ʝ��C�% CIM_Component ) & � ��� � � / �������� � CIM_CollectionOfSensors Description The CIM_CollectionOfSensors association indicates the binary sensors that make up the multi-state sensor. AMENDMENT LOCALE GroupComponent f@
� � � ref:CIM_MultiStateSensor Description The multi-state sensor. PartComponent f@
� [ q ~ ref:CIM_BinarySensor Description A binary sensor that is part of the multi-state sensor. �
C I M _ C o m p o n e n t �ʝ��C� CIM_Component ) z ��� � � � �������� � CIM_FileStorage Description A link between the file system and the logical file(s) addressed through this file system. AMENDMENT LOCALE GroupComponent f@
� � � � ref:CIM_FileSystem Description The file system. PartComponent f@
� 7 L Y ref:CIM_LogicalFile Description The logical file stored in the context of the file system. �
C I M _ C o m p o n e n t �ʝ��C�C CIM_Component ) $ 1 � ��� � � : I �������� � CIM_OperatingSystemSoftwareFeature Description Indicates the software features that make up the operating system. The software features can be part of different products. AMENDMENT LOCALE GroupComponent f@
� � # ref:CIM_OperatingSystem Description The operating system. PartComponent f@
� u � � ref:CIM_SoftwareFeature Description The software features that make up the operating system. �
C I M _ C o m p o n e n t �ʝ��C� CIM_Component ) � ��� � � ' �������� � CIM_OSProcess Description A link between the operating system and one or more processes running in the context of this operating system. AMENDMENT LOCALE GroupComponent f@
� � � ref:CIM_OperatingSystem Description The operating system. PartComponent f@
� S d q ref:CIM_Process Description The process running in the context of the operating system �
C I M _ C o m p o n e n t �ʝ��C�� CIM_Component ) t �� � � � � �������z � CIM_ProcessThread Description A link between a process and the thread(s) running in the context of this process. AMENDMENT LOCALE GroupComponent f@
� � � � ref:CIM_Process Description The process. PartComponent f@
� * : G ref:CIM_Thread Description The thread running in the context of the process. � C I M _ H o s t e d S e r v i c e ˝��C� CIM_HostedService ) $ �� & 1 w��������� � CIM_HostedBootService Description CIM_HostedBootService defines the hosting system for a boot service. Since this relationship is subclassed from CIM_HostedService, it inherits the scoping/naming scheme defined for service - where a service is weak to its hosting system. AMENDMENT LOCALE Dependent f@
� ] r ref:CIM_BootService Description The boot service hosted on the system. �6 4 6 5 9 A B 9 F 8 F 1 C 4 B 5 6 8 D B 6 4 3 8 B A E 1 1 B 2 6 E E 8 F 9 3 C B 5 F 8 1 9 5 E 2 1 E 8 C 3 8 3 D 6 C 4 4 C C 4 1 &�}�C�ȝ��C�*
� __NAMESPACE Appv �� � d�B� 8 G�X9� W ���A U I&y� � ��^u O � �a� U K�l� � �j�ݨ � ���/ T�;G ?�L v M��� ��j�� � �p�;� B ��3\� � j fOZ � C I M _ I n d i c a t i o n 3ȝ��C�^ 1 CIM_Indication 6 �� ' . > J W ) � � ^ w ������������������������������������������������� � CIM_InstIndication Abstract Version 2.9.0 UMLPackagePath CIM::Event Description CIM_InstIndication is an abstract superclass describing changes to instances. Subclasses represent specific types of change notifications, such as instance creation, deletion and modification. SourceInstance
" )
� ` h ��r object Required Description A copy of the instance that changed to generate the Indication. SourceInstance contains the current values of the properties selected by the Indication Filter's Query. In the case of CIM_InstDeletion, the property values are copied before the instance is deleted. SourceInstanceHost
* +
� � � � 3 string Description The host name or IP address of the SourceInstance. ModelCorrespondence ; CIM_InstIndication.SourceInstance SourceInstanceModelPath & +
� � � � r � string Description The Model Path of the SourceInstance. The following format MUST be used to encode the Model Path:
<NamespacePath>:<ClassName>.<Prop1>="<Value1>",
<Prop2>="<Value2>", ... ModelCorrespondence � CIM_InstIndication.SourceInstance � C I M _ I n d i c a t i o n 4ȝ��C� ) CIM_Indication 6 �� ( / ? K X + < �����������������������������������������p � CIM_ClassIndication Abstract Version 2.6.0 UMLPackagePath CIM::Event Description CIM_ClassIndication is an abstract superclass describing changes in the definition of the schema. Subclasses represent specific types of change notifications, such as class creation, deletion and modification. ClassDefinition
" )
� s { ��� � object Required Description The current definition of the class that is created, changed or deleted in the schema. In the case of a CIM_ClassDeletion Indication, the definition for the class just prior to deletion should be placed in this property. � C I M _ C l a s s I n d i c a t i o n 5ȝ��C� ) CIM_ClassIndication + # 3 ? L ������������������������������������������ � CIM_ClassCreation Version 2.6.0 UMLPackagePath CIM::Event Description CIM_ClassCreation notifies when a new class is defined in the schema. � C I M _ C l a s s I n d i c a t i o n 6ȝ��C� ) CIM_ClassIndication + # 3 ? L ������������������������������������������ � CIM_ClassDeletion Version 2.6.0 UMLPackagePath CIM::Event Description CIM_ClassDeletion notifies when a class is deleted from the schema. � C I M _ C l a s s I n d i c a t i o n 7ȝ��C�� - CIM_ClassIndication + ' 7 C P � � ��������������������������������������������� � CIM_ClassModification Version 2.6.0 UMLPackagePath CIM::Event Description CIM_ClassModification notifies when a class definition in the schema is modified. PreviousClassDefinition
& )
� � � �� object Required Description A copy of the 'previous' class definition whose change generated the Indication. PreviousClassDefinition contains an 'older' copy of the class' information, as compared to what is found in the ClassDefinition property (inherited from ClassIndication). � C I M _ I n s t I n d i c a t i o n 8ȝ��C� 1 CIM_InstIndication + " 2 > K �������������������������������������������������� � CIM_InstCreation Version 2.6.0 UMLPackagePath CIM::Event Description CIM_InstCreation notifies when a new instance is created. � C I M _ I n s t I n d i c a t i o n 9ȝ��C� 1 CIM_InstIndication + " 2 > K �������������������������������������������������� � CIM_InstDeletion Version 2.6.0 UMLPackagePath CIM::Event Description CIM_InstDeletion notifies when an existing instance is deleted. � C I M _ I n s t I n d i c a t i o n :ȝ��C�S 5 CIM_InstIndication + ' 7 C P � � ����������������������������������������������������� � CIM_InstModification Version 2.10.0 UMLPackagePath CIM::Event Description CIM_InstModification notifies when an instance is modified. PreviousInstance
.
� � � � object Description A copy of the 'previous' instance whose change generated the Indication. PreviousInstance contains 'older' values of an instance's properties (as compared to SourceInstance), selected by the IndicationFilter's Query. � _ _ E x t r i n s i c E v e n t ;ȝ��C�O
__ExtrinsicEvent ������������ � __SystemEvent �
_ _ S y s t e m E v e n t <ȝ��C�� __SystemEvent K ] _��������������������� � __EventDroppedEvent Event
� ; object:__Event IntendedConsumer f
� | ref:__EventConsumer � _ _ E v e n t D r o p p e d E v e n t =ȝ��C�� __EventDroppedEvent - ��������������������������o � __EventQueueOverflowEvent CurrentQueueSize
� Y a h uint32 units bytes � _ _ E v e n t D r o p p e d E v e n t >ȝ��C�8 " __EventDroppedEvent # J \ � � ���������������������������������� � __ConsumerFailureEvent ErrorCode
� B uint32 ErrorDescription
� { string ErrorObject
� � object:__ExtendedStatus � _ _ E v e n t D r o p p e d E v e n t ?ȝ��C�� __EventDroppedEvent E W ������������������������������~ � __QOSFailureEvent ErrorCode
� = uint32 ErrorDescription
� v string � _ _ S e c u r i t y R e l a t e d C l a s s @ȝ��C�k " __SecurityRelatedClass �� O Y � � � � ! S a � � U��������������������������������� � __ACE abstract AccessMask
� G � �� uint32 AceFlags
� � � �� uint32 AceType
� � � �� uint32 GuidInheritedObjectType
� � �� string GuidObjectType
� K � �� string TIME_CREATED
� � uint64 Trustee
� � � �� object:__Trustee � _ _ S e c u r i t y R e l a t e d C l a s s Aȝ��C�� __SecurityRelatedClass �� O U � � � � � 7 E U�����������������������������l � __Trustee abstract Domain
� G � �� string Name
� � �� string SID
� � � �� uint8 SidLength
� � � �� uint32 SIDString
� / � �� string TIME_CREATED
� d uint64 �
_ _ S y s t e m C l a s s Dȝ��C�U __SystemClass �� � __CacheControl abstract nt � yvR|�C�� ) " ' ��2 : B � MSFT_DtcTransactionTask Version 1.0 AMENDMENT LOCALE MS_409 � � Y0 M S F T _ F i l e S e r v e r �֝��C�� : MSFT_FileServer ) � �� � c ����������������������������������������������������������k � WSP_FileServer Description A file server object models the subsystems concept of a file server. wsp_fs 3/ - � � � � � 9 s! �! �! ( �. � CreateFileShare �� implemented ` ae442007200009F ROOT\Microsoft\Windows\Storage\Providers_v2 ���� � �� �� � $ � � ? � � * � � � W � U����������������������> � __PARAMETERS abstract Name string
� 0 In
� 0 W �� Required '
� 0 W ��� �� ID 4
�
W ��� ��� string Description string
� 1 In
� 1 X �� ID )
� � X ��� string
SourceVolume object
� � In
� � �� Required
'
� � ��> �� MSFT_Volume EmbeddedInstance
4
� � ��> ��� } ID
A
� 1 ��> ��� } � object:MSFT_Volume VolumeRelativePath string
� k In
� k � �� ID )
� � � ��� string ContinuouslyAvailable boolean
� , In
� , T �� ID )
� � T ��� boolean EncryptData boolean
� � In
� �
�� ID )
� v
��; boolean FileSharingProtocol uint16
� � In
� � � �� ID )
� 6 � ��� uint16 __ �B ae442007200009F ROOT\Microsoft\Windows\Storage\Providers_v2 ���� � �� �� * � \ � $ � l � U����������������� � __PARAMETERS abstract
CreatedFileShare object
� < Out
� < c �� MSFT_FileShare EmbeddedInstance
)
� < c ��� � ID
6
� 3 c ��� � � object:MSFT_FileShare f CreatedStorageJob ref f
� o Out f
� o � �� ID f )
� � � ��� ref:MSFT_StorageJob
ExtendedStatus object
� 4 Out
� 4 [ �� MSFT_StorageExtendedStatus EmbeddedInstance
)
� 4 [ ��� � ID
6
� 7 [ ��� � � object:MSFT_StorageExtendedStatus ReturnValue uint32
� � uint32 out
� � � �� __ � DeleteObject � �� implemented � ae442007200009F ROOT\Microsoft\Windows\Storage\Providers_v2 ���� � �^
�� * � � � : { ������������� � __PARAMETERS abstract f CreatedStorageJob ref f
� = Out f
� = a �� ID f )
� � a ��� ref:MSFT_StorageJob
ExtendedStatus object
� Out
� ) �� MSFT_StorageExtendedStatus EmbeddedInstance
)
� ) ��t X ID
6
� ) ��t X � object:MSFT_StorageExtendedStatus ReturnValue uint32
� n uint32 out
� n v �� __ � SetFriendlyName � �� implemented - ae442007200009F ROOT\Microsoft\Windows\Storage\Providers_v2 ���� � �� �� * � ���� � __PARAMETERS abstract FriendlyName string
� 8 In
� 8 _ �� Required '
� 8 _ ��� �� ID 4
� _ ��� ��� string __ �6 ae442007200009F ROOT\Microsoft\Windows\Storage\Providers_v2 ���� � �� �� * � r � ��������� � __PARAMETERS abstract
ExtendedStatus object
� : Out
context and shall not rely on this format. ModelCorrespondence ^ CIM_Indication.SequenceNumber SequenceNumber +
� � � � �$ �$ sint64 Description The sequence number portion of a sequence identifier for the indication. The sequence context portion of the sequence identifier is provided by the SequenceContext property. The combination of both property values represents the sequence identifier for the indication.
The sequence identifier for the indication enables a CIM listener to identify duplicate indications when the CIM service attempts the delivery retry of indications, to reorder indications that arrive out-of-order, and to detect lost indications.
If a CIM service does not support sequence identifiers for indications, this property shall be NULL.
If a CIM service supports sequence identifiers for indications, this property shall be maintained by the CIM service for each registered listener destination, and its value shall uniquely identify the indication within the sequence context provided by SequenceContext. It shall start at 0 whenever the sequence context string changes. Otherwise, it shall be increased by 1 for every new indication to that listener destination, and it shall wrap to 0 when the value range is exceeded.
When retrying the delivery of an indication, this property shall have the same value as in the original delivery. ModelCorrespondence �$ CIM_Indication.SequenceContext �0A136360A5ACE2240DC19B0464EB.1077.2724283285.180 NS_3FBDCB08ECD33FBEF028D2DB3EF058F8CE959779B943F43AB3DB3EC34ACA147D CD_00330E7458B5D9A0228F0B77CE0CF834B3F16E931D55E4B84F81D2634A6E0B53.2593.3438685317.496 CD_0053847C9174B114F63255F7E8E42BF75E9B7A4222D19AA84EE0BCCF56E90337.2599.3747338827.695 CD_0085D9877CA4455C14CC08522BE2A35BD6BDD5C767F64875E5726A387A0D9FAD.1198.3262291882.1218 CD_008720254C2A979DBD5FF3822840A198E79AD81A362A92EB99483EEC5D47BE05.1618.4201268886.306 CD_00B170B62C2F3CE0CF652E9172FD442FD4ED6E6431FA0C941DE48C4F06E373D1.1194.1606023628.622 CD_00B3AB9882FAFE5C6152ADC249422592DD6C82405F70D062289FE869D61E0C9F.1908.1452092353.1384 CD_00DFF747C2B1CBFF3E26EBB6153BD247325C452D8EE6781C31BD31C2A7081073.1878.2601009104.281 CD_01485C56AD31BD1C7B9875265E909545C1FD016E19345A12E2E00973CE0EF1CF.1193.3295308150.616 CD_01E1BC020A762ADC8945816F21D23E994CAF727D5579290522A7B046C6C167F5.2601.10513188.1678 CD_020D216315EBE851D1E95EB38EBC3A47071878BADCF464608068D12F0A2A6B6D.2592.4023702050.492 CD_024B3EE5711125ED9BB18C4A9AAFF769B862C9895F2BAA403A8960F91ED798DF.1194.3167676191.642 CD_0321441591402F5AF02BB91D74BEE22B0CD8DD0874929978DA89FBE91F7CA9DF.1190.3203185836.324 CD_038AC7DC2B3B3FE18119C0922FD190491410A00C8C9DE6AF3AED2E4BB066C596.1620.161185796.1048 CD_043F48AD48888B41BD56388FA26ECED8B66FE9C03EB10995414C716325CBFED3.1911.3088214315.4920 CD_044C6F3044E48C22993C2C07FFE6E4308713F44D28305AEAA2DE9289AE1E867E.2609.319564898.523 CD_04992E5C7CE2295E6031900D8FF9DBAC52E8ECD5C3C6E6D474AD88FAEE2D3163.2595.2203628606.530 CD_0499414692D783CDA863FDC3CD3ACD2DB8AE713F8A8DDED3EFB28B37782E127C.1163.4226461256.387 CD_04C7B00B843DD535EEFF8ADBC90D1E1778B3D8338A06E37E21692258CCC50FA9.1384.2001222950.85 CD_05C8462B4A570021DD79117F0A18597CFCABA57FA3361AE21ECBD780B8BC0A9B.2584.4181192019.473 CD_05D4D8FA77ED969866E398C6023AE274A4FE95E964B8F30EBE0E3225DB2EC75B.1105.597307562.519 CD_05D916B8A6374C4F193D5E08BCB54B1C2461B412F69F755D01428DA36005F49B.2600.58343558.574 CD_066880EE966FE7D86CCB39E13B59F3C7EA026EB96DBC471703C7B38EF25FC1D9.1405.1513301724.2323 CD_06B95516C170444CC895270E847F3B76BA4712C919901870D883B631ED78C408.1231.3970570054.2146 CD_06BAA5D4669A9FF5B5FD35414B6353315AC4BB24F6507E6658FAA9831018BDC5.2611.2362235368.412 CD_06D136F7B0ADFCDC593CD2915E41E046885B6FE2B8DA0198F3B2B133CE772261.1382.1680980615.318 CD_06ED746C3D4422DFE7E61C74D4754D1F561EF973D3387C0C0A4EC95471CDFF58.1193.3297055838.601 CD_06F499F2E4D54A4C7A3A14DB963938B9CE4FF6BC0CFF9EA9D0113E9D4BE3E7C9.2601.10278259.609 CD_06F5F6B28C8CF9B7239F51992CED65E9076CB252470411CD4455838A2FF091F7.2596.4225307485.530 CD_0750888F7DA336796CAD46D09BBCA6EE8FE708CB3E6A5972E9507072892D3743.2611.2746434791.408 CD_079F9962DB5B1A2D677708297D13FA6915104F278CBC0CB12F0C6471470862EC.1451.1875657703.2015 CD_07E19E30C996BE5EB2C069F75B45EC8BE08416240089C28E8823A8AA0508BAE7.1611.2527568223.1010 CD_082C07D164552D2B77F2EAD04875A64B40DC14D08A8AF625C8BCA071DE48CDE0.1335.1582721336.1720 CD_0834413373BFA65FA8219E678F81DD2C215A5FF7D7CBAA4CCA4B0C24350A6C82.1154.3423410669.1622 CD_089084A9F2C065B07097839183786A1564DECA9FE2E250A27CB3C47E8FE89ED6.2585.1998755071.513 CD_08A5326D25CFED909AB0A296563DCFC521D59CAF145159CF516E0E2D49E487D7.2584.1142974868.633 CD_04C7F4A052153A1B48405988115DDE17865E47F99CF145973E41882C1B4DF5ED.2614.48982946.81 CD_08D881D450D0615D55EC2939B63E533A7629C39B5BF81A337BC629700DA3A69D.2618.3912162168.81 CD_085B7593B1CE40D92007E7E7F4B676333B0F0F7158D072E9115D8F206A3DB6EA.2619.3400548237.699 CD_05D3203C0AC8D19D2C308667A810FE5B8035D169B8097B184681B340000218A8.2620.2056328351.1794 CD_05A2F7DA01784E24AEC74AE25AC1E45FCCF48AC863629F5475D0E862F884FF9F.2628.3018230446.710 CD_034D78523931C983BAECE5A02A4B6934DD8AF2673197544B9922FB153D366359.2629.4101601509.522 CD_046B79FF8FEA26EEFB72057DF7A67A7CB75727CCDA1025821CA0170FD33BCD6E.2608.415512933.220 CD_062E519DF64095D82428626FCC1CAD3361E295AFA643D5462A0FC5A948BBA34A.2630.3499836944.748 CD_00CB5505B362BFEF8A78ADC9829BC548EC024B6682159D697B0077E15B2E844C.2634.3923386825.314 CD_05FC8C25744A61FCE1B7262C6904EED1191403B85176B40933E4DB3BDE9A1EAF.2636.3307025567.222 CD_05CA5F8E6EDC2C8D11BBB4DA46B36ED992C196304CC24289ACA10C9E37FCC545.2636.97473225.397 CD_05411DB4575F606BDA4BDD0D50A031BA32BBE01F306EE4E3DFF67BDBC2325F30.2638.1837794718.507 CD_065D9E98A48D34FE9F1D987AAED57F037C48B1B316F34AE66BEBDA2778004AA0.2638.2916575788.604 CD_0748DB3A279743A043A27A29652B890BE80A51E24D8B834C6C112DDE493793F3.2640.2767720984.611 CD_07158AC46AB23011D10296EB63960CC939E2922A1ADF31B09CD4B8579AFB85A4.2640.3855938542.383 CD_0442F426186B770F6D9CA208711E127C2744CDB9E3F8C6CA1D92279D302D64EC.2640.2313594402.748 CD_08802E8C03811ED7B07D82942CD9F025CE302A278EC5904A6CDEA63BFA636223.2645.3235104893.990 CD_00677180F57FE40C90A823DF9297D042CBC58C7AF83C3FAD79D7AB4D3438298D.2646.3422241568.397 CD_07A0EC78D0058B8682505D47D43629FCC504426EFCBD83A930870EABFD27DA03.2648.1153597117.1973 CD_011B1BAF67EA69E2DE34409D684C80464FA202C09EB167987497A892748D7728.2650.3868123367.298 CD_08F544E69EA05A815B974A37DB4AEA943B8DDCD4A90A8DEB8F8B62D690EA1619.2657.3591362255.767 CD_000FA1AD23A342CC5409A97F904028C08F562A8841D024941D8FC5EF860D44AA.2658.3052092484.934 CD_049BB6B86464EB31BA1C68CF94C5AF1885FD1AC3516017A8738B6BC559DA272B.2786.3147843882.666 CD_08763D9228F09400573FC24C5D922DB07FAC1451AF56200F470342585B439D39.2787.806339709.1100 CD_03CFFCC6C1542E35804D1F6A5B36702D2553306CC4D7F61D8BAD38DB9237934A.2787.3317423026.1014 _5B465F4104D3552517D02B2BF1AFF64E953055B2E7A4C3B2D38624CFBF20F22B.2776.3920735672.270 I_54ADF8EFB299334971F3D43A98EDE5705AFA498930283C7F18D0683AB7E3B0A2.2777.161182987.282 I_573E30064525464A17015E3223816C271F3A1495F2DC8F796A052EB70F74D804.2777.3365127636.272 I_5A9768AB40F42C121C15B79FA3C2959FC1B58432610B4440062708D1FFCFA39D.2777.982911530.284 I_539C1A6FFD30FC28CC752838A935B41974C3C4F55A48F729D2778908FB1964BA.2779.1524843367.285 I_53AD65AEE9F08485ECA6A6F81710CEF506ED5C4F5ED427E10BFF6C317C3EC7AE.2779.2432031600.279 I_5B5DA1C6DC0B1645AA85BF2EE839E4B4076C6628A22833ABA9B02DDD0DEE2D86.2781.707906722.285 I_5AC9474BA4B053258B6E6B80E4E1B5F8B1E8150ADE434945793AF60CAB1120F9.2781.2069564047.275 I_5D0DD7D02E7E22DBD110035F7891E82A810900EBF6840055C3073CDA4EBC91E8.2784.3129109246.281 I_5C23EF913B8168161FAE3B0C84946CCA23746AD886FF7FBD1F06B67E7AEA67DC.2786.2544631528.286 8A3A.2784.2004662415.291 I_1A357289528C7168B7D7EDACB126E8CCABE61EB062D829B6F799A7AFA4B4B221.2784.997457186.278 7267E262A13552EDA31CCB423B7CC8AA18.2778.509786608.273 I_03AFF70647E7E1009786622EDB779FA20606E844FB2A846D03175425B39C9709.2778.2994674982.275 9 A A 5 4 8 6 5 F 4 U�jj��
͝��C�~ 3���� [ � WDMClassesOfDriver MSNdis C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] ernelbase.dll[MofResourceName] �Z� � �L(�� � 0SƯ| � k˨� H��+
� �ud�
� �m�-� p �M� � ��<L� � q�d^� p �pxF� T ��UG % ��b�l L ���ٸ LJ�\� ~X�� / ڝ��C�� ) � �� � ( < C � � h y � � � � U�������������������� � MSFT_ServerManagerRequestState locale deploymentprovider Error
� o � � object:MSFT_ServerManagerDeploymentError EmbeddedInstance MSFT_ServerManagerDeploymentError ProgressTicks
� � uint32 RequestState
� > E O uint8 ValueMap _ b e 0 1 2 RestartRequired
� � boolean TotalTicks
� � uint32 Warnings
� � string � �ڝ��C�� S ) # � �� � + ? S z � � � # 0 W c � � � � o z � 0 > e s � � � � E Y � � @ Z � � � � 8 D UUUUU������������������������������������������������������������������������������k � MSFT_ServerManagerServerComponent locale deploymentprovider BestPracticeModels 9
� r string ConfigurationStatus 4
� � � � uint8 ValueMap � � � � � 0 1 2 3 4 Deploys
,
� string Description
� O string Descriptor
0
� � � �� object EmbeddedObject DisplayName
� � string EventQuery 5
� string FeatureType
� E L V uint8 ValueMap f i l 0 1 2 Installed
� � � � uint8 ValueMap � � � � � � � 0 1 2 3 4 5 6 InstallWithParentByDefault *
� ' boolean MajorVersion
� ] sint32 MinorVersion
� � sint32 MutualExclusions &
� � string NonAncestorDependencies
"
� string NumericId
� = sint32 OptionalCompanions
I
� � � � object:MSFT_OptionalCompanion EmbeddedInstance MSFT_OptionalCompanion ParentName
� � string PostInstallDescription A
� 8 string PostUninstallDescription E
� y string SubFeatures
� � string SystemServices
=
� � ! object:MSFT_ServiceToMonitor EmbeddedInstance MSFT_ServiceToMonitor UniqueName
� c string � �ڝ��C�� ) - � �� � 5 I � MSFT_ServerManagerServerComponentDescriptor locale deploymentprovider � �ڝ��C�� ) � �� � 3 F n t 5������� � MSFT_ServiceToMonitor locale deploymentprovider DefaultMonitoring
� e boolean Name
� � string ic �6 4 6 5 9 A B 9 F 8 F 1 C 4 B 5 6 8 D B 6 4 3 8 B A E 1 1 B 2 6 E E 8 F 9 3 C B 5 F 8 1 9 5 E 2 1 E 8 C 3 8 3 D 6 C 4 4 C C 4 1 �ڝ��C�ȝ��C�4
� __NAMESPACE SDNDiagnostics F D 1 C 1 D 4 1 4 B 7 1 B 5 0 8 2 C 2 6 6 A 6 5 0 E 3 1 E F 6 D 5 0 1 9 3 8 2 7 2 4 2 4 4 B 6 8 5 F 2 1 7 C 0 A A E 0 0 A 9 2 1 �ڝ��C�Cȝ��C�$ � __SystemSecurity 4 1 C 5 3 E 6 D B 1 A C F 2 4 5 3 C E F D 4 1 3 9 8 1 9 8 E 6 1 3 F 1 0 D F F 4 7 7 0 9 E C A B 1 D 7 F 0 3 7 7 5 6 A C 8 C E 7 �ڝ��C�ȝ��C�� � � __thisNAMESPACE � �� � � ? 6 4 6 5 9 A B 9 F 8 F 1 C 4 B 5 6 8 D B 6 4 3 8 B A E 1 1 B 2 6 E E 8 F 9 3 C B 5 F 8 1 9 5 E 2 1 E 8 C 3 8 3 D 6 C 4 4 C C 4 1 �ڝ��C�ȝ��C�,
� __NAMESPACE Server F D 1 C 1 D 4 1 4 B 7 1 B 5 0 8 2 C 2 6 6 A 6 5 0 E 3 1 E F 6 D 5 0 1 9 3 8 2 7 2 4 2 4 4 B 6 8 5 F 2 1 7 C 0 A A E 0 0 A 9 2 1 �ڝ��C�Cȝ��C�$ � __SystemSecurity 4 1 C 5 3 E 6 D B 1 A C F 2 4 5 3 C E F D 4 1 3 9 8 1 9 8 E 6 1 3 F 1 0 D F F 4 7 7 0 9 E C A B 1 D 7 F 0 3 7 7 5 6 A C 8 C E 7 �ڝ��C�ȝ��C�� � � __thisNAMESPACE � �� � � ? 5 7 E 5 F 3 A D D 9 E 2 4 2 C 4 E 9 F 9 E D F 7 9 A A 9 7 F 7 9 E 7 9 1 1 C 5 A 8 B 9 0 2 E C 1 5 0 D 6 4 4 2 E 3 B 8 5 A 5 A A �ڝ��C�ȝ��C�� �����J @ 9 b � __Win32Provider {D57CD7F4-C9E0-4830-936E-B3AEDB89B7E9} LocalSystemHost SDNDiagnosticsProvider 7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D �ڝ��C�
ȝ��C�� ~ � __MethodProviderRegistration \\.\root\Microsoft\Windows\SDNDiagnostics\Server:__Win32Provider.Name="SDNDiagnosticsProvider" , R O O T \ M i c r o s o f t \ W i n d o w s \ S D N D i a g n o s t i c s \ S e r v e r _ _ M e t h o d P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 2 7 0 2 F F 6 6 7 5 5 8 B 3 8 B 6 C 1 4 F 0 B F A 8 4 1 7 2 0 D 2 F B 5 1 9 6 A 9 9 5 9 A 9 4 E 3 6 4 5 9 9 0 A 5 A 9 1 5 2 B D \ K I _ 7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D \ I _ 3 9 A 1 9 0 2 B 8 A D B 0 1 0 E 7 4 B 3 6 2 C 6 C 9 0 C 4 3 B 9 7 3 5 E 8 6 4 B C 2 1 F 7 9 7 E E 4 2 A E B 6 E 9 1 6 A 4 E 8 4 �ڝ��C�� 6 % � �� � - E Q � � � � F T � � � � UU���������������������������> � DiagnosticInfo ClassVersion 1.0.0 locale SDNDiagnosticsProvider DeviceType
� { � �� uint32 IsSDNCtlrPrimaryNode
� � � �� boolean LogLevel
� � �� sint8 LogLocation
� > � �� string LogSizeLimit
� ~ � �� uint32 LogTimeLimit
� � � �� uint32 Password
� � � �� string UserName
� 6 � �� string �
R O O T \ C I M V 2 _ _ M e t h o d P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 6 8 5 7 7 3 7 2 C 6 6 A 7 B 2 0 6 5 8 4 8 7 F B D 9 5 9 A A 1 5 4 E F 5 4 B 5 F 9 3 5 D C C 5 6 6 3 E 9 2 2 8 B 4 4 3 2 2 8 0 5 \ K I _ 7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D \ I _ C 1 2 4 B 3 E B 6 4 A D D 8 5 A 8 D D F C 1 8 A E 7 8 5 A A 3 A D 8 8 1 D 4 E A 3 2 7 5 5 6 6 0 F 1 1 0 A C 3 7 E B 8 D 8 1 4 5 f 4 V p n C o m m o n C o n f i g �ڝ��C�� G VpnCommonConfig 6 ' . � �� � 6 K ` � � � ����������������������������������������������������������������������6 � ThirdPartyVpnConnection ClassVersion 1.0.0 locale VpnClientPSProvider CustomConfiguration > '
� � � �� � �� string PlugInApplicationID : '
� � � �� � �� string VpnConfigurationXml 6
� . � �� string �ing �9 A B 5 3 8 0 6 E 8 8 6 6 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0 MJV�� ͝��C�l d�J�� K � WMIBinaryMofResource C:\Windows\System32\drivers\monitor.sys[MonitorWMI] ] ](͌� � �&h� = �!t� r I,O: y �U~� / ��� * wv�4 H 4Z� T � C I M _ L o g i c a l E l e m e n t ȝ��C�� G CIM_LogicalElement ) �� % + S a � � ; T � � � L Z � � � � m � � � � � b n �WUU������������������������������������������������������������������� � CIM_LogicalDevice Abstract Locale UUID {8502C529-5FBB-11D2-AAC1-006008C78BC7} Availability 6
� � � ��� � Z j uint16 ValueMap ! $ ' * . 2 6 : > B F J N R V 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 MappingStrings v � MIF.DMTF|Operational State|003.5 MIB.IETF|HOST-RESOURCES-MIB.hrDeviceStatus ConfigManagerErrorCode 6
� � ��( 0 7 A uint32 Schema Win32 ValueMap � � � � � � � � � � � � � � � � � � # ' + / 3 7 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 ConfigManagerUserConfig )
� � � ��� � boolean Schema Win32 CreationClassName '
� � � �� � �� string CIM_Key DeviceID '
� ; � ��C �� string CIM_Key ErrorCleared @
� � � �� boolean ErrorDescription <
� � � �� string LastErrorCode 8
�
� �� uint32 PNPDeviceID ( )
� V � ��^ f string Schema Win32 PowerManagementCapabilities
$
� � � �� uint16 PowerManagementSupported ,
� � �� boolean StatusInfo
. 6
� Y � ��a k � � uint16 ValueMap � � � � � 1 2 3 4 5 MappingStrings � MIF.DMTF|Operational State|003.3 SystemCreationClassName 0 4
� ' / ; Y �� � �� string Propagated CIM_System.CreationClassName CIM_Key SystemName 4 4
� � � � � �� � �� string Propagated CIM_System.Name CIM_Key � � # � � SetPowerState � ae442007200009F ROOT\CIMV2 ���� � �- �� * � \ � ������� � __PARAMETERS abstract PowerState uint16
� 6 IN
� 6 ] �� � � � � � � 1 2 3 4 5 6 ValueMap )
� 6 ] ��� � ID 6
� B ] ��� � � uint16 e Time datetime e
� b IN e
� b � �� ID e )
� � � ��� datetime __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � Reset y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � C I M _ L o g i c a l D e v i c e �ȝ��C� � CIM_LogicalDevice ) ��! ) /
W e � � r � � � �
? M � N ] � � ����UU�������������������������������������������������������������������������������������������������������������������������� � CIM_MediaAccessDevice Abstract Locale UUID {8502C52A-5FBB-11D2-AAC1-006008C78BC7} Capabilities B C
� � � ��� � � � n � uint16 ArrayType Indexed MappingStrings � 7 X MIF.DMTF|Storage Devices|001.9 MIF.DMTF|Storage Devices|001.11 MIF.DMTF|Storage Devices|001.12 MIF.DMTF|Disks|003.7 ModelCorrespondence � CIM_MediaAccessDevice.CapabilityDescriptions CapabilityDescriptions F 6
� � �� ( 1 F string ArrayType Indexed ModelCorrespondence N CIM_MediaAccessDevice.Capabilities CompressionMethod J
� � � �� string DefaultBlockSize Z
� � � �� uint64 ErrorMethodology N
� 7 � �� string MaxBlockSize b
� w � �� uint64 MaxMediaSize R )
� � � ��� � uint64 MappingStrings � MIF.DMTF|Sequential Access Devices|001.2 MinBlockSize j
� F � �� uint64 NeedsCleaning v
� � � �� boolean NumberOfMediaSupported r
� � � �� uint32 � C I M _ M e d i a A c c e s s D e v i c e �ȝ��C�0 � CIM_MediaAccessDevice ) �� % + ��������������������������������������������������������������������������������������������������������������������������������S � CIM_DisketteDrive Abstract Locale UUID {F27851CD-BBAC-11d2-85E5-0000F8102E5F} � C I M _ L o g i c a l D e v i c e �ȝ��C�? I CIM_LogicalDevice ) �� % + S b ������������������������������������������������������������������������� � CIM_CoolingDevice Abstract Locale UUID {9565979A-7D80-11D2-AAD3-006008C78BC7} ActiveCooling B
� � � �� boolean � C I M _ C o o l i n g D e v i c e �ȝ��C�� I CIM_CoolingDevice ) ! I �� �������������������������������������������������������������������������S � CIM_Refrigeration Locale UUID {F3A5233A-E3D3-11d2-8601-0000F8102E5F} Abstract � C I M _ C o o l i n g D e v i c e �ȝ��C�� I CIM_CoolingDevice ) D �� �������������������������������������������������������������������������N � CIM_HeatPipe Locale UUID {FE5D55E0-E3D3-11d2-8601-0000F8102E5F} Abstract � C I M _ L o g i c a l D e v i c e �ȝ��C� b CIM_LogicalDevice ) �� % + S [ � � % 7 i y � � ����U��������������������������������������������������������������������������������������������+ � CIM_StorageExtent Abstract Locale UUID {8502C538-5FBB-11D2-AAC1-006008C78BC7} Access B
� � � �� uint16 BlockSize D )
� � � ��� � uint64 MappingStrings � MIB.IETF|HOST-RESOURCES-MIB.hrStorageAllocationUnits ErrorMethodology L
� a � �� string NumberOfBlocks P
� � � � uint64 MappingStrings � MIB.IETF|HOST-RESOURCES-MIB.hrStorageSize Purpose X
� # � �� string � zvR|�C�� ) $ - 2 ��= E M � MSFT_DtcTransactionsStatisticsTask Version 1.0 AMENDMENT LOCALE MS_409 � � �P�I� ��G� X ��o�� r ݃��e t �U��� � V�X�� � Pt M � Lʝ��C� A �� � �� � - 7 ? E m z
e��������� � Win32_ClientApplicationSetting Association CIMWin32 Locale UUID {0F73ED5E-8ED9-11d2-B340-00105A1F8569} Application f 4
� � � �� � ��� � ref:Win32_DCOMApplication MappingStrings � WMI|Win32_DCOMApplication Client f 4
� T � �� � ��f v ref:CIM_DataFile MappingStrings ~ CIM|CIM_DataFile ng � C I M _ L o g i c a l E l e m e n t Mʝ��C� " CIM_LogicalElement ) �� ! ' O W � � / 5 � � u ~ W��������������������������������x � Win32_Account Abstract Locale UUID {8502C4C9-5FBB-11D2-AAC1-006008C78BC7} Domain 4
� � � �� � ��� � string MappingStrings � Win32API|Network Management Functions|Domain LocalAccount
� ( �� Boolean Fixed Name @ A
� � � ��� � � ��� � string Override Name MappingStrings � Win32API|Network Management Structures|name SID 4
� ( 0 �� � ��7 G string Fixed MappingStrings O Win32API|Security Identifiers (SIDs) SIDType A
� � � �� � ��� � + 5 uint8 Fixed MappingStrings � Win32API|Access Control Enumeration Types|SID_NAME_USE ValueMap ] ` c f i l o r u 1 2 3 4 5 6 7 8 9 �
W i n 3 2 _ A c c o u n t Nʝ��C�@ " Win32_Account 6 � �� � ' - U ] ���������������������������������� � Win32_SystemAccount CIMWin32 Locale UUID {8502C4CA-5FBB-11D2-AAC1-006008C78BC7} Domain @ 6
� � � ��� � � � string MappingStrings � Win32API|Network Management Functions|domainname Override Domain Name @ 6
� O � ��W a g w string Override Name MappingStrings Win32API|Network Management Structures|name �
W i n 3 2 _ A c c o u n t Oʝ��C�8 " Win32_Account 6 � �� �
% M U � ���������������������������������� � Win32_Group CIMWin32 Locale UUID {8502C4CB-5FBB-11D2-AAC1-006008C78BC7} Domain @ 6
� � � ��� � � � string MappingStrings � Win32API|Network Management Functions|domainname Override Domain Name @ 6
� G � ��O Y _ o string Override Name MappingStrings w Win32API|Network Management Structures|name N u � � Rename $ ��1 A Implemented MappingStrings I WMI # ae442007200009F ROOT\CIMV2 ���� � �� �� * ����Q � __PARAMETERS abstract Name string
� 0 In
� 0 W �� � Win32API|Network Management Structures|name MappingStrings )
� 0 W ��� � ID 6
� I W ��� � string __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ �
W i n 3 2 _ A c c o u n t Pʝ��C�� 5 Win32_Account 6 � �� � % + S ` 6 @ � � � � G P � � � � Z k * �WU�������������������������������������������������� � Win32_UserAccount CIMWin32 Locale UUID {8502C4CC-5FBB-11D2-AAC1-006008C78BC7} AccountType 6
� � � ��� � uint32 MappingStrings � Win32API|Network Management Structures|USER_INFO_2|usri2_flags BitMap $ ' * . 2 8 9 11 12 13 Disabled
# 4
� � � �� � ��� � boolean MappingStrings � Win32API|Network Management Structures|USER_INFO|UF_ACCOUNTDISABLE Domain @ 6
� 3 � ��; K � � string MappingStrings S Win32API|Network Management Functions|domainname Override Domain FullName % 4
� � � �� � ��� � string MappingStrings Win32API|Network Management Structures|USER_INFO_2|usri2_full_name Lockout ) 4
� � � �� � ��� � boolean MappingStrings � Win32API|Network Management Structures|USER_INFO_2|UF_LOCKOUT Name @ 6
� < � ��D N T d string Override Name MappingStrings l Win32API|Network Management Structures|name PasswordChangeable
+ 4
� � � �� � ��� boolean MappingStrings Win32API|Network Management Structures|USER_INFO_2|UF_PASSWD_CANT_CHANGE PasswordExpires - 4
� � � �� � ��� � boolean MappingStrings � Win32API|Network Management Structures|USER_INFO_2|UF_DONT_EXPIRE_PASSWD PasswordRequired / 4
� l � �� � ��u � boolean MappingStrings � Win32API|Network Management Structures|USER_INFO_2|UF_PASSWD_NOTREQD N u � � Rename $ ��1 A Implemented MappingStrings I WMI # ae442007200009F ROOT\CIMV2 ���� � �� �� * ����Q � __PARAMETERS abstract Name string
� 0 In
� 0 W �� � Win32API|Network Management Structures|name MappingStrings )
� 0 W ��� � ID 6
� I W ��� � string __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � C I M _ D e p e n d e n c y Wʝ��C�R CIM_Dependency ��! ) 5 � � U��������� � Win32_SessionResource Abstract Locale Antecedent f@
� a { � ref:Win32_LogicalElement Override Antecedent Dependent f@
� � � � ref:Win32_Session Override Dependent � {vR|�C�� ) & / 4 ��? G O � MSFT_DtcTransactionsTraceSessionTask Version 1.0 AMENDMENT LOCALE MS_409 � � �,�` P �;u� � �� ���B� �
� �O � C I M _ L o g i c a l E l e m e n t KtR|�C� CIM_LogicalElement ) 6 ��A I \ � � � � M b 1 � � U�������������������������p � CIM_System Description A CIM_System is a LogicalElement that aggregates an enumerable set of Managed System Elements. The aggregation operates as a functional whole. Within any particular subclass of System, there is a well-defined list of Managed System Element classes whose instances must be aggregated. AMENDMENT LOCALE CreationClassName
� � � � string Description The CreationClassName property indicates the name of the class or the subclass used in the creation of an instance. When used with the other key properties of this class, this property allows all instances of this class and its subclasses to be uniquely identified. Name )
� � � � � �� string Description The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property. NameFormat
� � � � string Description The CIM_System object and its derivatives are top level objects of CIM. They provide the scope for numerous components. Having unique system keys is required. A heuristic can be defined in individual system subclasses to attempt to always generate the same system name key. The NameFormat property identifies how the system name was generated, using the subclass' heuristic. PrimaryOwnerContact
� � � � string Description A string that provides information on how the primary system owner can be reached (e.g. phone number, email address, ...). PrimaryOwnerName
� ] e r string Description The name of the primary system owner. Roles
� � � � string Description An array (bag) of strings that specify the roles this System plays in the IT-environment. Subclasses of System may override this property to define explicit Roles values. Alternately, a Working Group may describe the heuristics, conventions and guidelines for specifying Roles. For example, for an instance of a networking system, the Roles property might contain the string, 'Switch' or 'Bridge'. � � C I M _ C o n t r o l l e r �tR|�C�� A CIM_Controller ) R ��] e s ����������������������������������������������������������������� � CIM_USBController Description Capabilities and management of a USB controller. AMENDMENT LOCALE Manufacturer 8
� � � � string Description The Manufacturer property indicates the name of the USB controller manufacturer.
Example: Acme � C I M _ S y s t e m R e s o u r c e �tR|�C�� CIM_SystemResource ) ! �� ' : y � z � ( U�����������������������������+ � CIM_MemoryMappedIO Description Personal Computer architecture Memory Mapped I/O. This class addresses both memory and port I/O resources. The property, MappedResource, defines whether memory or I/O is mapped (and for I/O whether the mapping is to a memory or a port space. AMENDMENT LOCALE CreationClassName
� f n { string Description CreationClassName indicates the name of the class or the subclass used in the creation of an instance. When used with the other key properties of this class, this property allows all instances of this class and its subclasses to be uniquely identified. CSCreationClassName
� � � � string Description The scoping computer system's creation class name property. CSName
� @ H U string Description The scoping computer system's name. EndingAddress
� � � � uint64 Description The EndingAddress property contains the ending address of memory mapped I/O StartingAddress
� T \ i uint64 Description The StartingAddress property contains the starting address of memory mapped I/O. The hardware resource identifier property should be set to this value to construct the mapped I/O resource key. � C I M _ S y s t e m R e s o u r c e �tR|�C�t
* CIM_SystemResource ) ; ��F
N [ 5 C D O � � , 1 D � �
{ � � � � � 2 < UUU���������������������������������������� � CIM_DMA Description Personal computer architecture DMA. AMENDMENT LOCALE AddressSize +
� � � � ( / uint16 Description An integer indicating the DMA channel address size in bits. Permissible values are 8, 16, 32 or 64 bits. If unknown, enter 0. Units bits Availability +
� | � � � � uint16 Description The Availability property indicates the availability of the DMA. Values � � $ Other Unknown Available In Use/Not Available In Use and Available/Shareable BurstMode
� { � � boolean Description Indicate whether the DMA channel supports burst mode ByteMode +
�
� � uint16 Description Indicates whether DMA may execute in 'count by byte' mode (value=4) or not (value=3). Also, "Other" (1) and "Unknown" (2) may be defined. Values � � � � Other Unknown Not execute in 'count by byte' mode Execute in 'count by byte' mode ChannelTiming +
� e m z � � uint16 Description DMA channel timing. For example, "Type A" (value =4) or "Type F" (6) could be specified. Values � ! ) Other Unknown ISA Compatible Type A Type B Type F CreationClassName
� p x � string Description CreationClassName indicates the name of the class or the subclass used in the creation of an instance. When used with the other key properties of this class, this property allows all instances of this class and its subclasses to be uniquely identified. CSCreationClassName
� � � � string Description The scoping computer system's creation class name. CSName
� A I V string Description The scoping computer system's name. DMAChannel )
� � � � � �� uint32 Description A part of the object's key value, the DMA channel number. MaxTransferSize +
� X ` m � � uint32 Description The maximum number of bytes that can be transferred by this DMA channel. If unknown, enter 0. Units bytes TransferWidths
+
� $ , 9 � � uint16 Description An array indicating all the transfer widths (in bits) supported by this DMA Channel. Permissible values are 8, 16, 32, 64 or 128 bits. If unknown, enter 0. Units bits TypeCTiming " +
� *
2
?
�
�
uint16 Description Indicates whether C type (burst) timing is supported (value=5) or not (value=4). Also, "Other" (1), "Unknown" (2) and "ISA Compatible" (3) are defined. Values �
�
' Other Unknown ISA Compatible Not Supported Supported WordMode $ +
� u } � uint16 Description Indicates whether DMA may execute in 'count by word' mode (value=4) or not (value=3). Also, "Other" (1) and "Unknown" (2) may be defined. Values 2 9 B g Other Unknown Not execute in 'count by word' mode Execute in 'count by word' mode � |vR|�C�� ) & / 4 ��? G O � MSFT_DtcTransactionsTraceSettingTask Version 1.0 AMENDMENT LOCALE MS_409 � � �PP � @��Z � �}I�� � ̀�9, � C I M _ L o g i c a l E l e m e n t )vR|�C�=
CIM_LogicalElement ) �� + � � M [ ������������� � Win32_Terminal Description The Win32_Terminal class is the element of the TerminalSetting association where groups such as: General, Logon, Session, Environment, Remote Control, Client, Network Adapter and Permission are several configuration setting classes. AMENDMENT LOCALE fEnableTerminal +
� d l y � � uint32 Description Enables or Disables the Terminal. Values � � FALSE TRUE LoggedOnUsers
� �
uint32 Description Determines the number of logged on sessions for given terminal TerminalName )
� � � ��� � string Description Name of the Terminal. _ al s i � � � Ter � : v
ion � � | : G � 1 ^ � � Enable & Description Enables or Disables the Terminal. The function takes one parameter, the flag thatenables or disables it. The call returns zero on success and an error on failure. ) a42c9160500003S ROOT\cimv2\TerminalServices\ms_409 ���� � �� �� * � ����� � __PARAMETERS abstract fEnableTerminal uint32
� ; In
� ; b �� ID )
� � b ��� uint32 __ �� a42c9160500003S ROOT\cimv2\TerminalServices\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � Create � � Description Creates a Terminal. The function takes three parameters: a name for the terminal, TerminalProtocol and the Transport, both of which are properties of Win32_TSGeneralSetting class. This creates a Terminal with default settings which can be customized by through appropriate functions in the various Win32_TerminalSetting classes. The function returns zero on success and an error on failure. 8 a42c9160500003S ROOT\cimv2\TerminalServices\ms_409 ���� � ��
�� * � � � I ������������D � __PARAMETERS abstract NewTerminalName string
� ; In
� ; b �� ID )
� � b ��� string Transport string
� � In
� � �� ID )
� � ��E string TerminalProtocol string
� � In
� � � �� ID )
� < � �� string __ �� a42c9160500003S ROOT\cimv2\TerminalServices\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � Rename $ 1 Description Renames the Terminal. The function takes one parameter, the New Terminalname. The call returns zero on success and an error on failure. ) a42c9160500003S ROOT\cimv2\TerminalServices\ms_409 ���� � �� �� * � ����� � __PARAMETERS abstract NewTerminalName string
� ; In
� ; b �� ID )
� � b ��� string __ �� a42c9160500003S ROOT\cimv2\TerminalServices\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � Delete � � Description Deletes the specified Terminal. The function takes one parameter, the Terminalname. The call returns zero on success and an error on failure. ) a42c9160500003S ROOT\cimv2\TerminalServices\ms_409 ���� � �� �� * � ����� � __PARAMETERS abstract NewTerminalName string
� ; In
� ; b �� ID )
� � b ��� string __ �� a42c9160500003S ROOT\cimv2\TerminalServices\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � C I M _ E l e m e n t S e t t i n g 7vR|�C�L CIM_ElementSetting ) ' � ��� � � Win32_TSVirtualIPSetting Description The Win32_TSVirtualIPSetting class is an association with Win32_TerminalService as the Element and Win32_TSVirtualIP as the Setting property This includes capabilities such as Enable Virtual IP, Set Virtual IP modes Per-session/Per-Program.Add/Remove a program to/from the list of Programs that needs a virtual IP.Enumerate Network Adapters and set a Network Adapter to use.Enable/Disable Virtualization of Loopback Addresses Per-Program. AMENDMENT LOCALE � _ _ E x t r i n s i c E v e n t :vR|�C�P __ExtrinsicEvent ) ) x ��� � � F V _��������������������� � Win32_RemoteAppChangeEvent Description This event represents a change to RemoteApp settings on this terminal server. AMENDMENT LOCALE OperationType +
� � � � uint32 Description Type of operation corresponding to the event Values . 6 > Create Delete Modify TargetInstance
� � � � object Description Object changed by the operation corresponding to the event se � C I M _ M a n a g e d E l e m e n t �wR|�C�] CIM_ManagedElement ) $ O ��Z b j p ����������������������� � MSFT_MTRegistryObject Description Abstract base class for registry objects. AMENDMENT LOCALE MS_409 Name )
� � � ��� � string Description The unique name of the registry object. � ~Tѐ = ۊ� � @�O � � ���@ � _V�b� M ��Π% x �H�� �
,�o�F � 0 8 9 9 3 0 7 4 0 8 A 3 2 0 4 0 A 6 D A 1 9 C 0 B 1 E C 2 7 4 5 A 3 D 6 0 4 B A A 9 D F F E 8 E E 4 B 7 5 C 3 D 9 1 E 1 6 1 0 9 <̝��C�ȝ��C�� P � � __EventProviderRegistration % select * from Win32_ComputerShutdownEvent \\.\Root\CIMV2:__Win32Provider.Name="MS_Shutdown_Event_Provider" C I M _ U s e r D e v i c e ^tR|�C�� = CIM_UserDevice ) X ��c k s � { � ������������������������������������������������������������� � CIM_Keyboard Description Capabilities and management of the keyboard logical device. AMENDMENT LOCALE Layout 0
� � � � string Description A free-form string indicating the format and layout of the Keyboard. NumberOfFunctionKeys 4
� < D Q uint16 Description Number of function keys on the Keyboard. Password 6 +
� � � � � � uint16 Description An integer indicating whether a hardware-level password is enabled at the keyboard (value=4), preventing local input. Other values are: "Disabled" (3), "Not Implemented" (5), "Other" (1) and "Unknown" (2). Values � � � � � Other Unknown Disabled Enabled Not Implemented � C I M _ D i s p l a y _tR|�C�o F CIM_Display
) [ ��f n { � � l y � � t � ���U������������������������������������������������������������������ � CIM_FlatPanel Description Capabilities and management of the flat panel logical device. AMENDMENT LOCALE DisplayType 0 +
� � � � uint16 Description An integer enumeration describing the type of flat panel display. Values < E L ` s � � � � Unknown Other Passive Matrix LCD Active Matrix LCD Cholesteric LCD Field Emission Display Electro Luminescent Display Gas Plasma LED HorizontalResolution 2 +
� ! . ] d uint32 Description Flat panel's horizontal resolution in pixels. Units pixels LightSource 6 +
� � � � ; C uint16 Description A description of the display illumination type. For example, backlit (value=2) or reflective (4) can be specified. Values [ d k t } Unknown Other Backlit Edgelit Reflective ScanMode 8 +
� � � � 0 8 uint16 Description A Flat panel's scan mode indicating either single (value=2) or dual scan (3). Values L U \ i Unknown Other Single Scan Dual Scan SupportsColor :
� � � � boolean Description Boolean indicating whether the flat panel supports color display. VerticalResolution < +
� U ] j � � uint32 Description Flat panel's vertical resolution in pixels. Units pixels � C I M _ D i s p l a y atR|�C�j C CIM_Display
) ! k ��v ~ � ! . � � - : ������������������������������������������������������������������ � CIM_DesktopMonitor Description Capabilities and management of the desktop monitor (CRT) logical device. AMENDMENT LOCALE Bandwidth 0 +
� � � � uint32 Description Monitor's bandwidth in megahertz. If unknown, enter 0. Units megahertz DisplayType 4 +
� g o | uint16 Description The type of desktop monitor or CRT. For example, multiscan color or monochrome monitors (values 2 or 3, respectively) can be indicated in this property. Values : C J [ q � Unknown Other Multiscan Color Multiscan Monochrome Fixed Frequency Color Fixed Frequency Monochrome ScreenHeight 6
� � � � uint32 Description The logical height of the display in screen coordinates. ScreenWidth :
� f n { uint32 Description The logical width of the display in screen coordinates. � C I M _ U s e r D e v i c e btR|�C� 4 CIM_UserDevice )
| ��� ����������������������������������������������������� � CIM_Display Description The CIM_Display class is a superclass for grouping the miscellaneous display devices that exist. AMENDMENT LOCALE � C I M _ L o g i c a l D e v i c e etR|�C�> 4 CIM_LogicalDevice ) � �� ���������������������������������������������������� � CIM_UserDevice Description User devices are logical devices that allow a computer system's users to input, view or hear data. The CIM_UserDevice class is a superclass from which other classes, such as CIM_Keyboard or CIM_DesktopMonitor, descend. AMENDMENT LOCALE IsLocked .
� B K X boolean Description An indication of whether the device is locked, preventing user input or output. � C I M _ L o g i c a l D e v i c e jtR|�C�o
M CIM_LogicalDevice ) ! ��� � � � � : L � � i p ���_������������������������������������������������������������������������� � CIM_NetworkAdapter Description NetworkAdapter is an Abstract class defining general networking hardware concepts (for example, PermanentAddress or Speed of operation). NetworkAdapters are Devices with the ability to support multiple, higher level protocols and provide the implementation behind the Network Model's ProtocolEndpoint class. (This information is conveyed using the DeviceSAPImplementation association, defined in the Core Model.) NetworkAdapters and their Endpoints represent the potential for connectivity among peers.
The 'potential for connectivity' is very different than the master-slave/controller-controlled by relationships of CIM_Controller. Sometimes, however, a single Device is both a kind of NetworkAdapter and a Controller - for example, when a FibreChannelAdapater is operating as a ComputerSystem's SCSIController. In this case, there are aspects of the Device that are network oriented and others that are Controller oriented - and, both the Controller and Adapter classes should be instantiated. A DeviceIdentity relationship would also be created to tie together these differing aspects/abstractions of the Device. AMENDMENT LOCALE AutoSense .
� � � � boolean Description A boolean indicating whether the NetworkAdapter is capable of automatically determining the speed or other communications characteristics of the attached network media. MaxSpeed 0 +
� � � � " ) uint64 Description The maximum speed, in bits per second, for the network adapter. Units bits per second NetworkAddresses 8
� x � � string Description An array of strings indicating the network addresses for an adapter. PermanentAddress <
� & string Description PermanentAddress defines the network address hard coded into an adapter. This 'hard coded' address may be changed via firmware upgrade or software configuration. If so, this field should be updated when the change is made. PermanentAddress should be left blank if no 'hard coded' address exists for the network adapter. Speed @ +
� � � � � � uint64 Description An estimate of the current bandwidth in bits per second. For endpoints which vary in bandwidth or for those where no accurate estimation can be made, this property should contain the nominal bandwidth. Units bits per second �F D 1 C 1 D 4 1 4 B 7 1 B 5 0 8 2 C 2 6 6 A 6 5 0 E 3 1 E F 6 D 5 0 1 9 3 8 2 7 2 4 2 4 4 B 6 8 5 F 2 1 7 C 0 A A E 0 0 A 9 2 1 ~vR|�C�Cȝ��C�$ � __SystemSecurity ���� N
���'�
T �τW2 2 [�Rd � L���T � ��.WI � �!B-� � �5[x� C I M _ L o g i c a l P o r t MwR|�C�
� CIM_LogicalPort 6 � � � ��� . � � � � i y � � E [ A S � � � � �
�
����������UU�������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������| � CIM_NetworkPort Description NetworkPort is the logical representation of network communications hardware such as a physical connector and the setup or operation of the network chips, at the lowest layers of a network stack. Version 2.10.0 AMENDMENT LOCALE MS_409 ActiveMaximumTransmissionUnit 5 � +
� g o | � � uint64 Description The active or negotiated maximum transmission unit (MTU) that can be supported. Units Bytes AutoSense 3 �
� ( boolean Description A Boolean that indicates whether the NetworkPort is capable of automatically determining the speed or other communications characteristics of the attached network media. FullDuplex 2 �
� ! boolean Description Boolean that indicates that the port is operating in full duplex mode. LinkTechnology . � +
� � � � c k uint16 Description An enumeration of the types of links. When set to 1 ("Other"), the related property OtherLinkTechnology contains a string description of the type of link. Values � � � � � � � � � � � � Unknown Other Ethernet IB FC FDDI ATM Token Ring Frame Relay Infrared BlueTooth Wireless LAN NetworkAddresses 1 �
� F N [ string Description An array of strings that indicates the network addresses for the port. OtherLinkTechnology / �
� � � � string Description A string value that describes LinkTechnology when it is set to 1, "Other". OtherNetworkPortType , �
� � � � string Description Note: The use of this property is deprecated in lieu of CIM_LogicalPort.PortType.
Deprecated description: The type of module, when PortType is set to 1 ("Other".) PermanentAddress 0 �
� � � string Description PermanentAddress defines the network address that is hardcoded into a port. This \'hardcoded\' address can be changed using a firmware upgrade or a software configuration. When this change is made, the field should be updated at the same time. PermanentAddress should be left blank if no \'hardcoded\' address exists for the NetworkAdapter. PortNumber - �
� " * 7 uint16 Description NetworkPorts are often numbered relative to either a logical module or a network element. Speed @ & � +
� � � � �
�
uint64 Description The current bandwidth of the Port in Bits per Second. For ports that vary in bandwidth or for those where no accurate estimation can be made, this property should contain the nominal bandwidth. Units Bits per Second SupportedMaximumTransmissionUnit 4 � +
� % 2 n u uint64 Description The maximum transmission unit (MTU) that can be supported. Units Bytes � C I M _ E l e m e n t S e t t i n g D a t a OwR|�C� CIM_ElementSettingData ) # 0 h ��s { � � � ����������������� � MSFT_NetAdapterElementSettingData Description Associates a network port with its configuration data. AMENDMENT LOCALE MS_409 ManagedElement f@
� � � � ref:MSFT_NetAdapter Description The managed element. SettingData f@
� 0 P ] ref:MSFT_NetAdapterSettingData Description The SettingData object associated with the element. �! M S F T _ N e t A d a p t e r E l e m e n t S e t t i n g D a t a PwR|�C�� + MSFT_NetAdapterElementSettingData # ) / < � ��� � � � ����������������W � MSFT_NetAdapterAdvancedPropertyElementSetting Description Associates a network port with its advanced property configuration stored in the registry. AMENDMENT LOCALE MS_409 SettingData f@
� � ) ref:MSFT_NetAdapterAdvancedPropertySettingData Description Advanced properties for the network adapter. � M S F T _ N e t S e t t i n g D a t a QwR|�C�� " MSFT_NetSettingData ) ) b ��m u } � � � � � � � �U�������������������������������� � MSFT_NetAdapterSettingData Description Represents the base class for network adapter settings. AMENDMENT LOCALE MS_409 InterfaceDescription
� � � � string Description Interface Description, a.k.a. ifDescr or friendly name is a unique name assigned to the network adapter during installation. This name cannot be changed and is persisted as long as the network adapter is not uninstalled. Name
� � � � string Description Name, a.k.a. Connection Name, ifAlias, or InterfaceAlias, is a unique name assigned to the adapter during installation. The Name of the adapter can be changed by the administrator and is persisted across the boot or network adapter restart. Source +
� , 4 A c k uint32 Description The source of the setting data.
Values � � � Unknown Other Device Persistent storage SystemName
� � � � string Description The scoping System\'s Name. �* M S F T _ N e t A d a p t e r P o w e r M a n a g e m e n t _ W a k e P a t t e r n twR|�C�� 4 MSFT_NetAdapterPowerManagement_WakePattern , ) 3 @ � ��� � � � E V � � T ` �U����������������������������� � MSFT_NetAdapterPowerManagement_WakePattern_TcpSyn Description MSFT_NetAdapterPowerManagement_WakePattern_TcpSyn defines settings for a TCP SYN wake pattern. AMENDMENT LOCALE MS_409 DestinationAddress
� � string Description Supplies the destination address of the SYN packet. DestinationPort
� � � � uint16 Description Supplies the TCP destination port number of the SYN packet. SourceAddress
� $ string Description Supplies the source address of the SYN packet. SourcePort
� � � � uint16 Description Supplies the TCP source port number of the SYN packet. �* M S F T _ N e t A d a p t e r P o w e r M a n a g e m e n t _ W a k e P a t t e r n uwR|�C�@ 4 MSFT_NetAdapterPowerManagement_WakePattern , ) 5 B � ��� � ������������������ � MSFT_NetAdapterPowerManagement_WakePattern_WildCard Description MSFT_NetAdapterPowerManagement_WakePattern_WildCard defines settings for 'Wake on any Packet'. AMENDMENT LOCALE MS_409 �! M S F T _ N e t A d a p t e r E l e m e n t S e t t i n g D a t a vwR|�C�� + MSFT_NetAdapterElementSettingData # ) " / c ��n v ~ � ���������������� � MSFT_NetAdapterQosElementSetting Description Associates a network port with its QoS properties. AMENDMENT LOCALE MS_409 SettingData f@
� � � � ref:MSFT_NetAdapterQosSettingData Description The QoS properties for the network adapter. �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� '
��2�� _ � WDMClassesOfDriver AcpiControlStatus C:\Windows\System32\drivers\processr.sys[PROCESSORWMI] Name] Y� F D 3 B B D 4 C 4 2 A C 2 F 7 F E F 2 6 4 3 4 0 A 9 E B 7 8 A 5 8 1 F E 5 C 2 8 5 6 1 C B 6 3 E D F 7 8 0 B 3 2 9 E A C 2 E E 4 �b��5��͝��C��� � + q i� t� v� �� � MSFT_CliAlias � F N u � � � � �
U�������������������������4 � MSFT_CliConnection Authority
� > STRING Locale
� m STRING NameSpace
� � STRING Password
� � STRING Server
� � STRING User
� , STRING | � ( + � MSFT_CliConnection ms_409 ROOT\CIMV2 . Base board (also known as a motherboard or system board) management. � & � �� � �# �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty �" d � MSFT_CliFormat TABLE STATUS / � � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � * � MSFT_CliProperty Status The Status property is a string indicating the current status of the object. Various operational and non-operational statuses can be defined. Operational statuses are "OK", "Degraded" and "Pred Fail". "Pred Fail" indicates that an element may be functioning properly but predicting a failure in the near future. An example is a SMART-enabled hard drive. Non-operational statuses can also be specified. These are "Error", "Starting", "Stopping" and "Service". The latter, "Service", could apply during mirror-resilvering of a disk, reload of a user permissions list, or other administrative work. Not all such work is on-line, yet the managed element is neither "OK" nor in one of the other states. Status � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 10 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap A E L V _ j t ~ OK Error Degraded Unknown Pred Fail Starting Stopping Service � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values ? C J T ] h r | OK Error Degraded Unknown Pred Fail Starting Stopping Service # 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � \ b � MSFT_CliProperty Name The Name property defines the label by which the object is known. Name J 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � ~ � � MSFT_CliProperty PoweredOn Boolean indicating that the physical element is powered on (TRUE), or is currently off (FALSE). PoweredOn ��� I =�9 Q ���8� O a�%`� h ې�3A
� GQ�� l �9��= � ]bAX� p ��Pl= � e��� Y Sdխ0 ] ���� O DV � ; ���H � M S F T _ N e t C o n S e c R u l e F i l t e r s &ם��C�� # MSFT_NetConSecRuleFilters N % 5 N �� � �� � [ d r y � � � � e��������` � MSFT_NetConSecRuleFilterByInterface UMLPackagePath CIM::Core::CoreElements Association wfascim ClassVersion 1.0.0 locale GroupComponent f@
� � � � ref:MSFT_NetConSecRule Override GroupComponent PartComponent f@
� * G Q ref:MSFT_NetInterfaceFilter Override PartComponent El � M S F T _ N e t C o n S e c R u l e F i l t e r s 'ם��C� # MSFT_NetConSecRuleFilters N ) 9 R �� � �� � _ h v } � � � e��������h � MSFT_NetConSecRuleFilterByInterfaceType UMLPackagePath CIM::Core::CoreElements Association wfascim ClassVersion 1.0.0 locale GroupComponent f@
� � � � ref:MSFT_NetConSecRule Override GroupComponent PartComponent f@
� . O Y ref:MSFT_NetInterfaceTypeFilter Override PartComponent so � M S F T _ N e t C o n S e c R u l e F i l t e r s (ם��C� # MSFT_NetConSecRuleFilters N ( 8 Q �� � �� � ^ g u | � � � e��������f � MSFT_NetConSecRuleFilterByProtocolPort UMLPackagePath CIM::Core::CoreElements Association wfascim ClassVersion 1.0.0 locale GroupComponent f@
� � � � ref:MSFT_NetConSecRule Override GroupComponent PartComponent f@
� - M W ref:MSFT_NetProtocolPortFilter Override PartComponent A � C I M _ P o l i c y S e t C o m p o n e n t )ם��C�$ CIM_PolicySetComponent 6 ' 4 ��A O V ^ n � � 9 C U����������� � MSFT_NetRuleInProfile UMLPackagePath CIM::Policy Association ClassVersion 1.0.0 locale GroupComponent f@
� � � � ref:MSFT_NetFirewallProfile Override GroupComponent PartComponent f@
� * ref:CIM_PolicyRule Override PartComponent Priority @ )
� z � � � �� uint16 Override Priority � M S F T _ N e t R u l e I n P r o f i l e *ם��C�N MSFT_NetRuleInProfile N - : �� � �� � G P ^ e m } � � L V U����������� � MSFT_NetConSecRuleInProfile UMLPackagePath CIM::Policy Association wfascim ClassVersion 1.0.0 locale GroupComponent f@
� � � � ref:MSFT_NetFirewallProfile Override GroupComponent PartComponent f@
� 3 = ref:MSFT_NetConSecRule Override PartComponent Priority @ )
� � � ��� � uint16 Override Priority � M S F T _ N e t S A A c t i o n I n S A R u l e +ם��C�$ " MSFT_NetSAActionInSARule 6 & 3 ��@ N U ] j � � & 5 U����������� � MSFT_NetSARuleMMAuth UMLPackagePath CIM::Policy Association ClassVersion 1.0.0 locale ActionOrder @ )
� � � ��� � uint16 Override ActionOrder GroupComponent f@
� � ref:CIM_SARule Override GroupComponent PartComponent f@
� a { � ref:MSFT_NetIKEP1AuthSet Override PartComponent � M S F T _ N e t S A R u l e M M A u t h ,ם��C�P MSFT_NetSARuleMMAuth N - : �� � �� � G P ^ e m z � � > M U����������� � MSFT_NetConSecRuleMMAuthSet UMLPackagePath CIM::Policy Association wfascim ClassVersion 1.0.0 locale ActionOrder @ )
� � � ��� � uint16 Override ActionOrder GroupComponent f@
� $ . ref:MSFT_NetConSecRule Override GroupComponent PartComponent f@
� y � � ref:MSFT_NetIKEP1AuthSet Override PartComponent � M S F T _ N e t S A A c t i o n I n S A R u l e -ם��C�( " MSFT_NetSAActionInSARule 6 ( 5 ��B P W _ l � � ( 7 U����������� � MSFT_NetSARuleQMCrypto UMLPackagePath CIM::Policy Association ClassVersion 1.0.0 locale ActionOrder @ )
� � � ��� � uint16 Override ActionOrder GroupComponent f@
� � ref:CIM_SARule Override GroupComponent PartComponent f@
� c � ref:MSFT_NetIKEQMCryptoSet Override PartComponent � M S F T _ N e t S A R u l e Q M C r y p t o .ם��C�V MSFT_NetSARuleQMCrypto N / < �� � �� � I R ` g o | � � @ O U����������� � MSFT_NetConSecRuleQMCryptoSet UMLPackagePath CIM::Policy Association wfascim ClassVersion 1.0.0 locale ActionOrder @ )
� � � ��� � uint16 Override ActionOrder GroupComponent f@
� & 0 ref:MSFT_NetConSecRule Override GroupComponent PartComponent f@
� { � � ref:MSFT_NetIKEQMCryptoSet Override PartComponent � M S F T _ N e t F i r e w a l l R u l e F i l t e r s 7ם��C� % MSFT_NetFirewallRuleFilters N * : S �� � �� � ` i w ~ � � � e��������j � MSFT_NetFirewallRuleFilterByProtocolPort UMLPackagePath CIM::Core::CoreElements Association wfascim ClassVersion 1.0.0 locale GroupComponent f@
� � � � ref:MSFT_NetFirewallRule Override GroupComponent PartComponent f@
� 1 Q [ ref:MSFT_NetProtocolPortFilter Override PartComponent oc � M S F T _ N e t F i r e w a l l R u l e F i l t e r s 8ם��C� % MSFT_NetFirewallRuleFilters N & 6 O �� � �� � \ e s z � � � e��������n � MSFT_NetFirewallRuleFilterBySecurity UMLPackagePath CIM::Core::CoreElements Association wfascim ClassVersion 1.0.0 locale GroupComponent f@
� � � � ref:MSFT_NetFirewallRule Override GroupComponent PartComponent f@
� - U _ ref:MSFT_NetNetworkLayerSecurityFilter Override PartComponent as � M S F T _ N e t F i r e w a l l R u l e F i l t e r s 9ם��C� % MSFT_NetFirewallRuleFilters N % 5 N �� � �� � [ d r y � � � e��������` � MSFT_NetFirewallRuleFilterByService UMLPackagePath CIM::Core::CoreElements Association wfascim ClassVersion 1.0.0 locale GroupComponent f@
� � � � ref:MSFT_NetFirewallRule Override GroupComponent PartComponent f@
� , G Q ref:MSFT_NetServiceFilter Override PartComponent re �
M S S A M T r a c e �ם��C� MSSAMTrace C � �� " A G o | � � � � SamQueryDisplayInfo Description SAM Query Display Information Guid {eb225178-f5f0-42b7-895b-db89276f647a} DisplayName SamQueryDisplayInfo locale MS\0x409 �F D 1 C 1 D 4 1 4 B 7 1 B 5 0 8 2 C 2 6 6 A 6 5 0 E 3 1 E F 6 D 5 0 1 9 3 8 2 7 2 4 2 4 4 B 6 8 5 F 2 1 7 C 0 A A E 0 0 A 9 2 1 yR|�C�Cȝ��C�$ � __SystemSecurity }J�M` � ���_ ���k �#!� � G�f� L-�� /�&� �QӪ
3��z� �L���
� ��!� ɡP�� J�
u� U �� ��Dd �3& " 4�H
�3�~R ��=�b ����x ~t`~ 4 3 C 8 6 C 3 E 5 B 2 B 7 F 1 D D 0 4 4 3 A 6 D A 4 E 1 7 A A 9 5 D 6 5 F 5 6 E E 0 C 1 9 C F 4 F D 3 B 5 D 9 A 5 F 6 3 C 5 2 2 �"�U�T�u͝��C�o 0 9 �� N � HNet_Connection {047525BC-A893-436A-91E8-557852561637} Ethernet Instance 0 A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 �"�U�T�v͝��C�| �� Z � HNet_ConnectionProperties HNet_Connection.Guid="{047525BC-A893-436A-91E8-557852561637}" R O O T \ M i c r o s o f t \ H o m e N e t H N e t _ C o n n e c t i o n P r o p e r t i e s
C o n n e c t i o n � N S _ 5 1 1 6 2 6 F A E 4 F 5 7 D B D 2 0 D F 5 C D 4 4 A 4 1 D A E C E D 2 8 C F 7 B 3 F D 8 B 1 2 0 1 2 C 7 F 4 B 5 8 F 4 4 E 6 6 5 \ K I _ A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 \ I _ 5 A B E 0 A 3 C 0 3 A 4 B D C 6 C E 5 A C 2 2 6 1 4 4 B A 9 8 A B D 8 1 F C 1 9 0 5 8 9 D 6 1 F 4 F B 6 7 A 3 4 2 5 2 F 7 4 F D X 4 3 C 8 6 C 3 E 5 B 2 B 7 F 1 D D 0 4 4 3 A 6 D A 4 E 1 7 A A 9 5 D 6 5 F 5 6 E E 0 C 1 9 C F 4 F D 3 B 5 D 9 A 5 F 6 3 C 5 2 2 �"�U�T�u͝��C�f 0 9 �� E � HNet_Connection {D12DED2F-AEFC-4788-A733-FAA9E04B44C7} Ethernet 2 A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 �"�U�T�v͝��C�| �� Z � HNet_ConnectionProperties HNet_Connection.Guid="{D12DED2F-AEFC-4788-A733-FAA9E04B44C7}" R O O T \ M i c r o s o f t \ H o m e N e t H N e t _ C o n n e c t i o n P r o p e r t i e s
C o n n e c t i o n � N S _ 5 1 1 6 2 6 F A E 4 F 5 7 D B D 2 0 D F 5 C D 4 4 A 4 1 D A E C E D 2 8 C F 7 B 3 F D 8 B 1 2 0 1 2 C 7 F 4 B 5 8 F 4 4 E 6 6 5 \ K I _ A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 \ I _ 5 A 8 2 1 8 7 B A D F D 0 5 C B F 9 0 D D A D A B 6 2 8 3 3 2 B F 3 B 6 4 F E A B C 1 C 8 9 9 9 5 4 6 5 9 A 9 4 C F 1 2 8 C 8 1 ��4 3 C 8 6 C 3 E 5 B 2 B 7 F 1 D D 0 4 4 3 A 6 D A 4 E 1 7 A A 9 5 D 6 5 F 5 6 E E 0 C 1 9 C F 4 F D 3 B 5 D 9 A 5 F 6 3 C 5 2 2 �"�U�T�u͝��C�q 0 9 �� P � HNet_Connection {0A645F4E-68C0-4C76-B4A3-0921C9718BDD} Local Area Connection A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 �"�U�T�v͝��C�| �� Z � HNet_ConnectionProperties HNet_Connection.Guid="{0A645F4E-68C0-4C76-B4A3-0921C9718BDD}" R O O T \ M i c r o s o f t \ H o m e N e t H N e t _ C o n n e c t i o n P r o p e r t i e s
C o n n e c t i o n � N S _ 5 1 1 6 2 6 F A E 4 F 5 7 D B D 2 0 D F 5 C D 4 4 A 4 1 D A E C E D 2 8 C F 7 B 3 F D 8 B 1 2 0 1 2 C 7 F 4 B 5 8 F 4 4 E 6 6 5 \ K I _ A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 \ I _ 4 1 F 4 0 B 0 A E D 8 0 D A 6 4 6 B B 3 A 5 4 C 3 4 C B D A F 7 2 A D B 4 E 6 4 1 4 1 4 1 6 C 5 4 3 4 8 9 2 B 2 4 E B 7 F 4 2 9 ��4 3 C 8 6 C 3 E 5 B 2 B 7 F 1 D D 0 4 4 3 A 6 D A 4 E 1 7 A A 9 5 D 6 5 F 5 6 E E 0 C 1 9 C F 4 F D 3 B 5 D 9 A 5 F 6 3 C 5 2 2 �"�U�T�u͝��C�f 0 9 �� E � HNet_Connection {2DBE1C3C-12E7-4095-90AF-AC78BF10DD42} Ethernet 2 A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 �"�U�T�v͝��C�| �� Z � HNet_ConnectionProperties HNet_Connection.Guid="{2DBE1C3C-12E7-4095-90AF-AC78BF10DD42}" R O O T \ M i c r o s o f t \ H o m e N e t H N e t _ C o n n e c t i o n P r o p e r t i e s
C o n n e c t i o n � N S _ 5 1 1 6 2 6 F A E 4 F 5 7 D B D 2 0 D F 5 C D 4 4 A 4 1 D A E C E D 2 8 C F 7 B 3 F D 8 B 1 2 0 1 2 C 7 F 4 B 5 8 F 4 4 E 6 6 5 \ K I _ A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 \ I _ 6 3 1 0 7 F 0 6 1 0 D 2 0 6 9 9 8 9 5 2 C 3 8 8 A 6 8 4 3 8 6 1 6 0 A 4 D C D E F 3 7 F A 7 5 D A 7 E 7 E 7 9 4 B 0 0 5 E 0 3 5 9 A B 5 3 8 0 6 E 8 8 6 6 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0 �b��5� ͝��C�x �f3��5��� W � WMIBinaryMofResource C:\Windows\System32\drivers\en-US\ACPI.sys.mui[ACPIMOFResource] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �b��5�
͝��C�� �f3��5� ` � WDMClassesOfDriver ACPITrace C:\Windows\System32\drivers\en-US\ACPI.sys.mui[ACPIMOFResource] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4
�b��5�
͝��C�� # �f3��5� d � WDMClassesOfDriver AMLIEvalData1 C:\Windows\System32\drivers\en-US\ACPI.sys.mui[ACPIMOFResource] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �b��5�
͝��C�� . �f3��5� o � WDMClassesOfDriver AMLIEvalData1_TypeGroup1 C:\Windows\System32\drivers\en-US\ACPI.sys.mui[ACPIMOFResource] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ^�b��5�
͝��C�z " -e3 �5� W � WDMClassesOfDriver PortClsEvent C:\Windows\System32\Drivers\portcls.SYS[PortclsMof] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/pl\}�
͝��C�� ��
�S}� ] � WDMClassesOfDriver WMIEvent C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/pl\}�
͝��C�� $ ��
�S}� c � WDMClassesOfDriver MS_WmiInternal C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ͣn�^��
͝��C�v J.3�� S � WDMClassesOfDriver WMIEvent C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 Σn�^��
͝��C�| $ J.3�� Y � WDMClassesOfDriver MS_WmiInternal C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 9 A B 5 3 8 0 6 E 8 8 6 6 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0 "�n�^�� ͝��C�l �2��2�� K � WMIBinaryMofResource C:\Windows\System32\drivers\monitor.sys[MonitorWMI] is.sys.mui[MofResourceName] 9 A B 5 3 8 0 6 E 8 8 6 6 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0 "�n�^�� ͝��C�l �2��2�� K � WMIBinaryMofResource C:\Windows\System32\drivers\monitor.sys[MonitorWMI] [MofResourceName] 9 A B 5 3 8 0 6 E 8 8 6 6 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0 "�n�^�� ͝��C�l �2��2�� K � WMIBinaryMofResource C:\Windows\System32\drivers\monitor.sys[MonitorWMI] \Windows\system32\kernelbase.dll[MofResourceName] ame] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 Σn�^��
͝��C�| $ J.3�� Y � WDMClassesOfDriver MS_WmiInternal C:\Windows\system32\kernelbase.dll[MofResourceName] +y��� � �\�]� � W��> � ⎽ � 5��֘
� ��O܊ � �H�� � =�o\� [ ��~)H / tH��w > �U?� � ��^H p B e h a v i o r ՝��C�� Behavior
6 # 0 � �� � S a g � � l � ����������L � DispatcherSynchronizationBehavior Description DispatcherSynchronizationBehavior ServiceModel UUID {f77324b6-5bb9-4721-b63c-b39d1826d72b} AsynchronousSendEnabled 6
� � � F S � �� boolean Description When enabled the reply on the channel will be send asynchronously. DisplayName AsynchronousSendEnabled MaxPendingReceives 6
� � � � + 8 � �� sint32 Description Limits the maximum number of pending receives that may be queued on the channel. DisplayName MaxPendingReceives he � B e h a v i o r ՝��C�Z Behavior
6 � �� � 3 A G o t ��������� � ClientViaBehavior Description ClientViaBehavior ServiceModel UUID {f6027ab3-a560-4222-a48c-3f572a6967a7} Uri 6
� � � � � � � �� string Description The ViaUri. DisplayName Uri he � B e h a v i o r ՝��C�� Behavior
6 ) � �� � E S Y � � ��������8 � TransactedBatchingBehavior Description TransactedBatchingBehavior ServiceModel UUID {e700e91e-8451-4a81-89ba-c5779050ea6b} MaxBatchSize 6
� � � � * � �� sint32 Description The maximum batch size for the transacted batching. DisplayName MaxBatchSize ch � B e h a v i o r ՝��C�d Behavior
6 , � �� � K Y _ � � f ~ 7 G W��������������� � DeliveryRequirementsAttribute Description DeliveryRequirementsAttribute ServiceModel UUID {b062d889-ea7c-4d18-86d7-c26c42f9b108} QueuedDeliveryRequirements 6
� � � � = J � �� string Description Specifies whether the binding for a service supports contracts. DisplayName QueuedDeliveryRequirements RequireOrderedDelivery 6
� � � � � �� boolean Description Specifies whether the binding supports ordered messages. DisplayName RequireOrderedDelivery TargetContract
6
� � � � � � � �� string Description The contract to which it applies. DisplayName TargetContract bu � B e h a v i o r
՝��C�� Behavior
6 ) 6 � �� � _ m s � � � � � � W��������������F � DataContractSerializerOperationBehavior Description DataContractSerializerOperationBehavior ServiceModel UUID {91384181-aaf9-44d2-9c19-8b73f177dc0a} IgnoreExtensionDataObject 6
� � j w � �� boolean Description When enabled the IExtensibleDataObject interface on data contract types will be ignored. DisplayName IgnoreExtensionDataObject MaxItemsInObjectGraph 6
� � � � � � �� sint32 Description Limits the maximum number of objects that may be deserialized by the data contract serializer in a single deserialization episode. DisplayName MaxItemsInObjectGraph Style
6
� � �
2 ? � �� string Description Defines the style of the SOAP message. DisplayName Style tr � B e h a v i o r ՝��C�g Behavior
6 ) � �� � E S Y � � N ] 1 � � W�������������������� � OperationBehaviorAttribute Description OperationBehaviorAttribute ServiceModel UUID {e6f51a1b-eb37-4377-9b0e-2cb3508be135} AutoDisposeParameters 6
� � � � * 7 � �� boolean Description The state of the auto dispose feature for parameters. DisplayName AutoDisposeParameters Impersonation 6
� � � �
� �� string Description Indicates the level of caller impersonation that the operation supports. DisplayName Impersonation ReleaseInstanceMode
6
� u } � � � � �� string Description Indicates when in the course of an operation invocation to recycle the object. DisplayName ReleaseInstanceMode TransactionAutoComplete 6
� Y b o � � � �� boolean Description Indicates whether to automatically commit the current transaction if no unhandled exceptions occur. DisplayName TransactionAutoComplete TransactionScopeRequired 6
� X a n � � � �� boolean Description Indicates whether the operation requires a transaction. DisplayName TransactionScopeRequired � B e h a v i o r ՝��C�� Behavior
6 ' � �� � A O U } � ��������> � TransactionFlowAttribute Description TransactionFlowAttribute ServiceModel UUID {379c7092-9b76-476a-a66b-1937939ed1d0} TransactionFlowOption 6
� � � � ' � �� string Description Indicates whether transactions flow or not. DisplayName TransactionFlowOption Fl � B e h a v i o r
՝��C�3
Behavior
6 - � �� � M [ a � � % * ������������� � XmlSerializerOperationBehavior Description XmlSerializerOperationBehavior ServiceModel UUID {307a1805-daa2-454b-93fa-97241bb1aed5} Style 6
� � � � � �� string Description Defines the style of the SOAP message. DisplayName Style Use 6
� n v � � � � �� string Description Specifies the SOAP encoding style. DisplayName Use �
E v e n t T r a c e ՝��C� EventTrace C � �� & 3 H U i o � � WSAT_TraceProvider locale MS\0x409 Description WSAT Trace Provider DisplayName WSAT_TraceProvider Guid {7f3fe630-462b-47c5-ab07-67ca84934abd} e � W S A T _ T r a c e P r o v i d e r ՝��C� WSAT_TraceProvider C � �� # 0 B O ` f � � WSAT_TraceEvent locale MS\0x409 Description WSAT Trace Event DisplayName WSAT_TraceEvent Guid {eb6517d4-090c-48ab-825e-adad366406a2} eE � W S A T _ T r a c e E v e n t ՝��C�]
WSAT_TraceEvent C � �� 2 ? Q ` � � � � r { � � ������������� � WSAT_TraceRecord Description WSAT Trace Record DisplayName WSAT_TraceRecord EventTypeName x � � � Trace Start Stop Suspend Resume EventType
ActivityID
N
� ( 0 ; H U ` f �� � �� object WmiDataId Description Activity ID extension Guid ActivityID EventID 6
� � � � � � �� sint32 WmiDataId Description EventID TraceRecord [
� ^ f q ~ � � � � � �� � �� string WmiDataId Description Trace Record StringTermination NullTerminated format w XMLFragment �4 1 C 5 3 E 6 D B 1 A C F 2 4 5 3 C E F D 4 1 3 9 8 1 9 8 E 6 1 3 F 1 0 D F F 4 7 7 0 9 E C A B 1 D 7 F 0 3 7 7 5 6 A C 8 C E 7 ֝��C�ȝ��C�� � � __thisNAMESPACE � �� � � ? BY�p v 'm �� J 3� 0 � j/�i Z �F#2o � S�tD � C I M _ L o g i c a l D e v i c e �ȝ��C�< z CIM_LogicalDevice ) �� ! ' O [ � � � � ' Y k � � � � 0 b v � � � ; M � � � M i � � ����UUUU������������������������������������������������������������������������������������������������������������������ � CIM_PotsModem Abstract Locale UUID {8502C546-5FBB-11D2-AAC1-006008C78BC7} AnswerMode B
� � � �� uint16 CompressionInfo D
� � � �� uint16 CountriesSupported F
� � �� string CountrySelected J
� Q � �� string CurrentPasswords N
� � � �� string DialType R
� � � �� uint16 ErrorControlInfo T
� � �� uint16 InactivityTimeout V
� Z � �� uint32 MaxBaudRateToPhone Z
� � � �� uint32 MaxBaudRateToSerialPort ^
� � � �� uint32 MaxNumberOfPasswords b
� 3 � �� uint16 ModulationScheme d
� w � �� uint16 RingsBeforeAnswer f
� � � �� uint8 SpeakerVolumeInfo g
� � �� uint16 SupportsCallback ! i
� D � �� boolean SupportsSynchronousConnect " k
� � � �� boolean TimeOfLastReset e # m
� � � �� datetime � C I M _ L o g i c a l D e v i c e �ȝ��C� t CIM_LogicalDevice ) �� # ) Q e 2 e � � ? W � � V p � � s � � � ) ����UU������������������������������������������������������������������������������������������������������������� � CIM_PowerSupply Abstract Locale UUID {8502C547-5FBB-11D2-AAC1-006008C78BC7} ActiveInputVoltage B 6
� � � ��� � � � uint16 ValueMap � � � � � � 1 2 3 4 5 6 MappingStrings MIF.DMTF|Power Supply|002.15 IsSwitchingSupply D
� \ � �� boolean Range1InputFrequencyHigh F
� � � �� uint32 Range1InputFrequencyLow J )
� � �� uint32 MappingStrings ! MIF.DMTF|Power Supply|002.17 Range1InputVoltageHigh N )
� � � � � �� uint32 MappingStrings � MIF.DMTF|Power Supply|002.8 Range1InputVoltageLow R )
� ! 1 � �� uint32 MappingStrings 9 MIF.DMTF|Power Supply|002.7 Range2InputFrequencyHigh V )
� � � � � �� uint32 MappingStrings � MIF.DMTF|Power Supply|002.20 Range2InputFrequencyLow Z )
� 5 = M � �� uint32 MappingStrings U MIF.DMTF|Power Supply|002.19 Range2InputVoltageHigh ^ )
� � � � � �� uint32 MappingStrings � MIF.DMTF|Power Supply|002.12 Range2InputVoltageLow b )
� N V f � �� uint32 MappingStrings n MIF.DMTF|Power Supply|002.11 TotalOutputPower f )
� � � � � �� uint32 MappingStrings � MIF.DMTF|Power Supply|002.21 TypeOfRangeSwitching j 6
� m � ��u � � uint16 ValueMap � � � � � � 1 2 3 4 5 6 MappingStrings � MIF.DMTF|Power Supply|002.16 � C I M _ L o g i c a l D e v i c e �ȝ��C�� x CIM_LogicalDevice )
�� % M \ ? J % � � $ > p � � ; O � � � � � ����UU����������������������������������������������������������������������������������������������������������������z � CIM_Battery Abstract Locale UUID {8502C548-5FBB-11D2-AAC1-006008C78BC7} BatteryStatus B 6
� � � ��� � uint16 ValueMap � � � � � � � � � � 1 2 3 4 5 6 7 8 9 10 11 MappingStrings MIF.DMTF|Portable Battery|002.14 Chemistry N 6
� � � ��� � � � uint16 ValueMap � � � � � � � � 1 2 3 4 5 6 7 8 MappingStrings � MIF.DMTF|Portable Battery|002.7 DesignCapacity P )
� \ � ��d t uint32 MappingStrings | MIF.DMTF|Portable Battery|002.8 DesignVoltage X )
� � � ��� � uint64 MappingStrings MIF.DMTF|Portable Battery|002.9 EstimatedChargeRemaining L
� h � �� uint16 EstimatedRunTime H )
� � � ��� � uint32 MappingStrings � MIF.DMTF|Portable Battery|002.15 ExpectedLife h
� 3 � �� uint32 FullChargeCapacity T )
� � � ��� � uint32 MappingStrings � MIF.DMTF|Portable Battery|002.11 MaxRechargeTime l
� � �� uint32 SmartBatteryVersion ` 6
� d � ��l @ t � string MaxLen MappingStrings � MIF.DMTF|Portable Battery|002.10 TimeOnBattery D
� � � �� uint32 TimeToFullCharge d )
� 8 � ��@ P uint32 MappingStrings X MIF.DMTF|Portable Battery|002.16 � C I M _ L o g i c a l F i l e �ȝ��C�$ ~ CIM_LogicalFile ) �� ! ' ������������������������������������������������������������������������������������������������������������������������������O � CIM_Directory Abstract Locale UUID {8502C55F-5FBB-11D2-AAC1-006008C78BC7} � C I M _ L o g i c a l E l e m e n t �ȝ��C�� W CIM_LogicalElement )
�� %
M ` � � $ � � Y i � � � 7 L � � } � � � � > N �WUU������������������������������������������������������������������������������������ � CIM_Process Abstract Locale UUID {8502C566-5FBB-11D2-AAC1-006008C78BC7} CreationClassName 4
� � � �� � ��� string CIM_Key MaxLen CreationDate e '
� � �� � �� datetime Fixed CSCreationClassName A
� s { � � �� � ��� string Propagated CIM_OperatingSystem.CSCreationClassName CIM_Key MaxLen CSName A
� , H �� � ��Q string Propagated CIM_OperatingSystem.CSName CIM_Key MaxLen ExecutionState <
� � � �� uint16 Handle $ 4
� � � �� � ��� string MaxLen KernelModeTime
(
� / � �� uint64 OSCreationClassName 0 A
� � � � � �� � ��� string Propagated CIM_OperatingSystem.CreationClassName CIM_Key MaxLen OSName 4 A
� > F R l �� � ��u string Propagated CIM_OperatingSystem.Name CIM_Key MaxLen Priority
8
� � � �� uint32 TerminationDate e >
� � � �� datetime UserModeTime B
� 6 � �� uint64 WorkingSetSize J
� x � �� uint64 �F D 1 C 1 D 4 1 4 B 7 1 B 5 0 8 2 C 2 6 6 A 6 5 0 E 3 1 E F 6 D 5 0 1 9 3 8 2 7 2 4 2 4 4 B 6 8 5 F 2 1 7 C 0 A A E 0 0 A 9 2 1 �Ν��C�Cȝ��C�$ � __SystemSecurity @! C I M _ E n a b l e d L o g i c a l E l e m e n t �ѝ��C�] � # CIM_EnabledLogicalElement ) �� & - = P h � � � S ] � � ' 9 � � Z i � � X n = � � < J � � c | � w � ����VUUU����������������������������������������������� ���� �������� ������������������������������������������������������������������������� � CIM_LogicalDevice Abstract Version 2.8.0 UMLPackagePath CIM::Core::Device AdditionalAvailability $ ~
� � � � uint16 ModelCorrespondence � CIM_LogicalDevice.Availability Availability X +
� ( 8 � � uint16 MappingStrings H j � MIF.DMTF|Operational State|006.5 MIB.IETF|HOST-RESOURCES-MIB.hrDeviceStatus MIF.DMTF|Host Device|001.5 ModelCorrespondence � CIM_LogicalDevice.AdditionalAvailability CreationClassName J )
� C � ��K string MaxLen DeviceID N )
� � � ��� @ string MaxLen ErrorCleared d
� � � � boolean Deprecated � CIM_ManagedSystemElement.OperationalStatus ErrorDescription `
� e m y string Deprecated � CIM_DeviceErrorData.ErrorDescription IdentifyingDescriptions # z +
� � * string ArrayType Indexed ModelCorrespondence 2 CIM_LogicalDevice.OtherIdentifyingInfo LastErrorCode \
� � � � uint32 Deprecated � CIM_DeviceErrorData.LastErrorCode MaxQuiesceTime % � +
� % 1 C J uint64 Deprecated 9 No value Units MilliSeconds OtherIdentifyingInfo f 8
� � � � � � � string ArrayType Indexed MaxLen ModelCorrespondence � CIM_LogicalDevice.IdentifyingDescriptions PowerManagementCapabilities T
� i q } uint16 Deprecated � CIM_PowerManagementCapabilities.PowerCapabilities PowerManagementSupported R
� � boolean Deprecated CIM_PowerManagementCapabilities PowerOnHours ! j )
� � � � � �� uint64 Units Hours Counter StatusInfo Z +
� � � � ) 9 uint16 Deprecated CIM_EnabledLogicalElement.EnabledState MappingStrings A MIF.DMTF|Operational State|006.4 SystemCreationClassName B 6
� � � ��� � � string MaxLen Propagated CIM_System.CreationClassName SystemName F 6
� J � ��R Z f string MaxLen Propagated CIM_System.Name TotalPowerOnHours " r )
� � � � � �� uint64 Units Hours Counter � ^ � s z ~ � f i � � M
M �
�
2 5 � � � � S f j n � � SetPowerState , Deprecated 4 CIM_PowerManagementService.SetPowerState � ae442007200009F ROOT\cimv2\power ���� � �5 �� * � � A ������� � __PARAMETERS abstract PowerState uint16
� 6 IN
� 6 ] �� ID )
� � ] ��� uint16 e Time datetime e
� � IN e
� � �� ID e )
� x ��= datetime __ � ae442007200009F ROOT\cimv2\power ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � Reset ae442007200009F ROOT\cimv2\power ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � EnableDevice $ 0 Deprecated 8 CIM_EnabledLogicalElement.RequestStateChange � ae442007200009F ROOT\cimv2\power ���� � �� �� * � ��� � __PARAMETERS abstract Enabled boolean
� 3 IN
� 3 [ �� ID )
� � [ ��� boolean __ � ae442007200009F ROOT\cimv2\power ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � OnlineDevice
Deprecated
CIM_EnabledLogicalElement.RequestStateChange � ae442007200009F ROOT\cimv2\power ���� � �� �� * � ��� � __PARAMETERS abstract Online boolean
� 2 IN
� 2 Z �� ID )
� � Z ��� boolean __ � ae442007200009F ROOT\cimv2\power ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � QuiesceDevice �
�
Deprecated CIM_EnabledLogicalElement.RequestStateChange � ae442007200009F ROOT\cimv2\power ���� � �� �� * � ��� � __PARAMETERS abstract Quiesce boolean
� 3 IN
� 3 [ �� ID )
� � [ ��� boolean __ � ae442007200009F ROOT\cimv2\power ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � SaveProperties ae442007200009F ROOT\cimv2\power ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � RestoreProperties ae442007200009F ROOT\cimv2\pm�ƶ� � wpJ� � �?��� - �`�� 9 N۽
R tΈZ
� d� 9 ���OV M �� f &� � $ ��M- ���4 �
E v e n t T r a c e ҝ��C�� EventTrace 6 � �� > D l t ~ � }����= � MSV1_0DebugTrace Description Security: NTLM Authentication Guid {5BBB6C18-AA45-49b1-A15F-085F7ED0AA90} locale MS\0x409 Flags E
� � � � � R Z ) uint32 Description Enable Flags ValueDescriptions V b p { � � � � � � � � . E Error Flag Warning Flag Init Flag Misc Flag Logon Session Flag Leak Track Flag Lpc Flag Lpc More Flag Api Flag Api More Flag Session Keys Flag Negotiate Flag Updates Flag NTLM V2 Flag Credentials Flag Protocol Version Flag Target Flag Values � � � � � � � � � � � � � Error Warning Init Misc LogonSess Leak Lpc LpcMore Api ApiMore SKey Nego Updates NtLmV2 Cred Version Target ValueMap q } � � � � � � � � � �
% 1 0x00000001 0x00000002 0x00000004 0x00000008 0x00000010 0x00000020 0x00000040 0x00000080 0x00000100 0x00000200 0x00000400 0x00000800 0x00001000 0x00002000 0x00004000 0x00008000 0x00010000 0 �
E v e n t T r a c e ҝ��C�� EventTrace 6 � ��
2 8 ` h r � MSV1_0Trace Description NTLM Security Protocol Guid {C92CF544-91B3-4dc0-8E11-C580339A0BF8} locale MS\0x409 M � M S V 1 _ 0 T r a c e ҝ��C�� MSV1_0Trace
C � �� 3 9 a n � � � � NtlmServerAccept Description NTLM Server Accept Guid {94d4c9eb-0d01-41ae-99e8-15b26b593a83} DisplayName NtlmServerAccept locale MS\0x409 � N t l m S e r v e r A c c e p t ҝ��C� NtlmServerAccept C � �� % 9 D S Z b l w � e��������v � NtlmServerAccept_Start Description NTLM Server Accept EventType EventTypeName Start locale MS\0x409 InContext A
� � � � � � �� � �� uint32 WmiDataId Description In-Context pointer StageHint 6
� J R ] j � �� uint32 WmiDataId Description Stage Hint � N t l m S e r v e r A c c e p t ҝ��C� NtlmServerAccept C � �� # 7 B Q V ^ h s � � � U����������������w � NtlmServerAccept_End Description NTLM Server Accept EventType EventTypeName End locale MS\0x409 InContext A
� � � � � � �� � �� uint32 WmiDataId Description In-Context pointer OutContext A
� R Z e r �� � �� uint32 WmiDataId Description Out-Context pointer StageHint 6
� � � � � � �� uint32 WmiDataId Description Stage Hint Status 6
� O W b o � �� uint32 WmiDataId Description Status � N t l m S e r v e r A c c e p t ҝ��C�� NtlmServerAccept C � �� $ 8 C R X ` j v / 6 � � 0 < � � < F �
U����������������������������� � NtlmServerAccept_Info Description NTLM Server Accept EventType EventTypeName Info locale MS\0x409 DomainName P
� � � � � $ , � �� string WmiDataId Description Client Domain Name StringTermination Counted format w Flags 6
� z � � � � �� uint32 WmiDataId Description Flags InContext A
� � ' �� � �� uint32 WmiDataId Description In-Context pointer OutContext A
� � � � � � �� � �� uint32 WmiDataId Description Out-Context pointer StageHint 6
� # 0 � �� uint32 WmiDataId Description Stage Hint UserName P
� � � � � � � � � � �� string WmiDataId Description Client User Name StringTermination Counted format w Workstation P
� h p { � � � � � � �� string WmiDataId Description Client Workstation StringTermination Counted format w � M S V 1 _ 0 T r a c e ҝ��C� MSV1_0Trace
C � �� # ; A i v � � � � NtlmClientInitialize Description NTLM Client Initialize Guid {6df28b22-73be-45cc-ba80-8b332b35a21d} DisplayName NtlmClientInitialize locale MS\0x409 � N t l m C l i e n t I n i t i a l i z e
ҝ��C�
NtlmClientInitialize C � �� ) A L [ b j t u��������~ � NtlmClientInitialize_Start Description NTLM Client Initialize EventType EventTypeName Start locale MS\0x409 InContext A
� � � � � � �� � �� uint32 WmiDataId Description In-Context pointer StageHint 6
� R Z e r � �� uint32 WmiDataId Description Stage Hint � N t l m C l i e n t I n i t i a l i z e ҝ��C�& NtlmClientInitialize C � �� ' ? J Y ^ f p { � � � U���������������� � NtlmClientInitialize_End Description NTLM Client Initialize EventType EventTypeName End locale MS\0x409 InContext A
� � � � � � �� � �� uint32 WmiDataId Description In-Context pointer OutContext A
� Z b m z � �� � �� uint32 WmiDataId Description Out-Context pointer StageHint 6
� � � � � � �� uint32 WmiDataId Description Stage Hint Status 6
� W _ j w � �� uint32 WmiDataId Description Status � M S V 1 _ 0 T r a c e ҝ��C�� MSV1_0Trace
C � �� - 3 [ h w � � NtlmLogonUser Description NTLM Logon User Guid {19196b33-a302-4c12-9d5a-eac149e93c46} DisplayName NtlmLogonUser locale MS\0x409 �
N t l m L o g o n U s e r
ҝ��C�� NtlmLogonUser C � �� " 3 > M T \ f � NtlmLogonUser_Start Description NTLM Logon User EventType EventTypeName Start locale MS\0x409 �
N t l m L o g o n U s e r ҝ��C�i NtlmLogonUser C � �� 1 < K P X b n + � � U����������������� � NtlmLogonUser_End Description NTLM Logon User EventType EventTypeName End locale MS\0x409 DomainName P
� � � � � � � �� string WmiDataId Description Domain Name StringTermination Counted format w LogonType 6
� o w � � � �� uint32 WmiDataId Description Logon Type Status 6
� � � � � �� uint32 WmiDataId Description Status UserName P
� w � � � � � � � �� string WmiDataId Description User Name StringTermination Counted format w ve � � ���C�� ) / ��: B � StdRegProv Description The StdRegProv class contains methods that interact with the system registry. You can use these methods to:
Verify the access permissions for a user
Create, enumerate, and delete registry keys
Create, enumerate, and delete named values
Read, write, and delete data values AMENDMENT LOCALE h 1 � Des � � n rov w � � � ds � � �# �- e s �- X. �7 G9 an V9 �9 �F �H
V �H I <V �W iss �W QX �a �e te, �e 9f �o �s e r �s &t O� Ղ en � c� �� �� ame Ӑ ґ �� �� , a �� �� � � � #� L� Ҿ � w� �� �� �� �� �� I� Y� O� �� �� �� i� �� � /� -� � 1 " � /� CreateKey ) Description The CreateKey method creates a subkey in the specified tree. � a42c9160500003S ROOT\Default\ms_409 ���� � �i �� * � � � ��������� � __PARAMETERS abstract hDefKey uint32
� 3 Optional parameter that specifies the tree that contains the sSubKeyName path. The default value is HKEY_LOCAL_MACHINE (0x80000002). The following trees are defined in Winreg.h:
HKEY_CLASSES_ROOT (0x80000000)
HKEY_CURRENT_USER (0x80000001)
HKEY_LOCAL_MACHINE (0x80000002)
HKEY_USERS (0x80000003)
HKEY_CURRENT_CONFIG (0x80000005)
HKEY_DYN_DATA (0x80000006)
Note that HKEY_DYN_DATA is a valid tree for Windows 95 and Windows 98 computers only. Description
� 3 Z IN )
� 3 Z V �� ID 6
� � Z V ��� uint32 sSubKeyName string
� Contains the key to be created. The CreateKey method creates all subkeys specified in the path that do not exist. For example, if MyKey and MySubKey do not exist in the following path, CreateKey creates both keys:
HKEY_LOCAL_MACHINE\SOFTWARE\MyKey\MySubKey Description
� + ' IN )
� + ' d �� ID 6
� � + ' d ��� string __ �� a42c9160500003S ROOT\Default\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � DeleteKey � � Description The DeleteKey method deletes a subkey in the specified tree. � a42c9160500003S ROOT\Default\ms_409 ���� � �i �� * � � � ��������
� __PARAMETERS abstract hDefKey uint32
� 3 Optional parameter that specifies the tree that contains the sSubKeyName path. The default value is HKEY_LOCAL_MACHINE (0x80000002). The following trees are defined in Winreg.h:
HKEY_CLASSES_ROOT (0x80000000)
HKEY_CURRENT_USER (0x80000001)
HKEY_LOCAL_MACHINE (0x80000002)
HKEY_USERS (0x80000003)
HKEY_CURRENT_CONFIG (0x80000005)
HKEY_DYN_DATA (0x80000006)
Note that HKEY_DYN_DATA is a valid tree for Windows 95 and Windows 98 computers only. Description
� 3 Z IN )
� 3 Z V �� ID 6
� � Z V ��� uint32 sSubKeyName string
� Contains the key to be deleted. Description
� I ' IN )
� I ' � �� ID 6
� I ' � ��� string __ �� a42c9160500003S ROOT\Default\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � EnumKey � � Description The EnumKey method enumerates the subkeys for the given path. � a42c9160500003S ROOT\Default\ms_409 ���� � �i �� * � � � ��������, � __PARAMETERS abstract hDefKey uint32
� 3 Optional parameter that specifies the tree that contains the sSubKeyName path. The default value is HKEY_LOCAL_MACHINE (0x80000002). The following trees are defined in Winreg.h:
HKEY_CLASSES_ROOT (0x80000000)
HKEY_CURRENT_USER (0x80000001)
HKEY_LOCAL_MACHINE (0x80000002)
HKEY_USERS (0x80000003)
HKEY_CURRENT_CONFIG (0x80000005)
HKEY_DYN_DATA (0x80000006)
Note that HKEY_DYN_DATA is a valid tree for Windows 95 and Windows 98 computers only. Description
� 3 Z IN )
� 3 Z V �� ID 6
� � Z V ��� uint32 sSubKeyName string
� Specifies the path that contains the subkeys to be enumerated. Description
� h ' IN )
� h ' � �� ID 6
� $ h ' � ��� string __ �� a42c9160500003S ROOT\Default\ms_409 ���� � �� �� W � * � ��������� � __PARAMETERS abstract sNames string
� 2 Contains an array of subkey strings. Description
� 2 � Y out )
� 2 � Y � �� ID 6
� = � Y � ��� string ReturnValue uint32
� � uint32 out
� � � �� t���P � �6� U H�%r � LB� � W i n 3 2 _ P e r f R a w D a t a �uR|�C�� � Win32_PerfRawData 6 # I V | ��� � � # . � � Z r @ T � � ~ � � � � � � �
1
�
�
W l B R � � {
�
. � � \ n & 3 UUUUU�������������������������������������������������������������������������������������������������������������������������������������������������������������������������� � MSiSCSI_MMIPSECStats Description iSCSI HBA main mode IPSEC Statistics DisplayName iSCSI HBA Main Mode IPSEC Statistics AMENDMENT LOCALE AcquireFailures
� � � � uint64 Description The number of times that an acquire has failed. AcquireHeapSize (
� O W d uint64 Description The number of entries in the acquire heap, which stores active acquires. This number increases under a heavy load and then gradually decreases over time, as the acquire heap is cleared. ActiveAcquire
� Z b o uint64 Description An acquire is a request by the IPSEC driver to have IKE perform a task. The active acquire statistic includes the outstanding request and the number of any queued requests. Typically, the number of active acquires is 1. Under a heavy load, the number of active acquires is 1 and the number of requests that are queued by IKE for processing. ActiveReceive
� uint64 Description The number of IKE messages received that are queued for processing. AuthenticationFailures @
� � � � uint64 Description The total number of identity authentication failures (Kerberos, certificate, and preshared key) that occurred during main mode negotiation. ConnectionListSize �
� � � � uint64 Description The number of quick mode state entries. GetSPIFailures
h
� � uint64 Description The total number of requests submitted by IKE to obtain a unique Security Parameters Index (SPI) that failed. InvalidCookiesReceived H
� � � � uint64 Description A cookie is a value contained in a received IKE message that is used by IKE to find the state of an active main mode. A cookie in a received IKE message that cannot be matched with an active main mode is invalid. InvalidPackets �
� � � � uint64 Description The number of received IKE messages that are invalid, including IKE messages with invalid header fields, incorrect payload lengths, and incorrect values for the responder cookie (when it should be set to 0). KeyAdditionFailures p
� & uint64 Description The number of outbound quick mode security associations (SAs) submitted by IKE that failed KeyAdditions X
� � � � uint64 Description The number of outbound quick mode security associations (SAs) added by IKE KeyUpdateFailures x
� ]
e
r
uint64 Description The number of inbound quick mode security associations (SAs) added by IKE KeyUpdates `
� �
�
uint64 Description The number of inbound quick mode security associations (SAs) added by IKE NegotiationFailures 8
� � � � uint64 Description The total number of negotiation failures that occurred during main mode (also known as Phase I) or quick mode (also known as Phase II) negotiation. OakleyMainMode �
� ~ � � uint64 Description The total number of successful SAs created during main mode negotiations. OakleyQuickMode �
�
#
0
uint64 Description The total number of successful SAs created during quick mode negotiations ReceiveFailures
� �
�
�
uint64 Description The number of times that the TCP stack has failed when receiving IKE messages. ReceiveHeapSize 0
� Z b o uint64 Description The number of entries in the IKE receive buffers for incoming IKE messages. SendFailures
� � � uint64 Description The number of times that the TCP/IP stack has failed when sending IKE messages. SoftAssociations �
� � � � uint64 Description The total number of negotiations that resulted in the use of plaintext (also known as soft SAs). This typically reflects the number of associations formed with computers that did not respond to main mode negotiation attempts. This can include both non-IPSEC-aware computers and IPSEC-aware computers that do not have IPSEC policy to negotiate security with this IPSEC peer. TotalGetSPI
P
� _ g t uint64 Description The total number of requests submitted by IKE to obtain a unique Security Parameters Index (SPI). � W i n 3 2 _ P e r f R a w D a t a �uR|�C� 4 Win32_PerfRawData 6 + H U h ��s { � ( 3 � � F W � � � � � U��������������������������������������������������I � MSiSCSI_ConnectionStatistics Description iSCSI Connection Statistics DisplayName iSCSI Connections AMENDMENT LOCALE BytesReceived +
� � � � � � uint64 DisplayName Bytes Received Description Count of # of bytes received over this connection BytesSent +
� l t � � � uint64 DisplayName Bytes Sent Description Count of # of bytes sent over this connection CID
� � uint16 Description The iSCSI connection ID for this connection instance. PDUCommandsSent " +
� � � � � � uint64 DisplayName PDUs Sent Description Count of # of PDU sent over this connection PDUResponsesReceived * +
� : B O ^ k uint64 DisplayName PDUs Received Description Count of # of PDU received over this connection UniqueAdapterId
+
� � � � uint64 DisplayName Adapter Id description Id that is globally unique to each instance of each adapter. This is the value reported by the MSiSCSI_HBAInformation class. USID
� � � � uint64 Description A uniquely generated session ID used only internally. This is the value returned by the LoginToTarget method. � �uR|�C��
) ' L ��W _ l � � U������������1 � MSiSCSIInitiator_LUNList Description Microsoft iSCSI Initiator: LUN List AMENDMENT LOCALE OSLunNumber
� � � � uint32 Description OS SCSI LUN number target LUN is mapped to TargetLun
� % uint64 Description Target LUN NT � �uR|�C�q ) ! . Z ��e m | � � : G � � � � U�������������������������� � MSiSCSIInitiator_TargetMappings Description Microsoft iSCSI Initiator: Target Mappings AMENDMENT LOCALE InitiatorName
� � � � string Description Initiator Name LUNList
� # 0 object:MSiSCSIInitiator_LUNList Description LUN List OSBusNumber
� s { � uint32 Description OS SCSI bus number target is mapped to OSDeviceName
� � � � string Description OS Device Name OSTargetNumber
� K S ` uint32 Description OS SCSI Target number target is mapped to TargetName
� � � � string Description Target Name � ,^n5� * @x� � ��4� R ��2 & � l X
(�{�r � ��4I 6 wz'� /�sF� $ C I M _ S e t t i n g *͝��C�� CIM_Setting
) " / � ��� � � � � ���������������������� � ScriptingStandardConsumerSetting Description Provides registration data common to all instances of the Active Script Consumer AMENDMENT LOCALE MaximumScripts
� � � � uint32 Description Maximum number of scripts run before the consumer will start a new instance. The consumer should be shut down periodically to clear out memory leaks from the scripts. Timeout
� � � � uint32 Description Maximum number of minutes before the consumer will start a new instance. If zero, consumer lifetime is controlled by the MaximumScripts property. Valid Range: 0-71,000. � _ _ E v e n t C o n s u m e r +͝��C�� 8 __EventConsumer
$ k s � � K T � � � � ' 3 z � � � oUU���������� ���������������������������������������� � SMTPEventConsumer locale BccLine , '
� Y a �� � �� string Template CcLine
( '
� � � �� � �� string Template FromLine '
� � �� � �� string Template HeaderFields 0
� C � �� string Message '
� � � �� � �� string Template Name
� � � �� string ReplyToLine '
� �� � �� string Template SMTPServer '
� h p �� � �� string not_null Subject '
� � � �� � �� string Template ToLine $ '
� �� � �� string Template �5 7 E 5 F 3 A D D 9 E 2 4 2 C 4 E 9 F 9 E D F 7 9 A A 9 7 F 7 9 E 7 9 1 1 C 5 A 8 B 9 0 2 E C 1 5 0 D 6 4 4 2 E 3 B 8 5 A 5 A A ,͝��C�ȝ��C�� ���M 9 ` � __Win32Provider {C7A3A54B-0250-11d3-9CD1-00105A1F4801} NetworkServiceHost SMTPEventConsumer C F F 4 1 3 7 0 C 7 0 E 2 6 A 1 6 9 C 5 F 7 C C 5 5 9 4 0 5 0 6 4 6 C 5 B 9 B C 0 F 0 D 1 F 0 F C 4 7 3 3 F A 2 A A 3 5 9 3 9 C -͝��C�ȝ��C�� @ % { � __EventConsumerProviderRegistration - SMTPEventConsumer \\.\root\default:__Win32Provider.Name="SMTPEventConsumer" R O O T \ d e f a u l t # _ _ E v e n t C o n s u m e r P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 8 9 2 F 8 D B 6 9 C 4 E D F B C 6 8 1 6 5 C 9 1 0 8 7 B 7 A 0 8 3 2 3 F 6 C E 5 B 5 E F 3 4 2 C 0 F 9 3 E 0 2 A 0 5 9 0 B F C 4 \ K I _ C F F 4 1 3 7 0 C 7 0 E 2 6 A 1 6 9 C 5 F 7 C C 5 5 9 4 0 5 0 6 4 6 C 5 B 9 B C 0 F 0 D 1 F 0 F C 4 7 3 3 F A 2 A A 3 5 9 3 9 C \ I _ B A C 3 F 6 A 6 A 3 5 D D 5 6 C C 5 1 C A D 0 B A F 3 2 5 F 0 D 2 8 7 9 8 9 C 2 8 1 F 5 3 4 A 9 D B B 7 6 F D 5 9 7 1 0 B 3 D E _ _ E v e n t C o n s u m e r /͝��C�� 8 __EventConsumer ��
& / � � F P �
� � � � > J � � oUU���������� ����������������������������������������� � SMTPEventConsumer AMENDMENT LOCALE BccLine ,
� [ c p string Description The email addresses of those persons to be included on the BCC: line. CcLine
(
� � � string Description The email addresses of those persons to be included on the CC: line. FromLine
� | � � string Description From line for the email message. If NULL, a from line will be constructed of the form WinMgmt@MachineName HeaderFields 0
� 6 > K string Description The header fields will be inserted into the SMTP email header without interpretation. Message
� � � � string Description The body of the email message. Name )
� I � ��Q ^ string Description A unique name identifying this instance of the SMTPEventConsumer. ReplyToLine
� � � � string Description Reply-To line for the email message. If NULL, no Reply-To field will be used. SMTPServer
� v ~ � string Description Local SMTP Server Subject
� � � � string Description The subject of the email message. ToLine $
� ? G T string Description The email addresses of those persons to be included on the TO: line. Addresses must be separated by commas or semicolons. � _ _ E v e n t C o n s u m e r 0͝��C� $ __EventConsumer g r � � � � & oE��������� �������������� ��� � LogFileEventConsumer Filename '
� U ] �� � �� string Not_Null IsUnicode
� � � �� boolean MaximumFileSize
� � � �� uint64 Name
� � �� string Text 2
� f n ��x �� � �� string Not_Null Template � _ _ E v e n t C o n s u m e r 1͝��C�� c __EventConsumer / v � � � ' Z n � � � � . = o � � � � 7 = o y � � � 5 J } � � � " T d � � � � P W o UU���������� ������������ �������������������������������������������� � � CommandLineEventConsumer CommandLineTemplate '
� d l �� � �� string Template CreateNewConsole
� � � �� boolean DEPRECATED CreateNewProcessGroup
� � �� boolean CreateSeparateWowVdm
� Q � �� boolean CreateSharedWowVdm
� � � �� boolean DesktopName
*
� � � �� string DEPRECATED ExecutablePath
� & � �� string FillAttribute J
� g � �� uint32 ForceOffFeedback T
� � � �� boolean ForceOnFeedback R
� � � �� boolean KillTimeout X
� / � �� uint32 Name
� g � �� string Priority "
� � � �� sint32 RunInteractively V
� � � �� boolean ShowWindowCommand N
� - � �� uint32 UseDefaultErrorMode
� t � �� boolean WindowTitle . '
� � � �� � �� string Template WorkingDirectory &
�
� �� string XCoordinate 2
� L � �� uint32 XNumCharacters B
� � � �� uint32 XSize :
� � � �� uint32 YCoordinate 6
� � �� uint32 YNumCharacters F
� H � �� uint32 YSize >
� � � �� uint32 � R O O T \ s u b s c r i p t i o n # _ _ E v e n t C o n s u m e r P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ E 1 D D 4 3 4 1 3 E D 9 F D 9 C 4 5 8 D 2 0 5 1 F 0 8 2 D 1 D 7 3 9 3 9 9 B 2 9 0 3 5 B 4 5 5 F 0 9 0 7 3 9 2 6 E 5 E D 9 8 7 0 \ K I _ C F F 4 1 3 7 0 C 7 0 E 2 6 A 1 6 9 C 5 F 7 C C 5 5 9 4 0 5 0 6 4 6 C 5 B 9 B C 0 F 0 D 1 F 0 F C 4 7 3 3 F A 2 A A 3 5 9 3 9 C \ I _ 6 7 5 C 8 C 0 2 4 3 5 D 7 4 D 2 B F 9 F B 2 F 1 A C C 8 A 4 2 7 A 0 7 2 2 7 6 A D 5 C 1 9 F 6 8 D 5 A 3 E C 5 0 6 D 1 3 F 5 D 8 o t h e ower ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ �29 NS_3F2E8022E512721B56515EF3BC51FB34E6E540D0FD898B8F849D2B28C15BFF55 KI_41C53E6DB1ACF2453CEFD41398198E613F10DFF47709ECAB1D7F037756AC8CE7 I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1077.4243257226.312 NS_3FBDCB08ECD33FBEF028D2DB3EF058F8CE959779B943F43AB3DB3EC34ACA147D CI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C IL_544CFC82C21CDF4713B5295DE1D928C00A64169D63339BF46F7D6B04314B4848.281.2513106506.266 KI_FD1C1D414B71B5082C266A650E31EF6D5019382724244B685F217C0AAE00A921 I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.292.3641209208.180 NS_42E4E0D295908E5E61369FD892A1F8D55E4601E6F286F3D44587BC7BAFF4CF40 CI_CE7B495DC4F9C5B3025BD303D59CCF3C872F4A46BF11E24BFCC42869498C54B0 IL_41CD80BFBD3EF2A72B1311F93D87AFDE77273A97897B7B012F0BFA851DE8E60A.316.3628980226.297 CR_1283D6E2E269ECFAA20DDCA78E5D8B7B8AC13879915B95F38BE4B062F89C60F6 C_366404C6BBC789A7EE3D5ACCDE9C5AB09583CC8BC05AB7F7F7498213BA102D4C KI_CE7B495DC4F9C5B3025BD303D59CCF3C872F4A46BF11E24BFCC42869498C54B0 I_41CD80BFBD3EF2A72B1311F93D87AFDE77273A97897B7B012F0BFA851DE8E60A.316.3628980226.297 NS_43C2C02FBB103B6C99DD6A3C49100E0157200FB50F8CAEF2EC314CAEF9D9E15C CD_2515B1950A64510A509CF61C80D68865E7CFF544688645F2490CFFE0E6C807F2.295.2770572094.1172 NS_511626FAE4F57DBD20DF5CD44A41DAECED28CF7B3FD8B12012C7F4B58F44E665 CI_C0C025C38981E58EE50CB7BB4E4786CBA14FD933E638861EA3A6A2E0C806211E IL_0AE842411B3B68BDB60FB4610360E1ECD2D583F7968316F79131DB25BF102F63.311.596629111.217 NS_55B7453F9A92245078FCB5133CDA2D219EDE36D5B0C242DB457F8DA87C352EDB CD_455876B64E565F4962FC035AF2C8087D1797E42AAA9586F45C5A3E20F37175C3.291.2143025691.598 NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805 CD_0685F0E7DE4E9ADE69B83CB6CC4B69291D69C22AD0E71A095A2E4AEBC8EC8B85.33.1958367369.441 CD_16275E16EEED6E74BD48AA48ACA3AF381CEAB3C980CF5112BF5B3053B0589A21.38.3136119186.311 CD_2F2626B7E6B190AABAC337367EE2C30A587328DFC7C5ED27A37779833EA30396.14.2362255453.4091 CD_403C7DAFD38411FBB7FFA51AD2D0CC5E3462A61D34EA60E279877DCCDC222D62.39.3518326436.452 CD_4D4CE956D39D51456603D4ED1BF7ABAD64E72F02B0D569299B434D13F41AD4C4.32.665098151.1664 CD_5D8A70064F693F027290F7573CE6C1A3BB6513B39CC41447AC81334C5DC5B8F9.31.3908298068.840 CD_6FFBA8B5854E9C5C5C698A9277971D04E447B67166A26CB7D9DD0D9F278C2D8B.13.1975713098.944 CD_805206C561285684F42D728C26661B4F548F5E54321B06170E013CB108084182.65.1665163772.660 CD_8A4037032A1E93595308B4A4BD6D8BFAF65C3C979F3304AFFC616809C573E05E.39.3634389385.570 CD_9E7A3EDE33ECA9119BCEA76C74DC7F82F81BD50C5633DBA89810B055F180A2DE.55.1.9780 CD_B6BF4F280E8F41D5C682A73285BD377F4F1516D4792C5D8362BF30684045009A.18.751711051.637 CD_C867B637B25E413A5893A8DF403F24B113B36FB9DA058811D901C232D15C4E60.34.835745797.730 CD_DA6435B5A6AFDE1EA49B0F1FA576B2FE264B6CCD6A9F163C86C6173386BDC535.20.1036408674.7270 CD_ED2E871CAA85DB91DA82D43856C298DADCDDAA2D7C9D06C8655F1779E6509A4E.34.1838294881.522 CI_41C53E6DB1ACF2453CEFD41398198E613F10DFF47709ECAB1D7F037756AC8CE7 IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.11.2102511209.368 IL_6952BC8C6187412BA6F7CAEE56328B9DCA8AFF615B18BF7135EB8A91F51729F6.1022.10946060.268 CR_0B714A230756027CB9D944F3C101E5485E82B469361846E74358E5EEBA5C05B7 R_272E5753DC3EECDD6057038DB6F26170E7D1CD565B954C6C4A406CB1BC2D023E __ � EnumValues � � Description The EnumValues method enumerates the named values of the given subkey. � a42c9160500003S ROOT\Default\ms_409 ���� � �i �� * � � � ��������1 � __PARAMETERS abstract hDefKey uint32
� 3 Optional parameter that specifies the tree that contains the sSubKeyName path. The default value is HKEY_LOCAL_MACHINE (0x80000002). The following trees are defined in Winreg.h:
HKEY_CLASSES_ROOT (0x80000000)
HKEY_CURRENT_USER (0x80000001)
HKEY_LOCAL_MACHINE (0x80000002)
HKEY_USERS (0x80000003)
HKEY_CURRENT_CONFIG (0x80000005)
HKEY_DYN_DATA (0x80000006)
Note that HKEY_DYN_DATA is a valid tree for Windows 95 and Windows 98 computers only. Description
� 3 Z IN )
� 3 Z V �� ID 6
� � Z V ��� uint32 sSubKeyName string
� Specifies the path that contains the named values to be enumerated. Description
� m ' IN )
� m ' � �� ID 6
� ) m ' � ��� string __ �
a42c9160500003S ROOT\Default\ms_409 ���� � ��
�� k � * J �
������������� � __PARAMETERS abstract sNames string
� 2 Contains an array of named value strings. The elements of this array correspond directly with the elements of iTypes. Description
� 2 � Y out )
� 2 � Y
�� ID 6
� � � Y
��F string Types sint32
� � Contains an array of data value types (integers). You can use these types to determine which Get method to call. For example, if the data value type is REG_SZ, you would call GetStringValue to retrieve the named value's data value. The elements of this array correspond directly with the elements of sNames. The following data value types are defined in Winnt.h:
REG_SZ (1)
REG_EXPAND_SZ (2)
REG_BINARY (3)
REG_DWORD (4)
REG_MULTI_SZ (7)
Description
� � � � out )
� � � � � �� ID 6
� Q � � � �� sint32 ReturnValue uint32
� � uint32 out
� � � �� __ � DeleteValue . . Description The DeleteValue method deletes a named value in the specified subkey. e a42c9160500003S ROOT\Default\ms_409 ���� � �
�� * � � � > � ������������� � __PARAMETERS abstract hDefKey uint32
� 3 Optional parameter that specifies the tree that contains the sSubKeyName path. The default value is HKEY_LOCAL_MACHINE (0x80000002). The following trees are defined in Winreg.h:
HKEY_CLASSES_ROOT (0x80000000)
HKEY_CURRENT_USER (0x80000001)
HKEY_LOCAL_MACHINE (0x80000002)
HKEY_USERS (0x80000003)
HKEY_CURRENT_CONFIG (0x80000005)
HKEY_DYN_DATA (0x80000006)
Note that HKEY_DYN_DATA is a valid tree for Windows 95 and Windows 98 computers only. Description
� 3 Z IN )
� 3 Z V �� ID 6
� � Z V ��� uint32 sSubKeyName string
� Specifies the key that contains the named value to be deleted. Description
� h ' IN )
� h ' � �� ID 6
� $ h ' � ��� string sValueName string
� J Specifies the named value to be deleted from the subkey. Specify an empty string to delete the default named value (the default named value is not deleted its value is set to "value not set" Description
� J 1 q in )
� J 1 q j �� ID 6
� � 1 q j ��� string __ �� a42c9160500003S ROOT\Default\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � SetDWORDValue g9 t9 Description The SetDWORDValue method sets the data value for a named value whose data type is REG_BINARY. %
a42c9160500003S ROOT\Default\ms_409 ���� � �� �� * � � � : � � U����������������5 � __PARAMETERS abstract hDefKey uint32
� 3 Optional parameter that specifies the tree that contains the sSubKeyName path. The default value is HKEY_LOCAL_MACHINE (0x80000002). The following trees are defined in Winreg.h:
HKEY_CLASSES_ROOT (0x80000000)
HKEY_CURRENT_USER (0x80000001)
HKEY_LOCAL_MACHINE (0x80000002)
HKEY_USERS (0x80000003)
HKEY_CURRENT_CONFIG (0x80000005)
HKEY_DYN_DATA (0x80000006)
Note that HKEY_DYN_DATA is a i� �� y ���� � �M�$� � =DZw� � ���� � �:5�D � �� � p Hҝ��C�I � �� �
� WsmAgent WsmAgent $ 8 � � gen � � � | � � A � � GetData # ��0 �� implemented static � ae442007200009F ROOT\Microsoft\Windows\winrm ���� � �! �� � 5 �� ��������t � __PARAMETERS abstract string
� * In
� * Q �� ID )
� � Q �� string detail string
� � In
� � �� ID )
� l ��1 string __ �� ae442007200009F ROOT\Microsoft\Windows\winrm ���� � �� �� * � � ��������F � __PARAMETERS abstract data string
� 0 Out
� 0 W �� ID )
� � W ��� string ReturnValue uint32
� uint32 out
� �� __ � SetData � ��� �� implemented static � ae442007200009F ROOT\Microsoft\Windows\winrm ���� � ��
�� � � � 5 �� ������������$ � __PARAMETERS abstract string
� * In
� * Q �� ID )
� � Q �� string detail string
� � In
� � �� ID )
� l ��1 string data string
� � In
� � � �� ID )
� � ��� string __ �� ae442007200009F ROOT\Microsoft\Windows\winrm ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � RemoveData � ��� �� implemented static � ae442007200009F ROOT\Microsoft\Windows\winrm ���� � �! �� � 5 �� ��������t � __PARAMETERS abstract string
� * In
� * Q �� ID )
� � Q �� string detail string
� � In
� � �� ID )
� l ��1 string __ �� ae442007200009F ROOT\Microsoft\Windows\winrm ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ �
E v e n t T r a c e Iҝ��C�i EventTrace 6 � �� ! 4 : b j t { a h u��������� � XWIZARD_TRACE_GUID Description XWizard Framework guid {777BA8FF-2498-4875-933A-3067DE883070} locale MS\0x409 Flags R
� � � � � k y � �
uint32 Description Enable Flags ValueDescriptions ) 8 D R ] Critical Flag Error Flag Warning Flag Info Flag Verbose Flag DefineValues � � � � � Critical Error Warning Info Verbose Values � � � � � Critical Error Warning Info Verbose ValueMap % 1 = I U 0x00000001 0x00000002 0x00000004 0x00000008 0x00000010 Level _
� � � � � � � [ c � � � � uint32 Description Levels ValueDescriptions 8 ` � � Abnormal termination/exit Severe error events (usually internal) Allocation/Resource/Stress failures User info (Registration/Wizard flow paths) Function entry/exit (Detail) DefineValues � F TRACE_LEVEL_CRITICAL TRACE_LEVEL_ERROR TRACE_LEVEL_WARNINGTRACE_LEVEL_INFORMATION TRACE_LEVEL_VERBOSE Values { � � � � Critical Error Warning Info Verbose ValueMap � � � � � 0x1 0x2 0x3 0x4 0x5 ValueType index �
E v e n t T r a c e Jҝ��C�� EventTrace 6 � �� 2 8 ` h r y q����e � TSRDPShellTrace Description TS RDP Shell Trace guid {BFA655DC-6C51-11DA-8BDE-F66BAD1E3F3A} locale MS\0x409 Flags R
� � � � � o } � � ' 1 uint32 Description Enable Flags ValueDescriptions 8 S TS_TRACE_LEVEL_NRM Flag TS_TRACE_LEVEL_ERROR Flag TS_TRACE_LEVEL_ASSERT Flag DefineValues � � � TS_TRACE_LEVEL_NRM TS_TRACE_LEVEL_ERROR TS_TRACE_LEVEL_ASSERT Values � � TS_TRACE_LEVEL_NRM TS_TRACE_LEVEL_ERROR TS_TRACE_LEVEL_ASSERT ValueMap A M Y 0x00000001 0x00000002 0x00000004 FA �
E v e n t T r a c e Kҝ��C�� EventTrace 6 � �� 0 6 ^ f p w q����c � TSRdpInitTrace Description TS Rdp Init Trace guid {C127C1A8-6CEB-11DA-8BDE-F66BAD1E3F3A} locale MS\0x409 Flags R
� � � � �
m { � � % / uint32 Description Enable Flags ValueDescriptions 6 Q TS_TRACE_LEVEL_NRM Flag TS_TRACE_LEVEL_ERROR Flag TS_TRACE_LEVEL_ASSERT Flag DefineValues � � � TS_TRACE_LEVEL_NRM TS_TRACE_LEVEL_ERROR TS_TRACE_LEVEL_ASSERT Values � � TS_TRACE_LEVEL_NRM TS_TRACE_LEVEL_ERROR TS_TRACE_LEVEL_ASSERT ValueMap ? K W 0x00000001 0x00000002 0x00000004 pt �6 4 6 5 9 A B 9 F 8 F 1 C 4 B 5 6 8 D B 6 4 3 8 B A E 1 1 B 2 6 E E 8 F 9 3 C B 5 F 8 1 9 5 E 2 1 E 8 C 3 8 3 D 6 C 4 4 C C 4 1 Lҝ��C�ȝ��C�.
� __NAMESPACE Hardware F D 1 C 1 D 4 1 4 B 7 1 B 5 0 8 2 C 2 6 6 A 6 5 0 E 3 1 E F 6 D 5 0 1 9 3 8 2 7 2 4 2 4 4 B 6 8 5 F 2 1 7 C 0 A A E 0 0 A 9 2 1 Mҝ��C�Cȝ��C�$ � __SystemSecurity 4 1 C 5 3 E 6 D B 1 A C F 2 4 5 3 C E F D 4 1 3 9 8 1 9 8 E 6 1 3 F 1 0 D F F 4 7 7 0 9 E C A B 1 D 7 F 0 3 7 7 5 6 A C 8 C E 7 Oҝ��C�ȝ��C�� � � __thisNAMESPACE � �� � � ? valid tree for Windows 95 and Windows 98 computers only. Description
� 3 Z IN )
� 3 Z V �� ID 6
� � Z V ��� uint32 sSubKeyName string
� Specifies the key that contains the named value to be set. Description
� d ' IN )
� d ' � �� ID 6
� d ' � ��� string sValueName string
� F Specifies the named value whose data value you are setting. You can specify an existing named value (update) or a new named value (create). Specify an empty string to set the data value for the default named value. Description
� F F m in )
� F F m �� ID 6
� F m ��� string uValue uint32
� $ Specifies a double word data value. Description
� $ q K in )
� $ q K � �� ID 6
� - q K � ��� uint32 __ �� a42c9160500003S ROOT\Default\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � SetQWORDValue �H �H Description The SetQWORDValue method sets the data value for a named value whose data type is REG_QWORD. )
a42c9160500003S ROOT\Default\ms_409 ���� � �� �� * � � � : � � U��������������������3 � __PARAMETERS abstract hDefKey uint32
� 3 Optional parameter that specifies the tree that contains the sSubKeyName path. The default value is HKEY_LOCAL_MACHINE (0x80000002). The following trees are defined in Winreg.h:
HKEY_CLASSES_ROOT (0x80000000)
HKEY_CURRENT_USER (0x80000001)
HKEY_LOCAL_MACHINE (0x80000002)
HKEY_USERS (0x80000003)
HKEY_CURRENT_CONFIG (0x80000005)
HKEY_DYN_DATA (0x80000006)
Note that HKEY_DYN_DATA is a valid tree for Windows 95 and Windows 98 computers only. Description
� 3 Z IN )
� 3 Z V �� ID 6
� � Z V ��� uint32 sSubKeyName string
� Specifies the key that contains the named value to be set. Description
� d ' IN )
� d ' � �� ID 6
� d ' � ��� string sValueName string
� F Specifies the named value whose data value you are setting. You can specify an existing named value (update) or a new named value (create). Specify an empty string to set the data value for the default named value. Description
� F F m in )
� F F m �� ID 6
� F m ��� string uValue uint64
� $ Specifies a quad word data value. Description
� $ o K in )
� $ o K � �� ID 6
� + o K � ��� uint64 __ �� a42c9160500003S ROOT\Default\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � GetDWORDValue �W �W Description The GetDWORDValue method returns the data value for a named value whose data type is REG_DWORD. M a42c9160500003S ROOT\Default\ms_409 ���� � ��
�� * � � � 2 U ������������� � __PARAMETERS abstract hDefKey uint32
� 3 Optional parameter that specifies the tree that contains the sSubKeyName path. The default value is HKEY_LOCAL_MACHINE (0x80000002). The following trees are defined in Winreg.h:
HKEY_CLASSES_ROOT (0x80000000)
HKEY_CURRENT_USER (0x80000001)
HKEY_LOCAL_MACHINE (0x80000002)
HKEY_USERS (0x80000003)
HKEY_CURRENT_CONFIG (0x80000005)
HKEY_DYN_DATA (0x80000006)
Note that HKEY_DYN_DATA is a valid tree for Windows 95 and Windows 98 computers only. Description
� 3 Z IN )
� 3 Z V �� ID 6
� � Z V ��� uint32 sSubKeyName string
� Specifies the path that contains the named values. Description
� \ ' IN )
� \ ' � �� ID 6
� \ ' � ��� string sValueName string
� > Specifies the named value whose data value you are retrieving. Specify an empty string to get the default named value. Description
� > � e in )
� > � e �� ID 6
� � � e ��Q string __ � a42c9160500003S ROOT\Default\ms_409 ���� � �� �� e � * ��������� � __PARAMETERS abstract uValue uint32
� 2 Contains the DWORD data value for the named value. Description
� 2 � Y out )
� 2 � Y � �� ID 6
� K � Y � �� uint32 ReturnValue uint32
� � uint32 out
� � � �� __ � GetQWORDValue �e �e Description The GetQWORDValue method returns the data value for a named value whose data type is REG_QWORD. M a42c9160500003S ROOT\Default\ms_409 ���� � ��
�� * � � � 2 U ������������� � __PARAMETERS abstract hDefKey uint32
� 3 Optional parameter that specifies the tree that contains the sSubKeyName path. The default value is HKEY_LOCAL_MACHINE (0x80000002). The following trees are defined in Winreg.h:
HKEY_CLASSES_ROOT (0x80000000)
HKEY_CURRENT_USER (0x80000001)
HKEY_LOCAL_MACHINE (0x80000002)
HKEY_USERS (0x80000003)
HKEY_CURRENT_CONFIG (0x80000005)
HKEY_DYN_DATA (0x80000006)
Note that HKEY_DYN_DATA is a valid tree for Windows 95 and Windows 98 computers only. Description
� 3 Z IN )
� 3 Z V �� ID 6
� � Z V ��� uint32 sSubKeyName string
� Specifies the path that contains the named values. Description
� \ ' IN )
� \ ' � �� ID 6
� \ ' � ��� string sValueName string
� > Specifies the named value whose data value you are retrieving. Specify an empty string to get the default named value. Description
� > � e in )
� > � e �� ID 6
� � � e ��Q string __ � a42c9160500003S ROOT\Default\ms_409 ���� � ��
�� e � * ������������� � __PARAMETERS abstract uValue uint64
� 2 Contains the DWORD data value for the named value. Description
� 2 � Y out )
� 2 � Y � �� ID 6
� K � Y � �� uint64 ReturnValue uint32
� � uint32 out
� � � �� __ � SetStringValue �s �s Description The SetStringValue method sets the data value for a named value whose data type is REG_MULTI_SZ. %
a42c9160500003S ROOT\Default\ms_409 ���� � �� �� * � � � � : � U����������������/ � __PARAMETERS abstract hDefKey uint32
� 3 Optional parameter that specifies the tree that contains the sSubKeyName path. The default value is HKEY_LOCAL_MACHINE (0x80000002). The following trees are defined in Winreg.h:
HKEY_CLASSES_ROOT (0x80000000)
HKEY_CURRENT_USER (0x80000001)
HKEY_LOCAL_MACHINE (0x80000002)
HKEY_USERS (0x80000003)
HKEY_CURRENT_CONFIG (0x80000005)
HKEY_DYN_DATA (0x80000006)
Note that HKEY_DYN_DATA is a valid tree for Windows 95 and Windows 98 computers only. Description
� 3 Z IN )
� 3 Z V �� ID 6
� � Z V ��� uint32 sSubKeyName string
� Specifies the key that contains the named value to be set. Description
� d ' IN )
� d ' � �� ID 6
� d ' � ��� string sValueName string
� F Specifies the named value whose data value you are setting. You can specify an existing named value (update) or a new named value (create). Specify an empty string to set the data value for the default named value. Description
� F F m in )
� F F m �� ID 6
� F m ��� string sValue string
� $ Specifies a string data value. Description
� $ k K in )
� $ k K � �� ID 6
� ' k K � ��� string �U�@ � �؉�3
� `� �
3ӝ��C�� ' N �� � �� � H Q ^ t a i � � k { I U ; I { � G S H \ " . � � �
�
UU������������������������������������� � MSiSCSI_TCPIPConfig WMI guid {7A2C6C2B-E5A5-49ad-AD68-133089ACD74D} wmiprov DisplayName TCP/IP configuration cpp_quote
//***************************************************************************
//
// iscsicfg.h
//
// Module: iScsi Discovery api
//
// Purpose: Header defining interface between user mode configuration
// apps and HBA driver miniport.
//
// Copyright (c) 2001 Microsoft Corporation
//
//***************************************************************************
#include <iscsidef.h>
//
//
// This class is required.
//
// TCP/IP configuration class, implement one instance for each IP address on
// your adapter. For example, if you adapter supports 3 IP addresses then
// your adapter would implement 3 instances of this class.
//
// This class uses PDO instance names with 1 instance for each TCP/IP interface.
//
Active
� � boolean AlternateDNSServer
N
� � �� � �� % 2 H U object:ISCSI_IP_Address WmiDataId DisplayName Alternate DNS Server Description Alternate DNS Server DefaultGateway
N
� � � �� � ��� � & object:ISCSI_IP_Address WmiDataId DisplayName Default Gateway Description Static Default Gateway IP address EnableDHCP N
� � � �� � ��� � � � � boolean WmiDataId displayName DHCP Enabled description TRUE if the adapter should use DHCP to discovery its IP address information. InstanceName
� s � �� string IpAddress
N
� � � �� � ��� , object:ISCSI_IP_Address WmiDataId DisplayName IP Address description IP address of the adapter IPVersions P
� � � ��� � � � $ uint32 WmiDataId description IP Versions supported **Add #defines** BitValues IPV4 IPV6 BitMap 0 < 0x00000001 0x00000002 PreferredDNSServer
N
� � � �� � ��� � � � object:ISCSI_IP_Address WmiDataId DisplayName Preferred DNS Server Description Preferred DNS Server SubnetMask
N
� � � �� � ��� � � � � object:ISCSI_IP_Address WmiDataId DisplayName Subnet Mask Description Static Subnet Mask UseDHCPForDNS
N
� T
� �� � ��]
h
u
�
�
boolean WmiDataId displayName Use DHCP for DNS description TRUE if the adapter should use DHCP to discover DNS addresses. UseLinkLocalAddress N
� E � �� � ��N Y f ~ � boolean WmiDataId DisplayName Use Link Local Address description TRUE if the adapter should use an autogenerated and non routable (link local) address as its IP address. � 4ӝ��C�l N �� � ��F S � k t ( P ^ � � T _ p | . < � � U��������������������������� � MSiSCSI_NICConfig WMI guid {C75258E9-BE79-4a48-A23D-EEB6F8FB940C} DisplayName NIC Port Configuration wmiprov cpp_quote //
// This class is optional.
//
// NIC Port configuration class, implement one instance for each physical
// network interface port on your adapter.
//
// This class uses PDO instance names with 1 instance for each physical
// network interface port on your adapter.
//
typedef enum
{
ISCSI_NIC_LINKSTATE_DISCONNECTED = 0,
ISCSI_NIC_LINKSTATE_CONNECTED = 1
} ISCSI_NIC_LINKSTATE, *PISCSI_NIC_LINKSTATE;
Active
� G boolean InstanceName
� � � �� string LinkSpeed C
� � � ��� � % uint32 WmiDataId DisplayName Link Speed Description Speed of network link in megabits per second. LinkState ]
� � � ��� � � � # T ^ uint32 WmiDataId DisplayName Link State description Link State **typedef** Values / C Media Disconnected Media Connected ValueMap j m 0 1 MacAddress P
� � � ��� � � ) uint8 WmiDataId DisplayName MAC Address description Ethernet MAC Address MAX MaxFrameSize C
� � � ��� � � � � uint32 WmiDataId DisplayName Max Frame Size description Maximum frame size MaxLinkSpeed
C
� = � ��E P ] m z uint32 WmiDataId DisplayName Max Link Speed Description Maximum Speed of network link in megabits per second. � :ӝ��C��
N �� � �� � ( 5 X ^ � � � � � � K Z � � @ N � � Y l + E UU��������������������������� � MSiSCSI_HBASessionConfig WMI wmiprov DisplayName HBA Session Default Configuration guid {B35694DE-D323-49d2-ABB2-8139209AD150} cpp_quote //
//
// This class is optional.
//
// This class allows the default session configuration to be managed. It
// contains the default values to use when establishing a session.
//
// This class must be registered using PDO instance names with a single instance
//
Active
� � boolean FirstBurstLength A
� , 4 � �� � ��? L uint32 WmiDataId Description maximum amount in bytes of unsolicited data an iSCSI initiator may send to the target, during the execution of a single SCSI command. This covers the immediate data (if any) and the sequence of unsolicited Data-Out PDUs (if any) that follow the command. ImmediateData A
� � � � �� � ��� � boolean WmiDataId Description The initiator and target negotiate support for immediate data. To turn immediate data off, the initiator or target must state its desire to do so. ImmediateData can be turned on if both the initiator and target have ImmediateData=Yes. InitialR2T A
� � �� � ��& 3 boolean WmiDataId Description The InitialR2T key is used to turn off the default use of R2T, thus allowing an initiator to start sending data to a target as if it has received an initial R2T with Buffer Offset=0 and Desired Data Transfer Length=min (FirstBurstSize, Expected Data Transfer Length). InstanceName
� x � �� string MaxBurstLength A
� � � � �� � ��� � uint32 WmiDataId Description Maximum SCSI data payload in bytes in an Data-In or a solicited Data-Out iSCSI sequence. MaxOutstandingR2T A
� � � � �� � ��� � uint32 WmiDataId Description Initiator and target negotiate the maximum number of outstanding R2Ts per task, excluding any implied initial R2T that might be part of that task. An R2T is considered outstanding until the last data PDU (with the F bit set to 1) is transferred, or a sequence reception timeout (section 6.12.1) is encountered for that data sequence. MaxRecvDataSegmentLength
A
� � � � �� � ��� � uint32 WmiDataId Description Maximum data segment length in bytes they can receive in an iSCSI PDU. lt � F 'ҝ��C�� ) � �� �
l v m����6 � BcdStore BcdProv Description This class represents a BCD store which holds a collection of BCD objects. FilePath 4
� � � �� � ��� � string Description A BcdStore is uniquely identified by its file path. The system store is denoted via an empty file path. xD pr s a : � � s a 0 � h jec ~ � �
�
9 � q ~ � h g z � � * rip 9 h l W niq k � � � s f � � �! V# sto h# �# ?% D( emp P( l( !* $- 2- N- �/ �2 �2 �2 �4 '6 36 O6 Y: \= i= �= �A C � OpenStore % ��2 �� implemented static � ae442007200009F ROOT\wmi ���� � �f �� * � ����� � __PARAMETERS abstract File string
� 0 in
� 0 W �� ID )
� � W ��� string __ �� ae442007200009F ROOT\wmi ���� � �� �� � ( * � ������R � __PARAMETERS abstract
Store object
� 1 out
� 1 X �� ID
)
� � X ��� object:BcdStore ReturnValue boolean
� boolean out
� # �� __ � ImportStore ��( �� implemented static � ae442007200009F ROOT\wmi ���� � �f �� * � ����� � __PARAMETERS abstract File string
� 0 in
� 0 W �� ID )
� � W ��� string __ �y ae442007200009F ROOT\wmi ���� � �( �� * m ��� � __PARAMETERS abstract ReturnValue boolean
� _ boolean out
� _ h �� __ � ImportStoreWithFlags � ��� �� implemented static � ae442007200009F ROOT\wmi ���� � �~ �� * � � � ��������; � __PARAMETERS abstract File string
� 0 in
� 0 W �� ID )
� � W ��� string Flags uint32
� � in
� � �� > 0 BitMap )
� � ��A 6 � Clean BitValues 6
� � ��A 6 � � ID C
� 3 ��A 6 � � � uint32 __ �y ae442007200009F ROOT\wmi ���� � �( �� * m ��� � __PARAMETERS abstract ReturnValue boolean
� _ boolean out
� _ h �� __ � ExportStore $ ��1 �� implemented static � ae442007200009F ROOT\wmi ���� � �f �� * � ����� � __PARAMETERS abstract File string
� 0 in
� 0 W �� ID )
� � W ��� string __ �y ae442007200009F ROOT\wmi ���� � �( �� * m ��� � __PARAMETERS abstract ReturnValue boolean
� _ boolean out
� _ h �� __ � CreateStore � ��� �� implemented static � ae442007200009F ROOT\wmi ���� � �f �� * � ����� � __PARAMETERS abstract File string
� 0 in
� 0 W �� ID )
� � W ��� string __ �� ae442007200009F ROOT\wmi ���� � �� �� � ( * � ������R � __PARAMETERS abstract
Store object
� 1 out
� 1 X �� ID
)
� � X ��� object:BcdStore ReturnValue boolean
� boolean out
� # �� __ � DeleteSystemStore � ��� �� implemented static y ae442007200009F ROOT\wmi ���� � �( �� * m ��� � __PARAMETERS abstract ReturnValue boolean
� _ boolean out
� _ h �� __ � GetSystemDisk S ��` �� implemented static � ae442007200009F ROOT\wmi ���� � �� �� * � � ������H � __PARAMETERS abstract Disk string
� 0 out
� 0 W �� ID )
� � W ��� string ReturnValue boolean
� boolean out
� �� __ � GetSystemPartition � ��� �� implemented static � ae442007200009F ROOT\wmi ���� � �� �� * � � # ������M � __PARAMETERS abstract Partition string
� 5 out
� 5 \ �� ID )
� � \ ��� string ReturnValue boolean
� boolean out
� �� __ � SetSystemStoreDevice � ��� �� implemented static � ae442007200009F ROOT\wmi ���� � �� �� * � ����� � __PARAMETERS abstract Partition string
� 5 in
� 5 \ �� ID )
� � \ ��� string __ �y ae442007200009F ROOT\wmi ���� � �( �� * m ��� � __PARAMETERS abstract ReturnValue boolean
� _ boolean out
� _ h �� __ � EnumerateObjects w# �� implemented � ae442007200009F ROOT\wmi ���� � �f �� * � ����� � __PARAMETERS abstract Type uint32
� 0 in
� 0 W �� ID )
� � W ��� uint32 __ � ae442007200009F ROOT\wmi ���� � �� �� * � � + ������U � __PARAMETERS abstract
Objects object
� 3 out
� 3 Z �� ID
)
� � Z ��� object:BcdObject ReturnValue boolean
� boolean out
� & �� __ � OpenObject _( �� implemented � ae442007200009F ROOT\wmi ���� � �` �� * � ����� � __PARAMETERS abstract Id string
� . in
� . U �� ID )
� � U ��� string __ �� ae442007200009F ROOT\wmi ���� � �� �� * � � * ������T � __PARAMETERS abstract
Object object
� 2 out
� 2 Y �� ID
)
� � Y ��� object:BcdObject ReturnValue boolean
� boolean out
� % �� __ � CreateObject A- �� implemented v ae442007200009F ROOT\wmi ���� � �% �� * � � 7 ��������v � __PARAMETERS abstract Id string
� . in
� . U �� ID )
� � U ��� string Type uint32
� � in
� � �� ID )
� n ��3 uint32 __ �� ae442007200009F ROOT\wmi ���� � �� �� * � � * ������T � __PARAMETERS abstract
Object object
� 2 out
� 2 Y �� ID
)
� � Y ��� object:BcdObject ReturnValue boolean
� boolean out
� % �� __ � DeleteObject �2 �� implemented � ae442007200009F ROOT\wmi ���� � �` �� * � ����� � __PARAMETERS abstract Id string
� . in
� . U �� ID )
� � U ��� string __ �y ae442007200009F ROOT\wmi ���� � �( �� * m ��� � __PARAMETERS abstract ReturnValue boolean
� _ boolean out
� _ h �� __ � CopyObject B6 �� implemented ae442007200009F ROOT\wmi ���� � ��
�� � � � H * � ������������! � __PARAMETERS abstract SourceStoreFile string
� ; in
� ; b �� ID )
� � b ��� string SourceId string
� � in
� � �� ID )
� ��D string Flags uint32
� � in
� � � �� 0 1 BitMap )
� � � �� � R _ CreateNewId DeleteExistingObject BitValues 6
� � � �� � u F ID C
� � �� � u F � uint32 __ �� ae442007200009F ROOT\wmi ���� � �� �� * � � * ������T � __PARAMETERS abstract
Object object
� 2 out
� 2 Y �� ID
)
� � Y ��� object:BcdObject ReturnValue boolean
� boolean out
� % �� __ �� a42c9160500003S ROOT\Default\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � GetStringValue �� � Description The GetStringValue method returns the data value for a named value whose data type is REG_SZ. M a42c9160500003S ROOT\Default\ms_409 ���� � ��
�� * � � � 2 V ������������� � __PARAMETERS abstract hDefKey uint32
� 3 Optional parameter that specifies the tree that contains the sSubKeyName path. The default value is HKEY_LOCAL_MACHINE (0x80000002). The following trees are defined in Winreg.h:
HKEY_CLASSES_ROOT (0x80000000)
HKEY_CURRENT_USER (0x80000001)
HKEY_LOCAL_MACHINE (0x80000002)
HKEY_USERS (0x80000003)
HKEY_CURRENT_CONFIG (0x80000005)
HKEY_DYN_DATA (0x80000006)
Note that HKEY_DYN_DATA is a valid tree for Windows 95 and Windows 98 computers only. Description
� 3 Z IN )
� 3 Z V �� ID 6
� � Z V ��� uint32 sSubKeyName string
� Specifies the path that contains the named values. Description
� \ ' IN )
� \ ' � �� ID 6
� \ ' � ��� string sValueName string
� > Specifies the named value whose data value you are retrieving. Specify an empty string to get the default named value. Description
� > � e in )
� > � e �� ID 6
� � � e ��R string __ � a42c9160500003S ROOT\Default\ms_409 ���� � �� �� f � * ��������� � __PARAMETERS abstract sValue string
� 2 Contains the string data value for the named value. Description
� 2 � Y out )
� 2 � Y � �� ID 6
� L � Y � �� string ReturnValue uint32
� � uint32 out
� � � �� __ � SetMultiStringValue � � Description The SetMultiStringValue method sets the data value for a named value whose data type is REG_MULTI_SZ. The SetMultiStringValue method returns a uint32 which is 0 if successful or some other value if any other error occurred. %
a42c9160500003S ROOT\Default\ms_409 ���� � �� �� * � � � � : � U����������������; � __PARAMETERS abstract hDefKey uint32
� 3 Optional parameter that specifies the tree that contains the sSubKeyName path. The default value is HKEY_LOCAL_MACHINE (0x80000002). The following trees are defined in Winreg.h:
HKEY_CLASSES_ROOT (0x80000000)
HKEY_CURRENT_USER (0x80000001)
HKEY_LOCAL_MACHINE (0x80000002)
HKEY_USERS (0x80000003)
HKEY_CURRENT_CONFIG (0x80000005)
HKEY_DYN_DATA (0x80000006)
Note that HKEY_DYN_DATA is a valid tree for Windows 95 and Windows 98 computers only. Description
� 3 Z IN )
� 3 Z V �� ID 6
� � Z V ��� uint32 sSubKeyName string
� Specifies the key that contains the named value to be set. Description
� d ' IN )
� d ' � �� ID 6
� d ' � ��� string sValueName string
� F Specifies the named value whose data value you are setting. You can specify an existing named value (update) or a new named value (create). Specify an empty string to set the data value for the default named value. Description
� F F m in )
� F F m �� ID 6
� F m ��� string sValue string
� $ Specifies an array of string data values. Description
� $ w K in )
� $ w K � �� ID 6
� 3 w K � ��� string __ � CopyObjects x= �� implemented � ae442007200009F ROOT\wmi ���� � ��
�� � � * � � D ������������ � __PARAMETERS abstract SourceStoreFile string
� ; in
� ; b �� ID )
� � b ��� string Type uint32
� � in
� � �� ID )
� { ��@ uint32 Flags uint32
� � in
� � � �� � 0 1 BitMap )
� � � �� � N [ CreateNewId DeleteExistingObject BitValues 6
� � � �� � q B ID C
� � �� � q B � uint32 __ �y ae442007200009F ROOT\wmi ���� � �( �� * m ��� � __PARAMETERS abstract ReturnValue boolean
� _ boolean out
� _ h �� __ �6EF205D46DBC51F13F62EC987E8BBEAC C_0ED8829CD55CB10045BE12FF28DC63BFD30CC65BF9376DAA6A5D15ADE3CAC700 C_4BD0F8A6C8D9EC0678D50228DC3CB44B9F26CFF9B291F8B882B0AD7C252B23A9 CR_E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 C_4890EFF41348A2D3FA104A85C8075E20E025F7CF40D004E2BC1C3C9AA54865F4 C_9AB53806E88665C047824D5369B271C53B233BBEAC7C15BE3BA9BD214E527500 C_A57480D0D82DDE51E01CC9C7625981822E2D1C37B70F78DC6E6179505A7BD928 C_A9FE98FE5C3E9051AEEC71D48BD2011F883E1553AA2DD7968A20C510AD60108F KI_0899307408A32040A6DA19C0B1EC2745A3D604BAA9DFFE8EE4B75C3D91E16109 I_AF40BBBDE0B04254A7DB7168AD8BD4619F792348A29FDE87570C9FC2F908731C.290.2972593478.282 KI_41C53E6DB1ACF2453CEFD41398198E613F10DFF47709ECAB1D7F037756AC8CE7 I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.292.623439295.368 KI_7010B213179D98B16AF38723EE1D750E86F808F341EE215AD8783D29EA117262 IR_2A8E85BB31065B3FC60BA81CED6A654079AE6D371D42FEE2259112FC3A521E06 R_097B2F9E0FE36EC7F3877350AB1E8E8E0879DBC3C32560F4916D3C7C564BDDF7.290.4176353141.514 IR_8B1547E29C4669664E5C74CF6C63C0DCB167707EDB55532CBAA32AF8A1CDDE88 R_5F3BD5E67807B789407C7E70FEA47B190EAF980A9E799D25A963DF46E602BBB8.291.1596782231.520 IR_DDB91418F3D637554FACB27F0581F4445917CEB1CCA74DD48A7FCFC0D9F39BBE R_4594D6C30924C4ED031F78EE8103A8C70830325B9BD2B6144E91FDA4F064B1F6.284.48204367.520 R_472E59D95C6C98C94622E4AD82DADA0687549064441307EEB295733E6DD86F4B.293.1162310107.514 R_48394ACFDBF2997914E68DA01913B5FBD80163B4632D972FB942C9D9BEF7EC87.290.32388456.516 I_2A8E85BB31065B3FC60BA81CED6A654079AE6D371D42FEE2259112FC3A521E06.290.14689292.330 I_8B1547E29C4669664E5C74CF6C63C0DCB167707EDB55532CBAA32AF8A1CDDE88.291.2039962604.373 I_DDB91418F3D637554FACB27F0581F4445917CEB1CCA74DD48A7FCFC0D9F39BBE.280.1491985856.392 KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD I_544CFC82C21CDF4713B5295DE1D928C00A64169D63339BF46F7D6B04314B4848.285.1062186952.242 KI_D890AC6A929040B86C73ED707F71F3BF5A8D5C24B862ABCFD812E1937C8FB0BB I_544CFC82C21CDF4713B5295DE1D928C00A64169D63339BF46F7D6B04314B4848.293.1942593529.356 KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C I_544CFC82C21CDF4713B5295DE1D928C00A64169D63339BF46F7D6B04314B4848.281.2513106506.266 I_B4BE796E49BD940EF3233AA1E20E02F74C49D58803EFB7DC7A8BF19657D6854C.291.3504180652.274 C_BC1364958E3C7F9CA5ABA0C9A15549E0C0B0F96B96EE058473CACD93E1EABD27 C_F048CF2C454CB8BAA99C1A4118013AD0A4526AC70F8F00D9BC60DB068406C882 C_CAEED6243C47285827AC6434674ED523459EB8C970204592D2B83B0408FC431D C_F875ABEA98E67A9A740EFA2E6386D639CE399E917B70AA67FC167FBE9663EAA3 C_DD19013C5DC1E320E81019FC349982C55E1E96FA47B8CD4B261815CDCB293CAE C_ECB038604F9CFB5C266539C1297002E6A1178A983B1B38CAC375931349F1C5AD C_E168D377E3EBDC80567E91D3F17E5FB581443E43A2B4D4956F85A552763C3781 KI_64659AB9F8F1C4B568DB6438BAE11B26EE8F93CB5F8195E21E8C383D6C44CC41 I_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.292.3272755293.188 C_D971E3FAAA635236F384E1888F166DA3C30F1188DF8FB5F90FFC090DE0EF87E7 C_E8CE06DB509B0590994561E0942576B49C1468E2ADAE12E9135A0B28175DA679 CR_E8CE06DB509B0590994561E0942576B49C1468E2ADAE12E9135A0B28175DA679 C_46C4D7624EF726AE82EECFECC7D2FAFCB46460D191B35F158A7EEAE469E508E2 C_9D13D81A0232A3B9A054E304F017E99ED70EE31D77185E5048D602C8F68F1D2C C_BF1E5E829A1544FF8B694A6E8073DFF9D1CD4B2724FDB9291959D5493401980F CR_BF1E5E829A1544FF8B694A6E8073DFF9D1CD4B2724FDB9291959D5493401980F C_B16263CC6C59AA3DEF58BA0C86C651F601D7D8872D7821EC2597A2AFC1F04035 C_B7BCFF3BD4E96F7233C3DB7B6D678F32D754777FD131B4A0A3799E101E4F57D0 C_37D6265F83F0B4A807334DDDEAC8A1C96BFA3B726A45400FF628A9564B8A2E7A CR_E6555E0E3A2A0EB36147D0BA2B88FF99C450AC95610E6A4CA8EA619881318FDC C_ACE6286BD25F0AA2207D2355DA74065D91E7CE838C5E66A6FF0F8AF0C177656D C_3DC91A797E626AC72558CF32A344BB47D2E2EC35EEBC7E9ECDD67B034B53206A I_092A55272DD5776D1F8B56BC2DC2767240A3BAAE69BF8801B96D23CE4A45B158.1155.3354343551.308 I_84DAE394D72EEC44948504C5752A6FB488C2F34AF0DDE614A4D6BA8E4EF41579.1155.2311941045.242 IR_092A55272DD5776D1F8B56BC2DC2767240A3BAAE69BF8801B96D23CE4A45B158 R_E307BE2388F4DD08F0918C82D97E15C14EE0D97137D0C6FB34A30F84A30D07C8.1155.3053163294.516 I_84DAE394D72EEC44948504C5752A6FB488C2F34AF0DDE614A4D6BA8E4EF41579.1155.2217469049.266 00 la �5 7 E 5 F 3 A D D 9 E 2 4 2 C 4 E 9 F 9 E D F 7 9 A A 9 7 F 7 9 E 7 9 1 1 C 5 A 8 B 9 0 2 E C 1 5 0 D 6 4 4 2 E 3 B 8 5 A 5 A A $ҝ��C�ȝ��C�� ���9 B � __Win32Provider {f8a56d3e-e304-4a9f-a916-5187019d7759} BcdProv miDataId Description Domain Name StringTermination Counted format w ExtError C
� g o z � � � � �� uint32 WmiDataId Description Extended Error Code format x klininfo C
�
" ; C � �� uint32 WmiDataId Description Extended Error klininfo format x Status C
� � � � � � � � �� uint32 WmiDataId Description Status format x Target P
� 8 @ K X ` s | � � �� string WmiDataId Description Target StringTermination Counted format w UserName P
� � � - 6 > � �� string WmiDataId Description User Name StringTermination Counted format w � M S K e r b T r a c e ҝ��C�' MSKerbTrace
C � �� ( R X � � � � � � KerbAcceptSecurityContext Description Kerberos Accept Security Context Handler Guid {94acefe3-9e56-49e3-9895-7240a231c371} DisplayName KerbAcceptSecurityContext locale MS\0x409 � rr (ҝ��C�
) � �� � ! � � 1 @ � � �������������� � BcdObject BcdProv Description This class represents a BCD object which holds a collection of BCD elements. Each BCD object is is identified by a guid. Id 4
� � � �� � ��� � string Description This is the guid id of this object, unique to this store. StoreFilePath 4
� � � �� � ��� � string Description This is the file path of the store that this object belongs to. Type )
� � �� * uint32 Description The upper 4 bits (28-31) represent the object type. The meaning of the lower 28 bits (0-27) is dependent on the object type. Wo n is 3 7 $ obj 7 S W ` tor l � C J _ { R Y � k � � n ��� � � {# �$ Des % 8% }. �/ fi 0 ,0 �< > tha 2> N> �E G to G 4G �O :Q ) LQ hQ �S gU yU �U X �Y 2 �Y �Y :\ �] r 4 �] �] n` �a nt b b �d !f mea 4f Pf �h Pj bit _j {j 6l �m � EnumerateElementTypes & �� implemented � ae442007200009F ROOT\wmi ���� � �� �� � * � ������I � __PARAMETERS abstract Types uint32
� 1 out
� 1 X �� ID )
� � X ��� uint32 ReturnValue boolean
� boolean out
� �� __ � EnumerateElements F �� implemented ae442007200009F ROOT\wmi ���� � �� �� * � � - ������W � __PARAMETERS abstract
Elements object
� 4 out
� 4 [ �� ID
)
� � [ ��� object:BcdElement ReturnValue boolean
� boolean out
� ( �� __ � GetElement { �� implemented � ae442007200009F ROOT\wmi ���� � �f �� * � ����� � __PARAMETERS abstract Type uint32
� 0 in
� 0 W �� ID )
� � W ��� uint32 __ � ae442007200009F ROOT\wmi ���� � �� �� * � � , ������V � __PARAMETERS abstract
Element object
� 3 out
� 3 Z �� ID
)
� � Z ��� object:BcdElement ReturnValue boolean
� boolean out
� ' �� __ � GetElementWithFlags n �� implemented � ae442007200009F ROOT\wmi ���� � �� �� � � * � ��������? � __PARAMETERS abstract Type uint32
� 0 in
� 0 W �� ID )
� � W ��� uint32 Flags uint32
� � in
� � �� > 0 BitMap )
� � ��A 6 � Qualified BitValues 6
� � ��A 6 � � ID C
� 7 ��A 6 � � � uint32 __ � ae442007200009F ROOT\wmi ���� � �� �� * � � , ������V � __PARAMETERS abstract
Element object
� 3 out
� 3 Z �� ID
)
� � Z ��� object:BcdElement ReturnValue boolean
� boolean out
� ' �� __ � SetDeviceElement z �� implemented f ae442007200009F ROOT\wmi ���� � �
�� � ) � R * � ������������h � __PARAMETERS abstract Type uint32
� 0 in
� 0 W �� ID )
� � W ��� uint32 DeviceType uint32
� � in
� �
�� S V Y \ _ 1 2 3 4 5 ValueMap )
� �
��b ; � � � � � BootDevice PartitionDevice FileDevice RamdiskDevice UnknownDevice Values 6
� �
��b ; � ID C
� �
��b ; � N uint32 AdditionalOptions string
� � in
� � � �� ID )
� ` � ��% string __ �y ae442007200009F ROOT\wmi ���� � �( �� * m ��� � __PARAMETERS abstract ReturnValue boolean
� _ boolean out
� _ h �� __ � SetPartitionDeviceElement � �� implemented � ae442007200009F ROOT\wmi ���� � �� �� � ) � R z � * � U���������������� � __PARAMETERS abstract Type uint32
� 0 in
� 0 W �� ID )
� � W ��� uint32 DeviceType uint32
� � in
� �
�� S V Y \ _ 1 2 3 4 5 ValueMap )
� �
��b ; � � � � � BootDevice PartitionDevice FileDevice RamdiskDevice UnknownDevice Values 6
� �
��b ; � ID C
� �
��b ; � N uint32 AdditionalOptions string
� � in
� � � �� ID )
� ` � ��% string Path string
� � in
� � � �� ID )
� � ��� string __ �y ae442007200009F ROOT\wmi ���� � �( �� * m ��� � __PARAMETERS abstract ReturnValue boolean
� _ boolean out
� _ h �� __ � SetPartitionDeviceElementWithFlags +% �� implemented A ae442007200009F ROOT\wmi ���� � �� �� � ) � R * F z � * � U���������������������� � __PARAMETERS abstract Type uint32
� 0 in
� 0 W �� ID )
� � W ��� uint32 DeviceType uint32
� � in
� �
�� S V Y \ _ 1 2 3 4 5 ValueMap )
� �
��b ; � � � � � BootDevice PartitionDevice FileDevice RamdiskDevice UnknownDevice Values 6
� �
��b ; � ID C
� �
��b ; � N uint32 AdditionalOptions string
� � in
� � � �� ID )
� ` � ��% string Path string
� � in
� � � �� ID )
� � ��� string Flags uint32
� 1 in
� 1 X �� � 6 BitMap )
� 1 X ��� � � DisableVhdDeviceDetection BitValues 6
� 1 X ��� � � � ID C
� � X ��� � � � B uint32 __ �y ae442007200009F ROOT\wmi ���� � �( �� * m ��� � __PARAMETERS abstract ReturnValue boolean
� _ boolean out
� _ h �� __ � SetFileDeviceElement 0 �� implemented a ae442007200009F ROOT\wmi ���� � � �� � ) � R � X * � � z � * � U����������������������������M � __PARAMETERS abstract Type uint32
� 0 in
� 0 W �� ID )
� � W ��� uint32 DeviceType uint32
� � in
� �
�� S V Y \ _ 1 2 3 4 5 ValueMap )
� �
��b ; � � � � � BootDevice PartitionDevice FileDevice RamdiskDevice UnknownDevice Values 6
� �
��b ; � ID C
� �
��b ; � N uint32 AdditionalOptions string
� � in
� � � �� ID )
� ` � ��% string Path string
� � in
� � � �� ID )
� � ��� string ParentDeviceType uint32
� < in
� < c �� ID )
� � c ��� uint32 ParentAdditionalOptions string
� � in
� � & �� ID )
� � & ��T string ParentPath string
� � in
� � � �� ID )
� E � ��
string __ �� a42c9160500003S ROOT\Default\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � GetMultiStringValue �� �� Description The GetMultiStringValue method returns the data value for a named value whose data type is REG_MULTI_SZ. The GetMultiStringValue method returns a uint32 which is 0 if successful or some other value if any other error occurred. M a42c9160500003S ROOT\Default\ms_409 ���� � ��
�� * � � � 2 V ������������� � __PARAMETERS abstract hDefKey uint32
� 3 Optional parameter that specifies the tree that contains the sSubKeyName path. The default value is HKEY_LOCAL_MACHINE (0x80000002). The following trees are defined in Winreg.h:
HKEY_CLASSES_ROOT (0x80000000)
HKEY_CURRENT_USER (0x80000001)
HKEY_LOCAL_MACHINE (0x80000002)
HKEY_USERS (0x80000003)
HKEY_CURRENT_CONFIG (0x80000005)
HKEY_DYN_DATA (0x80000006)
Note that HKEY_DYN_DATA is a valid tree for Windows 95 and Windows 98 computers only. Description
� 3 Z IN )
� 3 Z V �� ID 6
� � Z V ��� uint32 sSubKeyName string
� Specifies the path that contains the named values. Description
� \ ' IN )
� \ ' � �� ID 6
� \ ' � ��� string sValueName string
� > Specifies the named value whose data value you are retrieving. Specify an empty string to get the default named value. Description
� > � e in )
� > � e �� ID 6
� � � e ��R string __ � a42c9160500003S ROOT\Default\ms_409 ���� � �� �� o � * ��������� � __PARAMETERS abstract sValue string
� 2 Contains an array of string data values for the named value. Description
� 2 � Y out )
� 2 � Y � �� ID 6
� U � Y � ��
string ReturnValue uint32
� � uint32 out
� � � �� __ � SetExpandedStringValue .� ;� Description The SetExpandedStringValue method sets the data value for a named value whose data type is REG_EXPAND_SZ. The SetExpandedStringValue method returns a uint32 which is 0 if successful or some other value if any other error occurred. %
a42c9160500003S ROOT\Default\ms_409 ���� � �� �� * � � � n : � U����������������� � __PARAMETERS abstract hDefKey uint32
� 3 Optional parameter that specifies the tree that contains the sSubKeyName path. The default value is HKEY_LOCAL_MACHINE (0x80000002). The following trees are defined in Winreg.h:
HKEY_CLASSES_ROOT (0x80000000)
HKEY_CURRENT_USER (0x80000001)
HKEY_LOCAL_MACHINE (0x80000002)
HKEY_USERS (0x80000003)
HKEY_CURRENT_CONFIG (0x80000005)
HKEY_DYN_DATA (0x80000006)
Note that HKEY_DYN_DATA is a valid tree for Windows 95 and Windows 98 computers only. Description
� 3 Z IN )
� 3 Z V �� ID 6
� � Z V ��� uint32 sSubKeyName string
� Specifies the key that contains the named value to be set. Description
� d ' IN )
� d ' � �� ID 6
� d ' � ��� string sValueName string
� F Specifies the named value whose data value you are setting. You can specify an existing named value (update) or a new named value (create). Specify an empty string to set the data value for the default named value. Description
� F F m in )
� F F m �� ID 6
� F m ��� string sValue string
� $ Specifies an expanded string data value. The environment variable specified in the string must exist for the string to be expanded when you call GetExpandedStringValue. Description
� $ � K in )
� $ � K / �� ID 6
� � � K / ��j string __ �y ae442007200009F ROOT\wmi ���� � �( �� * m ��� � __PARAMETERS abstract ReturnValue boolean
� _ boolean out
� _ h �� __ � SetQualifiedPartitionDeviceElement A> �� implemented 4 ae442007200009F ROOT\wmi ���� � �� �� c � � � � * � U����������������� � __PARAMETERS abstract Type uint32
� 0 in
� 0 W �� ID )
� � W ��� uint32 PartitionStyle uint32
� � in
� � �� K N 0 1 ValueMap )
� � ��Q ? � � MBR GPT Values 6
� � ��Q ? � � ID C
� I ��Q ? � � � uint32 DiskSignature string
� r in
� r � �� ID )
� � ��� string PartitionIdentifier string
� 1 in
� 1 X �� ID )
� � X ��� string __ �y ae442007200009F ROOT\wmi ���� � �( �� * m ��� � __PARAMETERS abstract ReturnValue boolean
� _ boolean out
� _ h �� __ � SetVhdDeviceElement 'G �� implemented � ae442007200009F ROOT\wmi ���� � �4 �� � & F � � � n � 9 * � U�������������������������e � __PARAMETERS abstract Type uint32
� 0 in
� 0 W �� ID )
� � W ��� uint32 Path string
� � in
� � �� ID )
� p ��5 string ParentDeviceType uint32
� � in
� � � �� ID )
� , � ��� uint32 ParentAdditionalOptions string
� _ in
� _ � �� ID )
� � � ��� string ParentPath string
� in
� < �� ID )
� � < ��j string CustomLocate uint32
� � in
� � � �� ID )
� ] � ��" uint32 __ �y ae442007200009F ROOT\wmi ���� � �( �� * m ��� � __PARAMETERS abstract ReturnValue boolean
� _ boolean out
� _ h �� __ � SetStringElement [Q �� implemented ~ ae442007200009F ROOT\wmi ���� � �- �� � ; * � ��������z � __PARAMETERS abstract Type uint32
� 0 in
� 0 W �� ID )
� � W ��� uint32 String string
� � in
� � �� ID )
� r ��7 string __ �y ae442007200009F ROOT\wmi ���� � �( �� * m ��� � __PARAMETERS abstract ReturnValue boolean
� _ boolean out
� _ h �� __ � SetObjectElement �U �� implemented v ae442007200009F ROOT\wmi ���� � �% �� � 7 * � ��������v � __PARAMETERS abstract Type uint32
� 0 in
� 0 W �� ID )
� � W ��� uint32 Id string
� � in
� � �� ID )
� n ��3 string __ �y ae442007200009F ROOT\wmi ���� � �( �� * m ��� � __PARAMETERS abstract ReturnValue boolean
� _ boolean out
� _ h �� __ � SetObjectListElement �Y �� implemented x ae442007200009F ROOT\wmi ���� � �' �� � 8 * � ��������w � __PARAMETERS abstract Type uint32
� 0 in
� 0 W �� ID )
� � W ��� uint32 Ids string
� � in
� � �� ID )
� o ��4 string __ �y ae442007200009F ROOT\wmi ���� � �( �� * m ��� � __PARAMETERS abstract ReturnValue boolean
� _ boolean out
� _ h �� __ � SetIntegerElement �] �� implemented � ae442007200009F ROOT\wmi ���� � �3
�� � < * � ������������{ � __PARAMETERS abstract Type uint32
� 0 in
� 0 W �� ID )
� � W ��� uint32 Integer uint64
� � in
� �
�� ID )
� s
��8 uint64 __ �y ae442007200009F ROOT\wmi ���� � �( �� * m ��� � __PARAMETERS abstract ReturnValue boolean
� _ boolean out
� _ h �� __ � SetIntegerListElement b �� implemented � ae442007200009F ROOT\wmi ���� � �1 �� � = * � ��������| � __PARAMETERS abstract Type uint32
� 0 in
� 0 W �� ID )
� � W ��� uint32 Integers uint64
� � in
� � �� ID )
� t ��9 uint64 __ �y ae442007200009F ROOT\wmi ���� � �( �� * m ��� � __PARAMETERS abstract ReturnValue boolean
� _ boolean out
� _ h �� __ � SetBooleanElement Cf �� implemented ae442007200009F ROOT\wmi ���� � �. �� � = * � ������} � __PARAMETERS abstract Type uint32
� 0 in
� 0 W �� ID )
� � W ��� uint32 Boolean boolean
� � in
� � �� ID )
� t ��9 boolean __ �y ae442007200009F ROOT\wmi ���� � �( �� * m ��� � __PARAMETERS abstract ReturnValue boolean
� _ boolean out
� _ h �� __ � DeleteElement nj �� implemented � ae442007200009F ROOT\wmi ���� � �f �� * � ����� � __PARAMETERS abstract Type uint32
� 0 in
� 0 W �� ID )
� � W ��� uint32 __ �y ae442007200009F ROOT\wmi ���� � �( �� * m ��� � __PARAMETERS abstract ReturnValue boolean
� _ boolean out
� _ h �� __ � __ �� a42c9160500003S ROOT\Default\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � GetExpandedStringValue �� � Description The GetExpandedStringValue method returns the data value for a named value whose data type is REG_EXPAND_SZ. M a42c9160500003S ROOT\Default\ms_409 ���� � ��
�� * � � � 2 V ������������� � __PARAMETERS abstract hDefKey uint32
� 3 Optional parameter that specifies the tree that contains the sSubKeyName path. The default value is HKEY_LOCAL_MACHINE (0x80000002). The following trees are defined in Winreg.h:
HKEY_CLASSES_ROOT (0x80000000)
HKEY_CURRENT_USER (0x80000001)
HKEY_LOCAL_MACHINE (0x80000002)
HKEY_USERS (0x80000003)
HKEY_CURRENT_CONFIG (0x80000005)
HKEY_DYN_DATA (0x80000006)
Note that HKEY_DYN_DATA is a valid tree for Windows 95 and Windows 98 computers only. Description
� 3 Z IN )
� 3 Z V �� ID 6
� � Z V ��� uint32 sSubKeyName string
� Specifies the path that contains the named values. Description
� \ ' IN )
� \ ' � �� ID 6
� \ ' � ��� string sValueName string
� > Specifies the named value whose data value you are retrieving. Specify an empty string to get the default named value. Description
� > � e in )
� > � e �� ID 6
� � � e ��R string __ �� a42c9160500003S ROOT\Default\ms_409 ���� � �p �� �
* k ��������4 � __PARAMETERS abstract sValue string
� 2 Contains the expanded string data value for the named value. The string is only expanded if the environment variable (for example, %Path%) is defined. Description
� 2 � Y out )
� 2 � Y + �� ID 6
� � � Y + ��g string ReturnValue uint32
� � uint32 out
� � �� __ � SetBinaryValue �� �� Description The SetBinaryValue method sets the data value for a named value whose data type is REG_BINARY. The SetBinaryValue method returns a uint32 which is 0 if successful or some other value if any other error occurred. $
a42c9160500003S ROOT\Default\ms_409 ���� � �� �� * � � � : � � U����������������9 � __PARAMETERS abstract hDefKey uint32
� 3 Optional parameter that specifies the tree that contains the sSubKeyName path. The default value is HKEY_LOCAL_MACHINE (0x80000002). The following trees are defined in Winreg.h:
HKEY_CLASSES_ROOT (0x80000000)
HKEY_CURRENT_USER (0x80000001)
HKEY_LOCAL_MACHINE (0x80000002)
HKEY_USERS (0x80000003)
HKEY_CURRENT_CONFIG (0x80000005)
HKEY_DYN_DATA (0x80000006)
Note that HKEY_DYN_DATA is a valid tree for Windows 95 and Windows 98 computers only. Description
� 3 Z IN )
� 3 Z V �� ID 6
� � Z V ��� uint32 sSubKeyName string
� Specifies the key that contains the named value to be set. Description
� d ' IN )
� d ' � �� ID 6
� d ' � ��� string sValueName string
� F Specifies the named value whose data value you are setting. You can specify an existing named value (update) or a new named value (create). Specify an empty string to set the data value for the default named value. Description
� F F m in )
� F F m �� ID 6
� F m ��� string uValue uint8
� $ Specifies an array of binary data values. Description
� $ v J in )
� $ v J � �� ID 6
� 2 v J � ��� uint8 __ �� a42c9160500003S ROOT\Default\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � GetBinaryValue j� w� Description The GetBinaryValue method returns the data value for a named value whose data type is REG_BINARY. The GetBinaryValue method returns a uint32 which is 0 if successful or some other value if any other error occurred. M a42c9160500003S ROOT\Default\ms_409 ���� � ��
�� * � � � 2 V ������������� � __PARAMETERS abstract hDefKey uint32
� 3 Optional parameter that specifies the tree that contains the sSubKeyName path. The default value is HKEY_LOCAL_MACHINE (0x80000002). The following trees are defined in Winreg.h:
HKEY_CLASSES_ROOT (0x80000000)
HKEY_CURRENT_USER (0x80000001)
HKEY_LOCAL_MACHINE (0x80000002)
HKEY_USERS (0x80000003)
HKEY_CURRENT_CONFIG (0x80000005)
HKEY_DYN_DATA (0x80000006)
Note that HKEY_DYN_DATA is a valid tree for Windows 95 and Windows 98 computers only. Description
� 3 Z IN )
� 3 Z V �� ID 6
� � Z V ��� uint32 sSubKeyName string
� Specifies the path that contains the named values. Description
� \ ' IN )
� \ ' � �� ID 6
� \ ' � ��� string sValueName string
� > Specifies the named value whose data value you are retrieving. Specify an empty string to get the default named value. Description
� > � e in )
� > � e �� ID 6
� � � e ��R string __ �� a42c9160500003S ROOT\Default\ms_409 ���� � �� �� S � * � ��������� � __PARAMETERS abstract uValue uint8
� 2 Contains an array of binary bytes. Description
� 2 } X out )
� 2 } X � �� ID 6
� : } X � ��� uint8 ReturnValue uint32
� � uint32 out
� � � �� __ � CheckAccess �� �� Description The CheckAccess method verifies that the user possesses the specified permissions. The method returns a uint32 which is 0 if successful or some other value if any other error occurred. ' a42c9160500003S ROOT\Default\ms_409 ���� � ��
�� * � � � � ������������ � __PARAMETERS abstract hDefKey uint32
� 3 Optional parameter that specifies the tree that contains the sSubKeyName path. The default value is HKEY_LOCAL_MACHINE (0x80000002). The following trees are defined in Winreg.h:
HKEY_CLASSES_ROOT (0x80000000)
HKEY_CURRENT_USER (0x80000001)
HKEY_LOCAL_MACHINE (0x80000002)
HKEY_USERS (0x80000003)
HKEY_CURRENT_CONFIG (0x80000005)
HKEY_DYN_DATA (0x80000006)
Note that HKEY_DYN_DATA is a valid tree for Windows 95 and Windows 98 computers only. Description
� 3 Z IN )
� 3 Z V �� ID 6
� � Z V ��� uint32 sSubKeyName string
� Contains the key to be verified. Description
� J ' IN )
� J ' � �� ID 6
� J ' � ��� string uRequired uint32
� + Optional parameter that specifies the access permissions to be verified. You can add these values together to verify more than one access permission. The default value is 3. The following access permission values are defined in Winnt.h:
KEY_QUERY_VALUE (0X0001)
KEY_SET_VALUE (0X0002)
KEY_CREATE_SUB_KEY (0X0004)
KEY_ENUMERATE_SUB_KEYS (0X0008)
KEY_NOTIFY (0X0010)
KEY_CREATE_LINK (0X0020)
DELETE (0x00010000)
READ_CONTROL (0x00020000)
WRITE_DAC (0X00040000)
WRITE_OWNER (0X00080000) Description
� + B R in )
� + B R { �� ID 6
� � B R { ��� uint32 __ �� a42c9160500003S ROOT\Default\ms_409 ���� � �$ �� * E � � ������ � __PARAMETERS abstract bGranted boolean
� 4 This parameter is True if user possesses the specified access permissions. Otherwise, the parameter is False. Description
� 4 � \ out )
� 4 � \ �� ID 6
� � � \ ��A boolean ReturnValue uint32
� � uint32 out
� � � �� __ � SetSecurityDescriptor @� M� Description The SetSecurityDescriptor method updates the specified key's security descriptor with the supplied __SecurityDescriptor. The method returns a uint32 which is 0 if successful or some other value if any other error occurred. c a42c9160500003S ROOT\Default\ms_409 ���� � �
�� � � * x _ ������������ � __PARAMETERS abstract hDefKey uint32
� 3 Parameter that specifies the tree that contains the sSubKeyName path. The default value is HKEY_LOCAL_MACHINE (0x80000002). The following trees are defined in Winreg.h:
HKEY_CLASSES_ROOT (0x80000000)
HKEY_CURRENT_USER (0x80000001)
HKEY_LOCAL_MACHINE (0x80000002)
HKEY_USERS (0x80000003)
HKEY_CURRENT_CONFIG (0x80000005)
Description
� 3 � Z IN )
� 3 � Z � �� ID 6
� ^ � Z � �� uint32 sSubKeyName string
� � Contains the key name to set the security descriptor on. Description
� � � � IN )
� � � � �� ID 6
� � � � ��[ string
Descriptor object
� � Contains the security descriptor to set on the key name. Description
� � + � IN
)
� � + � d �� ID
6
� � + � d ��� object:__SecurityDescriptor __ �� a42c9160500003S ROOT\Default\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � GetSecurityDescriptor B O Description The GetSecurityDescriptor method returns the specified key's security descriptor in a __SecurityDescriptor. The method returns a uint32 which is 0 if successful or some other value if any other error occurred. � a42c9160500003S ROOT\Default\ms_409 ���� � �s �� * x ` ��������� � __PARAMETERS abstract hDefKey uint32
� 3 Parameter that specifies the tree that contains the sSubKeyName path. The default value is HKEY_LOCAL_MACHINE (0x80000002). The following trees are defined in Winreg.h:
HKEY_CLASSES_ROOT (0x80000000)
HKEY_CURRENT_USER (0x80000001)
HKEY_LOCAL_MACHINE (0x80000002)
HKEY_USERS (0x80000003)
HKEY_CURRENT_CONFIG (0x80000005)
Description
� 3 � Z IN )
� 3 � Z � �� ID 6
� ^ � Z � �� uint32 sSubKeyName string
� � Contains the key name to get the security descriptor for. Description
� � � � IN )
� � � � ! �� ID 6
� � � � ! ��\ string __ �6 a42c9160500003S ROOT\Default\ms_409 ���� � �� �� * ~ � ��������� � __PARAMETERS abstract
Descriptor object
� 6 Returns the security descriptor from the key name. Description
� 6 � ] OUT
)
� 6 � ] � �� ID
6
� O � ] � �� object:__SecurityDescriptor ReturnValue uint32
� � uint32 out
� � � �� __ �HKEY_CURRENT_USER (0x80000001)
HKEY_LOCAL_MACHINE (0x80000002)
HKEY_USERS (0x80000003)
HKEY_CURRENT_CONFIG (0x80000005)
HKEY_DYN_DATA (0x80000006)
Note that HKEY_DYN_DATA is a valid tree for Windows 95 and Windows 98 computers only. Description
� 3 Z IN )
� 3 Z V �� ID 6
� � Z V ��� uint32 sSubKeyName string
� Specifies the key that contains the named value to be deleted. Description
� h ' IN )
� h ' � �� ID 6
� $ h ' � ��� string sValueName string
� J Specifies the named value to be deleted from the subkey. Specify an empty string to delete the default named value (the default named value is not deleted its value is set to "value not set" Description
� J 1 q in )
� J 1 q j �� ID 6
� � 1 q j ��� string __ �� ae442007200009F ROOT\Default\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � SetDWORDValue g9 t9 Description The SetDWORDValue method sets the data value for a named value whose data type is REG_BINARY. %
ae442007200009F ROOT\Default\ms_409 ���� � �� �� * � � � : � � U����������������5 � __PARAMETERS abstract hDefKey uint32
� 3 Optional parameter that specifies the tree that contains the sSubKeyName path. The default value is HKEY_LOCAL_MACHINE (0x80000002). The following trees are defined in Winreg.h:
HKEY_CLASSES_ROOT (0x80000000)
HKEY_CURRENT_USER (0x80000001)
HKEY_LOCAL_MACHINE (0x80000002)
HKEY_USERS (0x80000003)
HKEY_CURRENT_CONFIG (0x80000005)
HKEY_DYN_DATA (0x80000006)
Note that HKEY_DYN_DA , C I M _ L o g i c a l E l e m e n t �tR|�C�� J CIM_LogicalElement ) � ��� � � � � � � ~ � � � � � M Z i z � � �
�
Q [ i x �
�
� � y � R ^ % * 6 � � � � � � ' 6 � � UUUUU��������������������������������������������������������������������X � Win32_ShadowCopy Description The Win32_ShadowCopy class is a storage extent that represents a duplicate copy of the original volume at some previous time. AMENDMENT LOCALE ClientAccessible . +
� � % 2 boolean DisplayName Client Accessible Description The ClientAccessible property is indicates whether the shadow copy was created by the Windows Previous Versions component. Count +
� � �
uint32 DisplayName Count Description The Count property is the number of shadow copies in the shadow copy set to which this shadow copy belongs. DeviceObject +
� � � � � � string DisplayName Device Object Description The DeviceObject property is the Windows object manager name of the underlying storage device that supports the original volume. Differential : +
� � � � � � boolean DisplayName Differential Description The Differential property indicates whether the shadow copy was created by a differential shadow copy provider. The provider can be implemented in hardware or software. ExposedLocally B +
� � � � boolean DisplayName Exposed Locally Description The ExposedLocally property indicates whether the shadow copy is exposed on the local machine with a drive letter or mount point. If this flag and the ExposedRemotely flag is not set, the shadow copy is hidden. ExposedName +
� 7 ? L Z g string DisplayName Exposed Name Description The ExposedName property is the file system name of the shadow copy when it is exposed. This property might contain a drive letter or mount point. This property is NULL when the shadow copy is hidden or otherwise not exposed. ExposedPath $ +
� � � � � � string DisplayName Exposed Path Description The ExposedPath property is the file system path of the shadow copy when it is exposed. This property is NULL when the shadow copy is hidden or otherwise unexposed. ExposedRemotely @ +
� � � � � � boolean DisplayName Exposed Remotely Description The ExposedRemotely property indicates whether the shadow copy is exposed on a remote machine with a network share. If this flag and the ExposedLocally flag is not set, the shadow copy is hidden. HardwareAssisted 8 +
� �
!
.
boolean DisplayName Hardware Assisted Description The HardwareAssisted property indicates whether the shadow copy was created by a hardware shadow copy provider. ID 6
� �
�
�
� ��
string DisplayName ID Description The ID property uniquely identifies the shadow copy on the system. Imported > +
� � � � � � boolean DisplayName Imported Description The Imported property indicates whether the shadow copy was imported onto this machine using the Import method rather than created using the ShadowCopy create method. NoAutoRelease
0 +
� � � � � � boolean DisplayName No Auto Release Description The NoAutoRelease property indicates whether the shadow copy is automatically deleted when the shadow copy requestor process ends. If this property is TRUE, the shadow copy is retained after the requestor process ends. NotSurfaced 6 +
� , 9 boolean DisplayName Not Surfaced Description The shadow copy is not currently in the device namespace of the local machine. NoWriters 2 +
� � � � � � boolean DisplayName No Writers Description The NoWriters property indicates whether the shadow copy was created with the involvement of shadow copy writer components. OriginatingMachine +
� � � � � � string DisplayName Originating Machine Description The OriginatingMachine property identifies the machine hosting the original volume. Persistent , +
� � � � � � boolean DisplayName Persistent Description The Persistent property indicates whether the shadow copy is persistent across reboots. Plex < +
� ^ g t z � boolean DisplayName Plex Description The Plex property indicates whether the shadow copy was created by a split mirror shadow copy provider. The provider can be implemented in hardware or software. ProviderID +
� o w � � � string DisplayName Provider ID Description The ProviderID uniquely identifies the shadow provider that created the shadow. ServiceMachine +
� 8 @ M ^ k string DisplayName Service Machine Description The ServiceMachine property identifies the machine currently servicing the shadow copy. SetID +
� ( 5 string DisplayName Shadow Set ID Description The SetID uniquely identifies the shadow copy set to which the shadow belongs. State
( 8
� � � � � � > F uint32 DisplayName State Description The State property describes the current state of the shadow copy Values
~ � � � � � � � � Unknown Preparing ProcessingPrepare Prepared ProcessingPrecommit Precommitted ProcessingCommit Committed ProcessingPostcommit Created Aborted Deleted Count Transportable 4 +
� o x � � � boolean DisplayName Transportable Description The Transportable property indicates whether the shadow copy can be surfaced on another machine. If this property is FALSE and the volumes are surfaced locally, it may not be possible to surface them later on a different machine. VolumeName +
� � � � � � string DisplayName VolumeName Description The VolumeName property identifies the original volume for which the shadow copy was taken. 2 6
!
� r � � Create & 3 g o Description Creates a shadow copy using the specified context. Values � � � � � 2 H Z � � � ' Success Access denied Invalid argument Specified volume not found Specified volume not supported Unsupported shadow copy context Insufficient storage Volume is in use Maximum number of shadow copies reached Another shadow copy operation is already in progress Shadow copy provider vetoed the operation Shadow copy provider not registered Shadow copy provider failure Unknown error � a42c9160500003S ROOT\CIMV2\ms_409 ���� � �� �� * � ��������N � __PARAMETERS abstract Volume string
� 2 in
� 2 Y �� This parameter is the volume that is used for the shadow copy. This volume is sometimes referred to as the 'original' volume. This parameter can be specified as a volume drive letter, mount point or volume GUID name. Description )
� 2 Y ��b � ID 6
� � Y ��b � � string Context string
� in
� 8 �� This parameter is the context that the provider will use when creating the shadow. Description )
� 8 ��� [ ���C�� ) / ��: B � StdRegProv Description The StdRegProv class contains methods that interact with the system registry. You can use these methods to:
Verify the access permissions for a user
Create, enumerate, and delete registry keys
Create, enumerate, and delete named values
Read, write, and delete data values AMENDMENT LOCALE � h / � Des � � f rov o � � ~ ds � � �# �- e s �- H. �7 39 an B9 �9 �F kH
V zH �H "V �W iss �W 5X �a �e te, �e f ho rs e r �s t )� �� en �� ;� �� �� ame �� �� ͞ Q� , a f� h� �� Ѯ � � � �� �� ?� �� \� l� _� �� � � � ^� @� M� %� N� � � � J � � � � �� CreateKey ) Description The CreateKey method creates a subkey in the specified tree. � a42c9160500003S ROOT\cimv2\ms_409 ���� � �i �� * � � � ��������� � __PARAMETERS abstract hDefKey uint32
� 3 Optional parameter that specifies the tree that contains the sSubKeyName path. The default value is HKEY_LOCAL_MACHINE (0x80000002). The following trees are defined in Winreg.h:
HKEY_CLASSES_ROOT (0x80000000)
HKEY_CURRENT_USER (0x80000001)
HKEY_LOCAL_MACHINE (0x80000002)
HKEY_USERS (0x80000003)
HKEY_CURRENT_CONFIG (0x80000005)
HKEY_DYN_DATA (0x80000006)
Note that HKEY_DYN_DATA is a valid tree for Windows 95 and Windows 98 computers only. Description
� 3 Z IN )
� 3 Z V �� ID 6
� � Z V ��� uint32 sSubKeyName string
� Contains the key to be created. The CreateKey method creates all subkeys specified in the path that do not exist. For example, if MyKey and MySubKey do not exist in the following path, CreateKey creates both keys:
HKEY_LOCAL_MACHINE\SOFTWARE\MyKey\MySubKey Description
� + ' IN )
� + ' d �� ID 6
� � + ' d ��� string __ �� a42c9160500003S ROOT\cimv2\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � DeleteKey � � Description The DeleteKey method deletes a subkey in the specified tree. � a42c9160500003S ROOT\cimv2\ms_409 ���� � �i �� * � � � ��������
� __PARAMETERS abstract hDefKey uint32
� 3 Optional parameter that specifies the tree that contains the sSubKeyName path. The default value is HKEY_LOCAL_MACHINE (0x80000002). The following trees are defined in Winreg.h:
HKEY_CLASSES_ROOT (0x80000000)
HKEY_CURRENT_USER (0x80000001)
HKEY_LOCAL_MACHINE (0x80000002)
HKEY_USERS (0x80000003)
HKEY_CURRENT_CONFIG (0x80000005)
HKEY_DYN_DATA (0x80000006)
Note that HKEY_DYN_DATA is a valid tree for Windows 95 and Windows 98 computers only. Description
� 3 Z IN )
� 3 Z V �� ID 6
� � Z V ��� uint32 sSubKeyName string
� Contains the key to be deleted. Description
� I ' IN )
� I ' � �� ID 6
� I ' � ��� string __ �� a42c9160500003S ROOT\cimv2\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � EnumKey � � Description The EnumKey method enumerates the subkeys for the given path. � a42c9160500003S ROOT\cimv2\ms_409 ���� � �i �� * � � � ��������, � __PARAMETERS abstract hDefKey uint32
� 3 Optional parameter that specifies the tree that contains the sSubKeyName path. The default value is HKEY_LOCAL_MACHINE (0x80000002). The following trees are defined in Winreg.h:
HKEY_CLASSES_ROOT (0x80000000)
HKEY_CURRENT_USER (0x80000001)
HKEY_LOCAL_MACHINE (0x80000002)
HKEY_USERS (0x80000003)
HKEY_CURRENT_CONFIG (0x80000005)
HKEY_DYN_DATA (0x80000006)
Note that HKEY_DYN_DATA is a valid tree for Windows 95 and Windows 98 computers only. Description
� 3 Z IN )
� 3 Z V �� ID 6
� � Z V ��� uint32 sSubKeyName string
� Specifies the path that contains the subkeys to be enumerated. Description
� h ' IN )
� h ' � �� ID 6
� $ h ' � ��� string __ �� a42c9160500003S ROOT\cimv2\ms_409 ���� � �� �� W � * � ��������� � __PARAMETERS abstract sNames string
� 2 Contains an array of subkey strings. Description
� 2 � Y out )
� 2 � Y � �� ID 6
� = � Y � ��� string ReturnValue uint32
� � uint32 out
� � � �� __ � EnumValues � � Description The EnumValues method enumerates the named values of the given subkey. � a42c9160500003S ROOT\cimv2\ms_409 ���� � �i �� * � � � ��������1 � __PARAMETERS abstract hDefKey uint32
� 3 Optional parameter that specifies the tree that contains the sSubKeyName path. The default value is HKEY_LOCAL_MACHINE (0x80000002). The following trees are defined in Winreg.h:
HKEY_CLASSES_ROOT (0x80000000)
HKEY_CURRENT_USER (0x80000001)
HKEY_LOCAL_MACHINE (0x80000002)
HKEY_USERS (0x80000003)
HKEY_CURRENT_CONFIG (0x80000005)
HKEY_DYN_DATA (0x80000006)
Note that HKEY_DYN_DATA is a valid tree for Windows 95 and Windows 98 computers only. Description
� 3 Z IN )
� 3 Z V �� ID 6
� � Z V ��� uint32 sSubKeyName string
� Specifies the path that contains the named values to be enumerated. Description
� m ' IN )
� m ' � �� ID 6
� ) m ' � ��� string __ �
a42c9160500003S ROOT\cimv2\ms_409 ���� � ��
�� k � * J �
������������� � __PARAMETERS abstract sNames string
� 2 Contains an array of named value strings. The elements of this array correspond directly with the elements of iTypes. Description
� 2 � Y out )
� 2 � Y
�� ID 6
� � � Y
��F string Types sint32
� � Contains an array of data value types (integers). You can use these types to determine which Get method to call. For example, if the data value type is REG_SZ, you would call GetStringValue to retrieve the named value's data value. The elements of this array correspond directly with the elements of sNames. The following data value types are defined in Winnt.h:
REG_SZ (1)
REG_EXPAND_SZ (2)
REG_BINARY (3)
REG_DWORD (4)
REG_MULTI_SZ (7)
Description
� � � � out )
� � � � � �� ID 6
� Q � � � �� sint32 ReturnValue uint32
� � uint32 out
� � � �� __ � DeleteValue �- . Description The DeleteValue method deletes a named value in the specified subkey. c a42c9160500003S ROOT\cimv2\ms_409 ���� � �
�� * � � � > � ������������� � __PARAMETERS abstract hDefKey uint32
� 3 Optional parameter that specifies the tree that contains the sSubKeyName path. The default value is HKEY_LOCAL_MACHINE (0x80000002). The following trees are defined in Winreg.h:
HKEY_CLASSES_ROOT (0x80000000)
HKEY_CURRENT_USER (0x80000001)
HKEY_LOCAL_MACHINE (0x80000002)
HKEY_USERS (0x80000003)
HKEY_CURRENT_CONFIG (0x80000005)
HKEY_DYN_DATA (0x80000006)
Note that HKEY_DYN_DATA is a valid tree for Windows 95 and Windows 98 computers only. Description
� 3 Z IN )
� 3 Z V �� ID 6
� � Z V ��� uint32 sSubKeyName string
� Specifies the key that contains the named value to be deleted. Description
� h ' IN )
� h ' � �� ID 6
� $ h ' � ��� string sValueName string
� J Specifies the named value to be deleted from the subkey. Specify an empty string to delete the default named value (the default named value is not deleted its value is set to "value not set" Description
� J 1 q in )
� J 1 q j �� ID 6
� � 1 q j ��� string __ �� a42c9160500003S ROOT\cimv2\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � SetDWORDValue S9 `9 Description The SetDWORDValue method sets the data value for a named value whose data type is REG_BINARY. #
a42c9160500003S ROOT\cimv2\ms_409 ���� � �� �� * � � � : � � U����������������5 � __PARAMETERS abstract hDefKey uint32
� 3 Optional parameter that specifies the tree that contains the sSubKeyName path. The default value is HKEY_LOCAL_MACHINE (0x80000002). The following trees are defined in Winreg.h:
HKEY_CLASSES_ROOT (0x80000000)
HKEY_CURRENT_USER (0x80000001)
HKEY_LOCAL_MACHINE (0x80000002)
HKEY_USERS (0x80000003)
HKEY_CURRENT_CONFIG (0x80000005)
HKEY_DYN_DATA (0x80000006)
Note that HKEY_DYN_DATA is a valid tree for Windows 95 and Windows 98 computers only. Description
� 3 Z IN )
� 3 Z V �� ID 6
� � Z V ��� uint32 sSubKeyName string
� Specifies the key that contains the named value to be set. Description
� d ' IN )
� d ' � �� ID 6
� d ' � ��� string sValueName string
� F Specifies the named value whose data value you are setting. You can specify an existing named value (update) or a new named value (create). Specify an empty string to set the data value for the default named value. Description
� F F m in )
� F F m �� ID 6
� F m ��� string uValue uint32
� $ Specifies a double word data value. Description
� $ q K in )
� $ q K � �� ID 6
� - q K � ��� uint32 __ �� a42c9160500003S ROOT\cimv2\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � SetQWORDValue �H �H Description The SetQWORDValue method sets the data value for a named value whose data type is REG_QWORD. '
a42c9160500003S ROOT\cimv2\ms_409 ���� � �� �� * � � � : � � U��������������������3 � __PARAMETERS abstract hDefKey uint32
� 3 Optional parameter that specifies the tree that contains the sSubKeyName path. The default value is HKEY_LOCAL_MACHINE (0x80000002). The following trees are defined in Winreg.h:
HKEY_CLASSES_ROOT (0x80000000)
HKEY_CURRENT_USER (0x80000001)
HKEY_LOCAL_MACHINE (0x80000002)
HKEY_USERS (0x80000003)
HKEY_CURRENT_CONFIG (0x80000005)
HKEY_DYN_DATA (0x80000006)
Note that HKEY_DYN_DATA is a valid tree for Windows 95 and Windows 98 computers only. Description
� 3 Z IN )
� 3 Z V �� ID 6
� � Z V ��� uint32 sSubKeyName string
� Specifies the key that contains the named value to be set. Description
� d ' IN )
� d ' � �� ID 6
� d ' � ��� string sValueName string
� F Specifies the named value whose data value you are setting. You can specify an existing named value (update) or a new named value (create). Specify an empty string to set the data value for the default named value. Description
� F F m in )
� F F m �� ID 6
� F m ��� string uValue uint64
� $ Specifies a quad word data value. Description
� $ o K in )
� $ o K � �� ID 6
� + o K � ��� uint64 __ �� a42c9160500003S ROOT\cimv2\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � GetDWORDValue �W �W Description The GetDWORDValue method returns the data value for a named value whose data type is REG_DWORD. K a42c9160500003S ROOT\cimv2\ms_409 ���� � ��
�� * � � � 2 U ������������� � __PARAMETERS abstract hDefKey uint32
� 3 Optional parameter that specifies the tree that contains the sSubKeyName path. The default value is HKEY_LOCAL_MACHINE (0x80000002). The following trees are defined in Winreg.h:
HKEY_CLASSES_ROOT (0x80000000)
HKEY_CURRENT_USER (0x80000001)
HKEY_LOCAL_MACHINE (0x80000002)
HKEY_USERS (0x80000003)
HKEY_CURRENT_CONFIG (0x80000005)
HKEY_DYN_DATA (0x80000006)
Note that HKEY_DYN_DATA is a valid tree for Windows 95 and Windows 98 computers only. Description
� 3 Z IN )
� 3 Z V �� ID 6
� � Z V ��� uint32 sSubKeyName string
� Specifies the path that contains the named values. Description
� \ ' IN )
� \ ' � �� ID 6
� \ ' � ��� string sValueName string
� > Specifies the named value whose data value you are retrieving. Specify an empty string to get the default named value. Description
� > � e in )
� > � e �� ID 6
� � � e ��Q string __ � a42c9160500003S ROOT\cimv2\ms_409 ���� � �� �� e � * ��������� � __PARAMETERS abstract uValue uint32
� 2 Contains the DWORD data value for the named value. Description
� 2 � Y out )
� 2 � Y � �� ID 6
� K � Y � �� uint32 ReturnValue uint32
� � uint32 out
� � � �� __ � GetQWORDValue �e �e Description The GetQWORDValue method returns the data value for a named value whose data type is REG_QWORD. K a42c9160500003S ROOT\cimv2\ms_409 ���� � ��
�� * � � � 2 U ������������� � __PARAMETERS abstract hDefKey uint32
� 3 Optional parameter that specifies the tree that contains the sSubKeyName path. The default value is HKEY_LOCAL_MACHINE (0x80000002). The following trees are defined in Winreg.h:
HKEY_CLASSES_ROOT (0x80000000)
HKEY_CURRENT_USER (0x80000001)
HKEY_LOCAL_MACHINE (0x80000002)
HKEY_USERS (0x80000003)
HKEY_CURRENT_CONFIG (0x80000005)
HKEY_DYN_DATA (0x80000006)
Note that HKEY_DYN_DATA is a valid tree for Windows 95 and Windows 98 computers only. Description
� 3 Z IN )
� 3 Z V �� ID 6
� � Z V ��� uint32 sSubKeyName string
� Specifies the path that contains the named values. Description
� \ ' IN )
� \ ' � �� ID 6
� \ ' � ��� string sValueName string
� > Specifies the named value whose data value you are retrieving. Specify an empty string to get the default named value. Description
� > � e in )
� > � e �� ID 6
� � � e ��Q string __ � a42c9160500003S ROOT\cimv2\ms_409 ���� � ��
�� e � * ������������� � __PARAMETERS abstract uValue uint64
� 2 Contains the DWORD data value for the named value. Description
� 2 � Y out )
� 2 � Y � �� ID 6
� K � Y � �� uint64 ReturnValue uint32
� � uint32 out
� � � �� __ � SetStringValue �s �s Description The SetStringValue method sets the data value for a named value whose data type is REG_MULTI_SZ. #
a42c9160500003S ROOT\cimv2\ms_409 ���� � �� �� * � � � � : � U����������������/ � __PARAMETERS abstract hDefKey uint32
� 3 Optional parameter that specifies the tree that contains the sSubKeyName path. The default value is HKEY_LOCAL_MACHINE (0x80000002). The following trees are defined in Winreg.h:
HKEY_CLASSES_ROOT (0x80000000)
HKEY_CURRENT_USER (0x80000001)
HKEY_LOCAL_MACHINE (0x80000002)
HKEY_USERS (0x80000003)
HKEY_CURRENT_CONFIG (0x80000005)
HKEY_DYN_DATA (0x80000006)
Note that HKEY_DYN_DATA is a valid tree for Windows 95 and Windows 98 computers only. Description
� 3 Z IN )
� 3 Z V �� ID 6
� � Z V ��� uint32 sSubKeyName string
� Specifies the key that contains the named value to be set. Description
� d ' IN )
� d ' � �� ID 6
� d ' � ��� string sValueName string
� F Specifies the named value whose data value you are setting. You can specify an existing named value (update) or a new named value (create). Specify an empty string to set the data value for the default named value. Description
� F F m in )
� F F m �� ID 6
� F m ��� string sValue string
� $ Specifies a string data value. Description
� $ k K in )
� $ k K � �� ID 6
� ' k K � ��� string __ �� a42c9160500003S ROOT\cimv2\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � GetStringValue ۂ Description The GetStringValue method returns the data value for a named value whose data type is REG_SZ. K a42c9160500003S ROOT\cimv2\ms_409 ���� � ��
�� * � � � 2 V ������������� � __PARAMETERS abstract hDefKey uint32
� 3 Optional parameter that specifies the tree that contains the sSubKeyName path. The default value is HKEY_LOCAL_MACHINE (0x80000002). The following trees are defined in Winreg.h:
HKEY_CLASSES_ROOT (0x80000000)
HKEY_CURRENT_USER (0x80000001)
HKEY_LOCAL_MACHINE (0x80000002)
HKEY_USERS (0x80000003)
HKEY_CURRENT_CONFIG (0x80000005)
HKEY_DYN_DATA (0x80000006)
Note that HKEY_DYN_DATA is a valid tree for Windows 95 and Windows 98 computers only. Description
� 3 Z IN )
� 3 Z V �� ID 6
� � Z V ��� uint32 sSubKeyName string
� Specifies the path that contains the named values. Description
� \ ' IN )
� \ ' � �� ID 6
� \ ' � ��� string sValueName string
� > Specifies the named value whose data value you are retrieving. Specify an empty string to get the default named value. Description
� > � e in )
� > � e �� ID 6
� � � e ��R string __ � a42c9160500003S ROOT\cimv2\ms_409 ���� � �� �� f � * ��������� � __PARAMETERS abstract sValue string
� 2 Contains the string data value for the named value. Description
� 2 � Y out )
� 2 � Y � �� ID 6
� L � Y � �� string ReturnValue uint32
� � uint32 out
� � � �� __ � SetMultiStringValue �� Ő Description The SetMultiStringValue method sets the data value for a named value whose data type is REG_MULTI_SZ. The SetMultiStringValue method returns a uint32 which is 0 if successful or some other value if any other error occurred. #
a42c9160500003S ROOT\cimv2\ms_409 ���� � �� �� * � � � � : � U����������������; � __PARAMETERS abstract hDefKey uint32
� 3 Optional parameter that specifies the tree that contains the sSubKeyName path. The default value is HKEY_LOCAL_MACHINE (0x80000002). The following trees are defined in Winreg.h:
HKEY_CLASSES_ROOT (0x80000000)
HKEY_CURRENT_USER (0x80000001)
HKEY_LOCAL_MACHINE (0x80000002)
HKEY_USERS (0x80000003)
HKEY_CURRENT_CONFIG (0x80000005)
HKEY_DYN_DATA (0x80000006)
Note that HKEY_DYN_DATA is a valid tree for Windows 95 and Windows 98 computers only. Description
� 3 Z IN )
� 3 Z V �� ID 6
� � Z V ��� uint32 sSubKeyName string
� Specifies the key that contains the named value to be set. Description
� d ' IN )
� d ' � �� ID 6
� d ' � ��� string sValueName string
� F Specifies the named value whose data value you are setting. You can specify an existing named value (update) or a new named value (create). Specify an empty string to set the data value for the default named value. Description
� F F m in )
� F F m �� ID 6
� F m ��� string sValue string
� $ Specifies an array of string data values. Description
� $ w K in )
� $ w K � �� ID 6
� 3 w K � ��� string __ �� a42c9160500003S ROOT\cimv2\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � GetMultiStringValue w� �� Description The GetMultiStringValue method returns the data value for a named value whose data type is REG_MULTI_SZ. The GetMultiStringValue method returns a uint32 which is 0 if successful or some other value if any other error occurred. K a42c9160500003S ROOT\cimv2\ms_409 ���� � ��
�� * � � � 2 V ������������� � __PARAMETERS abstract hDefKey uint32
� 3 Optional parameter that specifies the tree that contains the sSubKeyName path. The default value is HKEY_LOCAL_MACHINE (0x80000002). The following trees are defined in Winreg.h:
HKEY_CLASSES_ROOT (0x80000000)
HKEY_CURRENT_USER (0x80000001)
HKEY_LOCAL_MACHINE (0x80000002)
HKEY_USERS (0x80000003)
HKEY_CURRENT_CONFIG (0x80000005)
HKEY_DYN_DATA (0x80000006)
Note that HKEY_DYN_DATA is a valid tree for Windows 95 and Windows 98 computers only. Description
� 3 Z IN )
� 3 Z V �� ID 6
� � Z V ��� uint32 sSubKeyName string
� Specifies the path that contains the named values. Description
� \ ' IN )
� \ ' � �� ID 6
� \ ' � ��� string sValueName string
� > Specifies the named value whose data value you are retrieving. Specify an empty string to get the default named value. Description
� > � e in )
� > � e �� ID 6
� � � e ��R string __ � a42c9160500003S ROOT\cimv2\ms_409 ���� � �� �� o � * ��������� � __PARAMETERS abstract sValue string
� 2 Contains an array of string data values for the named value. Description
� 2 � Y out )
� 2 � Y � �� ID 6
� U � Y � ��
string ReturnValue uint32
� � uint32 out
� � � �� __ � SetExpandedStringValue �� � Description The SetExpandedStringValue method sets the data value for a named value whose data type is REG_EXPAND_SZ. The SetExpandedStringValue method returns a uint32 which is 0 if successful or some other value if any other error occurred. #
a42c9160500003S ROOT\cimv2\ms_409 ���� � �� �� * � � � n : � U����������������� � __PARAMETERS abstract hDefKey uint32
� 3 Optional parameter that specifies the tree that contains the sSubKeyName path. The default value is HKEY_LOCAL_MACHINE (0x80000002). The following trees are defined in Winreg.h:
HKEY_CLASSES_ROOT (0x80000000)
HKEY_CURRENT_USER (0x80000001)
HKEY_LOCAL_MACHINE (0x80000002)
HKEY_USERS (0x80000003)
HKEY_CURRENT_CONFIG (0x80000005)
HKEY_DYN_DATA (0x80000006)
Note that HKEY_DYN_DATA is a valid tree for Windows 95 and Windows 98 computers only. Description
� 3 Z IN )
� 3 Z V �� ID 6
� � Z V ��� uint32 sSubKeyName string
� Specifies the key that contains the named value to be set. Description
� d ' IN )
� d ' � �� ID 6
� d ' � ��� string sValueName string
� F Specifies the named value whose data value you are setting. You can specify an existing named value (update) or a new named value (create). Specify an empty string to set the data value for the default named value. Description
� F F m in )
� F F m �� ID 6
� F m ��� string sValue string
� $ Specifies an expanded string data value. The environment variable specified in the string must exist for the string to be expanded when you call GetExpandedStringValue. Description
� $ � K in )
� $ � K / �� ID 6
� � � K / ��j string __ �� a42c9160500003S ROOT\cimv2\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � GetExpandedStringValue þ о Description The GetExpandedStringValue method returns the data value for a named value whose data type is REG_EXPAND_SZ. K a42c9160500003S ROOT\cimv2\ms_409 ���� � ��
�� * � � � 2 V ������������� � __PARAMETERS abstract hDefKey uint32
� 3 Optional parameter that specifies the tree that contains the sSubKeyName path. The default value is HKEY_LOCAL_MACHINE (0x80000002). The following trees are defined in Winreg.h:
HKEY_CLASSES_ROOT (0x80000000)
HKEY_CURRENT_USER (0x80000001)
HKEY_LOCAL_MACHINE (0x80000002)
HKEY_USERS (0x80000003)
HKEY_CURRENT_CONFIG (0x80000005)
HKEY_DYN_DATA (0x80000006)
Note that HKEY_DYN_DATA is a valid tree for Windows 95 and Windows 98 computers only. Description
� 3 Z IN )
� 3 Z V �� ID 6
� � Z V ��� uint32 sSubKeyName string
� Specifies the path that contains the named values. Description
� \ ' IN )
� \ ' � �� ID 6
� \ ' � ��� string sValueName string
� > Specifies the named value whose data value you are retrieving. Specify an empty string to get the default named value. Description
� > � e in )
� > � e �� ID 6
� � � e ��R string __ �� a42c9160500003S ROOT\cimv2\ms_409 ���� � �p �� �
* k ��������4 � __PARAMETERS abstract sValue string
� 2 Contains the expanded string data value for the named value. The string is only expanded if the environment variable (for example, %Path%) is defined. Description
� 2 � Y out )
� 2 � Y + �� ID 6
� � � Y + ��g string ReturnValue uint32
� � uint32 out
� � �� __ � SetBinaryValue }� �� Description The SetBinaryValue method sets the data value for a named value whose data type is REG_BINARY. The SetBinaryValue method returns a uint32 which is 0 if successful or some other value if any other error occurred. "
a42c9160500003S ROOT\cimv2\ms_409 ���� � �� �� * � � � : � � U����������������9 � __PARAMETERS abstract hDefKey uint32
� 3 Optional parameter that specifies the tree that contains the sSubKeyName path. The default value is HKEY_LOCAL_MACHINE (0x80000002). The following trees are defined in Winreg.h:
HKEY_CLASSES_ROOT (0x80000000)
HKEY_CURRENT_USER (0x80000001)
HKEY_LOCAL_MACHINE (0x80000002)
HKEY_USERS (0x80000003)
HKEY_CURRENT_CONFIG (0x80000005)
HKEY_DYN_DATA (0x80000006)
Note that HKEY_DYN_DATA is a valid tree for Windows 95 and Windows 98 computers only. Description
� 3 Z IN )
� 3 Z V �� ID 6
� � Z V ��� uint32 sSubKeyName string
� Specifies the key that contains the named value to be set. Description
� d ' IN )
� d ' � �� ID 6
� d ' � ��� string sValueName string
� F Specifies the named value whose data value you are setting. You can specify an existing named value (update) or a new named value (create). Specify an empty string to set the data value for the default named value. Description
� F F m in )
� F F m �� ID 6
� F m ��� string uValue uint8
� $ Specifies an array of binary data values. Description
� $ v J in )
� $ v J � �� ID 6
� 2 v J � ��� uint8 __ �� a42c9160500003S ROOT\cimv2\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � GetBinaryValue *� 7� Description The GetBinaryValue method returns the data value for a named value whose data type is REG_BINARY. The GetBinaryValue method returns a uint32 which is 0 if successful or some other value if any other error occurred. K a42c9160500003S ROOT\cimv2\ms_409 ���� � ��
�� * � � � 2 V ������������� � __PARAMETERS abstract hDefKey uint32
� 3 Optional parameter that specifies the tree that contains the sSubKeyName path. The default value is HKEY_LOCAL_MACHINE (0x80000002). The following trees are defined in Winreg.h:
HKEY_CLASSES_ROOT (0x80000000)
HKEY_CURRENT_USER (0x80000001)
HKEY_LOCAL_MACHINE (0x80000002)
HKEY_USERS (0x80000003)
HKEY_CURRENT_CONFIG (0x80000005)
HKEY_DYN_DATA (0x80000006)
Note that HKEY_DYN_DATA is a valid tree for Windows 95 and Windows 98 computers only. Description
� 3 Z IN )
� 3 Z V �� ID 6
� � Z V ��� uint32 sSubKeyName string
� Specifies the path that contains the named values. Description
� \ ' IN )
� \ ' � �� ID 6
� \ ' � ��� string sValueName string
� > Specifies the named value whose data value you are retrieving. Specify an empty string to get the default named value. Description
� > � e in )
� > � e �� ID 6
� � � e ��R string __ �� a42c9160500003S ROOT\cimv2\ms_409 ���� � �� �� S � * � ��������� � __PARAMETERS abstract uValue uint8
� 2 Contains an array of binary bytes. Description
� 2 } X out )
� 2 } X � �� ID 6
� : } X � ��� uint8 ReturnValue uint32
� � uint32 out
� � � �� __ � CheckAccess ^� k� Description The CheckAccess method verifies that the user possesses the specified permissions. The method returns a uint32 which is 0 if successful or some other value if any other error occurred. % a42c9160500003S ROOT\cimv2\ms_409 ���� � ��
�� * � � � � ������������ � __PARAMETERS abstract hDefKey uint32
� 3 Optional parameter that specifies the tree that contains the sSubKeyName path. The default value is HKEY_LOCAL_MACHINE (0x80000002). The following trees are defined in Winreg.h:
HKEY_CLASSES_ROOT (0x80000000)
HKEY_CURRENT_USER (0x80000001)
HKEY_LOCAL_MACHINE (0x80000002)
HKEY_USERS (0x80000003)
HKEY_CURRENT_CONFIG (0x80000005)
HKEY_DYN_DATA (0x80000006)
Note that HKEY_DYN_DATA is a valid tree for Windows 95 and Windows 98 computers only. Description
� 3 Z IN )
� 3 Z V �� ID 6
� � Z V ��� uint32 sSubKeyName string
� Contains the key to be verified. Description
� J ' IN )
� J ' � �� ID 6
� J ' � ��� string uRequired uint32
� + Optional parameter that specifies the access permissions to be verified. You can add these values together to verify more than one access permission. The default value is 3. The following access permission values are defined in Winnt.h:
KEY_QUERY_VALUE (0X0001)
KEY_SET_VALUE (0X0002)
KEY_CREATE_SUB_KEY (0X0004)
KEY_ENUMERATE_SUB_KEYS (0X0008)
KEY_NOTIFY (0X0010)
KEY_CREATE_LINK (0X0020)
DELETE (0x00010000)
READ_CONTROL (0x00020000)
WRITE_DAC (0X00040000)
WRITE_OWNER (0X00080000) Description
� + B R in )
� + B R { �� ID 6
� � B R { ��� uint32 __ �~ a42c9160500003S ROOT\cimv2\ms_409 ���� � �$ �� * E � � ������ � __PARAMETERS abstract bGranted boolean
� 4 This parameter is True if user possesses the specified access permissions. Otherwise, the parameter is False. Description
� 4 � \ out )
� 4 � \ �� ID 6
� � � \ ��A boolean ReturnValue uint32
� � uint32 out
� � � �� __ � SetSecurityDescriptor �� � Description The SetSecurityDescriptor method updates the specified key's security descriptor with the supplied __SecurityDescriptor. The method returns a uint32 which is 0 if successful or some other value if any other error occurred. a a42c9160500003S ROOT\cimv2\ms_409 ���� � �
�� � � * x _ ������������ � __PARAMETERS abstract hDefKey uint32
� 3 Parameter that specifies the tree that contains the sSubKeyName path. The default value is HKEY_LOCAL_MACHINE (0x80000002). The following trees are defined in Winreg.h:
HKEY_CLASSES_ROOT (0x80000000)
HKEY_CURRENT_USER (0x80000001)
HKEY_LOCAL_MACHINE (0x80000002)
HKEY_USERS (0x80000003)
HKEY_CURRENT_CONFIG (0x80000005)
Description
� 3 � Z IN )
� 3 � Z � �� ID 6
� ^ � Z � �� uint32 sSubKeyName string
� � Contains the key name to set the security descriptor on. Description
� � � � IN )
� � � � �� ID 6
� � � � ��[ string
Descriptor object
� � Contains the security descriptor to set on the key name. Description
� � + � IN
)
� � + � d �� ID
6
� � + � d ��� object:__SecurityDescriptor __ �� a42c9160500003S ROOT\cimv2\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � GetSecurityDescriptor � Description The GetSecurityDescriptor method returns the specified key's security descriptor in a __SecurityDescriptor. The method returns a uint32 which is 0 if successful or some other value if any other error occurred. � a42c9160500003S ROOT\cimv2\ms_409 ���� � �s �� * x ` ��������� � __PARAMETERS abstract hDefKey uint32
� 3 Parameter that specifies the tree that contains the sSubKeyName path. The default value is HKEY_LOCAL_MACHINE (0x80000002). The following trees are defined in Winreg.h:
HKEY_CLASSES_ROOT (0x80000000)
HKEY_CURRENT_USER (0x80000001)
HKEY_LOCAL_MACHINE (0x80000002)
HKEY_USERS (0x80000003)
HKEY_CURRENT_CONFIG (0x80000005)
Description
� 3 � Z IN )
� 3 � Z � �� ID 6
� ^ � Z � �� uint32 sSubKeyName string
� � Contains the key name to get the security descriptor for. Description
� � � � IN )
� � � � ! �� ID 6
� � � � ! ��\ string __ �4 a42c9160500003S ROOT\cimv2\ms_409 ���� � �� �� * ~ � ��������� � __PARAMETERS abstract
Descriptor object
� 6 Returns the security descriptor from the key name. Description
� 6 � ] OUT
)
� 6 � ] � �� ID
6
� O � ] � �� object:__SecurityDescriptor ReturnValue uint32
� � uint32 out
� � � �� __ � __ � __ � CheckAccess 0r ��=r �� implemented static ae442007200009F ROOT\cimv2 ���� � ��
�� * � � C � � ����� 7 � __PARAMETERS abstract hDefKey uint32
� 3 IN
� 3 Z �� ID )
� � Z ��� uint32 sSubKeyName string
� � IN
� � �� ID )
� z ��? string uRequired uint32
� � in
� � � �� ID )
� / � ��� uint32 __ �� ae442007200009F ROOT\cimv2 ���� � �� �� * � � " ������L � __PARAMETERS abstract bGranted boolean
� 4 out
� 4 \ �� ID )
� � \ ��� boolean ReturnValue uint32
� uint32 out
� �� __ � SetSecurityDescriptor ' �y ���y ���y �y implemented static Privileges �y SeSecurityPrivilege ae442007200009F ROOT\cimv2 ���� � ��
�� � � * � � C ���������M � __PARAMETERS abstract hDefKey uint32
� 3 IN
� 3 Z �� ID )
� � Z ��� uint32 sSubKeyName string
� � IN
� � �� ID )
� z ��? string
Descriptor object
� � IN
� � � �� ID
)
� 0 � ��� object:__SecurityDescriptor :.z`� � � ��� X ��9 � ��u߷ \
kVY � >Y4/� ņ� ? wv�= z �J� � ]� � � 1ϝ��C�� ) ��% - 3 [ k Y����� � NTEventlogProviderConfig singleton Locale UUID {8502C57A-5FBB-11D2-AAC1-006008C78BC7} LastBootUpTime e
� � datetime Lo �5 7 E 5 F 3 A D D 9 E 2 4 2 C 4 E 9 F 9 E D F 7 9 A A 9 7 F 7 9 E 7 9 1 1 C 5 A 8 B 9 0 2 E C 1 5 0 D 6 4 4 2 E 3 B 8 5 A 5 A A 2ϝ��C�ȝ��C�� �?����M �� 9 f � __Win32Provider {FD4F53E0-65DC-11d1-AB64-00C04FD9159E} NetworkServiceHost MS_NT_EVENTLOG_PROVIDER F D 1 C 1 D 4 1 4 B 7 1 B 5 0 8 2 C 2 6 6 A 6 5 0 E 3 1 E F 6 D 5 0 1 9 3 8 2 7 2 4 2 4 4 B 6 8 5 F 2 1 7 C 0 A A E 0 0 A 9 2 1 �ѝ��C�Cȝ��C�$ � __SystemSecurity C I M _ S e t t i n g *ϝ��C�.
CIM_Setting
) % 2 > ��I Q e n ~ � � � � � � }����������������������������� � Win32_NamedJobObjectSecLimitSetting Description The Win32_NamedJobObjectSecLimitSetting class represents the security limit settings for a job object. For more information about job object security limit settings, see the Job Object Security and Access Rights topic in the Platform SDK Base Services documentation. AMENDMENT LOCALE PrivilegesToDelete
� � � � object:Win32_TokenPrivileges Description This property specifies the privileges to delete from the token, if SecurityLimitFlags is Filter Tokens. This property can be NULL if you do not want to delete any privileges. RestrictedSIDs
� � � � object:Win32_TokenGroups Description This property specifies the deny-only SIDs that will be added to the access token, if SecurityLimitFlags is Filter Tokens. This property can be NULL if you do not want to specify any deny-only SIDs. SecurityLimitFlags +
� � � � H P uint32 Description Specifies the security limitations for the job.A value of No Administrator prevents any process in the job from using a token that specifies the local administrators group.A value of Rescricted Token prevents any process in the job from using a token that was not created with the CreateRestrictedToken function.A value of Specific Token forces processes in the job to run under.A value Filter Tokens of applies a filter to the token when a process impersonates a client. Requires at least one of the following properties to be set - SidsToDisable, PrivilegesToDelete, or RestrictedSids. Values d v � � No Administrator Restricted Token Specific Token Filter Tokens SettingID @ )
� � � � � �� string Description The identifier by which the job object security limit setting instance is known.
As a Kernel object job object names are case sensitive. Because WMI keys are case insensitive, the name of the named job object must be decorated as follows: a capital letter should be preceded by a backslash. As a consequence of this convention, 'A' and 'a' are lower case and '\A' and '\a' are upper case. SIDsToDisable
� � � � object:Win32_TokenGroups Description This property specifies the SIDs to disable for access checking, if SecurityLimitFlagss is Filter Tokens.This property can be NULL if you do not want to disable any SIDs. � +ϝ��C�� ) F ��Q Y e � � U��������g � Win32_TokenGroups Description The Win32_TokenGroups abstract class contains information about the group account security identifiers (SIDs) associated with an access token. For more information about token groups and the TOKEN_GROUPS structure, see the Access Tokens topic in the Platform SDK Access Control documentation. AMENDMENT LOCALE GroupCount
� � � � uint32 Description Specifies the number of groups in the access token. Groups
� . ; object:Win32_SIDandAttributes Description Specifies an array of SIDs and attributes. on � ,ϝ��C�� ) $ n ��y � � ���������� � Win32_TokenPrivileges Description The Win32_TokenPrivileges abstract class contains information about a set of privileges for an access token. Each process or thread in the job object has an access token specifying what resources and actions are available to it. For more information, see the Access Tokens topic in the Platform SDK Access Control documentation. AMENDMENT LOCALE PrivilegeCount
� � � � uint32 Description Specifies the number of entries in the Privileges array. Privileges
� D d q object:Win32_LUIDandAttributes Description Specifies an array of LUIDs and attributes. ss � -ϝ��C�' ) % l ��w � T Y u��������� � Win32_SIDandAttributes Description This class represents a security identifier (SID) and its attributes. AMENDMENT LOCALE Attributes
� � � � uint32 Description Specifies attributes of the SID. This value contains up to 32 one-bit flags. Its meaning depends on the definition and use of the SID. SID
� � � � object:Win32_SID Description Specifies a security identifier (SID). he � .ϝ��C�b ) & � ��� � � � � ��������� � Win32_LUIDandAttributes Description The Win32_LUIDandAttributes abstract class represents a locally unique identifier (LUID) of a privilege and a set of bit flags that indicate the attributes of the privilege, such as whether the privilege is enabled. Each LUID and attributes structure defines the availability of a security privilege for the process. For more information, see LUID_AND_ATTRIBUTES. AMENDMENT LOCALE Attributes
� � � � uint32 Description Specifies attributes of the LUID. This value contains two 32-bit flags. Its meaning is dependent on the definition and use of the LUIDSpecifies attributes of the LUID. LUID
� � � � object:Win32_LUID Description Specifies a LUID value. TE � /ϝ��C� ) � ��� � � ( 1 ���������� � Win32_LUID Description The Win32_LUID abstract class represents a locally unique identifier (LUID), an identifier unique only on the local computer. Instances of the Win32_LUID class identify a process or thread so that they can be associated with security token privileges represented by instances of the Win32_LUIDandAttributes class. For more information about the role of LUIDs in security, see LUID. AMENDMENT LOCALE HighPart
� � � � uint32 Description Specifies the most significant bits of the LUID. LowPart
� ] e r uint32 Description Specifies the least significant bits of the LUID. of � _ _ E x t e n d e d S t a t u s 0ϝ��C�� __ExtendedStatus ) $ � ��� � � p � �����������������������������9 � Win32_JobObjectStatus Description The Win32_JobObjectStatus class reports error information obtained while attempting any failed operation in the Job Object provider. AMENDMENT LOCALE AdditionalDescription
� string Description The AdditionalDescription property contains additional information relating to the error. Win32ErrorCode
� � � � uint32 Description The Win32ErrorCode property contains the Win32 error code most recently encountered that caused the operation to fail. � of � TE � he � ss � on � �ecurity ch��@ � �lVh� u �� Wp � 6 4 6 5 9 A B 9 F 8 F 1 C 4 B 5 6 8 D B 6 4 3 8 B A E 1 1 B 2 6 E E 8 F 9 3 C B 5 F 8 1 9 5 E 2 1 E 8 C 3 8 3 D 6 C 4 4 C C 4 1 �ѝ��C�ȝ��C�+
� __NAMESPACE power C I M _ S e t t i n g (ϝ��C�G D CIM_Setting
) " / � �� $ r | ! � � � � � � m � 2 K � � � y � }UU�����������������������������������������������������������������P � Win32_NamedJobObjectLimitSetting Description The Win32_NamedJobObjectLimitSetting class represents the limit settings for a job object. The limit settings specify the resources available to the job in accord with how the limit setting flags are set. AMENDMENT LOCALE ActiveProcessLimit
0
� P X e uint32 Description Specifies the active process limit for the job. If you try to associate a process with a job, and this causes the active process count to exceed this limit, the process is terminated and the association fails. Ignored unless LimitFlags specifies Active Process Limit. Affinity 4
� � � � uint32 Description Specifies the processor affinity for all processes associated with the job. The affinity of each thread is set to this value, but threads are free to subsequently set their affinity, as long as it is a subset of the specified affinity mask. Processes cannot set their own affinity mask. Ignored unless LimitFlags specifies Limit Affinity. JobMemoryLimit
� M U b uint32 Description Specifies the per-job memory limit in kilobytes. It is ignored unless the LimitFlags specifies the Limit Job Memory value. LimitFlags $ +
� $ , 9 Q \ uint32 Description The LimitFlags property indicates the limits that are in effect. One or more of the following limits can be in effect:
Limit Working Set - Causes all processes associated with the job to use the same minimum and maximum working set sizes.
Limit Process Time - Establishes a user-mode execution time limit for each currently active process and for all future processes associated with the job.
Limit Job Time - Establishes a user-mode execution time limit for the job. This flag cannot be used with Limit Preserve Job Time.
Active Process Limit - Establishes a maximum number of simultaneously active processes associated with the job.
Limit Affinity - Causes all processes associated with the job to use the same processor affinity.
Limit Priority Class - Causes all processes associated with the job to use the same priority class.
Limit Preserve Job Time - Preserves any job time limits you previously set. As long as this flag is set, you can establish a per-job time limit once, then alter other limits in subsequent calls. This flag cannot be used with Limit Job Time.
Limit Scheduling Class - Causes all processes in the job to use the same scheduling class.
Limit Process Memory - Causes all processes associated with the job to limit their committed memory. When a process attempts to commit memory that would exceed the per-process limit, it fails. If the job object is associated with a completion port, a JOB_OBJECT_MSG_PROCESS_MEMORY_LIMIT message is sent to the completion port.
Limit Job Memory - Causes all processes associated with the job to limit the job-wide sum of their committed memory. When a process attempts to commit memory that would exceed the job-wide limit, it fails. If the job object is associated with a completion port, a JOB_OBJECT_MSG_JOB_MEMORY_LIMIT message is sent to the completion port.
Limit Die On Unhandled Exception - Forces a call to the SetErrorMode function with the SEM_NOGPFAULTERRORBOX flag for each process associated with the job.
Limit Breakaway OK - If any process associated with the job creates a child process using the CREATE_BREAKAWAY_FROM_JOB flag while this limit is in effect, the child process is not associated with the job.
Silent Breakaway OK - Allows any process associated with the job to create child processes that are not associated with the job. BitValues
� � � � � � 8 N ` � � Limit Working Set Limit Process Time Limit Job Time Active Process Limit Limit Affinity Limit Priority Class Limit Preserve Job Time Limit Scheduling Class Limit Process Memory Limit Job Memory Limit Die On Unhandled Exception Limit Breakaway OK Silent Breakaway OK MaximumWorkingSetSize ,
� � � uint32 Description Specifies the maximum working set size for all processes associated with the job. Ignored unless LimitFlags specifies Limit Working Set MinimumWorkingSetSize (
� � � � uint32 Description Specifies the minimum working set size for all processes associated with the job. Ignored unless LimitFlags specifies Limit Working Set PerJobUserTimeLimit +
� � � � ! uint64 Description Specifies the per-job user-mode execution time limit, in 100 nanoseconds. The system adds the current time of the processes associated with the job to this limit. For example, if you set this limit to 1 minute, and the job has a process that has accumulated 5 minutes of user-mode time, the limit actually enforced is 6 minutes. Units 100 nanoseconds PerProcessUserTimeLimit +
� � � � � � uint64 Description Specifies the per-process user-mode execution time limit, in 100 nanoseconds. It is ignored unless LimitFlags specifies Limit Process Time.The system periodically checks to determine whether each process associated with the job has accumulated more user-mode time than the set limit. If it has, the process is terminated. Units 100 nanoseconds PriorityClass 8
� 1 9 F uint32 Description Specifies the priority class for all processes associated with the job. Processes and threads cannot modify their priority class. Ignored unless LimitFlags specifies Limit Priority. ProcessMemoryLimit +
� J R _ � � uint32 Description Specifies the per-process memory limit in kilobytes. It is ignored unless the LimitFlags specifies the Limit Process Memory. Units kilobytes SchedulingClass
<
� - 5 B uint32 Description Specifies the scheduling class for all processes associated with the job. The valid values are 0 to 9. Use 0 for the least favorable scheduling class relative to other threads, and 9 for the most favorable scheduling class relative to other threads. Ignored unless LimitFlags specifies Limit Scheduling Class. SettingID @ )
� � � � � �� string Description The identifier by which the job object limit setting instance is known.
As a Kernel object job object names are case sensitive. Because WMI keys are case insensitive, the name of the named job object must be decorated as follows: a capital letter should be preceded by a backslash. As a consequence of this convention, 'A' and 'a' are lower case and '\A' and '\a' are upper case. � C I M _ C o l l e c t i o n S e t t i n g )ϝ��C�� CIM_CollectionSetting ) + � ��� � � \ e ���������: � Win32_NamedJobObjectSecLimit Description The Win32_NamedJobObjectSecLimit association class relates a job object and the job object security limit settings. AMENDMENT LOCALE Collection f@ )
� � � �� ref:Win32_NamedJobObject Description This property is a reference to the instance of a job object. Setting f@ )
� � � � � �� ref:Win32_NamedJobObjectSecLimitSetting Description This property is a reference to the instance that contains security limit settings for the job object. ip � � power ;ߞ� = ��� � �SX � � ��eh
� �eq9 � fv��� � �
d_ � �+:�\ q �\F�� � ��_Ӗ ( ���� � P̝��C�% 6 � �� � # K X � � � � [ f U���������������������� � Win32_SID SECRCW32 Locale UUID {8502C581-5FBB-11D2-AAC1-006008C78BC7} AccountName
� � � �� string BinaryRepresentation
� � � �� uint8 ReferencedDomainName
� � �� string SID '
� S � �� � �� string SidLength
� � � �� uint32 � Q̝��C�p A � �� � ��) 1 7 _ h � � U��������� � Win32_AccountSID SECRCW32 Association Locale UUID {8502C582-5FBB-11D2-AAC1-006008C78BC7} Element f '
� � � �� � �� ref:Win32_Account Setting f '
� � � �� � �� ref:Win32_SID B- � C I M _ S e t t i n g R̝��C� CIM_Setting
) ��! ) / W e ����������������� � Win32_SecuritySetting abstract Locale UUID {8502C583-5FBB-11D2-AAC1-006008C78BC7} ControlFlags
� � � �� uint32 � i m � � � � � GetSecurityDescriptor ( 4 Privileges @ U SeSecurityPrivilege SeRestorePrivilege % ae442007200009F ROOT\cimv2 ���� � �� �� * � � ; ��������e � __PARAMETERS abstract
Descriptor object
� 6 OUT
� 6 ] �� ID
)
� � ] ��� object:Win32_SecurityDescriptor ReturnValue uint32
� . uint32 out
� . 6 �� __ � SetSecurityDescriptor � � Privileges � � SeSecurityPrivilege SeRestorePrivilege ae442007200009F ROOT\cimv2 ���� � �� �� * � ����� � __PARAMETERS abstract
Descriptor object
� 6 IN
� 6 ] �� ID
)
� � ] ��� object:Win32_SecurityDescriptor __ �y ae442007200009F ROOT\cimv2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � C I M _ E l e m e n t S e t t i n g S̝��C�� CIM_ElementSetting ) ��) 1 7 _ h � � e��������" � Win32_SecuritySettingOfObject Abstract Locale UUID {8502C584-5FBB-11D2-AAC1-006008C78BC7} Element f@
� � � � ref:CIM_LogicalElement Override Element Setting f@
� � ref:Win32_SecuritySetting Override Setting me � T̝��C�{ 4 ��& ��3 ; A i p � � e�������� � Win32_SecuritySettingOwner abstract Association Locale UUID {8502C585-5FBB-11D2-AAC1-006008C78BC7} Owner f '
� � � �� � �� ref:Win32_SID SecuritySetting f '
� � � �� � �� ref:Win32_SecuritySetting 02 � U̝��C�{ 4 ��& ��3 ; A i p � � e�������� � Win32_SecuritySettingGroup abstract Association Locale UUID {8502C586-5FBB-11D2-AAC1-006008C78BC7} Group f '
� � � �� � �� ref:Win32_SID SecuritySetting f '
� � � �� � �� ref:Win32_SecuritySetting 02 � W i n 3 2 _ S e c u r i t y S e t t i n g O w n e r ^̝��C�� $ Win32_SecuritySettingOwner 6 � �� � " * 0 X _ � � e��������) � Win32_LogicalFileOwner SECRCW32 Locale UUID {8502C58E-5FBB-11D2-AAC1-006008C78BC7} Owner f@
� � � � ref:Win32_SID Override Owner SecuritySetting f@
� � ref:Win32_LogicalFileSecuritySetting Override SecuritySetting � C I M _ U S B C o n t r o l l e r H a s H u b G̝��C�+ ! CIM_USBControllerHasHub ) % w ��� � � ��������������������������������� � Win32_ControllerHasHub Description USBControllerHasHub defines the Hub(s) that are downstream of the USBController. AMENDMENT LOCALE Antecedent f@ )
� � � � � �� ref:Win32_USBController Description The USBController. Dependent f@ )
� I [ h � �� ref:Win32_USBHub Description The USBHub that is associated with the Controller. � C I M _ R e a l i z e s I̝��C�� CIM_Realizes ) + � ��� � � � � u��������, � Win32_DiskDrivePhysicalMedia Description The Win32_PhysicalElementsOfDiskDrive association defines the mapping between a disk drive and the physical components that implement it. AMENDMENT LOCALE Antecedent f@ )
� % 2 � �� ref:Win32_PhysicalMedia Description The Antecedent reference represents the physical component that implements the DiskDrive device. Dependent f@ )
� � � � � �� ref:Win32_DiskDrive Description The Dependent reference represents the disk drive. ha � C I M _ P h y s i c a l M e d i a *tR|�C�� C CIM_PhysicalMedia ) " � ��� � � � � ������������������������������������������������������������������B � Win32_PhysicalMedia Description The Win32_PhysicaMedia class represents any type of documentation or storage medium, such as tapes, CD ROMs, etc. AMENDMENT LOCALE SerialNumber @
� � � � string Description The Serial number property is a manufacturer-allocated number used to identify the physicalmedia.
Example: WD-WM3493798728 for a disk serial number. Tag @ )
� � � � � �� string Description The Tag property uniquely identifies the physical media in the system.
Example: \\PHYSICALDRIVE0 �
C I M _ U S B H u b ftR|�C�o F CIM_USBHub ) l ��w � J P ���������������������������������������������������������������������� � Win32_USBHub Description The Win32_USBHub class represents the management characterisitics of a USB Hub. AMENDMENT LOCALE DeviceID @ )
� � � � � �� string Description The DeviceID property DeviceID is an address or other identifying information which uniquely identifies the USBHub. Name <
� | � � string Description The Name property indicates the name of the USB Hub. �IVE0 �k drive. ha � � � � � 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 !N����
͝��C�� ) +/�Q �� ^ � WDMClassesOfDriver TcpIp_V0_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 #N����
͝��C�~ & +/�Q �� [ � WDMClassesOfDriver TcpIp_V1_Receive C:\Windows\system32\kernelbase.dll[MofResourceName] Name] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 #N����
͝��C�~ & +/�Q �� [ � WDMClassesOfDriver TcpIp_V1_Receive C:\Windows\system32\kernelbase.dll[MofResourceName] ourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 #N����
͝��C�~ & +/�Q �� [ � WDMClassesOfDriver TcpIp_V1_Receive C:\Windows\system32\kernelbase.dll[MofResourceName] l[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 #N����
͝��C�~ & +/�Q �� [ � WDMClassesOfDriver TcpIp_V1_Receive C:\Windows\system32\kernelbase.dll[MofResourceName] sourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 #N����
͝��C�~ & +/�Q �� [ � WDMClassesOfDriver TcpIp_V1_Receive C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 'N����
͝��C�{ # +/�Q �� X � WDMClassesOfDriver TcpIp_V1_Send C:\Windows\system32\kernelbase.dll[MofResourceName] ourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 'N����
͝��C�{ # +/�Q �� X � WDMClassesOfDriver TcpIp_V1_Send C:\Windows\system32\kernelbase.dll[MofResourceName] ourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 'N����
͝��C�{ # +/�Q �� X � WDMClassesOfDriver TcpIp_V1_Send C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 )N����
͝��C�s +/�Q �� P � WDMClassesOfDriver TcpIp C:\Windows\system32\kernelbase.dll[MofResourceName] base.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 )N����
͝��C�s +/�Q �� P � WDMClassesOfDriver TcpIp C:\Windows\system32\kernelbase.dll[MofResourceName] lbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 )N����
͝��C�s +/�Q �� P � WDMClassesOfDriver TcpIp C:\Windows\system32\kernelbase.dll[MofResourceName] e.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 )N����
͝��C�s +/�Q �� P � WDMClassesOfDriver TcpIp C:\Windows\system32\kernelbase.dll[MofResourceName] se.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 )N����
͝��C�s +/�Q �� P � WDMClassesOfDriver TcpIp C:\Windows\system32\kernelbase.dll[MofResourceName] rnelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 )N����
͝��C�s +/�Q �� P � WDMClassesOfDriver TcpIp C:\Windows\system32\kernelbase.dll[MofResourceName] base.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 )N����
͝��C�s +/�Q �� P � WDMClassesOfDriver TcpIp C:\Windows\system32\kernelbase.dll[MofResourceName] ase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 )N����
͝��C�s +/�Q �� P � WDMClassesOfDriver TcpIp C:\Windows\system32\kernelbase.dll[MofResourceName] elbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 )N����
͝��C�s +/�Q �� P � WDMClassesOfDriver TcpIp C:\Windows\system32\kernelbase.dll[MofResourceName] se.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 )N����
͝��C�s +/�Q �� P � WDMClassesOfDriver TcpIp C:\Windows\system32\kernelbase.dll[MofResourceName] ase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 )N����
͝��C�s +/�Q �� P � WDMClassesOfDriver TcpIp C:\Windows\system32\kernelbase.dll[MofResourceName] elbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 )N����
͝��C�s +/�Q �� P � WDMClassesOfDriver TcpIp C:\Windows\system32\kernelbase.dll[MofResourceName] rnelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 )N����
͝��C�s +/�Q �� P � WDMClassesOfDriver TcpIp C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 *N����
͝��C�| $ +/�Q �� Y � WDMClassesOfDriver TcpIp_SendIPV4 C:\Windows\system32\kernelbase.dll[MofResourceName] .dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 *N����
͝��C�| $ +/�Q �� Y � WDMClassesOfDriver TcpIp_SendIPV4 C:\Windows\system32\kernelbase.dll[MofResourceName] ourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 *N����
͝��C�| $ +/�Q �� Y � WDMClassesOfDriver TcpIp_SendIPV4 C:\Windows\system32\kernelbase.dll[MofResourceName] MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 *N����
͝��C�| $ +/�Q �� Y � WDMClassesOfDriver TcpIp_SendIPV4 C:\Windows\system32\kernelbase.dll[MofResourceName] dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 *N����
͝��C�| $ +/�Q �� Y � WDMClassesOfDriver TcpIp_SendIPV4 C:\Windows\system32\kernelbase.dll[MofResourceName] esourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 *N����
͝��C�| $ +/�Q �� Y � WDMClassesOfDriver TcpIp_SendIPV4 C:\Windows\system32\kernelbase.dll[MofResourceName] e] C 3 C 9 A A 5 4 8 6 5 F 4 ,fN�� �
͝��C�� # t�A>��� b � WDMClassesOfDriver PoolAllocFree C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 2 ndows\system32\kernelbase.dll[MofResourceName] ,8�NP �FD�g � N�j�J � �� �$ l C I M _ P h y s i c a l M e m o r y ,tR|�C��
t CIM_PhysicalMemory ) # � ���
� � ? U " � � � � � � n z 2 9 > 1 = �����_U������������������������������������������������������������������������������������������������������������� � Win32_PhysicalMemory Description The Win32_PhysicalMemory class represents a physical memory device located on a computer system as available to the operating system. AMENDMENT LOCALE Attributes L
� � �
uint32 Description SMBIOS - Type 17 - Attributes. Represents the RANK. ConfiguredClockSpeed P
� � � � uint32 Description Identifies the configured clock speed to the memory device, in megahertz (MHz) If the value is 0, the speed is unknown. ConfiguredVoltage T
� N V c uint32 Description Configured voltage for this device, in millivolts. If the value is 0, the voltage is unknown. DeviceLocator X
� � string Description The DeviceLocator property indicates the label of the socket or circuit board that holds this memory.
Example: SIMM 3 InterleaveDataDepth \
� � � � uint16 Description The InterleaveDataDepth property indicates the maximum number of consecutive rows of data that are accessed in a single interleaved transfer from the memory device. If the value is 0, then the memory is not interleaved. MaxVoltage ^
� � � uint32 Description Maximum operating voltage for this device, in millivolts. If the value is 0, the voltage is unknown MinVoltage b
� � � � uint32 Description Minimum operating voltage for this device, in millivolts. If the value is 0, the voltage is unknown SMBIOSMemoryType f
� ^ f s uint32 Description Type of memory used in this device. This is an extra property being added to report the raw SMBIOS memory type. The value reported by the property MemoryType is a CIM value mapped to SMBIOS value. Tag @ )
� u } � � �� string Description The Tag property contains a string that uniquely identifies the physical memory device represented by an instance of Win32_PhysicalMemory.
Example: Physical Memory 1 TypeDetail j +
� v ~ � L Y uint16 BitValues
� � � � � �
% 2 > Reserved Other Unknown Fast-paged Static column Pseudo-static RAMBUS Synchronous CMOS EDO Window DRAM Cache DRAM Non-volatile Description The TypeDetail property indicates the type of physical memory represented by Win32_PhysicalMemory. � C I M _ P h y s i c a l C o n n e c t o r ;tR|�C�� < CIM_PhysicalConnector ) " � ��� � � 8 U c � �
�
��}��������������������������������������������������������� � Win32_PortConnector Description The Win32_PortConnector class represents physical connection ports, such as DB-25 pin male, Centronics, and PS/2. AMENDMENT LOCALE ConnectorType ` * +
� � � � � uint16 Description The ConnectorType property indicates the physical attributes of the connector used by this port.
Example: 2 25 (Male RS-232) Values _ ! ) 3 ? ` � � � � �
2 W o � � � � � � � � � � � � � � ( 8 H M S Y d o ~ � � � � � � � � � � � � � % + 5 = I P \ m � � � � � � � � � ) E P W ^ e r z � � � � � � Unknown Other Male Female Shielded Unshielded SCSI (A) High-Density (50 pins) SCSI (A) Low-Density (50 pins) SCSI (P) High-Density (68 pins) SCSI SCA-I (80 pins) SCSI SCA-II (80 pins) SCSI Fibre Channel (DB-9, Copper) SCSI Fibre Channel (Fibre) SCSI Fibre Channel SCA-II (40 pins) SCSI Fibre Channel SCA-II (20 pins) SCSI Fibre Channel BNC ATA 3-1/2 Inch (40 pins) ATA 2-1/2 Inch (44 pins) ATA-2 ATA-3 ATA/66 DB-9 DB-15 DB-25 DB-36 RS-232C RS-422 RS-423 RS-485 RS-449 V.35 X.21 IEEE-488 AUI UTP Category 3 UTP Category 4 UTP Category 5 BNC RJ11 RJ45 Fiber MIC Apple AUI Apple GeoPort PCI ISA EISA VESA PCMCIA PCMCIA Type I PCMCIA Type II PCMCIA Type III ZV Port CardBus USB IEEE 1394 HIPPI HSSDC (6 pins) GBIC DIN Mini-DIN Micro-DIN PS/2 Infrared HP-HIL Access.bus NuBus Centronics Mini-Centronics Mini-Centronics Type-14 Mini-Centronics Type-20 Mini-Centronics Type-26 Bus Mouse ADB AGP VME Bus VME64 Proprietary Proprietary Processor Card Slot Proprietary Memory Card Slot Proprietary I/O Riser Slot PCI-66MHZ AGP2X AGP4X PC-98 PC-98Hireso PC-H98 PC-98Note PC-98Full Mini-Jack On Board Floppy 9 Pin Dual Inline (pin 10 cut) 25 Pin Dual Inline (pin 26 cut) 50 Pin Dual Inline 68 Pin Dual Inline On Board Sound Input from CD-ROM ExternalReferenceDesignator .
� � � � string Description The ExternalReferenceDesignator property indicates the external reference designator of the port. External reference designators are identifiers that determine the type and use of the port.
Example: COM1 InternalReferenceDesignator
2
� � � � string Description The InternalReferenceDesignator property indicates the internal reference designator of the port. Internal reference designators are specific to the manufacturer and identify the circuit board location or use of the port.
Example: J101 PortType 6 +
� �
�
N V uint16 Description The PortType property describes the function of the port.
Example: USB Values " � � / B Y w � � � � � �
"
9
I
Y
j
s
�
�
�
�
�
�
�
�
�
�
�
None Parallel Port XT/AT Compatible Parallel Port PS/2 Parallel Port ECP Parallel Port EPP Parallel Port ECP/EPP Serial Port XT/AT Compatible Serial Port 16450 Compatible Serial Port 16550 Compatible Serial Port 16550A Compatible SCSI Port MIDI Port Joy Stick Port Keyboard Port Mouse Port SSA SCSI USB FireWire (IEEE P1394) PCMCIA Type II PCMCIA Type II PCMCIA Type III Cardbus Access Bus Port SCSI II SCSI Wide PC-98 PC-98-Hireso PC-H98 Video Port Audio Port Modem Port Network Port 8251 Compatible 8251 FIFO Compatible Tag @ )
� J R _ � �� string Description The Tag property contains a string that uniquely identifies a port connection on the computer system.
Example: Port Connector 1 � W i n 3 2 _ C O M A p p l i c a t i o n AtR|�C�� Win32_COMApplication ) $ v ��� � � ����1 � Win32_DCOMApplication Description The Win32_DCOMApplication class represents the properties of a DCOM application. AMENDMENT LOCALE AppID )
� � � � � �� string Description The AppID property is a Globally Unique Identifier (GUID) for the DCOM application. e � W i n 3 2 _ C O M C l a s s �tR|�C�8 Win32_COMClass ) $ s ��~ � � ; A �������� � Win32_ClassicCOMClass Description The Win32_ClassicCOMClass class represents the properties of a COM component. AMENDMENT LOCALE ComponentId )
� � � � � �� string Description The ComponentId property contains the Globally Unique Identifier (GUID) of this COM class. Name
� m u � string Description The Name property contains the human-readable name for the COM class. si �ion. e �nector 1 �lMemory. �M class. � � � � � �, LvR|�C�� 6 # ( 5 U ��` h p � MSFT_OdbcDriverTask ClassVersion 1.0 Description Task provider for ODBC driver. AMENDMENT LOCALE MS_409 �+ � _Od b � K rsi ] � e Ta } �& y+ � Get # Description Retrieves one or more installed ODBC drivers from the system. > a42c9160500003S ROOT\Microsoft\Windows\Wdac\MS_409 ���� � �� �� * M � 5 ��������� � __PARAMETERS abstract Name string
� 0 In
� 0 W �� Specifies one or more ODBC drivers by driver name. You can use wildcard characters. The default is to return all ODBC drivers. Description )
� 0 W �� � ID 6
� � W �� � I string Platform string
� � In
� � � �� The platform architecture of the ODBC driver. Possible values are '32-bit', '64-bit' or 'All'. The default is 'All'. This is the platform architecture on the remote machine if this command is executed in a remote CIM session. Description )
� � � ���
ID 6
� y � ���
1 string __ �� a42c9160500003S ROOT\Microsoft\Windows\Wdac\MS_409 ���� � �8 �� * ? � � �������� � __PARAMETERS abstract
cmdletOutput object
� 8 Out
� 8 _ �� The output is an array of CIM objects of type MSFT_OdbcDriver, each of which represents an ODBC driver. Description
)
� 8 _ ��� � ID
6
� � _ ��� � ; object:MSFT_OdbcDriver ReturnValue uint32
� � uint32 out
� � � �� __ � SetByInputObject n { Description Configure driver\'s properties for one or more installed ODBC drivers. �
a42c9160500003S ROOT\Microsoft\Windows\Wdac\MS_409 ���� � �3
�� � & * Z T o � � U��������������� � __PARAMETERS abstract PassThru boolean
� 4 In
� 4 \ �� Passes the object created by this cmdlet through the pipeline. By default, this cmdlet does not pass any objects through the pipeline. Description )
� 4 \ �� � ID 6
� � \ �� � V boolean SetPropertyValue string
� � In
� � � �� Specifies the property values of the ODBC driver to be modified or added. Format as an array of strings where each string is: <key>=<value>. Description )
� � � ��� ID 6
� : � ��� � string RemovePropertyValue string
� i In
� i � �� Specifies the property values of the ODBC driver to be deleted. This is an array of keys to be removed. Description )
� i � ��' � ID 6
� � � ��' � k string
InputObject object
� � In
� � �� Modifies the ODBC driver represented by the specified ODBC driver objects. Enter a variable that contains the objects, or type a command or expression that gets the objects. Description
)
� � ��� / ID
6
� j ��� / " object:MSFT_OdbcDriver __ �� a42c9160500003S ROOT\Microsoft\Windows\Wdac\MS_409 ���� � �8 �� * ? � � �������� � __PARAMETERS abstract
cmdletOutput object
� 8 Out
� 8 _ �� The output is an array of CIM objects of type MSFT_OdbcDriver, each of which represents an ODBC driver. Description
)
� 8 _ ��� � ID
6
� � _ ��� � ; object:MSFT_OdbcDriver ReturnValue uint32
� � uint32 out
� � � �� __ � SetByName ( 5 Description Configure driver\'s properties for one or more installed ODBC drivers. Q
a42c9160500003S ROOT\Microsoft\Windows\Wdac\MS_409 ���� � �� �� � � * Z # � T o � � U�������������������1 � __PARAMETERS abstract PassThru boolean
� 4 In
� 4 \ �� Passes the object created by this cmdlet through the pipeline. By default, this cmdlet does not pass any objects through the pipeline. Description )
� 4 \ �� � ID 6
� � \ �� � V boolean SetPropertyValue string
� � In
� � � �� Specifies the property values of the ODBC driver to be modified or added. Format as an array of strings where each string is: <key>=<value>. Description )
� � � ��� ID 6
� : � ��� � string RemovePropertyValue string
� i In
� i � �� Specifies the property values of the ODBC driver to be deleted. This is an array of keys to be removed. Description )
� i � ��' � ID tHbsP � �
!�� � ���ͱ 3 V�N�� } M S F T _ N e t A d a p t e r S e t t i n g D a t a �՝��C�] 8 $ MSFT_NetAdapterSettingData C / � �� � D S a h p } � � S i � � � � � � � ��U����������������������������������������������������q � MSFT_NetAdapterRscSettingData UMLPackagePath CIM::Core::Settings NetAdapterCim ClassVersion 1.0.0 locale IPv4Enabled '
� � � �� � �� boolean IPv4FailureReason
, )
� � ��
uint32 ValueMap ; > A D G J M P 0 1 2 3 4 5 6 7 IPv4OperationalState (
� � � �� boolean IPv6Enabled " '
� � � �� � �� boolean IPv6FailureReason 0 )
� 1 � ��9 C uint32 ValueMap g j m p s v y | 0 1 2 3 4 5 6 7 IPv6OperationalState *
� � � �� boolean RscHardwareCapabilities
$ )
� � ��? Q object:MSFT_NetAdapterRscCapabilities EmbeddedInstance MSFT_NetAdapterRscCapabilities �
$ � � � � � �
� Enable �� implemented � ae442007200009F ROOT\standardcimv2 ���� � �* �� * � � < ����| � __PARAMETERS abstract IPv4 boolean
� 0 In
� 0 X �� ID )
� � X ��� boolean IPv6 boolean
� � In
� �
�� ID )
� s
��8 boolean __ �% ae442007200009F ROOT\standardcimv2 ���� � �� �� * � v � ��������� � __PARAMETERS abstract
cmdletOutput object
� 8 Out
� 8 _ �� MSFT_NetAdapterRscSettingData EmbeddedInstance
)
� 8 _ ��� � ID
6
� > _ ��� � � object:MSFT_NetAdapterRscSettingData ReturnValue uint32
� � uint32 out
� � � �� __ � Disable � �� implemented � ae442007200009F ROOT\standardcimv2 ���� � �* �� * � � < ����| � __PARAMETERS abstract IPv4 boolean
� 0 In
� 0 X �� ID )
� � X ��� boolean IPv6 boolean
� � In
� �
�� ID )
� s
��8 boolean __ �% ae442007200009F ROOT\standardcimv2 ���� � �� �� * � v � ��������� � __PARAMETERS abstract
cmdletOutput object
� 8 Out
� 8 _ �� MSFT_NetAdapterRscSettingData EmbeddedInstance
)
� 8 _ ��� � ID
6
� > _ ��� � � object:MSFT_NetAdapterRscSettingData ReturnValue uint32
� � uint32 out
� � � �� __ �! M S F T _ N e t A d a p t e r E l e m e n t S e t t i n g D a t a �՝��C�� + MSFT_NetAdapterElementSettingData # C " 2 � �� � G V d k s � ����������������� � MSFT_NetAdapterRssElementSetting UMLPackagePath CIM::Core::Settings NetAdapterCim ClassVersion 1.0.0 locale SettingData f@
� � � � ref:MSFT_NetAdapterRssSettingData Override SettingData � �՝��C� ! 6 � �� � , : A I c � � � � � � � � 0 I z � � � 2 UU�������������������������������c � MSFT_NetAdapter_QosSettings NetAdapterCim ClassVersion 1.0.0 locale BandwidthAssignmentTable
� � � �� uint8 ClassificationEnabled
� � � �� boolean ClassificationTable
)
� * � ��[ m object:MSFT_NetAdapter_QosClassificationElement EmbeddedInstance MSFT_NetAdapter_QosClassificationElement FlowControlEnabled
� � � �� boolean NumberOfClassificationElements
� ( � �� uint32 PriorityAssignmentTable
� s � �� uint8 PriorityFlowControlEnableArray
� � � �� boolean TransmissionSelectionEnabled
� � �� boolean TsaAssignmentTable
� \ � �� uint8
� ֝��C�e - ) � �� � & . K � c w � � Y u �
� � ! H k � � & UU������������������������������������������� � Win32_DeviceGuard Win32_DeviceGuard locale AvailableSecurityProperties +
� � � � � � uint32 ValueMap � � � � � � � � 1 2 3 4 5 6 7 8 ArrayType Indexed CodeIntegrityPolicyEnforcementStatus
� 8 @ J uint32 ValueMap Z ] ` 0 1 2 InstanceIdentifier
� � � �� string RequiredSecurityProperties +
� � E P uint32 ValueMap 0 3 6 9 < ? B 1 2 3 4 5 6 7 ArrayType Indexed SecurityServicesConfigured +
� � � � � � uint32 ValueMap � � � � 1 2 3 4 ArrayType Indexed SecurityServicesRunning +
� F N X � uint32 ValueMap p s v y | 1 2 3 4 5 ArrayType Indexed UsermodeCodeIntegrityPolicyEnforcementStatus
� � � � uint32 ValueMap 0 1 2 Version
� @ string VirtualizationBasedSecurityStatus
� � � � uint32 ValueMap � � � 0 1 2 VirtualMachineIsolation $
� � boolean VirtualMachineIsolationProperties
& +
� _ g q � � uint32 ValueMap � � � 1 2 3 ArrayType Indexed � �{(� > qR�� � ��� � (8�� # '{�
� � � %��kM � ][ � * ͝��C�& ] i � � ��������� � HNet_IcsSettings DhcpEnabled '
� T � �� � �� boolean DnsEnabled '
� � � �� � �� boolean Id '
� � � �� � �� string le � �˝��C�� ) % � ��� � � � � ��������h � Win32_ShareToDirectory Description The Win32_ShareToDirectory class represents an association between a shared resource on the computer system and the directory to which it is mapped. AMENDMENT LOCALE Share f )
� � �� * ref:Win32_Share Description The Share reference represents the properties of a shared resource available through the directory. SharedElement f )
� � � ��� � ref:CIM_Directory Description The SharedElement reference represents the properties of the directory that has been mapped to a shared resource. pe � C I M _ A s s o c i a t e d P r o c e s s o r M e m o r y �˝��C��
' CIM_AssociatedProcessorMemory ) ! . � ��� � � e p u������������ � Win32_AssociatedProcessorMemory Description The Win32_AssociatedProcessorMemory class represents an association between a processor and its cache memory. AMENDMENT LOCALE Antecedent f@ )
� �
� �� ref:Win32_CacheMemory Description The Antecedent reference represents cache memory available to the processor. Dependent f@ )
� � � � � �� ref:Win32_Processor Description The Dependent reference represents the processor that is using the cache memory. es � C I M _ I n s t a l l e d O S �˝��C�� CIM_InstalledOS ) * � ��� � � � � �����������{ � Win32_SystemOperatingSystem Description The Win32_SystemOperatingSystem class represents an association between a computer system and its operating system. AMENDMENT LOCALE GroupComponent f@ )
� � � �� ref:Win32_ComputerSystem Description The GroupComponent reference represents the properties of the computer system upon which the operating system is installed. PartComponent f@ )
� � � � �� ref:Win32_OperatingSystem Description The PartComponent reference represents the properties of the operating system running on this computer system. � C I M _ C a r d 1tR|�C�� X CIM_Card
) � ��� � � � � o t �����_���������������������������������������������������������������������������������� � Win32_BaseBoard Description The Win32_BaseBoard class represents a base board (also known as a motherboard or system board). AMENDMENT LOCALE ConfigOptions J
� � � � string Description The ConfigOptions property contains strings that describe the configuration of the jumpers and switches located on the base board.
Examples: JP2: 1-2 Cache Size is 256K, 2-3 Cache Size is 512K, SW1-1: Close to Disable On Board Video Product N
�
string Description The Product property indicates the base board part number defined by the manufacturer. Tag @ )
� � � � � �� string Description The Tag property uniquely identifies the base board of the system.
Example: Base Board � C I M _ S y s t e m R e s o u r c e �tR|�C�V CIM_SystemResource ) � ��� � � � � ; E � U��������������� � Win32_Environment Description The Win32_Environment class represents an environment or system environment setting on a Win32 computer system. AMENDMENT LOCALE Name )
� � � � � �� string Description The Name property contains a character string specifying the name of a Win32 environment variable. By specifying the name of a variable that does not yet exist, an application can create a new environment variable.
Example: Path. SystemVariable
� # 0 boolean Description The SystemVariable property indicates whether the variable is a system variable. A system variable is set by the operating system, and is independent from user environment settings.
Values: TRUE or FALSE. A value of TRUE indicates the variable is a system variable. UserName )
� | � � � �� string Description The UserName property indicates the owner of the environment setting. It is set to "<SYSTEM>" for settings that are specific to the Win32 system (as opposed to a specific user) and "<DEFAULT>" for default user settings.
Example: Jsmith. VariableValue
� � � � string Description The VariableValue property contains the placeholder variable of a Win32 environment variable. Information like the file system directory can change from machine to machine. The operating system substitutes placeholders for these.
Example: %SystemRoot%. CA � W i n 3 2 _ S h a r e �tR|�C�� Win32_Share
) ! j ��u } � ��������������������������� � Win32_ClusterShare Description The Win32_ClusterShare class represents a shared resource on a cluster. AMENDMENT LOCALE ServerName
� � � � string Description The ServerName property indicates the cluster server on which the share is hosted � C I M _ L o g i c a l E l e m e n t �tR|�C�� CIM_LogicalElement )
� ��� � � � � L \ f l & , � � U�����������������������L � Win32_Share Description The Win32_Share class represents a shared resource on a Win32 system. This may be a disk drive, printer, interprocess communication, or other shareable device.
Example: C:\PUBLIC. AMENDMENT LOCALE AccessMask
� " / uint32 Description This property has been deprecated in favour of the GetAccessMask method of this class due to the expense of calling GetEffectiveRightsFromAcl. The value will be set to NULL AllowMaximum
� - boolean Description The AllowMaximum property indicates whether the number of concurrent users for this resource has been limited.
Values: TRUE or FALSE. A value of TRUE indicates the number of concurrent users of this resource has not been limited and the value in the MaximumAllowed property is ignored. MaximumAllowed
� � � � uint32 Description The MaximumAllowed property indicates the limit on the maximum number of users allowed to use this resource concurrently. The value is only valid if the AllowMaximum member set to FALSE
Example: 10. Name
)
� � � � � �� string Description The Name property indicates the alias given to a path set up as a share on a Win32 system.
Example: public. Path
� X ` m string Description The Path property indicates the local path of the Win32 share.
Example: C:\Program Files Type +
� � � uint32 Description The Type property specifies the type of resource being shared. Types include disk drives, print queues, interprocess communications (IPC), and general devices. Values � � 3 A Disk Drive Print Queue Device IPC Disk Drive Admin Print Queue Admin Device Admin IPC Admin " �ted �ot%. CA �oard �r system. � � � es � pe � � � � TuZP a�_�T � 6,�� � ?�t�� � 7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D 3ϝ��C�
ȝ��C�t ] � __MethodProviderRegistration \\.\Root\CIMV2:__Win32Provider.Name="MS_NT_EVENTLOG_PROVIDER"
C I M _ C o m p o n e n t �ʝ��C�g
CIM_Component ) � ��� � � � � S b ������������� � CIM_Container Description The CIM_Container association represents the relationship between a contained and a containing physical element. A containing object must be a physical package. AMENDMENT LOCALE GroupComponent f@
�
& 3 ref:CIM_PhysicalPackage Description The physical package that contains other physical elements, including other packages. LocationWithinContainer
� � � � string Description A free-form string representing the positioning of the PhysicalElement within the PhysicalPackage. Information relative to stationary elements in the Container (for example, 'second drive bay from the top'), angles, altitudes and other data may be recorded in this property. This string could supplement or be used in place of instantiating the CIM_Location object. PartComponent f@
� � � � ref:CIM_PhysicalElement Description The physical element which is contained in the package. ti � C I M _ P h y s i c a l P a c k a g e 2tR|�C�| P CIM_PhysicalPackage )
��� � � F _ q � ; G A V ����W���������������������������������������������������������������������������� � CIM_Card Description The CIM_Card class represents a type of physical container that can be plugged into another card or hosting board, or is itself a hosting board/motherboard in a chassis. The CIM_Card class includes any package capable of carrying signals and providing a mounting point for physical components, such as chips, or other physical packages, such as other cards. AMENDMENT LOCALE HostingBoard <
� � � � boolean Description Boolean indicating that this card is a motherboard or, more generically, a baseboard in a chassis. RequirementsDescription >
� � � � string Description A free-form string describing the way(s) in which this card is physically unique from other cards. This property only has meaning when the corresponding boolean property, SpecialRequirements, is set to TRUE. RequiresDaughterBoard B
� � � � boolean Description Boolean indicating that at least one daughterboard or auxiliary card is required in order to function properly. SlotLayout D
� s { � string Description SlotLayout is a free-form string that describes the slot positioning, typical usage, restrictions, individual slot spacings or any other pertinent information for the slots on a card. SpecialRequirements H
� � � � boolean Description Boolean indicating that this card is physically unique from other cards of the same type and therefore requires a special slot. For example, a double-wide card requires two slots. Another example is where a certain card may be used for the same general function as other cards but requires a special slot (e.g., extra long), whereas the other cards can be placed in any available slot. If set to TRUE, then the corresponding property, RequirementsDescription, should specify the nature of the uniqueness or purpose of the card. � C I M _ P h y s i c a l E l e m e n t 8tR|�C��
A CIM_PhysicalElement ) " � ��� � � \ d � � � � � � � � u | ��_U�������������������������������������������������������������
� CIM_PhysicalPackage Description The CIM_PhysicalPackage class represents physical elements that contain or host other components. Examples are a rack enclosure or an adapter card. AMENDMENT LOCALE Depth
& +
�
M T real32 Description The depth of the physical package in inches. Units inches Height * +
� � � � � � real32 Description The height of the physical package in inches. Units inches HotSwappable .
� * 3 @ boolean Description A physical package can be hot swapped if it is possible to replace the element with a physically different but equivalent one while the containing package has power applied to it (i.e., is 'on'). For example, a disk drive package inserted using SCA connectors is removable and can be hot swapped. All packages that can be hot swapped are inherently removable and replaceable. Removable
0
� � � boolean Description A physical package is removable if it is designed to be taken in and out of the physical container in which it is normally found, without impairing the function of the overall packaging. A package can still be removable if power must be 'off' in order to perform the removal. If power can be 'on' and the package removed, then the element is removable and can be hot swapped. For example, an extra battery in a laptop is removable, as is a disk drive package inserted using SCA connectors. However, the latter can be hot swapped. A laptop's display is not removable, nor is a non-redundant power supply. Removing these components would impact the function of the overall packaging or is impossible due to the tight integration of the package. Replaceable 2
� * 3 @ boolean Description A physical package is replaceable if it is possible to replace (FRU or upgrade) the element with a physically different one. For example, some computer systems allow the main processor chip to be upgraded to one of a higher clock rating. In this case, the processor is said to be replaceable . Another example is a power supply package mounted on sliding rails. All removable packages are inherently replaceable . Weight 4 +
� " * 7 f m real32 Description The weight of the physical package in pounds. Units pounds Width 8 +
� � � � � � real32 Description The width of the physical package in inches. Units inches � 3 F � � IsCompatible , Description The IsCompatible method verifies whether the referenced physical element may be contained by or inserted into the physical package. The return value should be 0 if the request was successfully executed, 1 if the request is not supported and some other value if an error occurred. In a subclass, the set of possible return codes could be specified, using a ValueMap qualifier on the method. The strings to which the ValueMap contents are 'translated' may also be specified in the subclass as a Values array qualifier. a42c9160500003S ROOT\CIMV2\ms_409 ���� � �� �� * � ����� � __PARAMETERS abstract f ElementToCheck ref f
� : IN f
� : ^ �� ID f )
� � ^ ��� ref:CIM_PhysicalElement __ �� a42c9160500003S ROOT\CIMV2\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ �he card. �he card. � ti � __ � � kJ�� � ���K � �V�Y� p �D$|8 � �(� ���U3 V Z�v�� � �߄�5 � M S F T _ N e t S e t t i n g D a t a �yR|�C�y + MSFT_NetSettingData ) + P ��[ c k � 1 � � y � 4 T " / �U������������������������������������������ � MSFT_NCSIPolicyConfiguration Description Describes the NCSI Policy settings. AMENDMENT LOCALE MS_409 CorporateDNSProbeHostAddress
� � � � string Description Describes the expected address of the host name used as for the DNS probe. CorporateDNSProbeHostName
� ] e r string Description This is the host name of a PC known to be on the corporate network. CorporateSitePrefixList
� � string Description Describes the list of IPv6 corporate site prefixes that should be monitored for corporate connectivity CorporateWebsiteProbeURL
� � � � string Description This is the URL of the corporate website that will be used to perform an active probe against. DomainLocationDeterminationURL
� � � � string Description This is the HTTPS URL of the corporate website that will be used to determine the current domain location i.e. inside or outside corporate. PolicyStore $
� [ c p string Description PolicyStore property defines the store to retrieve the NCSI configuration policy. � D q � � Reset % Description Reset the NCSI configuration. ) a42c9160500003S ROOT\StandardCimv2\MS_409 ���� � �� �� * � � i � . � � F � v U�������������� � __PARAMETERS abstract CorporateDNSProbeHostAddress boolean
� H In
� H p �� ID )
� � p ��� boolean CorporateDNSProbeHostName boolean
� In
� 7 �� ID )
� � 7 ��e boolean CorporateSitePrefixList boolean
� � In
� � � �� ID )
� e � ��* boolean CorporateWebsiteProbeURL boolean
� � In
� � � �� ID )
� + � ��� boolean DomainLocationDeterminationURL boolean
� f In
� f � �� ID )
� � � ��� boolean
PassThru boolean
� In
� D �� ID
)
� � D ��r boolean __ �@ a42c9160500003S ROOT\StandardCimv2\MS_409 ���� � �� �� * � A ��������k � __PARAMETERS abstract
OutputObject object
� 8 Out
� 8 _ �� ID
)
� � _ ��� object:MSFT_NCSIPolicyConfiguration ReturnValue uint32
� 4 uint32 out
� 4 < �� __ �F D 1 C 1 D 4 1 4 B 7 1 B 5 0 8 2 C 2 6 6 A 6 5 0 E 3 1 E F 6 D 5 0 1 9 3 8 2 7 2 4 2 4 4 B 6 8 5 F 2 1 7 C 0 A A E 0 0 A 9 2 1 �yR|�C�Cȝ��C�$ � __SystemSecurity 4 1 C 5 3 E 6 D B 1 A C F 2 4 5 3 C E F D 4 1 3 9 8 1 9 8 E 6 1 3 F 1 0 D F F 4 7 7 0 9 E C A B 1 D 7 F 0 3 7 7 5 6 A C 8 C E 7 �yR|�C�ȝ��C�� � � __thisNAMESPACE � �� � � ?
E v e n t T r a c e ڧ���C�� EventTrace 6 � �� 4 : b j t { � � u��������9 � WMPNsSciGuid Description WMP Network Sharing API guid {8ed60a3a-8c12-49c5-a518-fdf451bc10fc} locale MS\0x409 Flags R
� � � � � 7 E a i � � uint32 Description Enable Flags ValueDescriptions - EntryExit Flag API Flag DefineValues Q \ EntryExit API Values u � EntryExit API ValueMap � � 0x00000001 0x00000002 Level _
� ' / < D W $ � � � � ' 2 uint32 Description Levels ValueDescriptions o � � � � Abnormal exit or termination Severe errors that need logging Warnings such as allocation failure Includes non-error cases Detailed traces from intermediate steps DefineValues 8 K ^ � TRACE_LEVEL_FATAL TRACE_LEVEL_ERROR TRACE_LEVEL_WARNINGTRACE_LEVEL_INFORMATION TRACE_LEVEL_VERBOSE Values � � � � � Fatal Error Warning Information Verbose ValueMap " 0x1 0x2 0x3 0x4 0x5 ValueType index �9 0 5 7 D 6 5 F 1 A 2 5 A 1 5 7 C 2 A B B 4 0 5 A 1 3 3 D 0 F 2 1 A B 6 1 1 1 8 D C 6 B 4 F B B 2 C 0 1 3 A 8 0 4 0 8 6 D 0 4 0 +�}�C�*�}�C�� ���� } � q � WMI_extension Microsoft.AppV.AppVClientWmi, Version=10.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35 v4.0.30319 {2A7B042D-578A-4366-9A3D-154C0498458E} NetworkServiceHost:CLR Microsoft.AppV.AppVClientWmi, Version=10.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35 E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C ,�}�C� ȝ��C�� � �������� � � __InstanceProviderRegistration __win32provider.Name="Microsoft.AppV.AppVClientWmi, Version=10.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" F i l e I o _ V 0 ���jj���
FileIo_V0 � �� % � � W������������! � FileIo_V0_Name EventType FileName C
� v ~ � � � � � �� string WmiDataId StringTermination NullTerminated format w FileObject 4
�
�� � �� uint32 WmiDataId pointer �6 4 6 5 9 A B 9 F 8 F 1 C 4 B 5 6 8 D B 6 4 3 8 B A E 1 1 B 2 6 E E 8 F 9 3 C B 5 F 8 1 9 5 E 2 1 E 8 C 3 8 3 D 6 C 4 4 C C 4 1 ��1��ȝ��C�,
� __NAMESPACE MS_409 ִ �` � W�< X �$έn � ̴�* � )}T� X M S F T _ N e t S e t t i n g D a t a �yR|�C�� ' MSFT_NetSettingData ) * � ��� � � � @ T � � � � " �U������������������������������������� � MSFT_NetISATAPConfiguration Description This class represents global ISATAP Configuration shared across all ISATAP interfaces. AMENDMENT LOCALE MS_409 PolicyStore
� � � � string Description PolicyStore property defines the store to retrieve the ISATAP configuration policy. ResolutionInterval
� � � � uint32 Description Resolution interval in minutes. ResolutionState +
� s { uint32 Description The state of the ISATAP resolution. One of the following values: disabled, enabled, default. Values � � � � default automatic enabled disabled Router
� � � � string Description Name of the ISATAP router. State +
� [ c p � � uint32 Description Describes the ISATAP service state. One of the following values: disabled, enabled or default. Values � � default automatic enabled disabled �
F a �
� Reset % Description Reset the ISATAP configuration. a42c9160500003S ROOT\StandardCimv2\MS_409 ���� � �� �� r N � � � � ? * � U������������ � __PARAMETERS abstract State boolean
� 1 In
� 1 Y �� ID )
� � Y ��� boolean Router boolean
� � In
� �
�� ID )
� v
��; boolean ResolutionState boolean
� � In
� � � �� ID )
� 3 � ��� boolean ResolutionInterval boolean
� b In
� b � �� ID )
� � � ��� boolean PassThru boolean
� In
� @ �� ID )
� � @ ��n boolean __ �> a42c9160500003S ROOT\StandardCimv2\MS_409 ���� � �� �� * � � @ ��������j � __PARAMETERS abstract
OutputObject object
� 8 Out
� 8 _ �� ID
)
� � _ ��� object:MSFT_NetISATAPConfiguration ReturnValue uint32
� 3 uint32 out
� 3 ; �� __ � C I M _ E l e m e n t S e t t i n g D a t a �yR|�C� CIM_ElementSettingData ) " f ��q y � � � ����������������� � MSFT_NetISATAPState Description This class represents per-interface ISATAP Configuration settings. AMENDMENT LOCALE MS_409 ManagedElement f@
� � � � ref:CIM_LANEndpoint Description ISATAP tunnel interface SettingData f@
� 1 R _ ref:MSFT_NetISATAPConfiguration Description ISATAP global settings associated with this interface �6 4 6 5 9 A B 9 F 8 F 1 C 4 B 5 6 8 D B 6 4 3 8 B A E 1 1 B 2 6 E E 8 F 9 3 C B 5 F 8 1 9 5 E 2 1 E 8 C 3 8 3 D 6 C 4 4 C C 4 1 �yR|�C�ȝ��C�,
� __NAMESPACE MS_409 F D 1 C 1 D 4 1 4 B 7 1 B 5 0 8 2 C 2 6 6 A 6 5 0 E 3 1 E F 6 D 5 0 1 9 3 8 2 7 2 4 2 4 4 B 6 8 5 F 2 1 7 C 0 A A E 0 0 A 9 2 1 �yR|�C�Cȝ��C�$ � __SystemSecurity �yR|�C�@ - 0 � � � � " � � � � � � � E h
& � � UU�������������������������������������������
� Win32_DeviceGuard AvailableSecurityProperties +
� i q ~ � � uint32 Description Indicates the set of security properties that are currently available. Values � , E Y w � Base Virtualization Support Secure Boot DMA Protection Secure Memory Overwrite UEFI Code Readonly SMM Security Mitigations 1.0 Mode Based Execution Control APIC Virtualization CodeIntegrityPolicyEnforcementStatus +
� S [ uint32 Description Indicates Code Integrity policy enforcement status. Values k p w Off Audit Enforced InstanceIdentifier )
� � � � � �� string Description Unique identifier for the instance. RequiredSecurityProperties +
� [ c p � � uint32 Description Indicates the set of security properties that are required to be available. Values � 8 L j Base Virtualization Support Secure Boot DMA Protection Secure Memory Overwrite UEFI Code Readonly SMM Security Mitigations 1.0 Mode Based Execution Control SecurityServicesConfigured +
� � � � & . uint32 Description Indicates the set of services that are configured. Values B T x � Credential Guard Hypervisor Enforced Code Integrity Secure Launch SMM Firmware Measurement SecurityServicesRunning +
� � � 9 A uint32 Description Indicates the set of services that are running. Values Y k � � � Credential Guard Hypervisor Enforced Code Integrity Secure Launch SMM Firmware Measurement Hardware-enforced Stack Protection (Kernel-mode) UsermodeCodeIntegrityPolicyEnforcementStatus +
� Q Y f � � uint32 Description Indicates user mode Code Integrity policy enforcement status. Values � � � Off Audit Enforced Version
� string Description Indicates the version of the provider. VirtualizationBasedSecurityStatus +
� � � � � � uint32 Description Indicates the current status of SMART. Values � � Off Enabled Running VirtualMachineIsolation $
� R [ h boolean Description Is Virtual Machine Isolation enabled. VirtualMachineIsolationProperties
& +
� � �
O
W
uint32 Description Indicates the set of Virtual Machine Isolation properties that are available. Values g
t
�
AMD SEV-SNP Virtualization-based Security Intel TDX � 4 1 C 5 3 E 6 D B 1 A C F 2 4 5 3 C E F D 4 1 3 9 8 1 9 8 E 6 1 3 F 1 0 D F F 4 7 7 0 9 E C A B 1 D 7 F 0 3 7 7 5 6 A C 8 C E 7 �yR|�C�ȝ��C�( � __thisNAMESPACE 4 � O�p� �rL4 _ ��hk < ;H�� �0o� b ��V� ? �VPT
(��r` � +���A C � l� K.� � B]ºz � @TF�Z ����b 5 �.× S
R O O T \ C I M V 2 _ _ I n s t a n c e P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 6 8 5 7 7 3 7 2 C 6 6 A 7 B 2 0 6 5 8 4 8 7 F B D 9 5 9 A A 1 5 4 E F 5 4 B 5 F 9 3 5 D C C 5 6 6 3 E 9 2 2 8 B 4 4 3 2 2 8 0 5 \ K I _ E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C \ I _ 9 1 3 2 0 4 3 0 4 A 0 8 7 2 4 1 3 4 A 9 D 5 D C 4 A 1 A A B D 6 D F 3 3 B E 9 6 D 1 0 9 B B 0 6 7 5 6 E 6 0 F 1 6 C D 5 2 1 2 0 5 5 7 E 5 F 3 A D D 9 E 2 4 2 C 4 E 9 F 9 E D F 7 9 A A 9 7 F 7 9 E 7 9 1 1 C 5 A 8 B 9 0 2 E C 1 5 0 D 6 4 4 2 E 3 B 8 5 A 5 A A ϝ��C�ȝ��C�� �?����M 9 m � __Win32Provider {6515834D-6125-4878-A3A3-6B0A73B809A2} NetworkServiceHost NamedJobObjectLimitSettingProv E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C ϝ��C� ȝ��C�� � ��������f � __InstanceProviderRegistration \\.\Root\CIMV2:__Win32Provider.Name="NamedJobObjectLimitSettingProv" n WQL:UnarySelect
R O O T \ C I M V 2 _ _ I n s t a n c e P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 6 8 5 7 7 3 7 2 C 6 6 A 7 B 2 0 6 5 8 4 8 7 F B D 9 5 9 A A 1 5 4 E F 5 4 B 5 F 9 3 5 D C C 5 6 6 3 E 9 2 2 8 B 4 4 3 2 2 8 0 5 \ K I _ E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C \ I _ 9 6 3 4 F A 8 E A 8 6 6 6 E 1 7 3 6 2 9 3 5 E 8 5 D 3 1 7 F F 2 1 6 D 0 E 4 5 6 B 4 F 0 F 4 5 1 6 A B 4 F 0 B 6 2 E D B 0 8 2 1 5 7 E 5 F 3 A D D 9 E 2 4 2 C 4 E 9 F 9 E D F 7 9 A A 9 7 F 7 9 E 7 9 1 1 C 5 A 8 B 9 0 2 E C 1 5 0 D 6 4 4 2 E 3 B 8 5 A 5 A A ϝ��C�ȝ��C�� �?����M 9 p � __Win32Provider {AB40A5C1-804B-40bd-9DFE-A640691C6956} NetworkServiceHost NamedJobObjectSecLimitSettingProv E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C ϝ��C� ȝ��C�� � ��������i � � __InstanceProviderRegistration \\.\Root\CIMV2:__Win32Provider.Name="NamedJobObjectSecLimitSettingProv" q WQL:UnarySelect
R O O T \ C I M V 2 _ _ I n s t a n c e P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 6 8 5 7 7 3 7 2 C 6 6 A 7 B 2 0 6 5 8 4 8 7 F B D 9 5 9 A A 1 5 4 E F 5 4 B 5 F 9 3 5 D C C 5 6 6 3 E 9 2 2 8 B 4 4 3 2 2 8 0 5 \ K I _ E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C \ I _ 2 5 8 A 2 0 3 C F 4 0 D 0 B B 1 D C A 0 4 6 4 E 5 8 B D F 3 2 C 1 F E 5 4 6 C 6 E 1 0 F 7 B 5 9 F 5 B C 4 A D 6 7 8 7 D 2 A 7 C C I M _ C o l l e c t i o n O f M S E s ϝ��C�� CIM_CollectionOfMSEs 6 � �� � * 2 8 ` u � � }���������������� � Win32_NamedJobObject NamedJobObjectProv Locale UUID {7552EF7F-7CC8-4022-9049-3B5E1B4B3852} BasicUIRestrictions
� � � �� uint32 CollectionID @ 4
� � � �� � ��� string Override CollectionId � C I M _ C o l l e c t e d M S E s ϝ��C� CIM_CollectedMSEs N � �� ��- 7 � D O W ] � � 5��������r � Win32_NamedJobObjectProcess SupportsCreate CreateBy PutInstance CIMWin32a Locale UUID {486F2A44-D0BF-46c1-9543-68EF5D37F1F9} Collection f@ 4
� � � ��� � � �� ref:Win32_NamedJobObject Override Collection Member f@ 4
� M � ��` j � �� ref:Win32_Process Override Member f � C I M _ S t a t i s t i c a l I n f o r m a t i o n ϝ��C�� y $ CIM_StatisticalInformation 6 � �� � : B H p � � � ( = o � � � � C W � � � � 4 f w � � � 2 L ~ � � � }UUU��������������������������������������������������������������������������������������������������������������������L � Win32_NamedJobObjectActgInfo NamedJobObjectActgInfoProv Locale UUID {486F2A44-D0BF-46c1-9543-68EF5D37F1F9} ActiveProcesses 4
� � � �� uint32 Name @ A
� � �� � �� " string MaxLen Override Name OtherOperationCount
L
� g � �� uint64 OtherTransferCount d
� � � �� uint64 PeakJobMemoryUsed p
� � � �� uint32 PeakProcessMemoryUsed l
� ; � �� uint32 ReadOperationCount <
� � � �� uint64 ReadTransferCount T
� � � �� uint64 ThisPeriodTotalKernelTime $
� � �� uint64 ThisPeriodTotalUserTime
� ^ � �� uint64 TotalKernelTime
� � � �� uint64 TotalPageFaultCount ,
� � � �� uint32 TotalProcesses 0
� * � �� uint32 TotalTerminatedProcesses
8
� v � �� uint32 TotalUserTime
� � � �� uint64 WriteOperationCount D
� � � �� uint64 WriteTransferCount \
� D � �� uint64 � W i n 3 2 _ C o l l e c t i o n S t a t i s t i c s ϝ��C�� $ Win32_CollectionStatistics 6 � � ��+ 3 9 a m � � e�������� � Win32_NamedJobObjectStatistics CIMWin32a Locale UUID {C741E1B8-2F7F-4f2b-9A0C-57FCFD89F5C8} Collection f@ '
� � � �� � �� ref:Win32_NamedJobObject Stats f@ '
� � � �� � �� ref:Win32_NamedJobObjectActgInfo � C I M _ C o l l e c t i o n S e t t i n g ϝ��C�� CIM_CollectionSetting 6 � � ��& . 4 \ h � � 5�������� � Win32_NamedJobObjectLimit CIMWin32a Locale UUID {08E31939-FAAB-4a3b-9B10-50151D1B9D24} Collection f@ '
� � � �� � �� ref:Win32_NamedJobObject Setting f@ '
� � � �� � �� ref:Win32_NamedJobObjectLimitSetting �
R O O T \ C I M V 2 _ _ M e t h o d P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 6 8 5 7 7 3 7 2 C 6 6 A 7 B 2 0 6 5 8 4 8 7 F B D 9 5 9 A A 1 5 4 E F 5 4 B 5 F 9 3 5 D C C 5 6 6 3 E 9 2 2 8 B 4 4 3 2 2 8 0 5 \ K I _ 7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D \ I _ F 3 9 B E 2 F 2 C C 7 5 5 1 B D E 9 0 E 6 2 4 B 5 C 7 3 0 1 C 1 5 8 A 6 8 D 6 1 8 B 8 8 7 A 1 3 5 B 2 1 C 9 C B 3 C E F D 8 6 3 E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C 4ϝ��C� ȝ��C�� � ���� ��_ x � __InstanceProviderRegistration \\.\Root\CIMV2:__Win32Provider.Name="MS_NT_EVENTLOG_PROVIDER" g WQL:UnarySelect
E v e n t T r a c e �ѝ��C�' EventTrace �� # I����� � WinInit AMENDMENT LOCALE Flags
� O W a uint32 ValueMap � � � � � � � 0x00000001 0x00000002 0x00000004 0x00000008 0x00000010 0x00000020 0x00000040 DM � � ]�^p [ ��3�� B�;r� � �ɔ� � ��/ � Am/
O M I _ C o n f i g u r a t i o n D o w n l o a d M a n a g e r �xR|�C� * OMI_ConfigurationDownloadManager " ) & s ��~ � � � ( � � ? P � � 3 D � � U��������������������������G � MSFT_WebDownloadManager Description Web download manager class inheriting from OMI_ConfigurationDownloadManager AMENDMENT LOCALE MS_409 AllowUnsecureConnection
� � � � boolean Description Boolean variable to allow unsecure connections CertificateID
� T \ i string Description The certificate ID used to locate the certificate. ConfigurationNames
� � � � string Description The set of configuration names with which to register with the Pull Server. ProxyCredential
� | � � object:MSFT_Credential Description Credential to access the proxy server ProxyURL
� � string Description String URL of the proxy server RegistrationKey
� p x � string Description Registration Key with which to register with the Pull Server ServerURL )
�
� �� string Description String URL of the download manager location � O M I _ M e t a C o n f i g u r a t i o n R e s o u r c e �xR|�C�� ' OMI_MetaConfigurationResource ) A ��L T \ � OMI_ReportManager Description Class defining a report manager AMENDMENT LOCALE MS_409 � O M I _ R e p o r t M a n a g e r �xR|�C�l OMI_ReportManager ) $ f ��q y � � % 4 � � I S � � I T U������������������������ � MSFT_WebReportManager Description Web report manager class inheriting from OMI_ReportManager class AMENDMENT LOCALE MS_409 AllowUnsecureConnection
� � � � boolean Description Specifies whether report manager can use unsecure connection over http. CertificateID
� ` h u string Description The certificate ID used to locate the certificate for secure connections. ProxyCredential
� � " object:MSFT_Credential Description Credential to access the proxy server ProxyURL
� � � string Description String URL of the proxy server RegistrationKey
� � � string Description Registration Key with which to register with the Reporting Server ServerURL )
� � � � � �� string Description URL of the server used by report manager. � O M I _ R e s o u r c e M o d u l e M a n a g e r �xR|�C�a # OMI_ResourceModuleManager ) & s ��~ � � � ( � � & 0 � � - 8 U������������������������ � MSFT_WebResourceManager Description Web resource module manager class inheriting from OMI_ResourceModuleManager AMENDMENT LOCALE MS_409 AllowUnsecureConnection
� � � � boolean Description Boolean variable to allow unsecure connections CertificateID
� T \ i string Description The certificate ID used to locate the certificate. ProxyCredential
� � � � object:MSFT_Credential Description Credential to access the proxy server ProxyURL
� \ d q string Description String URL of the proxy server RegistrationKey
� � � � string Description Registration Key with which to register with the Resource Repository Web ServerURL )
� o w � � �� string Description String URL of the resource module manager location � C I M _ E r r o r �xR|�C�� C CIM_Error 6 � � � ��� � � � � g s ������������������������������������������������������������������ � OMI_Error Description OMI_Error is a class used to report errors in the OMI infrastructure and components built on that infrastructure. Version 2.22.1 AMENDMENT LOCALE MS_409 error_Category < +
� M U uint16 Description Enumeration corresponding to the category enum in MI.h Values � � 5 T x � � � � ? a � � � � * J j � � � � - N q � � � MI_ERRORCATEGORY_NOT_SPECIFIED MI_ERRORCATEGORY_OPEN_ERROR MI_ERRORCATEGORY_CLOSE_EERROR MI_ERRORCATEGORY_DEVICE_ERROR MI_ERRORCATEGORY_DEADLOCK_DETECTED MI_ERRORCATEGORY_INVALID_ARGUMENT MI_ERRORCATEGORY_INVALID_DATA MI_ERRORCATEGORY_INVALID_OPERATION MI_ERRORCATEGORY_INVALID_RESULT MI_ERRORCATEGORY_INVALID_TYPE MI_ERRORCATEGORY_METADATA_ERROR MI_ERRORCATEGORY_NOT_IMPLEMENTED MI_ERRORCATEGORY_NOT_INSTALLED MI_ERRORCATEGORY_OBJECT_NOT_FOUND MI_ERRORCATEGORY_OPERATION_STOPPED MI_ERRORCATEGORY_OPERATION_TIMEOUT MI_ERRORCATEGORY_SYNTAX_ERROR MI_ERRORCATEGORY_PARSER_ERROR MI_ERRORCATEGORY_ACCESS_DENIED MI_ERRORCATEGORY_RESOURCE_BUSY MI_ERRORCATEGORY_RESOURCE_EXISTS MI_ERRORCATEGORY_RESOURCE_UNAVAILABLE MI_ERRORCATEGORY_READ_ERROR MI_ERRORCATEGORY_WRITE_ERROR MI_ERRORCATEGORY_FROM_STDERR MI_ERRORCATEGORY_SECURITY_ERROR MI_ERRORCATEGORY_PROTOCOL_ERROR MI_ERRORCATEGORY_CONNECTION_ERROR MI_ERRORCATEGORY_AUTHENTICATION_ERROR MI_ERRORCATEGORY_LIMITS_EXCEEDED MI_ERRORCATEGORY_QUOTA_EXCEEDED MI_ERRORCATEGORY_NOT_ENABLED error_Code 4
� 1 9 F uint32 Description Application-specific error code error_Type 8
� � � � string Description The name of the error type, for example : 'HRESULT' or 'MI_RESULT' or 'Win32' � �xR|�C�� : 6 $ ) 6 X ��c k s � � � ( C � � � ^ k H Y UU��������������������������������������������������������, � MSFT_DedupProperties ClassVersion 1.0 Description Volume deduplication properties. AMENDMENT LOCALE MS_409 InPolicyFilesCount (
� � � � uint64 Description The number of files that currently qualify for optimization. InPolicyFilesSize 0
� E M Z uint64 Description The aggregate size of all files that currently qualify for optimization. OptimizedFilesCount
� � � � uint64 Description The number of optimized files on the volume. OptimizedFilesSavingsRate $
� o w � uint32 Description The ratio of deduplication savings to the logical size of all optimized files on the volume, expressed as a percentage. OptimizedFilesSize
� = E R uint64 Description The total logical size of all optimized files on the volume, in bytes. SavingsRate
� � � � uint32 Description The ratio of deduplication savings to the logical size of all of the files on the volume, expressed as a percentage. SavingsSize
� � � � uint64 Description The difference between the logical size of the optimized files and the logical size of the store (the deduplicated user data plus deduplication metadata). UnoptimizedSize
� � � � uint64 Description The total logical size of all files on the volume, in bytes. This is an estimate of the volume used space if deduplication feature was disabled. � W _}p � ���o � LV�� � �:��� n �o��� � C�Ó� � C I M _ C o n n e c t e d T o �ʝ��C�h CIM_ConnectedTo ) > ��I Q ] y � u��������� � CIM_SlotInSlot Description Slots are special types of connectors into which adapter cards are typically inserted. The CIM_SlotInSlot relationship represents the ability of a special adapter to extend the existing slot structure to enable otherwise incompatible cards to be plugged into a frame or hosting board. The adapter effectively creates a new slot and can be thought of (conceptually) as a slot in a slot. This enables cards that would otherwise be physically and/or electrically incompatible with the existing slots to be supported, by interfacing to the slot provided by the adapter. This has many practical uses. For example, networking boards are very expensive. As new hardware becomes available, chassis and even card configurations change. To protect the investment of their customers, networking vendors will manufacture special adapters that enable old cards to fit into new chassis or HostingBoards and/or new cards to fit into old. This is done using a special adapter that fits over one or more existing slots and presents a new slot into which the card can plug. AMENDMENT LOCALE Antecedent f@
� � � � ref:CIM_Slot Description The Antecedent reference represents the existing slot(s) of the hosting board, or frame that are being adapted to accommodate a card that would otherwise not be physically and/or electrically compatible with it. Dependent f@
� � � � ref:CIM_Slot Description The new slot provided by the adapter board. � �ʝ��C�o ) . ��9 A W � � * 1 � � U��������������� � CIM_AdjacentSlots Description CIM_AdjacentSlots describes the layout of slots on a hosting board or adapter card. Information like the distance between the slots and whether they are 'shared' (if one is populated, then the other slot can not be used), is conveyed as properties of the association. AMENDMENT LOCALE DistanceBetweenSlots +
� � � � � � real32 Description The distance, in inches, between adjacent slots. Units inches SharedSlots
� ( 5 boolean Description Slots can be located in close proximity on hostingboards or other cards, such that if one of these slots is populated by an adapter card, the other slot must be left empty. This relationship is indicated by the SharedSlots boolean set to TRUE. SlotA f
� ] k x ref:CIM_Slot Description One of the adjacent slots. SlotB f
� � � � ref:CIM_Slot Description The 'other' adjacent slot. r � C I M _ D e p e n d e n c y �ʝ��C�� CIM_Dependency ) ; ��F N Z � � u��������O � CIM_PackageInSlot Description Complex networking devices often are chassis-based. These chassis allow for enhancement and/or augmentation of their base functionality by accepting additional chassis devices, similar to accepting functionality in the form of adding cards. This association models this capability. AMENDMENT LOCALE Antecedent f@
� � � � ref:CIM_Slot Description The slot into which the physical package is inserted. Dependent f@
� ( 5 ref:CIM_PhysicalPackage Description The package in the slot. � C I M _ P a c k a g e I n S l o t �ʝ��C�4 CIM_PackageInSlot ) � ��� � � Y d u��������� � CIM_CardInSlot Description Slots are special types of connectors into which adapter cards are inserted. This relationship of a card in a slot is made explicit using the CIM_CardInSlot association. AMENDMENT LOCALE Antecedent f@
� ! . ref:CIM_Slot Description The slot into which the card is inserted. Dependent f@
� � � � ref:CIM_Card Description The card in the slot. �
C I M _ C o m p o n e n t �ʝ��C�Y CIM_Component ) # � ��� � � o ~ �������� � CIM_LinkHasConnector Description Cables and links utilize physical connectors to actually 'connect' physical elements. This association explicitly defines this relationship of connectors for CIM_PhysicalLink. AMENDMENT LOCALE GroupComponent f@
� # 9 F ref:CIM_PhysicalLink Description The physical link that has a connector. PartComponent f@
� � � � ref:CIM_PhysicalConnector Description The physical connector. � C I M _ P h y s i c a l C o n n e c t o r :tR|�C�� T CIM_PhysicalConnector )
w ���
� � H W
� % v � ! � � � � ���UU��������������������������������������������������������������������������������
� CIM_Slot Description The Slot class represents Connectors into which Packages are inserted. For example, a PhysicalPackage that is a DiskDrive may be inserted into an SCA 'Slot'. As another example, a Card (subclass of PhysicalPackage) may be inserted into a 16-, 32-, or 64-bit expansion 'Slot' on a HostingBoard. PCI or PCMCIA Type III Slots are examples of the latter. AMENDMENT LOCALE HeightAllowed . +
� � � � 9 @ real32 Description Maximum height of an adapter card that can be inserted into the slot, in inches. Units inches LengthAllowed
2 +
� � � � � � real32 Description Maximum length of an adapter card that can be inserted into the slot, in inches. Units inches MaxDataWidth 6 8
� Z b o � � � � uint16 Description Maximum bus width of adapter cards that can be inserted into this slot, in bits. Units bits Values � � � � � 8 16 32 64 128 Number 8
� 6 > K uint16 Description The Number property indicates the physical slot number, which can be used as an index into a system slot table, whether or not that slot is physically occupied. PurposeDescription :
� - 5 B string Description A free-form string describing that this slot is physically unique and may hold special types of hardware. This property only has meaning when the corresponding boolean property, SpecialPurpose, is set to TRUE. SpecialPurpose >
� Q Z g boolean Description Boolean indicating that this slot is physically unique and may hold special types of hardware, e.g. a graphics processor slot. If set to TRUE, then the property, PurposeDescription property (a string), should specify the nature of the uniqueness or purpose of the slot. SupportsHotPlug @
� � � � boolean Description Boolean indicating whether the slot supports hot-plug of adapter cards. ThermalRating B +
� Z b o � � uint32 Description Maximum thermal dissipation of the slot in milliwatts. Units milliwatts VccMixedVoltageSupport F +
� t | uint16 Description An array of enumerated integers indicating the Vcc voltage supported by this slot. Values � � � � Unknown Other 3.3V 5V VppMixedVoltageSupport J +
� �
d
l
uint16 Description An array of enumerated integers indicating the Vpp voltage supported by this slot. Values �
�
�
�
�
Unknown Other 3.3V 5V 12V �nnector. � � � r � � � � �F*#p | ��P�� � �te�
u QWD
S @ Z�5]� t -3�� � M S F T _ N e t A d a p t e r S e t t i n g D a t a �՝��C�� ` $ MSFT_NetAdapterSettingData C , < � �� � Q ` n u } � � � K a � � # > p � � � # U _ � � * g v � � � ��UUU������������������������������������������������������������������������������������������@ � MSFT_NetAdapterAdvancedPropertySettingData UMLPackagePath CIM::Core::Settings NetAdapterCim ClassVersion 1.0.0 locale DefaultDisplayValue
(
� � � �� string DefaultRegistryValue V
� � �� string DisplayName
� C � �� string DisplayParameterType , )
� � � ��� � uint32 ValueMap � � � � � � 1 2 3 4 5 6 DisplayValue $ '
� � �� � �� string NumericParameterBaseValue :
� h � �� string NumericParameterMaxValue B
� � � �� string NumericParameterMinValue >
� � �� string NumericParameterStepValue F
� M � �� string Optional 0
� � � �� boolean RegistryDataType N 4
� � � �� � ��� � uint32 ValueMap 1 4 7 11 RegistryKeyword J '
� _ � �� � �� string RegistryValue R '
� � � �� � �� string ValidDisplayValues 6
� � � �� string ValidRegistryValues
2
� 8 � �� string � # ' � � Reset �� implemented Y ae442007200009F ROOT\standardcimv2 ���� � �� �� * � � ��������� � __PARAMETERS abstract
CmdletOutput object
� 8 Out
� 8 _ �� MSFT_NetAdapterAdvancedPropertySettingData EmbeddedInstance
)
� 8 _ ��� � ID
6
� K _ ��� � object:MSFT_NetAdapterAdvancedPropertySettingData ReturnValue uint32
� � uint32 out
� � � �� __ �! M S F T _ N e t A d a p t e r E l e m e n t S e t t i n g D a t a �՝��C�� + MSFT_NetAdapterElementSettingData # C & 6 � �� � K Z h o w � ����������������� � MSFT_NetAdapterBindingElementSetting UMLPackagePath CIM::Core::Settings NetAdapterCim ClassVersion 1.0.0 locale SettingData f@
� � � � ref:MSFT_NetAdapterBindingSettingData Override MSFT_NetAdapterSettingData � M S F T _ N e t A d a p t e r S e t t i n g D a t a �՝��C�6 > $ MSFT_NetAdapterSettingData C # 3 � �� � H W e l t ~ � � � 9 M � � � � ��U����������������������������������������������������������D � MSFT_NetAdapterBindingSettingData UMLPackagePath CIM::Core::Settings NetAdapterCim ClassVersion 1.0.0 locale BindName *
� � � �� string Characteristics 6
� � � �� uint32 ComponentClassGuid
2
� 1 � �� string ComponentClassName .
� w � �� string ComponentID
&
� � � �� string DisplayName "
� � � �� string Enabled '
� ; � �� � �� boolean � $ ( a j � � � � Enable �� implemented 5 ae442007200009F ROOT\standardcimv2 ���� � �� �� * � ~ � ��������� � __PARAMETERS abstract
cmdletOutput object
� 8 Out
� 8 _ �� MSFT_NetAdapterBindingSettingData EmbeddedInstance
)
� 8 _ ��� � ID
6
� B _ ��� � � object:MSFT_NetAdapterBindingSettingData ReturnValue uint32
� � uint32 out
� � � �� __ � Disable y �� implemented 5 ae442007200009F ROOT\standardcimv2 ���� � �� �� * � ~ � ��������� � __PARAMETERS abstract
cmdletOutput object
� 8 Out
� 8 _ �� MSFT_NetAdapterBindingSettingData EmbeddedInstance
)
� 8 _ ��� � ID
6
� B _ ��� � � object:MSFT_NetAdapterBindingSettingData ReturnValue uint32
� � uint32 out
� � � �� __ � M S F T _ N e t A d a p t e r S e t t i n g D a t a �՝��C�� + $ MSFT_NetAdapterSettingData C 1 A � �� � V e s z � � � � �������������������������������������������= � MSFT_NetAdapterDataPathConfigurationSettingData UMLPackagePath CIM::Core::Settings NetAdapterCim ClassVersion 1.0.0 locale Profile '
� � � �� � �� string ProfileSource $ 4
� � �� � ��! + uint32 ValueMap 7 : 1 2 � �՝��C�\ 6 � �� � : I W ^ f v � � � ; ] � � U���������������������� � MSFT_NetAdapterEncapsulatedPacketTaskOffloadCapabilities NetAdapterCim ClassVersion 1.0.0 locale LsoV2Supported
� � � �� uint32 ReceiveChecksumOffloadSupported
� � � �� uint32 RssSupported
� 3 � �� uint32 TransmitChecksumOffloadSupported
� � � �� uint32 VmqSupported
� � � �� uint32 �7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D �ڝ��C�
ȝ��C�g P � __MethodProviderRegistration \\.\root\CIMV2:__Win32Provider.Name="PlatIdProv" Y0#�p 7 �\`� � ϯ �a � �Y�I � 3�v/�
� [_N� � C I M _ D e p e n d e n c y �ʝ��C� CIM_Dependency ) ! � ��� � � u��������� � CIM_ElementsLinked Description The CIM_ElementsLinked association indicates which physical elements are cabled together by a physical link. AMENDMENT LOCALE Antecedent f@
� � � � ref:CIM_PhysicalLink Description The physical link. Dependent f@
� H a n ref:CIM_PhysicalElement Description The physical element that is linked. � C I M _ D e p e n d e n c y �ʝ��C�� CIM_Dependency ) � ��� � � S ^ u�������� � CIM_ConnectedTo Description The CIM_ConnectedTo association indicates that two or more physical connectors are connected together. AMENDMENT LOCALE Antecedent f@
� � � � ref:CIM_PhysicalConnector Description The Antecedent represents a physical connector that serves as one end of the connection. Dependent f@
� � � � ref:CIM_PhysicalConnector Description The Dependent represents another physical connector that serves as the other end of the connection. rs �
C I M _ C o n t a i n e r �ʝ��C�r
CIM_Container ) % � ��� � � � ������������� � CIM_ConnectorOnPackage Description Physical packages contain connectors as well as other physical elements. The CIM_ConnectorOnPackage association makes explicit the containment relationship between connectors and packages. AMENDMENT LOCALE GroupComponent f@
� 2 K X ref:CIM_PhysicalPackage Description The physical package that has a connector. PartComponent f@
� � � � ref:CIM_PhysicalConnector Description The physical connector. � C I M _ D e p e n d e n c y �ʝ��C�� CIM_Dependency ) ( �� ! - � � u��������A � CIM_ComputerSystemPackage Description Similar to the way that logical devices are 'Realized' by physical elements, unitary computer systems are realized in one or more physical packages. The CIM_ComputerSystemPackage association explicitly defines this relationship. AMENDMENT LOCALE Antecedent f@
� Y r ref:CIM_PhysicalPackage Description The physical package(s) that realize a unitary computer system. Dependent f@
� � # ref:CIM_UnitaryComputerSystem Description The unitary computer system. � C I M _ P h y s i c a l E l e m e n t <tR|�C�p 1 CIM_PhysicalElement ) $ r ��} � � 6 E ��_����������������������������������������������� � CIM_PhysicalConnector Description The CIM_PhysicalConnector class represents any physical element that is used to connect to other elements. Any object that can be used to connect and transmit signals or power between two or more physical elements is a descendant (or member) of this class. For example, slots and D-shell connectors are types of physical connectors. AMENDMENT LOCALE ConnectorPinout
&
� � � � string Description A free-form string describing the pin configuration and signal usage of a physical connector. ConnectorType * +
� ~ � � � � uint16 Description An array of integers defining the type of physical connector. An array is specified to allow the description of 'combinations' of connector information. For example, one array entry could specify RS-232 (value=25), another DB-25 (value=23) and a third entry define the connector as "Male" (value=2). Values z � � � � � � � ) J ` w � � � 2 L S Z b h o v } � � � � � � � � � � � � � �
' , 1 7 = E T d u ~ � � � � � � � � � � � � � � / H a l q v � � � � � �
$
/
:
D
N
f
�
�
�
�
�
�
�
�
4 9 > C H N S Y ` l p t � � � � � � � � � Unknown Other Male Female Shielded Unshielded SCSI (A) High-Density (50 pins) SCSI (A) Low-Density (50 pins) SCSI (P) High-Density (68 pins) SCSI SCA-I (80 pins) SCSI SCA-II (80 pins) SCSI Fibre Channel (DB-9, Copper) SCSI Fibre Channel (Fibre) SCSI Fibre Channel SCA-II (40 pins) SCSI Fibre Channel SCA-II (20 pins) SCSI Fibre Channel BNC ATA 3-1/2 Inch (40 pins) ATA 2-1/2 Inch (44 pins) ATA-2 ATA-3 ATA/66 DB-9 DB-15 DB-25 DB-36 RS-232C RS-422 RS-423 RS-485 RS-449 V.35 X.21 IEEE-488 AUI UTP Category 3 UTP Category 4 UTP Category 5 BNC RJ11 RJ45 Fiber MIC Apple AUI Apple GeoPort PCI ISA EISA VESA PCMCIA PCMCIA Type I PCMCIA Type II PCMCIA Type III ZV Port CardBus USB IEEE 1394 HIPPI HSSDC (6 pins) GBIC DIN Mini-DIN Micro-DIN PS/2 Infrared HP-HIL Access.bus NuBus Centronics Mini-Centronics Mini-Centronics Type-14 Mini-Centronics Type-20 Mini-Centronics Type-26 Bus Mouse ADB AGP VME Bus VME64 Proprietary Proprietary Processor Card Slot Proprietary Memory Card Slot Proprietary I/O Riser Slot PCI-66MHZ AGP2X AGP4X PC-98 PC-98-Hireso PC-H98 PC-98Note PC-98Full SSA SCSI Circular On Board IDE Connector On Board Floppy Connector 9 Pin Dual Inline 25 Pin Dual Inline 50 Pin Dual Inline 68 Pin Dual Inline On Board Sound Connector Mini-jack PCI-X Sbus IEEE 1396-1993 32 bit Sbus IEEE 1396-1993 64 bit MCA GIO XIO HIO NGIO PMC MTRJ VF-45 Future I/O SC SG Electrical Optical Ribbon GLM 1x9 Mini SG LC HSSC VHDCI Shielded (68 pins) InfiniBand � � C I M _ P h y s i c a l E l e m e n t =tR|�C�� > CIM_PhysicalElement ) 7 ��B J R ] h � . 5 ��_������������������������������������������������������������ � CIM_PhysicalLink Description The CIM_PhysicalLink class represents the cabling of physical elements together. For example, serial or Ethernet cables, and infrared Links would be subclasses (if additional properties or associations are defined) or instances of CIM_PhysicalLink. In many cases, the numerous physical cables within a physical package or network will not be modeled. However, where these cables or links are critical components, or are tagged assets of the company, these objects can be instantiated using this class or one of its descendent classes. AMENDMENT LOCALE Length
& +
� � � � P W real64 Description The current length of the physical link in feet. For some connections, especially wireless technologies, this property may not be applicable and should be left uninitialized. Units feet MaxLength . +
� � � � � � real64 Description The maximum length of the physical link in feet. Units feet MediaType 6 +
� 9 A N ( uint16 Description The MediaType property defines the particular type of media through which transmission signals pass. Common network media include twisted-pair (value=11 or 12), coaxial (7, 8 or 9) and fiber-optic cable (10). Values t } � � � � � � � � � � � � � Unknown Other Cat1 Cat2 Cat3 Cat4 Cat5 50-ohm Coaxial 75-ohm Coaxial 100-ohm Coaxial Fiber-optic UTP STP Ribbon Cable Twinaxial Optical 9um Optical 50um Optical 62.5um Wired
8
� a j w boolean Description Boolean indicating whether the physical link is an actual cable (TRUE) or a wireless connection (FALSE). �finiBand � �r system. � � rs � � � � � f ������� � __PARAMETERS abstract 0��<� _ &�� � U�S� �9�� � a
�� u $�� � ! �� � �d� � @��D � W i n 3 2 _ S y s t e m M e m o r y R e s o u r c e �ɝ��C� 7 $ Win32_SystemMemoryResource 6 � �� � % - 3 [ g � � ������������������������������������������������������] � Win32_DeviceMemoryAddress CIMWin32 Locale UUID {8502C4CF-5FBB-11D2-AAC1-006008C78BC7} MemoryType
0 6
� � � ��� � H X string ValueMap � � � " * 5 C ReadWrite ReadOnly WriteOnly Prefetchable CombinedWrite Type24 Cacheable WindowDecode Bar MappingStrings ` Win32API|SystemStructures|CM_PARTIAL_RESOURCE_DESCRIPTOR|Flags StartingAddress @ A
� � �� B L � �� uint64 MappingStrings MIF.DMTF|Memory Mapped I/O|001.1 Override StartingAddress � W i n 3 2 _ S y s t e m M e m o r y R e s o u r c e �ɝ��C�W 5 $ Win32_SystemMemoryResource 6 � �� � & , T [ � � ����������������������������������������������������� � Win32_PortResource CIMWin32 Locale UUID {8502C4D0-5FBB-11D2-AAC1-006008C78BC7} Alias
0 )
� � � ��� � boolean MappingStrings � Win32API|Configuration Manager Structures|IO_INFO StartingAddress @ A
� F � ��N ^ � � � �� uint64 MappingStrings f MIF.DMTF|Memory Mapped I/O|001.1 Override StartingAddress � W i n 3 2 _ M e t h o d P a r a m e t e r C l a s s �ɝ��C��
8 $ Win32_MethodParameterClass ) �� ( . V c R h � � u � . 0 < � � m � � � K R � � w � " UUU������������������������������������������������ � � Win32_ProcessStartup Abstract Locale UUID {8502C4DB-5FBB-11D2-AAC1-006008C78BC7} CreateFlags 6
� � � ��� � uint32 MappingStrings � Win32API|Process and Thread Functions|CreateProcess|dwCreationFlags BitMap 8 ; > A D G J N 0 1 2 3 4 9 10 26 EnvironmentVariables )
� � � ��� � string MappingStrings � Win32Registry|HKEY_CURRENT_USER\Environment ErrorMode
2 )
� . � ��6 F uint16 MappingStrings N Win32API|Error Functions|SetErrorMode FillAttribute , )
� � � ��� � uint32 MappingStrings � Win32API|Process and Thread Structures|STARTUPINFO|dwFillAttribute PriorityClass 6
� r � ��z � � � uint32 MappingStrings � Win32API|Process and Thread Structures|JOBOBJECT_BASIC_LIMIT_INFORMATION|PriorityClass ValueMap " ) 32 64 128 256 16384 32768 ShowWindow 0 )
� s � ��{ � uint16 MappingStrings � Win32API|Process and Thread Structures|STARTUPINFO|wShowWindow Title )
� � �� ) string MappingStrings 1 Win32API|Process and Thread Structures|STARTUPINFO|lpTitle WinstationDesktop )
� � � ��� � string MappingStrings � Win32API|Process and Thread Structures|STARTUPINFO|lpDesktop X )
� O � ��W g uint32 MappingStrings o Win32API|Process and Thread Structures|STARTUPINFO|dwX XCountChars $ )
� � � ��� uint32 MappingStrings Win32API|Process and Thread Structures|STARTUPINFO|XCountChars XSize )
� � � ��� � uint32 MappingStrings � Win32API|Process and Thread Structures|STARTUPINFO|dwXSize Y )
� � ��' 7 uint32 MappingStrings ? Win32API|Process and Thread Structures|STARTUPINFO|dwY YCountChars
( )
� � � ��� � uint32 MappingStrings � Win32API|Process and Thread Structures|STARTUPINFO|YCountChars YSize )
� Y � ��a q uint32 MappingStrings y Win32API|Process and Thread Structures|STARTUPINFO|dwYSize � C I M _ S e t t i n g �ɝ��C�� " CIM_Setting
C � �� � , H P V ~ � & 0 � � $ * � � U��������������������������������� � Win32_StartupCommand CIMWin32 Privileges 4 SeRestorePrivilege Locale UUID {8502C50A-5FBB-11D2-AAC1-006008C78BC7} Command 4
� � � �� � ��� � string MappingStrings � Win32Registry|SOFTWARE\Microsoft\Windows\CurrentVersion\Run Location A
� � �� � ��� � . > string ValueMap � � � � Startup Common Startup HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices MappingStrings F Win32Registry|\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\Windows Name 4
� � � �� � ��� � string MappingStrings � Win32API|File Structures|WIN32_FIND_DATA|cFileName User 4
� l � �� � ��t � string MappingStrings � WMI UserSID )
� � � ��� � string MappingStrings � WMI �
C I M _ C o m p o n e n t �ɝ��C�C CIM_Component 6 � �� � & , T d e��������� � Win32_SubDirectory CIMWin32 Locale UUID {F25FE469-783E-11d2-90BF-0060081A46FD} GroupComponent f@ A
� � � �� � ��� � � � ref:Win32_Directory Override GroupComponent MappingStrings � WMI|Win32_Directory PartComponent f@ A
� m � �� � ��� � � � ref:Win32_Directory Override PartComponent MappingStrings � WMI|Win32_Directory � C I M _ S y s t e m C o m p o n e n t �ɝ��C�G CIM_SystemComponent 6 � �� � $ * R b & e��������� � Win32_SystemBIOS CIMWin32 Locale UUID {8502C4EE-5FBB-11D2-AAC1-006008C78BC7} GroupComponent f@ A
� � � �� � ��� � � � ref:Win32_ComputerSystem Override GroupComponent MappingStrings � WMI|Win32_ComputerSystem PartComponent f@ A
� u � �� � ��� � � � ref:Win32_BIOS Override PartComponent MappingStrings � WMI|Win32_BIOS � C I M _ I n s t a l l e d O S �ɝ��C�f CIM_InstalledOS 6 � �� � ' / 5 ] m " 1 u����������� � Win32_SystemOperatingSystem CIMWin32 Locale UUID {8502C4F0-5FBB-11D2-AAC1-006008C78BC7} GroupComponent f@ A
� � � �� � ��� � � ref:Win32_ComputerSystem Override GroupComponent MappingStrings WMI|Win32_ComputerSystem PartComponent f@ A
� � � �� � ��� � � � ref:Win32_OperatingSystem Override PartComponent MappingStrings � WMI|Win32_OperatingSystem � W i n 3 2 _ P n P D e v i c e P r o p e r t y ʝ��C�� ! Win32_PnPDeviceProperty $ * ����������������������\ � Win32_PnPDevicePropertySint16Array Data
� T � �� Sint16 �E 8 E 7 2 C 5 3 4 A B A 4 2 7 E 6 9 C E 6 B 8 8 3 E 8 F F A 9 7 0 1 D E 1 C D D 9 E 0 4 D 7 D 1 8 1 5 F 4 4 2 0 2 9 2 F 1 6 D C [͝��C�'͝��C�J * , " � ScriptingStandardConsumerSetting �8��p 4 ��"�� ] �l�� � 5�_��
�ňE� � �� 6a ! ~͝��C� �� ) 5 � %��������� � HNet_ConnectionIcmpSetting Association Connection f '
� j � �� � �� ref:HNet_Connection IcmpSettings f '
� � � �� � �� ref:HNet_FwIcmpSettings � C I M _ D e p e n d e n c y �ʝ��C�) CIM_Dependency ) � ��� � � J U u��������� � CIM_Realizes Description CIM_Realizes is the association that defines the mapping between a logical device and the physical component that implements the device. AMENDMENT LOCALE Antecedent f@
� � ref:CIM_PhysicalElement Description The physical component that implements the device. Dependent f@
� � � � ref:CIM_LogicalDevice Description The logical device. � �ʝ��C�� )
* ��5 = F � � < O , 2 � � , 5 U���������������������������� � CIM_Product Description CIM_Product is a concrete class that is a collection of physical elements, software features and/or other products, acquired as a unit. Acquisition implies an agreement between supplier and consumer which may have implications to product licensing, support and warranty. AMENDMENT LOCALE Caption
� r z � string Description A short textual description (one-line string) for the Product. Description
� string Description A textual description of the product. IdentifyingNumber )
� � � ��� � string Description Product identification such as a serial number on software, a die number on a hardware chip, or (for non-commercial Products) a project number. Name )
� i � ��q ~ string Description Commonly used product name. SKUNumber
� � � � string Description Product SKU (stock keeping unit) information. Vendor
� J R _ string Description The name of the Product's supplier, or entity selling the Product (the manufacturer, reseller, OEM, etc.). Corresponds to the Vendor property in the Product object in the DMTF Solution Exchange Standard. Version )
� l � ��t � string Description Product version information. Corresponds to the Version property in the product object in the DMTF Solution Exchange Standard. co � �ʝ��C� ) $ z ��� � � 6 ; ���������� � CIM_ParticipatesInSet Description CIM_ParticipatesInSet indicates which physical elements should be replaced together. AMENDMENT LOCALE Element f
� � � � ref:CIM_PhysicalElement Description The physical element which should be replaced with other elements, as a set. Set f
� g � ref:CIM_ReplacementSet Description The CIM_ReplacementSet. w � C I M _ D e p e n d e n c y �ʝ��C�b CIM_Dependency ) �� � � u��������� � CIM_Docked Description A laptop, a type of chassis, may be docked in another type of chassis, a docking station. This is the relationship represented by the CIM_Docked association. Because this is such a typical relationship, it is explicitly described. AMENDMENT LOCALE Antecedent f@
� L ] j ref:CIM_Chassis Description The docking station. Dependent f@
� � � � ref:CIM_Chassis Description The laptop that is 'docked'. � C I M _ M a n a g e d S y s t e m E l e m e n t >tR|�C�� ) " CIM_ManagedSystemElement ) �� - �
� � Q X � � � � y � '
5
�
�
= B | � UU��������������������������������������� � CIM_PhysicalElement AMENDMENT Description Subclasses of CIM_PhysicalElement define any component of a system that has a distinct physical identity. Instances of this class can be defined in terms of labels that can be physically attached to the object. All processes, files, and logical devices are considered not to be physical elements. For example, it is not possible to attach a label to a modem. It is only possible to attach a label to the card that implements the modem. The same card could also implement a LAN adapter. These are tangible managed system elements (usually actual hardware items) that have a physical manifestation of some sort. A managed system element is not necessarily a discrete component. For example, it is possible for a single card (which is a type of physical element) to host more than one logical device. The card would be represented by a single physical element associated with multiple logical devices. LOCALE CreationClassName
� � string Description CreationClassName indicates the name of the class or the subclass used in the creation of an instance. When used with the other key properties of this class, this property allows all instances of this class and its subclasses to be uniquely identified. Manufacturer
� F N [ string Description The name of the organization responsible for producing the physical element. This may be the entity from whom the element is purchased, but this is not necessarily true. The latter information is contained in the Vendor property of CIM_Product. Model
� � � � string Description The name by which the physical element is generally known. OtherIdentifyingInfo
� , string Description OtherIdentifyingInfo captures additional data, beyond asset tag information, that could be used to identify a physical element. One example is bar code data associated with an element that also has an asset tag. Note that if only bar code data is available and is unique/able to be used as an element key, this property would be NULL and the bar code data used as the class key, in the tag property. PartNumber
� � �
string Description The part number assigned by the organization responsible for producing or manufacturing the physical element. PoweredOn
� � � � boolean Description Boolean indicating that the physical element is powered on (TRUE), or is currently off (FALSE). SerialNumber
� a
i
v
string Description A manufacturer-allocated number used to identify the PhysicalElement. SKU
� �
�
string Description The stock keeping unit number for this physical element. Tag
� n v � string Description An arbitrary string that uniquely identifies the physicalelement and serves as the element's key. The Tag property can contain information such as asset tag or serial number data. The key for CIM_PhysicalElement is placed very high in the object hierarchy in order to independently identify the hardware/entity, regardless of physical placement in or on cabinets, adapters, etc. For example, a removable component that can be hot swapped, may be taken from its containing (scoping) package and be temporarily unused. The object still continues to exist - and may even be inserted into a different scoping container. Therefore, the key for physicalelement is an arbitrary string and is defined independently of any placement or location-oriented hierarchy. Version "
� � � � string Description A string indicating the version of the physical element. �docked'. � w � co � � � � :9}�@ ` �$��
6��� �
C I M _ T h r e a d ?tR|�C�4 S CIM_Thread ) R ��]
e r ; C � � 9 C � � � � ]
k
� � � � � � ��]U�������������������������������������������������������������������������������? � Win32_Thread Description The Win32_Thread class represents a thread of execution.While a process must have one thread of execution, the process can create other threads to execute tasks in parallel. Threads share the process environment, thus multiple threads under the same process use less memory than the same number of processes. AMENDMENT LOCALE ElapsedTime 6 +
� � � � & - uint64 Description The ElapsedTime property indicates the total execution time given to this thread since its creation. Units milliseconds Handle @
� o w � string Description The Handle property represents a handle to a thread. The handle has full access rights by default. With the correct security access, the handle can be used in any function that accepts a thread handle. Depending on the inheritance flag specified when it is created, this handle can be inherited by child processes. KernelModeTime @ +
� ! ( uint64 Description The KernelModeTime property indicates the raw counter data from the performance counter type
PERF_SIZE_LARGE | PERF_TYPE_COUNTER | PERF_COUNTER_RATE | PERF_TIMER_100NS | PERF_DELTA_COUNTER | PERF_DISPLAY_PERCENT
The counter data is in 100 nanosecond units. Units 100 nanoseconds Priority @ "
� o w � uint32 Description The Priority property indicates the dynamic priority of the thread. Each thread has a dynamic priority that the scheduler uses to determine which thread to execute. Initially, a thread's dynamic priority is the same as its base priority. The system can raise and lower the dynamic priority, to ensure that it is responsive (guaranteeing that no threads are starved for processor time). The system does not boost the priority of threads with a base priority level between 16 and 31. Only threads with a base priority between 0 and 15 receive dynamic priority boosts. Higher numbers indicate higher priorities. PriorityBase
>
� ( 5 uint32 Description The PriorityBase property indicates the current base priority of a thread. The operating system may raise the thread's dynamic priority above the base priority if the thread is handling user input, or lower it toward the base priority if the thread becomes compute-bound. The PriorityBase propertycan have a value between 0 and 31 ProcessHandle @
*
� � � � string Description The ProcessHandle property indicates the process that created the thread. The contents of this property can be used by Win32 API elements. StartAddress B
� �
�
�
uint32 Description The StartAddress property indicates the starting address of the thread. Because any application with appropriate access to the thread can change the thread's context, this value may only be an approximation of the thread's starting address. ThreadState F +
� � � �
uint32 Description The ThreadState property indicates the current execution state for the thread. A thread can have one of eight values: Initialized (recognized by the microkernel), Ready (prepared to run on next available processor), Running (executing), Standby (about to run, only one thread may be in this state at a time), Terminated (finished executing), Waiting (not ready for the processor, when ready, it will be rescheduled), Transition (thread is waiting for resources other than the processor), and Unknown (the thread state is unknown). Values 9 F M V _ k t � Initialized Ready Running Standby Terminated Waiting Transition Unknown ThreadWaitReason J +
� � � � x � uint32 Description The ThreadWaitReason property indicates why the thread is waiting. The value is only valid if the ThreadState member is set to Waiting. Values of 0 or 7 denote that the thread is waiting for the Executive, 1 or 8 for a Free Page, 2 or 9 for a Page In, 3 or 10 for a Pool Allocation, 4 or 11 for an Execution Delay, 5 or 12 for a Suspended condition, 6 or 13 for a User Request, 14 for an Event Pair High, 15 for an Event Pair Low, 16 for an Local Procedure Call (LPC) Receive, 17 for an LPC Reply, 18 for Virtual Memory, 19 for a Page Out. 20 and higher are not assigned. Event Pairs allow communication with protected subsystems (see Context Switches). Values � � � � ' 2 < D T d n v � � � � � � Executive FreePage PageIn PoolAllocation ExecutionDelay FreePage PageIn Executive FreePage PageIn PoolAllocation ExecutionDelay FreePage PageIn EventPairHigh EventPairLow LPCReceive LPCReply VirtualMemory PageOut Unknown UserModeTime @ . +
� & ' . uint64 Description The UserModeTime property indicates the raw counter data from the performance counter type
PERF_SIZE_LARGE | PERF_TYPE_COUNTER | PERF_COUNTER_RATE | PERF_TIMER_100NS | PERF_DELTA_COUNTER | PERF_DISPLAY_PERCENT
The counter data is in 100 nanosecond units. Units 100 nanoseconds de � C I M _ I n f r a r e d C o n t r o l l e r �tR|�C�� A CIM_InfraredController ) # � ��� � � b p ����������������������������������������������������������������� � Win32_InfraredDevice Description The Win32_InfraredDevice class represents the capabilities and management of an infrared device. AMENDMENT LOCALE DeviceID @ )
� � � � � �� string Description The DeviceID property contains a string uniquely identifying the infrared device with other devices on the system. Manufacturer 8
� � � � string Description The Manufacturer property indicates the name of the manufacturer of the infrared device .
Example: Acme � C I M _ L o g i c a l E l e m e n t �tR|�C�� CIM_LogicalElement ) ( � ��� � � � � D N � � � � � U�������������������������� � Win32_QuickFixEngineering Description The Win32_QuickFixEngineering class represents system-wide Quick Fix Engineering (QFE) or updates that have been applied to the current operating system. AMENDMENT LOCALE CSName
�
string Description The CSName property contains the local name of the computer system. The value for this member comes from the CIM_ComputerSystem class. FixComments
� � � � string Description The FixComments property contains additional comments relating to the update. HotFixID )
� � � � � �� string Description The HotFixID property specifies the unique identifier associated with a particular QFE. InstalledBy
� , 4 A string Description The InstalledBy property identifies who installed the update. If this value is unknown, the property will be empty. InstalledOn
� � � string Description The InstalledOn property provides the date and time when the update was installed. If this value is unknown, the property will be empty. ServicePackInEffect )
� � � � � �� string Description The ServicePackInEffect property specifies what servicepack was in effect when the update was applied. If no service pack has been applied, the property takes on the value SP0. If it can not be determined what service pack was in effect, this property will be NULL. av �le: Acme �oseconds de �le: Acme � � � � {�$�� � �S�� ��x�� � �ؒO
� ���+" � ڥ � �>��� ` �_�X' I ���p 7�r�u ( �%� � 8 rT�� & �Cn� 6 r~\X1 , �֝��C�� A � �� � & H U W ��b o � � � � �
� � ! U���������� � Win32_RoamingUserHealthConfiguration UserProfileConfigurationProvider description singleton inpartition w local-system HealthStatusForTempProfiles N
� � � �� � �� | � � � uint8 description Configure how the Win32_UserProfile::HealthStatus property should reflect the use of temporary profiles. Values � � � Healthy Unhealthy Caution ValueMap � � � 0 1 2 LastProfileDownloadIntervalCautionInHours 4
� A � �� � ��I V uint16 description This is the time threshold, in hours, after which the profile health is reported as Caution when the profile has not been downloaded yet LastProfileDownloadIntervalUnhealthyInHours 4
� O � �� � ��W d uint16 description This is the time threshold, in hours, after which the profile health is reported as Unhealthy when the profile has not been uploaded yet LastProfileUploadIntervalCautionInHours 4
� Y � �� � ��a n uint16 description This is the time threshold, in hours, after which the profile health is reported as Caution when the profile has not been uploaded yet LastProfileUploadIntervalUnhealthyInHours 4
� c � �� � ��k x uint16 description This is the time threshold, in hours, after which the profile health is reported as Unhealthy when the profile has not been downloaded yet � � �֝��C�� A � �� � < I \ ��g t � � w � ) 7 / E � � U��������������Y � Win32_OfflineFilesHealth UserProfileConfigurationProvider description Private Interface singleton inpartition | local-system LastSuccessfulSyncTime )
� � � ��� � string description A DATETIME value, in string format, that represents the last time this folder was successfully synchronized to the Offline Files cache. LastSyncStatus )
� � � ��� � uint8 description The status of the last attempt to synchronize this folder to the Offline Files cache. LastSyncTime )
� n � ��v � string description A DATETIME value, in string format, that represents the last time an attempt was made to synchronized this folder to the Offline Files cache, even if it was unsuccessful. OfflineAccessEnabled )
� | � ��� � boolean description If true, the Offline Files feature is enabled for this folder. OnlineMode )
� � �� + boolean description If true, the share is working in Online mode io �F D 1 C 1 D 4 1 4 B 7 1 B 5 0 8 2 C 2 6 6 A 6 5 0 E 3 1 E F 6 D 5 0 1 9 3 8 2 7 2 4 2 4 4 B 6 8 5 F 2 1 7 C 0 A A E 0 0 A 9 2 1 �֝��C�Cȝ��C�$ � __SystemSecurity C I M _ S A N e g o t i a t i o n A c t i o n
ם��C�� \ ! CIM_SANegotiationAction 1 9 P " y � � � ��������������������������������������������������������� ����� ��� � CIM_IKEAction UMLPackagePath CIM::IPsecPolicy locale AggressiveModeGroupID T +
� � � � � � uint16 ValueMap � � � � � � � � 0 1 2 3 4 5 .. 0x8000.. ModelCorrespondence � CIM_IKEAction.VendorID ExchangeMode L
� N V ` uint16 ValueMap p s v 2 3 4 UseIKEIdentityType N +
� � � � I ^ uint16 ValueMap # & ) , / 3 7 ; ? 1 2 3 4 5 6 7 8 9 10 11 12 .. 0x8000.. ModelCorrespondence f CIM_IPNetworkIdentity.IdentityType VendorID P
� � string � C I M _ S e t t i n g D a t a ם��C�� CIM_SettingData ) ' < ��F �����������������N � CIM_ScopedSettingData UMLPackagePath CIM::Core::Settings Abstract locale �6 4 6 5 9 A B 9 F 8 F 1 C 4 B 5 6 8 D B 6 4 3 8 B A E 1 1 B 2 6 E E 8 F 9 3 C B 5 F 8 1 9 5 E 2 1 E 8 C 3 8 3 D 6 C 4 4 C C 4 1 �:Ͼlu�ȝ��C�)
� __NAMESPACE SMB 4 1 C 5 3 E 6 D B 1 A C F 2 4 5 3 C E F D 4 1 3 9 8 1 9 8 E 6 1 3 F 1 0 D F F 4 7 7 0 9 E C A B 1 D 7 F 0 3 7 7 5 6 A C 8 C E 7 �:Ͼlu�ȝ��C�� � � __thisNAMESPACE � �� � p # ? 5 7 E 5 F 3 A D D 9 E 2 4 2 C 4 E 9 F 9 E D F 7 9 A A 9 7 F 7 9 E 7 9 1 1 C 5 A 8 B 9 0 2 E C 1 5 0 D 6 4 4 2 E 3 B 8 5 A 5 A A �:Ͼlu�ȝ��C�� �����M @ 9 W � __Win32Provider {3B873591-9427-4418-A086-79175735738F} NetworkServiceHost smbwmiv2 7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D �:Ͼlu�
ȝ��C�u ^ � __MethodProviderRegistration \\.\ROOT\Microsoft\Windows\Smb:__Win32Provider.Name="smbwmiv2" R O O T \ M i c r o s o f t \ W i n d o w s \ S m b _ _ M e t h o d P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 3 7 F D 5 3 8 6 C 0 2 8 E 9 6 0 C 9 0 B C 7 7 B 9 D 8 D D C A 2 8 B 2 4 B A E 2 E 3 1 5 E 8 D 8 2 0 9 B F 5 E 2 6 3 3 5 7 5 D 8 \ K I _ 7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D \ I _ B C 0 0 0 C F E 0 4 C 2 A 2 3 B 7 4 5 1 0 5 F B 1 5 7 1 C A 3 D 8 9 0 D 9 5 8 0 D 1 A A 6 7 4 6 2 2 4 E 3 9 8 C 7 5 8 7 F D 8 4 0 8 9 9 3 0 7 4 0 8 A 3 2 0 4 0 A 6 D A 1 9 C 0 B 1 E C 2 7 4 5 A 3 D 6 0 4 B A A 9 D F F E 8 E E 4 B 7 5 C 3 D 9 1 E 1 6 1 0 9 �:Ͼlu�ȝ��C�� M � � __EventProviderRegistration % select * from MSFT_SmbShareChangeEvent \\.\ROOT\Microsoft\Windows\Smb:__Win32Provider.Name="smbwmiv2" R O O T \ M i c r o s o f t \ W i n d o w s \ S m b _ _ E v e n t P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 3 7 F D 5 3 8 6 C 0 2 8 E 9 6 0 C 9 0 B C 7 7 B 9 D 8 D D C A 2 8 B 2 4 B A E 2 E 3 1 5 E 8 D 8 2 0 9 B F 5 E 2 6 3 3 5 7 5 D 8 \ K I _ 0 8 9 9 3 0 7 4 0 8 A 3 2 0 4 0 A 6 D A 1 9 C 0 B 1 E C 2 7 4 5 A 3 D 6 0 4 B A A 9 D F F E 8 E E 4 B 7 5 C 3 D 9 1 E 1 6 1 0 9 \ I _ B C 0 0 0 C F E 0 4 C 2 A 2 3 B 7 4 5 1 0 5 F B 1 5 7 1 C A 3 D 8 9 0 D 9 5 8 0 D 1 A A 6 7 4 6 2 2 4 E 3 9 8 C 7 5 8 7 F D 8 4 4 E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C �:Ͼlu� ȝ��C�� � ��������` y � __InstanceProviderRegistration \\.\ROOT\Microsoft\Windows\Smb:__Win32Provider.Name="smbwmiv2" h WQL:UnarySelect R O O T \ M i c r o s o f t \ W i n d o w s \ S m b _ _ I n s t a n c e P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 3 7 F D 5 3 8 6 C 0 2 8 E 9 6 0 C 9 0 B C 7 7 B 9 D 8 D D C A 2 8 B 2 4 B A E 2 E 3 1 5 E 8 D 8 2 0 9 B F 5 E 2 6 3 3 5 7 5 D 8 \ K I _ E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C \ I _ B C 0 0 0 C F E 0 4 C 2 A 2 3 B 7 4 5 1 0 5 F B 1 5 7 1 C A 3 D 8 9 0 D 9 5 8 0 D 1 A A 6 7 4 6 2 2 4 E 3 9 8 C 7 5 8 7 F D 8 4 C�eSP � SX� z �ĺ� �
rU�e � 6 4 6 5 9 A B 9 F 8 F 1 C 4 B 5 6 8 D B 6 4 3 8 B A E 1 1 B 2 6 E E 8 F 9 3 C B 5 F 8 1 9 5 E 2 1 E 8 C 3 8 3 D 6 C 4 4 C C 4 1 �Ν��C�ȝ��C�/
� __NAMESPACE directory C I M _ A s s o c i a t e d M e m o r y �ʝ��C�:
CIM_AssociatedMemory ) , q ��| � � / : W������������� � CIM_AssociatedProcessorMemory Description Associates the processor and system memory, or a processor's cache. AMENDMENT LOCALE BusSpeed +
� � � � $ uint32 Description Speed of the bus, in MHertz, between the processor and memory. Units megahertz Dependent f@
� f y � ref:CIM_Processor Description The processor that accesses the memory or uses the cache. � C I M _ L o g i c a l E l e m e n t @tR|�C��
9 CIM_LogicalElement ) � ��� � � , � � b j � � � � E M � � � � [ j � � UUU������������������������������������������������������� � CIM_Thread Description Threads represent the ability to execute units of a process or task in parallel. A process can have many threads, each of which is weak to the process. AMENDMENT LOCALE CreationClassName
�
string Description CreationClassName indicates the name of the class or the subclass used in the creation of an instance. When used with the other key properties of this class, this property allow all instances of this class and its subclasses to be uniquely identified. CSCreationClassName
� X ` m string Description The scoping computer system's creation class name. CSName
� � � � string Description The scoping computer system's name. ExecutionState +
� X ` m � � uint16 Description Indicates the current operating condition of the thread. Values include ready (2), running (3), and blocked (4), among others. Values % , 5 > Q Unknown Other Ready Running Blocked Suspended Blocked Suspended Ready Handle )
� � � � � �� string Description A string used to identify the thread. KernelModeTime +
� & . ; � � uint64 Description Time in kernel mode, in milliseconds. If this information is not available, a value of 0 should be used. Units milliseconds OSCreationClassName
� � string Description The scoping operating system's creation class name. OSName
� y � � string Description The scoping operating system's name. Priority "
� � � � uint32 Description Priority indicates the urgency or importance of execution of a thread. A thread may have a different priority than its owning process. If this information is not available for a thread, a value of 0 should be used. ProcessCreationClassName &
� % 2 string Description The scoping process' CreationClassName. ProcessHandle
* )
� � � � � �� string Description The scoping process' Handle. UserModeTime . +
� # 0 � � uint64 Description Time in user mode, in milliseconds. If this information is not available, a value of 0 should be used. Units milliseconds � C I M _ L o g i c a l E l e m e n t �tR|�C�� B CIM_LogicalElement 6
�� * ;
C V � � \ q 9 A � � � � H X R g
�
�
� � g u j
z
UUU���������������������������������������������������������������� � CIM_Process Description Each instance of the CIM_Process class represents a single instance of a running program. A user of the OperatingSystem will typically see a Process as an application or task. Within an OperatingSystem, a Process is defined by a workspace of memory resources and environmental settings that are allocated to it. On a multitasking System, this workspace prevents intrusion of resources by other Processes. Additionally, a Process can execute as multiple Threads, all which run within the same workspace. AMENDMENT DisplayName Processes (CIM) LOCALE CreationClassName +
� � � � � � string Description CreationClassName indicates the name of the class or the subclass used in the creation of an instance. When used with the other key properties of this class, this property allows all instances of this class and its subclasses to be uniquely identified. DisplayName Class Name CreationDate e +
� A N datetime Description Time that the process began executing. DisplayName CreationDate CSCreationClassName +
� � � � string Description CSCreationClassName contains the scoping computer system's creation class name. DisplayName Computer System Class Name CSName +
� z � � � � string Description The scoping computer system's name. DisplayName Computer System Name ExecutionState 8
� - 5 B � � � � uint16 Description Indicates the current operating condition of the process. Values include ready (2), running (3), and blocked (4), among others. DisplayName Execution State Values
% , 5 > Q b n w Unknown Other Ready Running Blocked Suspended Blocked Suspended Ready Terminated Stopped Growing Handle 6
� � � � 3 @ � �� string Description A string used to identify the process. A process ID is a kind of process handle. DisplayName Handle KernelModeTime 8
� � � � * = D uint64 Description Time in kernel mode, in milliseconds. If this information is not available, a value of 0 should be used. DisplayName Kernel Model Time Units milliseconds OSCreationClassName +
� � � � � � string Description The scoping operating system's creation class name. DisplayName Operating System Class Name OSName " +
� U
]
j
�
�
string Description The scoping operating system's name. DisplayName Operating System Name Priority & +
� �
�
� � uint32 Description Priority indicates the urgency or importance of execution of a process. If a priority is not defined for a process, a value of 0 should be used. DisplayName Priority TerminationDate e
* +
� � H U datetime Description Time that the process was stopped or terminated. DisplayName Termination Date UserModeTime . 8
� � � � 8
E
U
\
uint64 Description Time in user mode, in milliseconds. If this information is not available, a value of 0 should be used. DisplayName User Mode Time Units milliseconds WorkingSetSize 6 8
� �
�
�
{ � � � uint64 Description The amount of memory in bytes that a process needs to execute efficiently, for an operating system that uses page-based memory management. If an insufficient amount of memory is available (< working set size), thrashing will occur. If this information is not known, NULL or 0 should be entered. If this data is provided, it could be monitored to understand a process' changing memory requirements as execution proceeds. DisplayName Working Set Size Units bytes �iseconds �he cache. � � � � �! M S F T _ N e t S e t t i n g D a t a �yR|�C�� / MSFT_NetSettingData ) $ 1 S ��^ f n � � � ! � � $ 3 � � * 1 �UU��������������������������������������������� � MSFT_NetDnsTransitionConfiguration Description Configuration settings for DNS64 AMENDMENT LOCALE MS_409 AcceptInterface (
� � � � string Description Names of interfaces on which to accept incoming queries AlwaysSynthesize
� 7 @ M boolean Description If true, return synthesized quad-A response even if A record was found ExclusionList
� � � � string Description List of addresses that DNS64 should not translate Latency
� M U b uint32 Description Delay in ms between sending quad-A query and A query OnlySendAQuery
� � � � boolean Description If true, do not send quad-A query before sending A query PrefixMapping
� _ g t string Description Mapping of IPv4 address ranges to IPv4 prefixes SendInterface
$
� � � � string Description Name of interface on which to send outgoing queries State +
� j r � � uint32 Description Indicates whether DNS64 is enabled or disabled Values � � enabled disabled ( 4 C � � � � ( / h � � � Enable & Description Enable DNS64 a42c9160500003S ROOT\StandardCimv2\MS_409 ���� � �� �� * � ��� � __PARAMETERS abstract PassThru boolean
� 4 In
� 4 \ �� ID )
� � \ ��� boolean __ �L a42c9160500003S ROOT\StandardCimv2\MS_409 ���� � �� �� * � G ��������q � __PARAMETERS abstract
OutputObject object
� 8 Out
� 8 _ �� ID
)
� � _ ��� object:MSFT_NetDnsTransitionConfiguration ReturnValue uint32
� : uint32 out
� : B �� __ � Disable � � Description Disable DNS64 a42c9160500003S ROOT\StandardCimv2\MS_409 ���� � �� �� * � ��� � __PARAMETERS abstract PassThru boolean
� 4 In
� 4 \ �� ID )
� � \ ��� boolean __ �L a42c9160500003S ROOT\StandardCimv2\MS_409 ���� � �� �� * � G ��������q � __PARAMETERS abstract
OutputObject object
� 8 Out
� 8 _ �� ID
)
� � _ ��� object:MSFT_NetDnsTransitionConfiguration ReturnValue uint32
� : uint32 out
� : B �� __ � Reset @ M Description Reset DNS64 configuration
a42c9160500003S ROOT\StandardCimv2\MS_409 ���� � �� �� = � N � � 0 � � � G � ^ u � � * � UU�������������������� � __PARAMETERS abstract State boolean
� 1 In
� 1 Y �� ID )
� � Y ��� boolean OnlySendAQuery boolean
� � In
� � �� ID )
� ~ ��C boolean Latency boolean
� � In
� � � �� ID )
� 3 � ��� boolean AlwaysSynthesize boolean
� ` In
� ` � �� ID )
� � � ��� boolean PrefixMapping boolean
� In
� C �� ID )
� � C ��q boolean
ExclusionList boolean
� � In
� � � �� ID
)
� g � ��, boolean SendInterface boolean
� � In
� � � �� ID )
� " � ��� boolean AcceptInterface boolean
� N In
� N v �� ID )
� � v ��� boolean PassThru boolean
� In
� , �� ID )
� � , ��Z boolean __ �L a42c9160500003S ROOT\StandardCimv2\MS_409 ���� � �� �� * � G ��������q � __PARAMETERS abstract
OutputObject object
� 8 Out
� 8 _ �� ID
H% \��C�{/ n ) � �� � ) � 1 U } � � � / W z � � � x � � � R y � � u � � � 0 W � � � i � � � A p � � � V n � � � � 1 Y r � � � �
=
e
�
�
�
�
4 N v � � � � * A i } � � �
/
V
~
�
�
�
�
1 L t � � � � ' O l � � � � " J c � � � � H b � � � � & N d � � � < Z � � > R y � � � � � # A i � � . F � � 8 ` } � 8 S { � � � d q � � � � e � � � 3 [ r � � ` y � � " M � � � F c � � � � A h � � � � � ' 7 � � � � X! l! �! �! �! �! " ." U" r" �" �" '# =# d# �# �# �# �# $ A$ ^$ �$ �$ �$ % .% F% m% �% �% �% G& ^& �& �& �& �& ' $' �' �' ( .( U( s( �( �( �( �( ) .) PUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUu�) �������������������� ������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������) � MSFT_MpPreference ProtectionManagement locale AllowDatagramProcessingOnWinServer k
� t boolean AllowNetworkProtectionDownLevel j
� � boolean AllowNetworkProtectionOnWinServer X �
� boolean AllowSwitchToAsyncInspection s "
� N boolean ApplyDisableNetworkScanningToIOAV > �
� � boolean AttackSurfaceReductionOnlyExclusions M �
� � string AttackSurfaceReductionRules_Actions O �
� @ G Q uint8 ValueMap i l o r u 0 1 2 5 6 AttackSurfaceReductionRules_Ids N �
� � string AttackSurfaceReductionRules_RuleSpecificExclusions { 8
� string AttackSurfaceReductionRules_RuleSpecificExclusions_Id z 4
� q string BruteForceProtectionAggressiveness /
� � � � uint8 ValueMap � � � 0 1 2 BruteForceProtectionConfiguredState *
� D K U uint8 ValueMap i l o r 0 1 2 4 BruteForceProtectionExclusions 0
� � string BruteForceProtectionLocalNetworkBlocking 4
� boolean BruteForceProtectionMaxBlockTime +
� O uint32 BruteForceProtectionSkipLearningPeriod 6
� � boolean CheckForSignaturesBeforeRunningScan K
� � boolean CloudBlockLevel I �
� 1 8 B uint8 ValueMap Z ] ` c f 0 1 2 4 6 CloudExtendedTimeout J �
� � uint32 ComputerID '
� � � �� � �� string ControlledFolderAccessAllowedApplications P �
� 9 string ControlledFolderAccessDefaultProtectedFolders R �
� � string ControlledFolderAccessProtectedFolders Q �
� � string DefinitionUpdatesChannel h
� , 3 = uint8 ValueMap M P S 0 4 5 DisableArchiveScanning 6 �
� � boolean DisableAutoExclusions
� � boolean DisableBehaviorMonitoring 2 �
� boolean DisableBlockAtFirstSeen H �
� P boolean DisableCacheMaintenance ~ ?
� � boolean DisableCatchupFullScan 7 �
� � boolean DisableCatchupQuickScan 8 �
�
boolean DisableCoreServiceECSIntegration � D
� \
boolean DisableCoreServiceTelemetry � F
� �
boolean DisableCpuThrottleOnIdleScans [ �
� �
boolean DisableDatagramProcessing Y �
� + boolean DisableDnsOverTcpParsing d
� m boolean DisableDnsParsing c
� � boolean DisableEmailScanning 9 �
� � boolean DisableFtpParsing r
� ! boolean DisableGradualRelease i
� ` boolean DisableHttpParsing b
� � boolean DisableInboundConnectionFiltering m
� � boolean DisableIOAVProtection 3 �
� &
boolean DisableNetworkProtectionPerfTelemetry o
� u
boolean DisablePrivacyMode / �
� �
boolean DisableQuicParsing w ,
� �
boolean DisableRdpParsing n
� ( boolean DisableRealtimeMonitoring 4 �
� k boolean DisableRemovableDriveScanning : �
� � boolean DisableRestorePoint ; �
� � boolean DisableScanningMappedNetworkDrivesForFullScan < �
� F boolean DisableScanningNetworkFiles = �
� � boolean DisableScriptScanning 5 �
� � boolean DisableSmtpParsing v *
� boolean DisableSshParsing e
� A boolean DisableTamperProtection u (
� � boolean DisableTlsParsing a �
� � boolean EnableControlledFolderAccess L �
� ! uint8 ValueMap 9 < ? B E 0 1 2 3 4 EnableConvertWarnToBlock Z �
� � boolean EnableDnsSinkhole l
� � boolean EnableFileHashComputation V �
� � boolean EnableFullScanOnBatteryPower \ �
� E boolean EnableLowCpuPriority U �
� � boolean EnableNetworkProtection K �
� � � � uint8 ValueMap � � � 0 1 2 EnableUdpReceiveOffload � J
� 3 boolean EnableUdpSegmentationOffload � H
� y boolean EngineUpdatesChannel g
� � � � uint8 ValueMap � � � � � 0 2 3 4 5 6 ExclusionExtension
� 6 string ExclusionIpAddress
� q string ExclusionPath
� � string ExclusionProcess
� � string ForceUseProxyOnly ` �
� boolean HideExclusionsFromLocalUsers q
� ` boolean HighThreatDefaultAction E �
� � � � uint8 ValueMap � � � � � � � 1 2 3 6 8 9 10 IntelTDTEnabled y 2
� % boolean LowThreatDefaultAction C �
� r y � uint8 ValueMap � � � � � � � 1 2 3 6 8 9 10 MAPSReporting - �
� � � uint8 ValueMap 0 1 2 MeteredConnectionUpdates W �
� W boolean ModerateThreatDefaultAction D �
� � � � uint8 ValueMap � � � � � � � 1 2 3 6 8 9 10 NetworkProtectionReputationMode x .
� 0 uint32 OobeEnableRtpAndSigUpdate | <
� r boolean PerformanceModeStatus } >
� � � � uint8 ValueMap � � 0 1 PlatformUpdatesChannel f
� % , 6 uint8 ValueMap R U X [ ^ a 0 2 3 4 5 6 ProxyBypass _ �
� � string ProxyPacUrl ] �
� � string ProxyServer ^ �
� � str �i C I M _ P r i n t e r ]͝��C�W; 8 CIM_Printer
~ � �� � & � � � � ��� ��) 3 C ��$ S _ > U � � � � �
�
� � -
5
[ l � � � � � � � � � � � � � � � � h r � � m y � � �! �!
# # �& �& ( ( R) \) �* �* �+ �+ q, z, R- a- �. �.
0 0 �0 �0 32 A2 �3 4 �5 �5 `7 m7 ������������UUUUUUUU���������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������W8 � Win32_Printer CIMWin32 Description The Win32_Printer class represents a device connected to a Win32 computer system that is capable of reproducing a visual image on a medium. Locale UUID {8502C4BC-5FBB-11D2-AAC1-006008C78BC7} SupportsCreate CreateBy AddPrinterConnection SupportsDelete DeleteBy DeleteInstance SupportsUpdate Attributes 3 � N
� � � �� � ��� � c n uint32 Description The Attributes property indicates the attributes of the Win32 printing device. These attributes are represented through a combination of flags. Attributes of the printer include:
Queued - Print jobs are buffered and queued.
Direct - Specifies that the document should be sent directly to the printer. This is used if print job are not being properly queued.
Default - The printer is the default printer on the computer.
Shared - Available as a shared network resource.
Network - Attached to the network.
Hidden - Hidden from some users on the network.
Local - Directly connected to this computer.
EnableDevQ - Enable the queue on the printer if available.
KeepPrintedJobs - Specifies that the spooler should not delete documents after they are printed.
DoCompleteFirst - Start jobs that are finished spooling first.
WorkOffline - Queue print jobs when printer is not available.
EnableBIDI - Enable bi-directional printing.
RawOnly - Allow only raw data type jobs to be spooled.
Published - Indicates whether the printer is published in the network directory service.
MappingStrings Win32API|Printing and Print Spooler Structures|PRINTER_INFO_2|Attributes BitValues � � � � � � � � � * 3 Queued Direct Default Shared Network Hidden Local EnableDevQ KeepPrintedJobs DoCompleteFirst WorkOffline EnableBIDI RawOnly Published AveragePagesPerMinute S 6
� � � ��� � 5 E uint32 Description The AveragePagesPerMinute property specifies the rate (average number of pages per minute) that the printer is capable of sustaining. MappingStrings M Win32API|Printing and Print Spooler Structures|PRINTER_INFO_2|AveragePPM Comment C � A
� � � �� � ��� Y i string Description The Comment property specifies the comment of a print queue.
Example: Color printer MappingStrings q Win32API|Printing and Print Spooler Structures|PRINTER_INFO_2|pComment Default 6 � 6
�
� ��
x
�
boolean Description The Default property indicates whether the printer is the default printer on the computer. MappingStrings �
DefaultPriority Q A
� �
� �� � ���
f v uint32 Description The DefaultPriority property specifies the default priority value assigned to each print job. MappingStrings ~ Win32API|Printing and Print Spooler Structures|PRINTER_INFO_2|DefaultPriority DeviceID @ N
� 3 � �� � ��; E O \ � � string Override DeviceId Description The DeviceID property contains a string uniquely identifying the printer with other devices on the system. MappingStrings � Win32API|Printing and Print Spooler Structures|PRINTER_INFO_4|sPrinterName Direct 5 � A
� �
� �� � ���
�
9 I boolean Description The Direct property indicates whether the print jobs should be sent directly to the printer. This means that no spool files are created for the print jobs.
MappingStrings Q Win32API DoCompleteFirst = � A
� � � �� � ��� � h x boolean Description The DoCompleteFirst property indicates whether the printer should start jobs that have finished spooling as opposed to the order of the job received. MappingStrings � DriverName B � A
� � � �� � ��� � Z j string Description The DriverName property specifies the name of the Win32 printer driver.
Example: Windows NT Fax Driver MappingStrings r Win32API|Printing and Print Spooler Structures|PRINTER_INFO_2|pDriverName EnableBIDI ? � A
� � �� � ��! . � � boolean Description The EnableBIDI property indicates whether the printer can print bidirectionally. MappingStrings � EnableDevQueryPrint ; � A
� � � �� � �� � � boolean Description The EnableDevQueryPrint property indicates whether to hold documents in the queue, if document and printer setups do not match MappingStrings � ExtendedDetectedErrorState K � P
� ( � ��0 = � � ; K uint16 Description The ExtendedDetectedErrorState property reports standard error information. Any additional information should be recorded in the DetecteErrorState property. Values ( 1 8 B M W b l w � � � � � � Unknown Other No Error Low Paper No Paper Low Toner No Toner Door Open Jammed Service Requested Output Bin Full Paper Problem Cannot Print Page User Intervention Required Out of Memory Server Unknown ModelCorrespondence CIM_Printer.ErrorInformation MappingStrings S MIB.IETF|Printer-MIB.hrPrinterDetectedErrorState ExtendedPrinterStatus J � P
� � � �� � � ` h w � uint16 Description Status information for a Printer, beyond that specified in the LogicalDevice Availability property. Values include "Idle" (3) and an indication that the Device is currently printing (4). ValueMap ! $ ' * - 0 3 6 9 < @ D H L P T X \ 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 Values � � � � � � � � � $ 0 @ L ^ j Other Unknown Idle Printing Warmup Stopped Printing Offline Paused Error Busy Not Available Waiting Processing Initialization Power Save Pending Deletion I/O Active Manual Feed MappingStrings � MIB.IETF|Printer-MIB.hrPrinterStatus Hidden : � A
� � �� � �� " s � boolean Description The Hidden property indicates whether the printer is hidden from network users. MappingStrings � KeepPrintedJobs < � A
� � � �� � ��� z � boolean Description The KeepPrintedJobs property indicates whether the print spooler should not delete the jobs after they are completed. MappingStrings � Local 9 � A
� � � �� � ��� N ^ boolean Description The Local property indicates whether the printer is attached to the network. A masquerading printer is printer that is implemented as local printers but has a port that refers to a remote machine. From the application perspective these hybrid printers should be viewed as printer connections since that is their intended behavior. MappingStrings f Location D � A
� � � �� � ��� � : J �4 C I M _ J o b CtR|�C�� 8 CIM_Job ) ! � ��� � � � � Z f y � �
�
� � � � �
��U������������������������������������������������������ � Win32_ScheduledJob Description The Win32_ScheduledJob class represents a job scheduled using the network management schedule service functions (also known as "Job" and "AT command" functions). Note that this is different from the tasks scheduled using the Windows 2000 Task Scheduler. This class is only instrumented on Windows NT 4.0 and later. Each job scheduled against the schedule service is stored persistently (the scheduler will know to start the job even after a reboot) and is executed at the specified time and day of the week and/or month. If the computer is not active or if the scheduled service is not running at the specified job time the schedule service will run the specified job on the next day at the specified time. Scheduled jobs are scheduled with respect to Universal Coordinated Time (UTC), i.e. with bias offset from GMT. This means that a job can be specified using any time zone specification. The Win32_ScheduledJob class will return the local time with UTC offset when enumerating an object and convert to local time when creating new jobs. For example a job specified to run on a computer in Boston at 10:30 pm Monday PST time will be scheduled to run locally at 1:30am Tuesday EST. It should be noted that a client must take into account whether daylight savings time is in operation on the local computer and if so subtract a bias of 60 minutes from the UTC offset. AMENDMENT LOCALE Command
� � � � string Description The Command property contains the name of the command, batch program, or binary file (along with command line arguments) that the schedule service will use to invoke the job.
Example: defrag /q /f DaysOfMonth $ +
� � � � � � uint32 BitValues ~ � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 Description The DaysOfMonth property indicates the days of the month when the job is scheduled to run. DaysOfWeek
( +
� � � � uint32 BitValues � � � � �
Monday Tuesday Wednesday Thursday Friday Saturday Sunday Description The DaysOfWeek property indicates the days of the week when the job is scheduled to run. InteractWithDesktop ,
� � � � boolean Description The InteractWithDesktop property allows the specified job to be interactive (meaning a user can give input to a scheduled job while it is executing).
Values TRUE or FALSE. If TRUE, then the job will be interactive. If FALSE, then the job will not be interactive. JobId . )
� - � �� uint32 Description The JobId property indicates the identifier number of the job. It is used by methods as a handle to a single job being scheduled on this computer. JobStatus @ +
� � � string Description The JobStatus property indicates whether a scheduled service executed successfully the last time this job was supposed to run. Values � � Success Failure RunRepeatedly
2
� �
boolean Description The RunRepeatedly property indicates whether the scheduled job should run repeatedly on the days that the job is scheduled.
Values: TRUE or FALSE. If TRUE, then the job is run repeatedly. If FALSE, then the job is run once. StartTime e@
� , 6 C datetime Description The StartTime property represents the UTC time to run the job, in the form of YYYYMMDDHHMMSS.MMMMMM(+-)OOO, where YYYYMMDD must be replaced by ********. The replacement is necessary because the scheduling service only allows jobs to be configured on a day of the month, day of the week, or run once. A job cannot be run on a specific date.
Example: ********123000.000000-420 which implies 12:30 pm PST with daylight savings time in effect. �# - � � *" ." �# � Create & 3 O W Description The Create function submits a job to the operating system for execution at a specified future time and date. This function requires that the schedule service be started at the computer towhich the job is submitted. The method returns an integer value which can be interpretted as follows:
0 - Successful completion
1 - Not supported
2 - Access denied
8 - Unknown failure
9 - Path not found
21 - Invalid parameter
22 - Service not started
Other - For integer values other than those listed above, refer to Win32 error code documentation. Values { � � � � � � � Successful completion Not supported Access denied Unknown failure Path not found Invalid parameter Service not started Other ) a42c9160500003S ROOT\CIMV2\ms_409 ���� � �� �� * � � ? - � T
� � � U����������������������
� __PARAMETERS abstract Command string
� 3 In
� 3 Z �� The Command parameter contains the name of the command, batch program, or binary file (along with command line parameters) that the schedule service will use to invoke the job.
Example: defrag /q /f Description )
� 3 Z ��P � ID 6
� � Z ��P � � string e StartTime datetime e
� In e
� * �� The StartTime parameter represents the UTC time to run the job. This is of the form YYYYMMDDHHMMSS.MMMMMM(+-)OOO, where YYYYMMDD must be replaced by ********.
Example: ********123000.000000-420 which implies 12:30 pm PST with daylight savings time in effect. Description e )
� * ��] X ID e 6
� � * ��] X � datetime RunRepeatedly boolean
� In
� < �� The RunRepeatedly parameter indicates whether the scheduled job should run repeatedly on the days that the job is scheduled.
Values: TRUE or FALSE. If TRUE, then the job is run repeatedly according to the DaysOfWeek and DaysOfMonth parameter. If no value is supplied the parameter defaults to FALSE. Description )
� < ��� j ID 6
� $ < ��� j � boolean
DaysOfWeek uint32
� K In
� K r �� The DaysOfWeek parameter indicates the days of the week when the job is scheduled to run, and is used only when the RunRepeatedly parameter is TRUE. Description
)
� K r ��6 � � � � � � � � Monday Tuesday Wednesday Thursday Friday Saturday Sunday BitValues
6
� K r ��6 � � z ID
C
� ~ r ��6 � � z ) uint32 DaysOfMonth uint32
� � In
� � � �� The DaysOfMonth parameter indicates the days of the month when the job is scheduled to run, and is used only when the RunRepeatedly parameter is TRUE. Description )
� � � ��� � V
Y
\
_
b
e
h
k
n
q
u
y
}
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 BitValues 6
� � � ��� � �
� ID C
� m � ��� � �
� uint32 InteractWithDesktop boolean
� � In
� � � �� The InteractWithDesktop parameter indicates whether the specified job should be interactive (meaning a user can give input to the scheduled job while it is executing).
Values TRUE or FALSE. If TRUE, then the job will be interactive. The default value of this parameter is FALSE. Description )
� � � ��
� ID 6
� �
� ��
� P
boolean __ �� a42c9160500003S ROOT\CIMV2\ms_409 ���� � �L �� * Y � � ��������" � __PARAMETERS abstract JobId uint32
� 1 Out
� 1 X �� The JobId parameter indicates the identifier number of the job. This parameter is a handle to the job being scheduled on this computer. Description )
� 1 X �� � ID 6
� � X �� � U uint32 ReturnValue uint32
� � uint32 out
� � � �� __ � Delete �
y! �! Description The Delete method deletes a scheduled job. The method returns an integer value which can be interpretted as follows:
0 - Successful completion
1 - Not supported
2 - Access denied
8 - Unknown failure
9 - Path not found
21 - Invalid parameter
22 - Service not started
Other - For integer values other than those listed above, refer to Win32 error code documentation. Values �! �! �! �! �! �! " #" Successful completion Not supported Access denied Unknown failure Path not found Invalid parameter Service not started Other � a42c9160500003S ROOT\CIMV2\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � __ �" string Description The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property. Notify @
�# � � " � string Description User to be notified upon job completion or failure. Owner @
�# T \ " i string Description User that submitted the job. Priority @
�# � � " � uint32 Description Priority indicates the urgency or importance of execution of a job. StartTime e@ $
�# N X " e datetime Description Time that the job was begun. Status @ +
�# � � " � � " � string Description The Status property is a string indicating the current status of the object. Various operational and non-operational statuses can be defined. Operational statuses are "OK", "Degraded" and "Pred Fail". "Pred Fail" indicates that an element may be functioning properly but predicting a failure in the near future. An example is a SMART-enabled hard drive. Non-operational statuses can also be specified. These are "Error", "Starting", "Stopping" and "Service". The latter, "Service", could apply during mirror-resilvering of a disk, reload of a user permissions list, or other administrative work. Not all such work is on-line, yet the managed element is neither "OK" nor in one of the other states. Values � � � � � �
,
8
OK Error Degraded Unknown Pred Fail Starting Stopping Service Stressed NonRecover No Contact Lost Comm TimeSubmitted e@ ,
�# ~
�
" �
datetime Description Time that the job was submitted. UntilTime e@ 0
�# �
�
" datetime Description Time after which the job is invalid or should be stopped. ��o � #�q� ^ m��9� b t�u[ f �R�k� j �+ �
�2�� � ���h L �т�� � [e��t � g+ � ��xZ� � a�OnR o J��
� � 86��b ~ R S O P _ P o l m k r P r o S e t t i n g �uR|�C�Y 8 RSOP_PolmkrProSetting ) % g ��r z ~ ��������������������������������������������������������� � RSOP_PolmkrTaskSetting Description Localized version of RSOP_PolmkrTaskSetting for American English AMENDMENT LOCALE id @ 6
� � � � � � �� string Description Inherited from RSOP_PolmkrProSetting. DisplayName Id precedence @ 6
� _ g t � � � �� uint32 Description Inherited from RSOP_PolmkrProSetting. DisplayName Precedence � R S O P _ P o l m k r T a s k S e t t i n g �uR|�C� 8 RSOP_PolmkrTaskSetting ) * q ��| ��������������������������������������������������������� � RSOP_PolmkrSchedTaskSetting Description Localized version of RSOP_PolmkrSchedTaskSetting for American English AMENDMENT LOCALE � R S O P _ P o l m k r T a s k S e t t i n g �uR|�C� 8 RSOP_PolmkrTaskSetting ) , u ��� ��������������������������������������������������������� � RSOP_PolmkrSchedTaskV2Setting Description Localized version of RSOP_PolmkrSchedTaskV2Setting for American English AMENDMENT LOCALE � R S O P _ P o l m k r T a s k S e t t i n g �uR|�C�" 8 RSOP_PolmkrTaskSetting ) ! . y ��� ��������������������������������������������������������� � RSOP_PolmkrImmediateTaskSetting Description Localized version of RSOP_PolmkrImmediateTaskSetting for American English AMENDMENT LOCALE � R S O P _ P o l m k r T a s k S e t t i n g �uR|�C�& 8 RSOP_PolmkrTaskSetting ) # 0 } ��� ��������������������������������������������������������� � RSOP_PolmkrImmediateTaskV2Setting Description Localized version of RSOP_PolmkrImmediateTaskV2Setting for American English AMENDMENT LOCALE � R S O P _ P o l m k r P r o S e t t i n g �uR|�C�c 8 RSOP_PolmkrProSetting ) * q ��| � � % ��������������������������������������������������������� � RSOP_PolmkrStartMenuSetting Description Localized version of RSOP_PolmkrStartMenuSetting for American English AMENDMENT LOCALE id @ 6
� � � � � �� string Description Inherited from RSOP_PolmkrProSetting. DisplayName Id precedence @ 6
� i q ~ � � � �� uint32 Description Inherited from RSOP_PolmkrProSetting. DisplayName Precedence � R S O P _ P o l m k r P r o S e t t i n g �uR|�C�m 8 RSOP_PolmkrProSetting ) " / { ��� � � # / ��������������������������������������������������������� � RSOP_PolmkrStartMenuSettingVista Description Localized version of RSOP_PolmkrStartMenuSettingVista for American English AMENDMENT LOCALE id @ 6
� � � � � �� string Description Inherited from RSOP_PolmkrProSetting. DisplayName Id precedence @ 6
� s { � � � � �� uint32 Description Inherited from RSOP_PolmkrProSetting. DisplayName Precedence � R S O P _ P o l m k r S e t t i n g �uR|�C� 8 RSOP_PolmkrSetting ) ' k ��v ��������������������������������������������������������~ � RSOP_PolmkrServerSetting Description Localized version of RSOP_PolmkrServerSetting for American English AMENDMENT LOCALE � R S O P _ P o l m k r P r o S e t t i n g �uR|�C�g 8 RSOP_PolmkrProSetting ) , u ��� � � ) ��������������������������������������������������������� � RSOP_PolmkrApplicationSetting Description Localized version of RSOP_PolmkrApplicationSetting for American English AMENDMENT LOCALE id @ 6
� � � � � �� string Description Inherited from RSOP_PolmkrProSetting. DisplayName Id precedence @ 6
� m u � � � � �� uint32 Description Inherited from RSOP_PolmkrProSetting. DisplayName Precedence � R S O P _ P o l m k r P r o S e t t i n g �uR|�C�[ 8 RSOP_PolmkrProSetting ) & i ��t | � ��������������������������������������������������������� � RSOP_PolmkrDriveSetting Description Localized version of RSOP_PolmkrDriveSetting for American English AMENDMENT LOCALE id @ 6
� � � �
� �� string Description Inherited from RSOP_PolmkrProSetting. DisplayName Id precedence @ 6
� a i v � � � �� uint32 Description Inherited from RSOP_PolmkrProSetting. DisplayName Precedence � R S O P _ P o l m k r P r o S e t t i n g �uR|�C�a 8 RSOP_PolmkrProSetting ) ) o ��z � � # ��������������������������������������������������������� � RSOP_PolmkrInternetSetting Description Localized version of RSOP_PolmkrInternetSetting for American English AMENDMENT LOCALE id @ 6
� � � � � �� string Description Inherited from RSOP_PolmkrProSetting. DisplayName Id precedence @ 6
� g o | � � � �� uint32 Description Inherited from RSOP_PolmkrProSetting. DisplayName Precedence � R S O P _ P o l m k r P r o S e t t i n g �uR|�C�\ 8 RSOP_PolmkrProSetting ) $ j ��u } � ��������������������������������������������������������� � RSOP_PolmkrIE7Setting Description Localized version of RSOP_PolmkrInternetSetting for American English AMENDMENT LOCALE id @ 6
� � � � � �� string Description Inherited from RSOP_PolmkrProSetting. DisplayName Id precedence @ 6
� b j w � � � �� uint32 Description Inherited from RSOP_PolmkrProSetting. DisplayName Precedence � R S O P _ P o l m k r P r i n t e r S e t t i n g �uR|�C�% 8 # RSOP_PolmkrPrinterSetting ) ! . y ��� ��������������������������������������������������������� � RSOP_PolmkrSharedPrinterSetting Description Localized version of RSOP_PolmkrSharedPrinterSetting for American English AMENDMENT LOCALE � R S O P _ P o l m k r P r o S e t t i n g �uR|�C�_ 8 RSOP_PolmkrProSetting ) ( m ��x � � ! ��������������������������������������������������������� � RSOP_PolmkrProfileSetting Description Localized version of RSOP_PolmkrProfileSetting for American English AMENDMENT LOCALE id @ 6
� � � � � �� string Description Inherited from RSOP_PolmkrProSetting. DisplayName Id precedence @ 6
� e m z � � � �� uint32 Description Inherited from RSOP_PolmkrProSetting. DisplayName Precedence � R S O P _ P o l m k r F o l d e r O p t i o n S e t t i n g �uR|�C�* 8 ( RSOP_PolmkrFolderOptionSetting ) ! . y ��� ��������������������������������������������������������� � RSOP_PolmkrFolderOptionsSetting Description Localized version of RSOP_PolmkrFolderOptionsSetting for American English AMENDMENT LOCALE � ��k�P � �}�� � 畳� ) N�9� 6 C I M _ L o g i c a l E l e m e n t "ʝ��C�I G CIM_LogicalElement 6 � �� � # + 1
Y e 3 < � � � � � � � � > J � � ~ � " . � � � � WUU�������������������������������������������������������������������3
� Win32_NetworkConnection CIMWin32 Locale UUID {8502C4CD-5FBB-11D2-AAC1-006008C78BC7} AccessMask > 6
� � � ��� � � � uint32 Schema Win32 BitMap
# ' + / 0 1 2 3 4 5 6 7 8 16 17 18 19 20 Comment )
� s � ��{ � string MappingStrings � Win32API|Windows Networking Structures|NETRESOURCE|lpComment ConnectionState C
� 3 � ��; C M � � string MaxLen ValueMap i t { � � � Connected Error Paused Disconnected Connecting Reconnecting MappingStrings � Win32API|Network Management Structures|USE_INFO_1|ui1_status ConnectionType 6
� U � ��] m � � string MappingStrings u Win32API|Windows Networking Structures|NETRESOURCE|dwScope ValueMap � � Current Connection Persistent Connection DisplayType 6
� C � ��K [ � � string MappingStrings c Win32API|Windows Networking Structures|NETRESOURCE|dwDisplayType ValueMap � � � � Domain Generic Server Share LocalName $ )
� % � ��- = string MappingStrings E Win32API|Windows Networking Structures|NETRESOURCE|lpLocalName Name @ A
� � � �� � ��� � � string Override Name MappingStrings
Win32API|Windows Networking Structures|NETRESOURCE Persistent
( )
� � � ��� � boolean MappingStrings � Win32API|Windows Networking Functions|WNetEnumResource ProviderName * )
� � ��' 7 string MappingStrings ? Win32API|Windows Networking Structures|NETRESOURCE|lpProvider RemoteName . )
� � � ��� � string MappingStrings � Win32API|Windows Networking Structures|NETRESOURCE|lpRemoteName RemotePath
2 )
� e � ��m } string MappingStrings � Win32API|Windows Networking Structures|NETRESOURCE|lpRemoteName ResourceType 6 6
� � �� 0 s } string MappingStrings 8 Win32API|Windows Networking Structures|NETRESOURCE|dwType ValueMap � � � Disk Print Any UserName : )
� � � ��� � string MappingStrings
Win32API|Windows Networking Functions|WNetGetUser � C I M _ L o g i c a l E l e m e n t #ʝ��C� CIM_LogicalElement 6 � �� � ' - U c �������������������������� � Win32_NetworkClient CIMWin32 Locale UUID {8502C4D5-5FBB-11D2-AAC1-006008C78BC7} Manufacturer )
� � � ��� � string MappingStrings � Win32Registry|SYSTEM\CurrentControlSet\Services\LanmanWorkstation\NetworkProvider|Mfg Name @ A
� f � �� � ��n x ~ � string Override Name MappingStrings � Win32Registry|SYSTEM\CurrentControlSet\Services\LanmanWorkstation\NetworkProvider|Name Wo � C I M _ L o g i c a l E l e m e n t $ʝ��C�� D CIM_LogicalElement 6 � �� � ! ) / W n 0 � � � � S g � � m s 1 G � � � z � @ T �
�
�
� � H e
.
�
�
WUUU��������������������������������������������������������������� � Win32_NetworkProtocol CIMWin32 Locale UUID {8502C4D8-5FBB-11D2-AAC1-006008C78BC7} ConnectionlessService )
� � � ��� � boolean MappingStrings � Win32_API|Windows Sockets Structures|PROTOCOL_INFO|dwServiceFlags|XP1_CONNECTIONLESS GuaranteesDelivery )
� g � ��p � boolean MappingStrings � Win32_API|Windows Sockets Structures|PROTOCOL_INFO|dwServiceFlags|XP_GUARANTEED_DELIVERY GuaranteesSequencing )
� / � ��8 H boolean MappingStrings P Win32_API|Windows Sockets Structures|PROTOCOL_INFO|dwServiceFlags|XP_GUARANTEED_ORDER MaximumAddressSize )
� � � ���
uint32 MappingStrings Win32_API|Windows Sockets Structures|PROTOCOL_INFO|iMaxSockAddr MaximumMessageSize )
� � � ��� � uint32 MappingStrings � Win32_API|Windows Sockets Structures|PROTOCOL_INFO|dwMessageSize MessageOriented
" )
� H � ��Q a boolean MappingStrings i Win32_API|Windows Sockets Structures|PROTOCOL_INFO|dwServiceFlags|XP_MESSAGE_ORIENTED MinimumAddressSize $ )
� � �� # uint32 MappingStrings + Win32_API|Windows Sockets Structures|PROTOCOL_INFO|iMinSockAddr Name @ A
� � � �� � ��� � � � string Override Name MappingStrings � Win32_API|Windows Sockets Structures|PROTOCOL_INFO|lpProtocol PseudoStreamOriented ( )
� ~ � ��� � boolean MappingStrings � Win32_API|Windows Sockets Structures|PROTOCOL_INFO|dwServiceFlags|XP_PSEUDO_STREAM SupportsBroadcasting
* )
� @ � ��I Y boolean MappingStrings a Win32_API|Windows Sockets Structures|PROTOCOL_INFO|dwServiceFlags|XP_SUPPORTS_BROADCAST SupportsConnectData , )
� � �� boolean MappingStrings ' Win32_API|Windows Sockets Structures|PROTOCOL_INFO|dwServiceFlags|XP_CONNECT_DATA SupportsDisconnectData . )
� � � ��� � boolean MappingStrings � Win32_API|Windows Sockets Structures|PROTOCOL_INFO|dwServiceFlags|XP_DISCONNECT_DATA SupportsEncryption 0 )
� � � ��� � boolean MappingStrings � Win32_API|Windows Sockets Structures|PROTOCOL_INFO|dwServiceFlags|XP_ENCRYPTS SupportsExpeditedData 2 )
� I
� ��R
b
boolean MappingStrings j
Win32_API|Windows Sockets Structures|PROTOCOL_INFO|dwServiceFlags|XP_EXPEDITED_DATA SupportsFragmentation 4 )
�
� �� & boolean MappingStrings . Win32_API|Windows Sockets Structures|PROTOCOL_INFO|dwServiceFlags|XP_FRAGMENTATION SupportsGracefulClosing 6 )
� � � ��� � boolean MappingStrings � Win32_API|Windows Sockets Structures|PROTOCOL_INFO|dwServiceFlags|XP_GRACEFUL_CLOSE SupportsGuaranteedBandwidth 8 )
� � � ��� � boolean MappingStrings � Win32_API|Windows Sockets Structures|PROTOCOL_INFO|dwServiceFlags|XP_BANDWIDTH_ALLOCATION SupportsMulticasting : )
� e
� ��n
~
boolean MappingStrings �
Win32_API|Windows Sockets Structures|PROTOCOL_INFO|dwServiceFlags|XP_SUPPORTS_MULTICAST SupportsQualityofService < )
� 0 � ��9 I boolean MappingStrings Q Win32_API|Windows Sockets Structures|WSAPROTOCOL_INFO|dwServiceFlags1|XP1_QOS_SUPPORTED �5 7 E 5 F 3 A D D 9 E 2 4 2 C 4 E 9 F 9 E D F 7 9 A A 9 7 F 7 9 E 7 9 1 1 C 5 A 8 B 9 0 2 E C 1 5 0 D 6 4 4 2 E 3 B 8 5 A 5 A A )̝��C�ȝ��C�� ������# D � __Win32Provider Decoupled:NonCOM Standard Non-COM Event Provider ��~�� � .?��^
A '�꩟ X�]j� ��NA� x�g'� [ �|dN< h E!�� �胪 H C I M _ D a t a F i l e 5ϝ��C�� � CIM_DataFile A � �� � / ��? G M u � � � ! S f � � W ` ��������W������������������������������������������������������������������������������������������������������������������������������������������������������� � Win32_NTEventlogFile MS_NT_EVENTLOG_PROVIDER SupportsUpdate Locale UUID {8502C57B-5FBB-11D2-AAC1-006008C78BC7} LogfileName ! ~ '
� � � �� � �� string Fixed MaxFileSize " � '
� � �� � �� uint32 NumberOfRecords # �
� K � �� uint32 OverwriteOutDated % � 4
� � � �� � ��� � uint32 Range 0-365 | 4294967295 OverWritePolicy $ � 4
� � �� � ��& 0 string ValueMap @ C K 0 1..365 4294967295 Sources & �
� � � �� string � � � C S � � � ClearEventlog ) 8 B d ��q } ValueMap V Y \ ` 0 8 21 .. implemented Privileges � � SeSecurityPrivilege SeBackupPrivilege ae442007200009F ROOT\CIMV2 ���� � �� �� * � ����� � __PARAMETERS abstract ArchiveFileName string
� ; in
� ; b �� ID )
� � b ��� string __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � BackupEventlog ) | � � ��� � ValueMap � � � � � 0 8 21 183 .. implemented Privileges � � SeSecurityPrivilege SeBackupPrivilege ae442007200009F ROOT\CIMV2 ���� � �� �� * � ����� � __PARAMETERS abstract ArchiveFileName string
� ; in
� ; b �� ID )
� � b ��� string __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � 6ϝ��C�) = P � �� � ; T d � � � � � � � - f l � � � � � � � �
: H z � � � Q W � � UUUU��������������������������������������������������������� � Win32_NTLogEvent Privileges & SeSecurityPrivilege MS_NT_EVENTLOG_PROVIDER EnumPrivileges l SeSecurityPrivilege Locale UUID {8502C57C-5FBB-11D2-AAC1-006008C78BC7} Category
� � uint16 CategoryString
� string ComputerName
$
� W _ �� string Fixed Data 4
� � Uint8 EventCode
� � uint16 EventIdentifier
� � �� uint32 Fixed EventType 8 )
� P W ��^ h uint8 Fixed ValueMap � � � � � � 0 1 2 3 4 5 InsertionStrings
0
� � string Logfile
� � �� string Message ,
� 2 string RecordNumber
� r � �� uint32 SourceName
� � � �� string Fixed TimeGenerated e
� � �� datetime Fixed TimeWritten e
� @ J �� datetime Fixed Type )
� � � ��� � string Fixed ValueMap � � � � � � 0 1 2 4 8 16 User (
� � string � 7ϝ��C�� [ � �� � . > [ g � � � � �� � � # ��������n � Win32_NTLogEventLog MS_NT_EVENTLOG_PROVIDER EnumPrivileges F SeSecurityPrivilege Privileges o SeSecurityPrivilege Locale UUID {8502C57D-5FBB-11D2-AAC1-006008C78BC7} Association Log f '
� � �� � �� ref:Win32_NTEventlogFile Record f '
� X � �� � �� ref:Win32_NTLogEvent iv � 8ϝ��C�� [ � �� � / ? \ h � � � � �� � � ! ��������m � Win32_NTLogEventUser MS_NT_EVENTLOG_PROVIDER EnumPrivileges G SeSecurityPrivilege Privileges p SeSecurityPrivilege Locale UUID {8502C57E-5FBB-11D2-AAC1-006008C78BC7} Association Record f '
� � �� � �� ref:Win32_NTLogEvent User f '
� V � �� � �� ref:Win32_UserAccount ri � 9ϝ��C� [ � �� � 3 C ` l � � � � �� � � % - ��������x � Win32_NTLogEventComputer MS_NT_EVENTLOG_PROVIDER EnumPrivileges K SeSecurityPrivilege Privileges t SeSecurityPrivilege Locale UUID {8502C57F-5FBB-11D2-AAC1-006008C78BC7} Association Computer f '
� � �� � �� ref:Win32_ComputerSystem Record f '
� b � �� � �� ref:Win32_NTLogEvent it �5 7 E 5 F 3 A D D 9 E 2 4 2 C 4 E 9 F 9 E D F 7 9 A A 9 7 F 7 9 E 7 9 1 1 C 5 A 8 B 9 0 2 E C 1 5 0 D 6 4 4 2 E 3 B 8 5 A 5 A A :ϝ��C�ȝ��C�� ���J 9 i � __Win32Provider {F55C5B4C-517D-11d1-AB57-00C04FD9159E} LocalSystemHost MS_NT_EVENTLOG_EVENT_PROVIDER 0 8 9 9 3 0 7 4 0 8 A 3 2 0 4 0 A 6 D A 1 9 C 0 B 1 E C 2 7 4 5 A 3 D 6 0 4 B A A 9 D F F E 8 E E 4 B 7 5 C 3 D 9 1 E 1 6 1 0 9 ;ϝ��C�ȝ��C�� x � � __EventProviderRegistration % select * from __InstanceCreationEvent where TargetInstance isa "Win32_NTLogEvent" \\.\Root\CIMV2:__Win32Provider.Name="MS_NT_EVENTLOG_EVENT_PROVIDER"
R O O T \ C I M V 2 _ _ E v e n t P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 6 8 5 7 7 3 7 2 C 6 6 A 7 B 2 0 6 5 8 4 8 7 F B D 9 5 9 A A 1 5 4 E F 5 4 B 5 F 9 3 5 D C C 5 6 6 3 E 9 2 2 8 B 4 4 3 2 2 8 0 5 \ K I _ 0 8 9 9 3 0 7 4 0 8 A 3 2 0 4 0 A 6 D A 1 9 C 0 B 1 E C 2 7 4 5 A 3 D 6 0 4 B A A 9 D F F E 8 E E 4 B 7 5 C 3 D 9 1 E 1 6 1 0 9 \ I _ 4 8 1 C 5 6 4 1 F C 3 1 E C D F E D B 9 C C 2 7 B 9 B 4 A C 9 E 3 E D A 5 4 7 9 D 7 2 A B C 3 6 7 6 D E 7 8 0 2 7 6 2 0 D 0 6 4 5 7 E 5 F 3 A D D 9 E 2 4 2 C 4 E 9 F 9 E D F 7 9 A A 9 7 F 7 9 E 7 9 1 1 C 5 A 8 B 9 0 2 E C 1 5 0 D 6 4 4 2 E 3 B 8 5 A 5 A A Pҝ��C�ȝ��C�� ���M 9 V � __Win32Provider {fd209e2e-813b-41c0-8646-4c3e9c917511} NetworkServiceHost IPMIPrv ˨;p > R�+� f #�'# P��� +�k�2 5 E�� g f C I M _ S e t t i n g Qʝ��C� � CIM_Setting
C � �� � % 1 M U [ � � 3 G � � � $ - � � q x � � d s
! � � l w ! � � ~
�
+ 1 � � � � 6
C
�
�
� � Q ] � � � � > L � � � � 7 A � � UUUUUUU������������������������������������������������������������������������������������������������������������������������������������/ � Win32_NetworkLoginProfile CIMWin32 Privileges 9 SeRestorePrivilege Locale UUID {8502C4E7-5FBB-11D2-AAC1-006008C78BC7} AccountExpires e )
� � � ��� � datetime MappingStrings � Win32API|Network Management Structures|USER_INFO_3|usri3_acct_expires AuthorizationFlags )
� ~ � ��� � uint32 MappingStrings � Win32API|Network Management Structures|USER_INFO_3|usri3_auth_flags BadPasswordCount )
� , � ��4 D uint32 MappingStrings L Win32API|Network Management Functions|NetUserEnum CodePage )
� � � ��� � uint32 MappingStrings � Win32API|Network Management Structures|USER_INFO_3|usri3_code_page Comment )
� d � ��l | string MappingStrings � Win32API|Network Management Structures|USER_INFO_3|usri3_comment CountryCode )
�
� �� " uint32 MappingStrings * Win32API|Network Management Structures|USER_INFO_3|usri3_country_code Flags $ 6
� � � ��� � $ uint32 MappingStrings � Win32API|Network Management Structures|USER_INFO_3|usri3_flags BitMap x { ~ � � � � � � � � � � � � � � � � � 0 1 3 4 5 6 7 8 9 11 12 13 16 17 18 19 20 21 22 23 FullName
( )
� � �� string MappingStrings Win32API|Network Management Structures|USER_INFO_3|usri3_full_name HomeDirectory , )
� � � ��� � string MappingStrings � Win32API|Network Management Structures|USER_INFO_3|usri3_home_dir HomeDirectoryDrive 0 )
� X � ��` p string MappingStrings x Win32API|Network Management Structures|USER_INFO_3|usri3_home_dir_drive LastLogoff e
4 )
� � �� datetime MappingStrings & Win32API|Network Management Structures|USER_INFO_3|usri3_last_logoff LastLogon e 8 )
� � � ��� � datetime MappingStrings � Win32API|Network Management Structures|USER_INFO_3|usri3_last_logon LogonHours < 6
� e � ��m � u � string MaxLen MappingStrings � Win32API|Network Management Structures|USER_INFO_3|usri3_logon_hours LogonServer @ )
�
� ��
/
string MappingStrings 7
Win32API|Network Management Structures|USER_INFO_3|usri3_logon_server MaximumStorage D )
� �
� ���
�
uint64 MappingStrings �
Win32API|Network Management Structures|USER_INFO_3|usri3_max_storage Name L A
� � � �� � ��� � � string MaxLen MappingStrings � Win32API|Network Management Structures|USER_INFO_3|usri3_name NumberOfLogons P )
� . � ��6 F uint32 MappingStrings N Win32API|Network Management Structures|USER_INFO_3|usri3_num_logons Parameters T )
� � � ��� � string MappingStrings � Win32API|Network Management Structures|USER_INFO_3|usri3_parms PasswordAge e X )
� z
� ���
�
datetime MappingStrings �
Win32API|Network Management Structures|USER_INFO_3|usri3_password_age PasswordExpires e \ )
� + � ��5 E datetime MappingStrings M Win32API|Network Management Structures|USER_MODALS_INFO_0|usrmod0_max_passwd_age PrimaryGroupId ` )
� � � ��� � uint32 MappingStrings Win32API|Network Management Structures|USER_INFO_3|usri3_primary_group_id Privileges d )
� � � ��� � uint32 MappingStrings � Win32API|Network Management Structures|USER_INFO_3|usri3_priv Profile h )
� 3 � ��; K string MappingStrings S Win32API|Network Management Structures|USER_INFO_3|usri3_profile ScriptPath l )
� � � ��� � string MappingStrings � Win32API|Network Management Structures|USER_INFO_3|usri3_script_path UnitsPerWeek p )
� � � ��� � uint32 MappingStrings � Win32API|Network Management Structures|USER_INFO_3|usri3_units_per_week UserComment t )
� 0 � ��8 H string MappingStrings P Win32API|Network Management Structures|USER_INFO_3|usri3_usr_comment UserId x )
� � � ��� � uint32 MappingStrings � Win32API|Network Management Structures|USER_INFO_3|usri3_user_id UserType | 6
� � � ��� � � � string MappingStrings � Win32API|Network Management Structures|USER_INFO_3|usri3_flags ValueMap . I _ z Normal Account Duplicate Account Workstation Trust Account Server Trust Account Interdomain Trust Account Unknown Workstations � )
� � � ��� � string MappingStrings � Win32API|Network Management Structures|USER_INFO_3|usri3_workstations �
C I M _ C o m p o n e n t Rʝ��C�4 CIM_Component 6 � �� � # ) Q a e��������� � Win32_GroupUser CIMWin32 Locale UUID {8502C508-5FBB-11D2-AAC1-006008C78BC7} GroupComponent f@ A
� � � �� � ��� � � � ref:Win32_Group Override GroupComponent MappingStrings � WMI|Win32_Group PartComponent f@ A
� b � �� � ��u � � ref:Win32_Account Override PartComponent MappingStrings � WMI|Win32_Account � C I M _ L o g i c a l E l e m e n t Sʝ��C�� CIM_LogicalElement �� ! , ��������������������������U � Win32_Session Abstract Locale StartTime e
� K DateTime �
W i n 3 2 _ S e s s i o n Tʝ��C�� ' Win32_Session 6 � �� � & , T k � � � � �_�������������������������������������K � Win32_LogonSession CIMWin32 Locale UUID {9083C21E-7D58-4e0e-BC30-0BC8922AFB8B} AuthenticationPackage
� � String LogonId
� � � �� String LogonType
� uint32 ValueMap 6 9 < ? B E H 2 3 4 5 7 8 9 � C I M _ D e p e n d e n c y Uʝ��C� CIM_Dependency �� $ 0 b m U��������� � Win32_SubSession Abstract Locale Antecedent f@
� O ref:Win32_Session Dependent f@
� � ref:Win32_Session �0 8 9 9 3 0 7 4 0 8 A 3 2 0 4 0 A 6 D A 1 9 C 0 B 1 E C 2 7 4 5 A 3 D 6 0 4 B A A 9 D F F E 8 E E 4 B 7 5 C 3 D 9 1 E 1 6 1 0 9 *̝��C�ȝ��C�� t � � __EventProviderRegistration ) T select * from MSFT_WMI_GenericNonCOMEvent select * from MSFT_NcProvEvent \\.\root\cimv2:__Win32Provider.Name="Standard Non-COM Event Provider" �a{p ��u� � �C�O 1 ���F
� ϒ� � � v�!F� C I M _ M a n a g e d E l e m e n t �ѝ��C�� ) CIM_ManagedElement ( 8 F a � � � " ? � � 4 L � � �U���������������������������������������4 � CIM_RegisteredProfile Version 2.22.0 UMLPackagePath CIM::Interop AdvertiseTypeDescriptions " +
� � � � � � string ArrayType Indexed ModelCorrespondence � CIM_RegisteredProfile.AdvertiseTypes AdvertiseTypes 6
� M U ��_ j s � uint16 Required ArrayType Indexed ModelCorrespondence � CIM_RegisteredProfile.AdvertiseTypeDescriptions InstanceID @ )
� � �� string Override InstanceID OtherRegisteredOrganization +
� x � � � string MaxLen ModelCorrespondence � CIM_RegisteredProfile.RegisteredOrganization RegisteredName )
� " ��, string Required MaxLen RegisteredOrganization )
� � � ��� � uint16 Required ModelCorrespondence � CIM_RegisteredProfile.OtherRegisteredOrganization RegisteredVersion
� " * �� string Required � C I M _ M a n a g e d E l e m e n t �ѝ��C�I 2 CIM_ManagedElement ) ��$ - 5 E
^ s � � N [ � � � � ; L � � w � * 2 � � �UU�����������������������������������������������m � CIM_ManagedSystemElement Abstract Version 2.22.0 UMLPackagePath CIM::Core::CoreElements CommunicationStatus
&
� � uint16 DetailedStatus (
� � � � uint16 ModelCorrespondence � ( CIM_EnabledLogicalElement.PrimaryStatus CIM_ManagedSystemElement.HealthState HealthState $
� z uint16 InstallDate e
� � � � datetime MappingStrings � MIF.DMTF|ComponentID|001.5 Name
� + 3 string MaxLen OperatingStatus *
� x � � uint16 ModelCorrespondence � CIM_EnabledLogicalElement.EnabledState OperationalStatus +
� $ - B uint16 ArrayType Indexed ModelCorrespondence J CIM_ManagedSystemElement.StatusDescriptions PrimaryStatus
,
� � � � uint16 ModelCorrespondence � CIM_ManagedSystemElement.DetailedStatus CIM_ManagedSystemElement.HealthState Status +
� k s �
string Deprecated � CIM_ManagedSystemElement.OperationalStatus MaxLen StatusDescriptions +
� $ 9 string ArrayType Indexed ModelCorrespondence A CIM_ManagedSystemElement.OperationalStatus � C I M _ M a n a g e d S y s t e m E l e m e n t �ѝ��C�� 2 " CIM_ManagedSystemElement ) �� ' . > ��������������������������������������������������W � CIM_LogicalElement Abstract Version 2.6.0 UMLPackagePath CIM::Core::CoreElements � C I M _ L o g i c a l E l e m e n t �ѝ��C�( H CIM_LogicalElement ) ��% . 6 F _ y < L ~ �
� � 6 _ u ���OP����������������������������������������������� ���� �������� N � CIM_EnabledLogicalElement Abstract Version 2.22.0 UMLPackagePath CIM::Core::CoreElements AvailableRequestedStates <
� � � � uint16 ModelCorrespondence � � CIM_EnabledLogicalElement.RequestStateChange CIM_EnabledLogicalElementCapabilities.RequestedStatesSupported EnabledDefault 6
� v � �� uint16 EnabledState .
� � � � uint16 ModelCorrespondence � CIM_EnabledLogicalElement.OtherEnabledState OtherEnabledState 0
� I Q f string ModelCorrespondence n CIM_EnabledLogicalElement.EnabledState RequestedState 4
� � � � uint16 ModelCorrespondence � CIM_EnabledLogicalElement.EnabledState TimeOfLastStateChange e 8
� U datetime TransitioningToState @
� � � � uint16 ModelCorrespondence � � & CIM_EnabledLogicalElement.RequestStateChange CIM_EnabledLogicalElement.RequestedState CIM_EnabledLogicalElement.EnabledState U l . 1 � RequestStateChange % : ModelCorrespondence B CIM_EnabledLogicalElement.RequestedState � ae442007200009F ROOT\cimv2\power ���� � �e �� * o � ������ � __PARAMETERS abstract RequestedState uint16
� : IN
� : a �� � CIM_EnabledLogicalElement.RequestedState ModelCorrespondence )
� : a ��� � ID 6
� U a ��� �
uint16 e TimeoutPeriod datetime e
� ~ IN e
� ~ � �� ID e )
� � ��� datetime __ �� ae442007200009F ROOT\cimv2\power ���� � �� �� * � � % ��������O � __PARAMETERS abstract f Job ref f
� / OUT f
� / S �� ID f )
� � S ��� ref:CIM_ConcreteJob ReturnValue uint32
� uint32 out
� �� __ � C I M _ L o g i c a l D e v i c e �ѝ��C�� � CIM_LogicalDevice - C Q � � & 7 � � � � �������_���������������������������������������������� ���� �������� ����������������������������������������������������������������������������������������������s � CIM_Sensor Version 2.16.0 UMLPackagePath CIM::Device::Sensors CurrentState ) �
� } � � string MaxLen OtherSensorTypeDescription ' � +
� � � � � string MaxLen ModelCorrespondence CIM_Sensor.SensorType PollingInterval * � +
� p x � � uint64 Units NanoSeconds PUnit second * 10^-9 PossibleStates ( �
� � � � string MaxLen SensorType & �
� ' / D uint16 ModelCorrespondence L CIM_Sensor.OtherSensorTypeDescription � R O O T \ c i m v 2 \ p o w e r _ _ I n s t a n c e P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 3 5 7 9 D C 9 5 1 6 5 7 E A 6 0 8 7 1 C D 1 E 9 E B E E 6 A 8 D 0 A D 7 1 1 2 8 7 8 3 7 B D 9 6 3 1 F 6 B 3 F C 9 E C 7 1 4 1 E \ K I _ E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C \ I _ 0 7 5 1 8 8 3 6 0 6 9 F 2 8 6 6 1 B 2 B D E 6 3 E A 9 5 A F E 8 1 F 3 8 2 2 D 4 6 7 7 A 4 9 C B A E 5 F 5 9 4 E D 1 3 F E B A F string Description The Location property specifies the physical location of the printer.
Example: Bldg. 38, Room 1164 MappingStrings R Win32API|Printing and Print Spooler Structures|PRINTER_INFO_2|pLocation Network 8 � A
� � � �� � ��� S c boolean Description The Network property indicates whether the printer is a network printer. MappingStrings k Parameters E � A
� � � �� � ��� � ? O string Description The Parameters property specifies optional parameters for the print processor.
Example: Copies=2 MappingStrings W Win32API|Printing and Print Spooler Structures|PRINTER_INFO_2|pParameters PortName G � A
� � � �� � �� ! /! string Description The PortName property identifies the ports that can be used to transmit data to the printer. If a printer is connected to more than one port, the names of each port are separated by commas. Under Windows 95, only one port can be specified.
Example: LPT1:, LPT2:, LPT3: MappingStrings 7! Win32API|Printing and Print Spooler Structures|PRINTER_INFO_2|pPortName PrinterPaperNames F � 6
� �! � ���! �! �" �" string Description The PrinterPaperNames property indicates the list of paper sizes supported by the printer. The printer-specified names are used to represent supported paper sizes.
Example: B5 (JIS). MappingStrings �" Win32API|Printing and Print Spooler Structures|DeviceCapabilities|DC_PAPERNAMES PrinterState I � N
� w# # �� � ���# �# �$ �$ % (% uint32 DEPRECATED Description This property has been deprecated in favor of PrinterStatus, DetectedErrorState and ErrorInformation CIM properties that more clearly indicate the state and error status of the printer. The PrinterState property specifies a values indicating one of the possible states relating to this printer. MappingStrings �$ Win32API|Printing and Print Spooler Structures|PRINTER_INFO_6|dwStatus Values �% �% �% �% �% �% �% �% �% �% �% & & '& 0& <& L& X& c& m& x& �& �& �& �& Paused Error Pending Deletion Paper Jam Paper Out Manual Feed Paper Problem Offline IO Active Busy Printing Output Bin Full Not Available Waiting Processing Initialization Warming Up Toner Low No Toner Page Punt User Intervention Required Out of Memory Door Open Server_Unknown Power Save PrintJobDataType H � A
� +' � �� � ��3' @' �' �' string Description The PrintJobDataType property indicates the default data type that will be used for a print job. MappingStrings �' Win32API|Printing and Print Spooler Structures|PRINTER_INFO_2|pDataType PrintProcessor T A
� b( � �� � ��j( w( �( �( string Description The PrintProcessor property specifies the name of the print spooler that handles print jobs.
Example: SPOOLSS.DLL. MappingStrings ) Win32API|Printing and Print Spooler Structures|PRINTER_INFO_2|pPrintProcessor Priority R A
� �) � �� � ���) �) :* J* uint32 Description The Priority property specifies the priority of the printer. The jobs on a higher priority printer are scheduled first. MappingStrings R* Win32API|Printing and Print Spooler Structures|PRINTER_INFO_2|DefaultPriority Published A � A
� �* � �� � ��+ + v+ �+ boolean Description The Published property indicates whether the printer is published in the network directory service. MappingStrings �+ Queued 4 � A
� �+ � �� � ���+ �+ O, _, boolean Description The Queued property indicates whether the printer buffers and queues print jobs. MappingStrings g, Win32API RawOnly @ � A
� �, � �� � ���, �, 8- H- boolean Description The RawOnly property indicates whether the printer accepts only raw data to be spooled. MappingStrings P- SeparatorFile L � A
� �- � �� � ���- �- _. o. string Description The SeparatorFile property specifies the name of the file used to create a separator page. This page is used to separate print jobs sent to the printer. MappingStrings w. Win32API|Printing and Print Spooler Structures|PRINTER_INFO_2|pSepFile ServerName M 6
� / � ��/ $/ �/ �/ string Description The ServerName property identifies the server that controls the printer. If this string is NULL, the printer is controlled locally. MappingStrings �/ Win32API|Printing and Print Spooler Structures|PRINTER_INFO_2|pServerName Shared 7 � A
� d0 � �� � ��m0 z0 �0 �0 boolean Description The Shared property indicates whether the printer is available as a shared network resource. MappingStrings �0 ShareName N A
� L1 � �� � ��T1 a1 �1 �1 string Description The ShareName property indicates the share name of the Win32 printing device.
Example: \\PRINTSERVER1\PRINTER2 MappingStrings �1 Win32API|Printing and Print Spooler Structures|PRINTER_INFO_2|pShareName SpoolEnabled U A
� �2 �2 �� � ���2 �2 �3 �3 boolean DEPRECATED Description The SpoolEnabled property shows whether spooling is enabled for this printer.
Values:TRUE or FALSE.
The SpoolEnabled property has been deprecated. There is no replacementvalue and this property is now considered obsolete. MappingStrings �3 Win32API|Printing and Print Spooler Structures|PRINTER_INFO_2|Attributes StartTime e O A
� P4 � �� � ��Z4 g4 K5 [5 datetime Description The StartTime property specifies the earliest time the printer can print a job (if the printer has been limited to print only at certain times). This value is expressed as time elapsed since 12:00 AM GMT (Greenwich mean time). MappingStrings c5 Win32API|Printing and Print Spooler Structures|PRINTER_INFO_2|StartTime UntilTime e P A
� 6 � �� � ��6 6 �6 7 datetime Description The UntilTime property specifies the latest time the printer can print a job (if the printer has been limited to print only at certain times). This value is expressed as time elapsed since 12:00 AM GMT (Greenwich mean time). MappingStrings 7 Win32API|Printing and Print Spooler Structures|PRINTER_INFO_2|UntilTime WorkOffline > � A
� �7 � �� � ���7 �7 =8 M8 boolean Description The WorkOffline property indicates whether to queue print jobs on the computer if the printer is offline. MappingStrings U8 X. � � T \ � � t � c g � � m
| � � � E T � � i | $ ( � � �# �# �& �& �) �+ t- � Pause 6 = ��J W x � � � Implemented Description The Pause method pauses the print queue. No jobs can print anymore until the print queue is resumed. The method can return the following values:
0 - Success.
5 - Access denied.
Other - For integer values other than those listed above, refer to the documentation on the Win32 error codes. ValueMap � � � 0 5 .. Values � � � Success Access denied Other y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � Resume 6 � ��� � � � Z�6� � l��
4�� �&��& �O)t5 �c�A k 9��
� � F i l e T r a c e �ӝ��C�g ~ FileTrace ) � �� � � � � O a � � . ; � � = I � � � � E P �
�
r � � � S h � �
d
p
�
�
7 G � � � � ; F � � � j y � � K Z WUUUUUU������������������������������������������������������������������������������������������������������������������������ � FileOperation EventType +
� � � � � � � � � � � � � � � EventTypeName FileTrace AccessToken B 4
� 3 ; F �� � �� uint32 WmiDataId pointer CreateOnExisting C
� � � � � � � � �� uint8 WmiDataId Values � � � False True NA ValueMap
0 1 2 FileName f C
� k s ~ � � � � �� string WmiDataId StringTermination NullTerminated format w FileObject & A
� " % �� � �� uint64 WmiDataId format x pointer IsDirectory C
� � � � � � � � �� uint8 WmiDataId Values � � � False True NA ValueMap � � � 0 1 2 IsFastIO )
� + 2 � �� uint8 WmiDataId IsPagingIO )
� � � � �� uint8 WmiDataId LastAccessTime
. )
� � �
� �� sint64 WmiDataId MinorOperation )
� 3 : � �� uint8 WmiDataId Operation C
� � � � � | � � �� uint8 WmiDataId Values - s � � � � � � � 3 N d z � � � � �
! 4 E O W f � � � � � � �
+ 9 @ P _ l w NORMALIZE_NAME_COMPONENT GENERATE_FILE_NAME VOLUME_DISMOUNT VOLUME_MOUNT MDL_WRITE_COMPLETE PREPARE_MDL_WRITE MDL_READ_COMPLETE MDL_READ NETWORK_QUERY_OPEN FAST_IO_CHECK_IF_POSSIBLE NOTIFY_STREAM_FILE_OBJECT RELEASE_FOR_CC_FLUSH ACQUIRE_FOR_CC_FLUSH RELEASE_FOR_MOD_WRITE ACQUIRE_FOR_MOD_WRITE RELEASE_FOR_SECTION_SYNCHRONIZATION ACQUIRE_FOR_SECTION_SYNCHRONIZATION CREATE CREATE_NAMED_PIPE CLOSE READ WRITE QUERY_INFORMATION SET_INFORMATION QUERY_EA SET_EA FLUSH_BUFFERS QUERY_VOLUME_INFORMATION SET_VOLUME_INFORMATION DIRECTORY_CONTROL FILE_SYSTEM_CONTROL DEVICE_CONTROL INTERNAL_DEVICE_CONTROL SHUTDOWN LOCK_CONTROL CLEANUP CREATE_MAILSLOT QUERY_SECURITY SET_SECURITY POWER SYSTEM_CONTROL DEVICE_CHANGE QUERY_QUOTA SET_QUOTA PNP ValueMap - >
A
D
G
J
M
P
S
V
Y
\
`
d
h
l
p
t
x
|
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
0 1 2 3 4 5 6 7 8 9 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 OperationalParameters Z 6
� C J U ` � �� uint8 WmiDataId WmiSizeIs ParametersLength ParametersLength J )
� � � � �� uint32 WmiDataId PreviousValue b 6
� ! ( 3 > � �� uint8 WmiDataId WmiSizeIs PreviousValueLength PreviousValueLength R )
� � � � �� uint32 WmiDataId ProcessCreateTime )
� �
� �� sint64 WmiDataId ProcessId
)
� Q
Y
� �� uint32 WmiDataId ResultData ^ 6
� �
�
�
�
� �� uint8 WmiDataId WmiSizeIs ResultLength ResultLength N )
� $ , � �� uint32 WmiDataId SequenceNumber
)
� ~ � � �� uint32 WmiDataId SessionId 6 )
� � � � �� uint32 WmiDataId SidLength F )
� ( 0 � �� uint32 WmiDataId StartTime )
� } � � �� sint64 WmiDataId Status 6
� � � � � � �� uint32 WmiDataId format x UserSID
V 6
� G O Z e � �� object WmiDataId extension Sid VolumeDosName j C
� � � � � � �� string WmiDataId StringTermination NullTerminated format w VolumeGuidName n C
� l t � � � � �� string WmiDataId StringTermination NullTerminated format w VolumeName r C
�
0 @ H � �� string WmiDataId StringTermination NullTerminated format w WindowStation : 4
� � � � �� � �� uint64 WmiDataId pointer �
E v e n t T r a c e �ӝ��C�� EventTrace 6 � �� 4 : b j t { u����w � fdpHostCtlGuid Description FDPHost Service Trace guid {f1c521ca-da82-4d79-9ee4-d7a375723b68} locale MS\0x409 Flags R
� � � � � % 3 B J Y c uint32 Description Enable Flags ValueDescriptions DUMMY Flag DefineValues ; DUMMY Values R DUMMY ValueMap k 0x00000001 �
E v e n t T r a c e �ӝ��C�� EventTrace 6 � �� + 1 Y a k r i����n � FDWNetCtlGuid Description FD WNet Trace guid {8b20d3e4-581f-4a27-8109-df01643a7a93} locale MS\0x409 Flags R
� � � � � * 9 A P Z uint32 Description Enable Flags ValueDescriptions DUMMY Flag DefineValues 2 DUMMY Values I DUMMY ValueMap b 0x00000001 �
E v e n t T r a c e �ӝ��C�� EventTrace 6 � �� 4 : b j t { u����w � fdResPubCtlGuid Description FD Publication Trace guid {649e3596-2620-4d58-a01f-17aefe8185db} locale MS\0x409 Flags R
� � � � � % 3 B J Y c uint32 Description Enable Flags ValueDescriptions DUMMY Flag DefineValues ; DUMMY Values R DUMMY ValueMap k 0x00000001 �
E v e n t T r a c e �ӝ��C�� EventTrace 6 � �� 1 7 _ g q x q����t � CtlGuidAssocDB Description PNPX AssocDB Trace guid {7311AD03-18D6-45ac-9B08-B020BDD6A590} locale MS\0x409 Flags R
� � � � � " 0 ? G V ` uint32 Description Enable Flags ValueDescriptions DUMMY Flag DefineValues 8 DUMMY Values O DUMMY ValueMap h 0x00000001 � R S O P _ P o l m k r P r o S e t t i n g ԝ��C�) 8 RSOP_PolmkrProSetting ( , ^ j ������������, * . ��������������������������������� � RSOP_PolmkrDialupOptionSetting Locale id @
� V � �� string precedence @
� � � �� uint32 �7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D $՝��C�
ȝ��C�m V � __MethodProviderRegistration \\.\root\StandardCimv2:__Win32Provider.Name="NetTtCim" ��?b� �E}�� � Ug�c _ ��� M �G�� C K��'R \ �?K�� ��ڰ R S O P _ P o l i c y S e t t i n g
ѝ��C�� � RSOP_PolicySetting ) ) 1 A t � � � Q a � � G a � � A N � � / 3 p � � � * \ k � � I _ � � � � + ] n � � Q c � � " T c � � (
5
�
�
�
�
0 < n � � � � � / C v � � �
Q
b
�^UUUUUUUUU���������� � � �����������������������������������������������������������������������������������������������������������������������������������������������������
� RSOP_ApplicationManagementPolicySetting Locale AllowX86OnIA64 f
� k � �� boolean ApplicationId '
� � � �� � �� string ApplyCause % � )
� � �� uint32 ValueMap 9 < ? B E H K N 1 2 3 4 5 6 7 8 AssignmentType \ )
� � � � � �� uint32 ValueMap � � � 1 2 3 Categories
4
� � � �� string DemandInstallable d
� > � �� boolean DeploymentLastModifyTime e H
� � � �� datetime DeploymentType X )
� � � � � �� uint32 ValueMap � � 1 2 DisplayInARP n
� 8 � �� boolean Eligibility $ � )
� � � � � �� uint32 ValueMap � � � � 1 2 3 4 EntryType 4
� � �� � �� uint32 ValueMap & ) , 1 2 3 id @ '
� h � �� � �� string IgnoreLanguage p
� � � �� boolean InstallationUI ` )
� � � �� uint32 ValueMap 1 2 LanguageId T
� T � �� uint32 LanguageMatch & � )
� � � � � �� uint32 ValueMap � � � � � 1 2 3 4 5 LossOfScopeAction h )
� % - 7 � �� uint32 ValueMap C F 1 2 MachineArchitectures P
� � � �� uint32 OnDemandClsid ( �
� � � �� string OnDemandFileExtension ' �
� � �� string OnDemandProgId ) �
� U � �� string PackageLocation ,
� � � �� string PackageType )
� � � � � �� uint32 ValueMap 1 2 precedence @ '
� I � �� � �� uint32 PrecedenceReason 8 )
� � � � � �� uint32 ValueMap � � � � � � 1 2 3 4 5 6 ProductId $
� � �� string Publisher
(
� L � �� string RedeployCount D
� � � �� uint32 RemovalCause * � )
� � � � � �� uint32 ValueMap
"
%
1 2 3 4 5 6 7 8 RemovalType + � )
� l
t
~
� �� uint32 ValueMap �
�
�
�
1 2 3 4 RemovingApplication , �
� �
� �� string ReplaceableApplications ! z
� ( � �� string ScriptFile 0
� f � �� string SecurityDescriptor L
� � � �� uint8 SupportURL v
� � � �� string Transforms r
� ' � �� string UninstallUnmanaged l
� m � �� boolean UpgradeableApplications " ~
� � � �� string UpgradeSettingsMandatory # �
�
� �� boolean VersionNumberHi @
� I
� �� uint32 VersionNumberLo <
� �
� �� uint32 � R S O P _ P o l i c y S e t t i n g ѝ��C�� I RSOP_PolicySetting % - C � � � � / � � � � s � � @ Q � � � � L \ �^UU���������� � � ������������������������������������������������� � RSOP_FolderRedirectionPolicySetting Locale configurationControl @ )
� z � ��� � uint32 ValueMap � � 0 1 grantType ,
� � � �� boolean id @ '
� � �� � �� string installationType )
� f n x � �� uint32 ValueMap � � 1 2 moveType .
� � � �� boolean parentFolderId 8
� � �� string policyRemoval
0 )
� O W a � �� uint32 ValueMap m p 1 2 precedence @ '
� � � �� � �� uint32 primaryComputerEvaluation < )
� � �� uint32 ValueMap 4 7 : = 1 2 3 4 redirectedPaths
(
� { � �� string redirectingGroup
� � � �� string redirectionFlags 4
� � �� uint32 resultantPath
� D � �� string securityGroups $
� � � �� string � ѝ��C�G ) ] j � � � � ! ^ m P`� � �������� � � RSOP_ExtensionStatus Locale beginTime e
� S � �� datetime displayName
� � � �� string endTime e
� � � �� datetime error
�
� �� uint32 extensionGuid '
� V � �� � �� string loggingStatus )
� � � � � �� uint32 ValueMap � � � 1 2 3 � ѝ��C�5
# 1 c s � � ������������� � RSOP_ExtensionEventSource Locale eventLogName
� [ � �� string eventLogSource
� � � �� string id '
� � � �� � �� string P_ � ѝ��C�+ ' 4 � � %��������� � RSOP_ExtensionEventSourceLink Locale eventSource f '
� i � �� � �� ref:RSOP_ExtensionEventSource extensionStatus f '
� � � �� � �� ref:RSOP_ExtensionStatus � *ѝ��C�D
# + 2 o ~ � � ������������� � RSOP_IEAdministrativeTemplateFile Locale GPOID '
� g � �� � �� string lastWriteTime e
� � � �� datetime name '
� � � �� � �� string Ad � C I M _ D e p e n d e n c y =ѝ��C�� CIM_Dependency ) � �� � ! ) 5 � � U��������_ � Win32_ShadowOn MSVSS__PROVIDER Locale Antecedent f@ N
� � � �� � ��� � � � ref:Win32_Volume min max override Antecedent Dependent f@ N
� * � �� � ��@ E J T ref:Win32_ShadowCopy min max override Dependent f: �E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C Qҝ��C� ȝ��C� � ���� �� R � __InstanceProviderRegistration \\.\root\Hardware:__Win32Provider.Name="IPMIPrv" ��� � � ��UW� � A)�p � �qq� o ���+�
{ ��� � ���K� @ dH�� � Be� Z � /�S � x)Ơ6 � C I M _ A s s o c i a t e d S e n s o r �ʝ��C�� CIM_AssociatedSensor ) # 0 � ��� � � 2 = � � U���������� � CIM_AssociatedSupplyCurrentSensor Description A power supply may have an associated current sensor, monitoring its input frequency. This is described by this association. AMENDMENT LOCALE Antecedent f@
� � ref:CIM_CurrentSensor Description The current sensor. Dependent f@
� i ~ � ref:CIM_PowerSupply Description The power supply associated with the current sensor. MonitoringRange +
� � � UINT16 Description Indicates the power supply's input frequency range measured by the associated sensor. Range 1, 2 or both can be specified using the values 2, 3 or 4, respectively. Values � � � � Unknown Other Range 1 Range 2 Both Range 1 and 2 ly � C I M _ A s s o c i a t e d S e n s o r �ʝ��C�� CIM_AssociatedSensor ) # 0 � ��� � � 0 ; � � U���������� � CIM_AssociatedSupplyVoltageSensor Description A power supply may have an associated voltage sensor, monitoring its input voltage. This is described by this association. AMENDMENT LOCALE Antecedent f@
� � ref:CIM_VoltageSensor Description The voltage sensor. Dependent f@
� g | � ref:CIM_PowerSupply Description The power supply associated with the voltage sensor. MonitoringRange +
� � � UINT16 Description Indicates the power supply's input voltage range measured by the associated sensor. Range 1, 2 or both can be specified using the values 2, 3 or 4, respectively. Values � � � � Unknown Other Range 1 Range 2 Both Range 1 and 2 pp � C I M _ B a s e d O n �ʝ��C�{ CIM_BasedOn
) ! . � �� r } �������������������������� � CIM_LogicalDiskBasedOnVolumeSet Description LogicalDisks can be BasedOn a single Volume (for example, exposed by a software volume manager), or be BasedOn a DiskPartition directly. The former relationship is made explicit in this association. AMENDMENT LOCALE Antecedent f@
� A T a ref:CIM_VolumeSet Description The volume set. Dependent f@
� � � � ref:CIM_LogicalDisk Description The logical disk which is built on the volume set. � C I M _ B a s e d O n ˝��C�A CIM_BasedOn
) ) � ��� � � + �������������������������� � CIM_PSExtentBasedOnPExtent Description Protected space extents are based on a physical extent. This relationship is made explicit in this association. AMENDMENT LOCALE Antecedent f@
� � �
ref:CIM_PhysicalExtent Description The physical extent. Dependent f@
� W u � ref:CIM_ProtectedSpaceExtent Description The protected space extent which is built on the physical extent. � C I M _ D e p e n d e n c y ˝��C�G CIM_Dependency ) ! q ��| � � � � . U������������������������� � CIM_BIOSLoadedInNV Description A link between BIOS element and non-volatile storage where the BIOS is loaded. AMENDMENT LOCALE Antecedent f@
� � � � ref:CIM_NonVolatileStorage Description The non-volatile storage. Dependent f@
� 7 L Y ref:CIM_BIOSElement Description The BIOS stored in the non-volatile extent. EndingAddress
� � � � UINT64 Description The ending address where the BIOS is located in non-volatile storage. StartingAddress
� Z b o UINT64 Description The starting address where the BIOS is located in non-volatile storage. � C I M _ D e p e n d e n c y ˝��C�� CIM_Dependency ) �� ! - � � u��������* � CIM_BootOSFromFS Description A link between the operating system and the file system(s) from which this operating system is loaded. The association is many-to-many since a distributed OS could depend on several file systems in order to correctly and completely load. AMENDMENT LOCALE Antecedent f@
� Y m z ref:CIM_FileSystem Description The file system from which the operating system is loaded. Dependent f@
� � ref:CIM_OperatingSystem Description The operating system. � C I M _ D e p e n d e n c y ˝��C� CIM_Dependency ) ' � ��� � � u��������� � CIM_DeviceAccessedByFile Description Specifies the logical device that is associated with, and accessed using the referenced CIM_DeviceFile. AMENDMENT LOCALE Antecedent f@
� � � � ref:CIM_DeviceFile Description The device file. Dependent f@
� E \ i ref:CIM_LogicalDevice Description The device that is accessed using the device file. � C I M _ C o n t r o l l e d B y ˝��C�� ) CIM_ControlledBy ) � ��� � � D O � � � � ���������������������������������������� � CIM_SCSIInterface Description CIM_SCSIInterface is a CIM_ControlledBy relationship indicating which devices are accessed through a SCSI controller and the characteristics of this access. AMENDMENT LOCALE Antecedent f@
� ! . ref:CIM_SCSIController Description The SCSI controller. Dependent f@
� { � � ref:CIM_LogicalDevice Description The logical device. SCSIRetries
� � � UINT32 Description Number of SCSI retries that have occurred since last hard or soft reset related to the controlled Device. The time of last reset is indicated in the TimeOfDeviceReset property, inherited from the ControlledBy association. SCSITimeouts "
� # 0 UINT32 Description Number of SCSI timeouts that have occurred since last hard or soft reset related to the controlled Device. The time of last reset is indicated in the TimeOfDeviceReset property, inherited from the ControlledBy association. � C I M _ D e p e n d e n c y ˝��C�& CIM_Dependency ) " � ��� � � ' 2 u��������� � CIM_ResidesOnExtent Description An association between a FileSystem and the StorageExtent where it is located. Typically, a FileSystem ResidesOn a LogicalDisk. AMENDMENT LOCALE Antecedent f@
� � ref:CIM_StorageExtent Description The storage extent. Dependent f@
� ^ r ref:CIM_FileSystem Description The file system that is located on the storage extent. � C I M _ L o g i c a l F i l e uR|�C�� CIM_LogicalFile ) �� ( N V � CIM_DeviceFile AMENDMENT Description A device file is a special type of logical file that represents a device. This convention is useful for some operating systems that manage devices using a byte stream I/O model. The logical device that is associated with this file is specified using the CIM_DeviceAccessedByFile relationship. LOCALE �F D 1 C 1 D 4 1 4 B 7 1 B 5 0 8 2 C 2 6 6 A 6 5 0 E 3 1 E F 6 D 5 0 1 9 3 8 2 7 2 4 2 4 4 B 6 8 5 F 2 1 7 C 0 A A E 0 0 A 9 2 1 '�}�C�Cȝ��C�$ � __SystemSecurity ACE � lean SkipFolderCycle boolean
� in
� @ �� This parameter indicates whether the folder cycle checking should be skipped or not. Description )
� @ ��� n ID 6
� P @ ��� n boolean ForceDismount boolean
� z in
� z � �� This parameter indicates whether the volume should be forced to dismount before checking. Description )
� z � ��+ � ID 6
� � � ��+ � o boolean RecoverBadSectors boolean
� � in
� �
�� This parameter indicates whether the bad sectors should be located and the readable information should be recovered from these sectors. Description )
� �
��� ; ID 6
� P
��� ; boolean
OkToRunAtBootUp boolean
� | in
� | � �� This parameter indicates whether the chkdsk operation should be performed at next boot up time, in case the operation could not be performed because the disk was locked at time the method was called. Description
)
� | � ��� � ID
6
� ' � ��� � � boolean __ �� a42c9160500003S ROOT\CIMV2\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � ScheduleAutoChk O \ S [ Description This method is used schedule chkdsk to be run at the next reboot if the dirty bit has been set.The method is applicable to only those volume instances that represent a physical disk in the machine. It is not applicable to mapped logical drives. Values s | � � � Success Remote Drive Removable Drive Drive Not Root Directory Unknown Drive � a42c9160500003S ROOT\CIMV2\ms_409 ���� � �> �� * � ����� � __PARAMETERS abstract Volume string
� 2 in
� 2 Y �� This parameter is used to specify the list of volumes that should be scheduled for autochk at next reboot. The string syntax consists of the the drive letter, mount point name, or volume GUID name for the volume. Description )
� 2 Y ��] � ID 6
� � Y ��] � � string __ �� a42c9160500003S ROOT\CIMV2\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � ExcludeFromAutoChk # � � Description This method is used to exclude volumes from the chkdsk operation to be run at the next reboot. If not excluded, chkdsk is performed on the volume if the dirty bit has been set for the disk. Note that the calls to exclude volumes are not cumulative. That is, if a call is made to excluded some volumes, then the new list is not added to the list of ones that were already marked for exclusion, instead the new list of volumes overwrites the previous one. The method is applicable to only those volume instances that represent a physical disk in the machine and is not applicable to mapped logical drives. Values � � � � � Success Remote Drive Removable Drive Drive Not Root Directory Unknown Drive � a42c9160500003S ROOT\CIMV2\ms_409 ���� � �1 �� * � ����� � __PARAMETERS abstract Volume string
� 2 in
� 2 Y �� This parameter is used to specify the list of volumes that should be excluded from autochk at next reboot. The string syntax consists of the the drive letter followed by a colon for the logical disk. Description )
� 2 Y ��P � ID 6
� � Y ��P � � string __ �� a42c9160500003S ROOT\CIMV2\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � Format * 7 b j Description This method is used to format the volume. Values � � � � ! ! @! X! l! �! �! �! �! �! �! " " 8" X" g" Success Unsupported file system Incompatible media in drive Access denied Call cancelled Call cancellation request too late Volume write protected Volume lock failed Unable to quick format Input/Output error Invalid volume label No media in drive Volume is too small Volume is too large Volume is not mounted Cluster size is too small Cluster size is too large Cluster size is beyond 32 bits Unknown error Failed to enable compression after format completed � a42c9160500003S ROOT\CIMV2\ms_409 ���� � �r �� � ; �
� * � � =
g S e � U��������������������� � __PARAMETERS abstract FileSystem string
� 6 in
� 6 ] �� File System DisplayName )
� 6 ] ��� � The file system format to use for the volume. Description 6
� 6 ] ��� � � t z � � � NTFS FAT32 FAT UDF EXFAT Values C
� 6 ] ��� � � � \ ID P
��F` � ���,I � X}��H j ��4�� � =k$f � P؝��C�� 6 � �� � % 2 � � F [ � � [ e � � � � U�������������������������8 � MsftUal_ServerUser Version 1 UAL Description This is a class of property qualifiers that provides client access detail by user, for the local server as a whole. ActivityCount
� � � � uint32 Description The incremental counter of client user accesses for a particular client user. ChassisSerialNumber
� � � � string Description Unit identification for the local server. FirstSeen e
� � datetime Description The date and time when a client user name is first seen by a server. LastSeen e
� � � � datetime Description The date and time when a client user name is last seen by a server. UserName )
� . � ��6 C string Description The client user name that accompanies the UAL payload from installed roles and products, if applicable. UUID
� � � � string Description SMBIOS reported universally unique identifier for this server unit. � Q؝��C�� f 6 � �� � # 0 � � � � � � �
� � � � � � ' 9 � � B K � � �
�
� � � �
1
�
�
# 6 � � J ^ � � G [ � � UUUUUU������������������������������������������������������������������������������������������������r � MsftUal_SystemId Version 1 UAL Description This is a class of property qualifiers that provides profile details of the local server and reflects changes if they are made. CoresPerPhysicalProcessor
� �
uint32 Description The number of cores for an instance of the physical processor in the system. For example, for a dual-core processor system, this property has a value of 2. CreationTime e
� � � � datetime Description The date and time that the current operating system first became operational with this set of system identity properties. If the properties of a system change, then a new System Identity record is created. LogicalProcessorsPerPhysicalProcessor
� % 2 uint32 Description The number of logical processors for an instance of a Hyper-Thread capable physical processor in the system. For example, in a Hyper-Thread quad-core processor system, this property has a value of 8. MaximumMemory
� 6 > K uint64 Description T h e m a x i m u m s y s t e m m e m o r y s i z e ( i n b y t e s ) . F o r a v i r t u a l m a c h i n e , t h i s v a l u e r e p r e s e n t s w h a t t h e h y p e r v i s o r c o n f i g u r e d f o r t h e v i r t u a l m a c h i n e s m e m o r y s i z e . OSBuildNumber
8
� � � � uint32 Description The build number of the operating system. OSCountryCode L
� > F S string Description The code for the country or region that an operating system uses. Values are based on international phone dialing prefixes. OSCurrentTimeZone P
� $ sint16 Description The number, in minutes, an operating system is offset from Greenwich mean time (GMT). The number is positive, negative, or zero. OSDaylightInEffect R
� � � � boolean Description If True, the daylight savings mode is ON. OSLastBootUpTime T
� e m z string Description The date and time the operating system was last restarted. OSMajor 0
� � � uint32 Description The major portion of the version number of the operating system. OSMinor 4
� w � uint32 Description The minor portion of the version number of the operating system. OSPlatformId <
�
uint32 Description An integer that represents the operating system platform. The possible values of the data property are "1" to indicate an unsupported Windows system and "2" to indicate a supported Windows system. OSProductType D
� & 3 uint32 Description An enumeration type that identifies the operating system that you are running. OSSerialNumber H
� � � � string Description The operating system product serial identification number. OSSuiteMask @
� I Q ^ uint32 Description The SuiteMask of the local system. PhysicalProcessorCount
� � � � uint32 Description The number of physical processors currently available on a system. ServicePackMajor X
� ]
e
r
uint32 Description The major version number of the service pack. ServicePackMinor \
� �
�
�
uint32 Description The minor version number of the service pack. SystemDNSHostName (
� b j w string Description The server name according to the domain name server (DNS). SystemDomainName
,
� � � string Description The name of the domain, or workgroup, to which the server belongs. SystemManufacturer
� � � � string Description The name of the BIOS manufacturer. SystemProductName
�
string Description The product name specified in the system BIOS. SystemSerialNumber $ )
� � � ��� � string Description The unit identification for the local server. SystemSMBIOSUUID
� ) string Description The SMBIOS reported universally unique identifier for this server unit. �
E v e n t T r a c e U؝��C�> EventTrace 6 � ��! . V \ � � � � ������ � CtlGuidPortableDeviceConnectApi Description Portable Device Connectivity API Trace guid {02FE721A-0725-469E-A26D-37B3C09FAAC1} locale MS\0x409 Flags R
� � 3 L Z K S D N uint32 Description Enable Flags ValueDescriptions W v � � � � - WPD_TRACE_LEVEL_CRITICAL Flag WPD_TRACE_LEVEL_ERROR Flag WPD_TRACE_LEVEL_WARNING Flag WPD_TRACE_LEVEL_ASSERT Flag WPD_TRACE_LEVEL_FUNCTRACE Flag WPD_TRACE_LEVEL_INFORMATION Flag WPD_TRACE_LEVEL_VERBOSE Flag WPD_TRACE_LEVEL_RESERVED Flag DefineValues ~ � � � � � 1 WPD_TRACE_LEVEL_CRITICAL WPD_TRACE_LEVEL_ERROR WPD_TRACE_LEVEL_WARNING WPD_TRACE_LEVEL_ASSERT WPD_TRACE_LEVEL_FUNCTRACE WPD_TRACE_LEVEL_INFORMATION WPD_TRACE_LEVEL_VERBOSE WPD_TRACE_LEVEL_RESERVED Values w � � � � � * WPD_TRACE_LEVEL_CRITICAL WPD_TRACE_LEVEL_ERROR WPD_TRACE_LEVEL_WARNING WPD_TRACE_LEVEL_ASSERT WPD_TRACE_LEVEL_FUNCTRACE WPD_TRACE_LEVEL_INFORMATION WPD_TRACE_LEVEL_VERBOSE WPD_TRACE_LEVEL_RESERVED ValueMap r ~ � � � � � � 0x00000001 0x00000002 0x00000004 0x00000008 0x00000010 0x00000020 0x00000040 0x00000080 ap �F D 1 C 1 D 4 1 4 B 7 1 B 5 0 8 2 C 2 6 6 A 6 5 0 E 3 1 E F 6 D 5 0 1 9 3 8 2 7 2 4 2 4 4 B 6 8 5 F 2 1 7 C 0 A A E 0 0 A 9 2 1 W؝��C�Cȝ��C�$ � __SystemSecurity 6 4 6 5 9 A B 9 F 8 F 1 C 4 B 5 6 8 D B 6 4 3 8 B A E 1 1 B 2 6 E E 8 F 9 3 C B 5 F 8 1 9 5 E 2 1 E 8 C 3 8 3 D 6 C 4 4 C C 4 1 ���C�ȝ��C�6
� __NAMESPACE InventoryLogging nventoryLogging 4 1 C 5 3 E 6 D B 1 A C F 2 4 5 3 C E F D 4 1 3 9 8 1 9 8 E 6 1 3 F 1 0 D F F 4 7 7 0 9 E C A B 1 D 7 F 0 3 7 7 5 6 A C 8 C E 7 �yR|�C�ȝ��C�( � __thisNAMESPACE ?� C I M _ U n i t a r y C o m p u t e r S y s t e m FtR|�C��8 � # CIM_UnitaryComputerSystem ) # � ��� 0 � � � � - e � � � � % � � �
� � � �
�
� � y � # , G m � � � � � � � � � Q k H c . � � � � � d! r! �" �" �# �# �$
% !& -& ' ' �' ( �( �( �) �) �* �*
, #, �- �- �/ �/ +1 91 ;2 P2
3 3 �3 �3 5 %5 ���UUUUUUUUUUUU������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������5 � Win32_ComputerSystem Description The Win32_ComputerSystem class represents a computer system operating in a Win32 environment. AMENDMENT LOCALE AdminPasswordStatus * +
� � � � s { uint16 Description The AdminPasswordStatus property identifies the system-wide hardware security settings for Administrator Password Status. Values � � � � Disabled Enabled Not Implemented Unknown AutomaticManagedPagefile
,
� boolean Description The AutomaticManagedPagefile property determines whether the system managed pagefile is enabled. This capability is notAvailable on windows server 2003,XP and lower versions.
Values: TRUE or FALSE. If TRUE, the automatic managed pagefile is enabled. AutomaticResetBootOption .
� Y b o boolean Description The AutomaticResetBootOption property determines whether the automatic reset boot option is enabled, i.e. whether the machine will try to reboot after a system failure.
Values: TRUE or FALSE. If TRUE, the automatic reset boot option is enabled. AutomaticResetCapability 0
� � � � boolean Description The AutomaticResetCapability property determines whether the auto reboot feature is available with this machine. This capability is available on Windows NT but not on Windows 95.
Values: TRUE or FALSE. If TRUE, the automatic reset is enabled. BootOptionOnLimit 2 +
� w uint16 Description Boot Option on Limit. Identifies the system action to be taken when the Reset Limit is reached. Values � � � � Reserved Operating system System utilities Do not reboot BootOptionOnWatchDog 4 +
� ' 4 � � uint16 Description The BootOptionOnWatchDog Property indicates the type of re-boot action to be taken after the time on the watchdog timer has elapsed. Values � � � Reserved Operating system System utilities Do not reboot BootROMSupported 6
� Q Z g boolean Description The BootROMSupported property determines whether a boot ROM is supported.
Values are TRUE or FALSE. If BootROMSupported equals TRUE, then a boot ROM is supported. BootStatus 8
� C K X uint16 Description Status and Additional Data fields that identify the boot status BootupState < +
� � � � �
�
string Description The BootupState property specifies how the system was started. Fail-safe boot (also called SafeBoot) bypasses the user's startup files.
Constraints: Must have a value. Values �
�
�
Normal boot Fail-safe boot Fail-safe with network boot ChassisBootupState @ +
� = E R � � uint16 Description The ChassisBootupState property indicates the enclosure's bootup state. Values � � � � � � Other Unknown Safe Warning Critical Non-recoverable ChassisSKUNumber B
� 7 ? L string Description Number of null-terminated string describing the chassis or enclosure SKU number CurrentTimeZone F +
� � � �
�
sint16 Description The CurrentTimeZone property indicates the amount of time the unitary computer system is offset from Coordinated Universal Time. Units minutes DaylightInEffect H
� �
�
�
boolean Description The DaylightInEffect property specifies if the daylight savings is in effect.
Values: TRUE or FALSE. If TRUE, daylight savings is presently being observed. In most cases this means that the current time is one hour earlier than the standard time. DNSHostName J
� , string Description The DNSHostName property indicates the DNS host name of the local computer. Domain N
� � � � string Description The Domain property indicates the name of the domain to which the computer belongs. DomainRole R +
� \ d q � � uint16 Description The DomainRole property indicates the role this computer plays within its assigned domain-workgroup. The domain-workgroup is a collection of computers on the same network. For example, the DomainRole property may show this computer is a "Member Workstation" (value of [1]). Values � � � � � Standalone Workstation Member Workstation Standalone Server Member Server Backup Domain Controller Primary Domain Controller EnableDaylightSavingsTime T
� s | � boolean Description The EnableDaylightSavingsTime property indicates whether Daylight Savings Time is recognized on this machine. FALSE - time does not move an hour ahead or behind in the year. NULL - the status of DST is unknown on this system FrontPanelResetStatus V +
� � � � E M uint16 Description The FrontPanelResetStatus property identifies the hardware security settings for the reset button on the machine. Values a k t � Disabled Enabled Not Implemented Unknown HypervisorPresent X
� � � � boolean Description The HypervisorPresent property determines whether the system is running under a hypervisor that follows the industry standard convention for reporting a hypervisor is present.
Values: TRUE or FALSE. If TRUE, a hypervisor is present. InfraredSupported Z
� " boolean Description The InfraredSupported property determines whether an infrared (IR) port exists on the computer system.
Values are TRUE or FALSE. If InfraredSupported equals TRUE, then an IR port exists. KeyboardPasswordStatus \ +
� / 7 D � � uint16 Description The KeyboardPasswordStatus property identifies the system-wide hardware security settings for Keyboard Password Status. Values � � � � Disabled Enabled Not Implemented Unknown Manufacturer ! ^
� @ H U string Description The Manufacturer property indicates the name of the computer manufacturer.
Example: Acme Model " b
� � � � string Description The Model property indicates the product name of the computer given by the manufacturer. NetworkServerModeEnabled # f
� � � � boolean Description The NetworkServerModeEnabled property determines whether Network Server Mode is enabled.
Values: TRUE or FALSE. If TRUE, Network Server Mode is enabled. NumberOfLogicalProcessors $ h
� � � � uint32 Description The NumberOfLogicalProcessors property indicates the number of logical processors currently available on the system. NumberOfProcessors % l
� Z b o uint32 Description The NumberOfProcessors property indicates the number of physical processors currently available on the system. This is the number of processors whose status is "enabled" - versus simply the number of processors for the computer system. The former can be determined by enumerating the number of processor instances associated with the computer system object, using the Win32_ComputerSystemProcessor association. OEMLogoBitmap & p
� F M Z uint8 Description The OEMLogoBitmap array holds the data for a bitmap created by the OEM. OEMStringArray ' t
� � � � string Description This structure contains free form strings defined by the OEM. Examples of this are: Part Numbers for Reference Documents for the system, contact information for the manufacturer, etc. PartOfDomain ( x
� � � � boolean Description The PartOfDomain property indicates whether the computer is part of a domain or workgroup. If TRUE, the computer is part of a domain. If FALSE, the computer is part of a workgroup. If NULL, the computer is not part of a network group, or is unknown. PauseAfterReset ) z +
� E M Z O! V! sint64 Description The PauseAfterReset property identifies the time delay before the reboot is initiated. It is used after a system power cycle, system reset (local or remote), and automatic system reset. A value of -1 indicates that the pause value is unknown Units milliseconds PCSystemType * � +
� �! �! �! 7" ?" uint16 Description The PCSystemType property indicates the nature of the PC a user is working with like Laptop, Desktop, Tablet-PC etc. Values g" t" }" �" �" �" �" �" �" Unspecified Desktop Mobile Workstation Enterprise Server SOHO Server Appliance PC Performance Server Maximum PCSystemTypeEx + �
� # !# )# uint16 Values
U# b# k# s# �# �# �# �# �# �# Unspecified Desktop Mobile Workstation Enterprise Server SOHO Server Appliance PC Performance Server Slate Maximum PowerOnPasswordStatus , � +
� "$ *$ 7$ �$ �$ uint16 Description The PowerOnPasswordStatus property identifies the system-wide hardware security settings for Power On Password Status. Values �$ �$ �$ �$ Disabled Enabled Not Implemented Unknown PowerSupplyState - � +
� C% K% X% �% �% uint16 Description The PowerSupplyState identifies the state of the enclosure's power supply (or supplies) when last booted. Values �% �% �% �% & & Other Unknown Safe Warning Critical Non-recoverable ResetCount . �
� Y& a& n& sint16 Description The ResetCount property indicates the number of automatic resets since the last intentional reset. A value of -1 indicates that the count is unknown. ResetLimit / �
� >' F' S' sint16 Description The ResetLimit property indicates the number of consecutive time the system reset will be attempted. A value of -1 indicates that the limit is unknown SupportContactDescription 0 �
� 2( :( G( string Description The SupportContactDescription property is an array that indicates the support contact information for the Win32 computer system. SystemFamily 1 �
� ) ) ) string Description This text string identifies the family to which a particular computer belongs. A family refers to a set of computers that are similar but not identical from a hardware or software point of view SystemSKUNumber 2 �
� * * -* string Description This text string identifies a particular computer configuration for sale. It is sometimes also called a product ID or purchase order number SystemStartupDelay 3 � +
� + + + �+ , uint16 Description The SystemStartupDelay property indicates the time to delay before starting the operating system
Note: The SE_SYSTEM_ENVIRONMENT privilege is required on IA64bit machines. This privilege is not required for 32bit systems. units seconds SystemStartupOptions 4 �
� O, W, d, string Description The SystemStartupOptions property array indicates the options for starting up the computer system. Note that this property is not writable on IA64 bit machines.
Constraints: Must have a value.
Note: The SE_SYSTEM_ENVIRONMENT privilege is required on IA64bit machines. This privilege is not required for other systems. SystemStartupSetting 5 �
� �- �- �- uint8 Description The SystemStartupSetting property indicates the index of the default start profile. This value is 'calculated' so that it usually returns zero (0) because at write-time, the profile string is physically moved to the top of the list. (This is how Windows NT determines which value is the default.)
Note: The SE_SYSTEM_ENVIRONMENT privilege is required on IA64bit machines. This privilege is not required for 32bit systems. SystemType 6 � +
� �/ �/ �/ s0 {0 string Description The SystemType property indicates the type of system running on the Win32 computer.
Constraints: Must have a value Values
�0 �0 �0 �0 �0 �0 �0 1 1 1 X86-based PC MIPS-based PC Alpha-based PC Power PC SH-x PC StrongARM PC 64-bit Intel PC x64-based PC Unknown X86-Nec98 PC ThermalState 7 � +
� r1 z1 �1 �1 �1 uint16 Description The ThermalState property identifies the enclosure's thermal state when last booted. Values 2 2 2 2 2 *2 Other Unknown Safe Warning Critical Non-recoverable TotalPhysicalMemory 8 � +
� �2 �2 �2 �2 3 uint64 Description The TotalPhysicalMemory property indicates the total size of physical memory.
Example: 67108864 Units bytes UserName 9 �
� C3 K3 X3 string Description The UserName property indicates the name of the currently-logged-on user.
Constraints: Must have a value.
Example: johnsmith WakeUpType : � +
� 4 $4 14 �4 �4 uint16 Description The WakeUpType property indicates the event that caused the system to power up. Values �4 �4 �4 �4 �4 �4 �4 �4 5 Reserved Other Unknown APM Timer Modem Ring LAN Remote Power Switch PCI PME# AC Power Restored Workgroup ; �
� Q5 Y5 f5 string Description The Workgroup property contains the name of the workgroup. This value is only valid if the PartOfDomain property is FALSE. uU l � � �7 m9 �9 �= �S !U � Rename & 3 � � Description The Rename method is used to change the name of a computer either in a workgroup or a domain. When working remotely, the Rename method does not function for Windows XP Home Edition or on Professional Edition (workgroup only). It should be noted that, for any computer in a domain (except the Domain Controller, since it can authenticate itself), delegation is required as a second hop is needed from the machine being remoted over to the Domain Controller for authentication. There are no restrictions for local cases.
If the Password and Username parameters are specified, then the connection to winmgmt must use a high authentication level (i.e. no less than RPC_C_AUTHN_LEVEL_PKT_PRIVACY) when they connect to winmgmt (i.e. in the call to obtain the IWbemServices interface) or SetProxyBlanket on their IWbemServices ptr. If they are local to winmgmt then this is not a concern because their authentication level is as good as RPC_C_AUTHN_LEVEL_PKT_PRIVACY as well as their client request never goes over the wire to get to the winmgmt.
If Password and Username are left null, the provider does not care.
If the provider determines that the authentication level is too low and a Password or Username has been specified then WBEM_E_ENCRYPTED_CONNECTION_REQUIRED will be returned.
The method can return the following values:
0 - Success. Reboot required.
Other - For integer values other than those listed above, refer to Win32 error code documentation. Values
Success Other W a42c9160500003S ROOT\CIMV2\ms_409 ���� � ��
�� * � � \ � 9 ������������� � __PARAMETERS abstract Name string
� 0 In
� 0 W �� The Name parameter specifies the new name. The name cannot include control characters, leading or trailing spaces, or any of the following characters: / \ [ ] : | < > + = ; , ? Description )
� 0 W ��9 � ID 6
� � W ��9 � } string Password string
� � In
� � �� If the UserName parameter specifies an account name, the Password parameter must point to the password to use when connecting to the domain controller. Otherwise, this parameter must be NULL.
Password and Username must use a high authentication level (i.e. no less than RPC_C_AUTHN_LEVEL_PKT_PRIVACY) when they connect to winmgmt (i.e. in the call to obtain the IWbemServices interface) or SetProxyBlanket on their IWbemServices ptr. If they are local to winmgmt then this is not a concern because their authentication level is as good as RPC_C_AUTHN_LEVEL_PKT_PRIVACY as well as their client request never goes over the wire to get to the winmgmt.
If Password and Username are left null, the provider does not care.
If the provider determines that the authentication level is too low and a Password or Username has been specified then WBEM_E_ENCRYPTED_CONNECTION_REQUIRED will be returned.
This parameter is only used for domain renames on Windows 2000 platforms and beyond. Description )
� � �� > ID 6
� � �� > X string UserName string
� � In
� � � �� The Username parameter is a pointer to a constant null-terminated character string that specifies the account name to use when connecting to the domain controller. The string must specify either a domain NetBIOS name and user account (for example, "REDMOND\user") or the user principal name (UPN) of the user in the form of an Internet-style login name (for example, "someone@microsoft.com"). If this parameter is NULL, the caller's context is used.
Password and Username must use a high authentication level (i.e. no less than RPC_C_AUTHN_LEVEL_PKT_PRIVACY) when they connect to winmgmt (i.e. in the call to obtain the IWbemServices interface) or SetProxyBlanket on their IWbemServices ptr. If they are local to winmgmt then this is not a concern because their authentication level is as good as RPC_C_AUTHN_LEVEL_PKT_PRIVACY as well as their client request never goes over the wire to get to the winmgmt.
If Password and Username are left null, the provider does not care.
If the provider determines that the authentication level is too low and a Password or Username has been specified then WBEM_E_ENCRYPTED_CONNECTION_REQUIRED will be returned.
This parameter is only used for domain renames on Windows 2000 platforms and beyond. Description )
� � � ��� ID 6
� } � ��� 5 string __ �� a42c9160500003S ROOT\CIMV2\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � JoinDomainOrWorkgroup % 2 � � Description The JoinDomainOrWorkgroup method joins computer systems to a domain or workgroup. This method is only available on Windows 2000 platforms and beyond. The method can return the following values:
0 - Success.
Other - For integer values other than those listed above, refer to Win32 error code documentation.
Note: If moving a computer from a Domain to a WorkGroup, the computer must first be removed from the domain before running this method to join the Workgroup.
Password and Username must use a high authentication level (i.e. no less than RPC_C_AUTHN_LEVEL_PKT_PRIVACY) when they connect to winmgmt (i.e. in the call to obtain the IWbemServices interface) or SetProxyBlanket on their IWbemServices ptr. If they are local to winmgmt then this is not a concern because their authentication level is as good as RPC_C_AUTHN_LEVEL_PKT_PRIVACY as well as their client request never goes over the wire to get to the winmgmt.
If Password and Username are left null, the provider does not care.
If the provider determines that the authentication level is too low and a Password or Username has been specified then WBEM_E_ENCRYPTED_CONNECTION_REQUIRED will be returned. Values � � Success Other � a42c9160500003S ROOT\CIMV2\ms_409 ���� � �� �� � �
�
D * + � � 7 U���������������������� � __PARAMETERS abstract Name string
� 0 In
� 0 W �� The Name parameter specifies the domain or workgroup to join. This parameter cannot be NULL. Description )
� 0 W ��� � ID 6
� o W ��� � ' string Password string
� � In
� � � �� If the UserName parameter specifies an account name, the Password parameter must point to the password to use when connecting to the domain controller. Otherwise, this parameter must be NULL.
Password and Username must use a high authentication level (i.e. no less than RPC_C_AUTHN_LEVEL_PKT_PRIVACY) when they connect to winmgmt (i.e. in the call to obtain the IWbemServices interface) or SetProxyBlanket on their IWbemServices ptr. If they are local to winmgmt then this is not a concern because their authentication level is as good as RPC_C_AUTHN_LEVEL_PKT_PRIVACY as well as their client request never goes over the wire to get to the winmgmt.
If Password and Username are left null, the provider does not care.
If the provider determines that the authentication level is too low and a Password or Username has been specified then WBEM_E_ENCRYPTED_CONNECTION_REQUIRED will be returned. Description )
� � � ��h � ID 6
� � � ��h � � string UserName string
� In
� ? �� The Username parameter is a pointer to a constant null-terminated character string that specifies the account name to use when connecting to the domain controller. The string must specify either a domain NetBIOS name and user account (for example, "REDMOND\user") or the user principal name (UPN) of the user in the form of an Internet-style login name (for example, "someone@microsoft.com"). If this parameter is NULL, the caller's context is used.
Password and Username must use a high authentication level (i.e. no less than RPC_C_AUTHN_LEVEL_PKT_PRIVACY) when they connect to winmgmt (i.e. in the call to obtain the IWbemServices interface) or SetProxyBlanket on their IWbemServices ptr. If they are local to winmgmt then this is not a concern because their authentication level is as good as RPC_C_AUTHN_LEVEL_PKT_PRIVACY as well as their client request never goes over the wire to get to the winmgmt.
If Password and Username are left null, the provider does not care.
If the provider determines that the authentication level is too low and a Password or Username has been specified then WBEM_E_ENCRYPTED_CONNECTION_REQUIRED will be returned. Description )
� ? ription PolicySourceTimeZoneRedirection indicates whether the property TimeZoneRedirection is configured by Server(0) or Group Policy (1) PolicySourceUseRDEasyPrintDriver ( �
� �
uint32 Description PolicySourceUseRDEasyPrintDriver indicates whether the property UseRDEasyPrintDriver is configured by Server(0) or Group Policy (1). PolicySourceUseTempFolders
4
� � � � uint32 Description PolicySourceUseTempFolders indicates whether the property UseTempFolders is configured by Server(0) or Group Policy (1). PossibleLicensingTypes
� � � � uint32 Description Each bit of the property value acts as an index into the array of values in the BitValues list. ProfilePath H
� ] e r string Description Describes the profile path for the machine. RedirectSmartCards ) �
� � � � uint32 Description Control the redirection of smart card devices in a Remote Desktop Services session: (0) Remote Desktop Services users cannot use a smart card to log on to a Remote Desktop Services session, (1) smart card device redirection is allowed. ServerName )
� $" � ��," 9" string Description Name of the Terminal Server whose properties are of interest. SessionBrokerDrainMode |
� �" �" �" uint32 Description Session Broker Drain Mode: (0) Allow new user logons, (1) Deny new user logons until reboot, (2) Deny new user logons. SingleSession @ +
� �# �# �# �# �# uint32 Description Indicates if only one session is allowed per user. Values �# �# False True TerminalServerMode +
� H$ P$ ]$ �$ �$ uint32 Description Qualifier for Mode of Terminal Service Values �$ �$ RemoteAdmin AppServer TimeZoneRedirection X
� �$ �$ % uint32 Description Indicates if time zone redirection is enabled or disabled. UseRDEasyPrintDriver ' �
� �% �% �% uint32 Description Specifies whether the Remote Desktop Easy Print printer driver is used first to install all client printers: (0) RD Session Host server tries to find a suitable printer driver to install the client printer. If the RD Session Host server does not have a printer driver that matches the client printer, the server tries to use the Remote Desktop Easy Print driver to install the client printer, (1) RD Session Host server first tries to use the Remote Desktop Easy Print printer driver to install all client printers. If for any reason the Remote Desktop Easy Print printer driver cannot be used, a printer driver on the RD Session Host server that matches the client printer is used. UserPermission $ +
� �( �( �( �( �( uint32 Description Application Compatibility bit. Values �( �( FALSE TRUE UseTempFolders 0 +
� .) 6) C) k) s) uint32 Description Use Temporary Folders Per Session bit. Values ) �) FALSE TRUE � b � 0 O � � � � 1 d �
�
� _
% D � � � � P } 3 � � 3 L � �! �# �# #$ V& �' ( ( �* G, \, �, �, �2 �2 d3 *6 �7 �7
8 8 ; #; < 9> �? �? �@ �C _E qE �E �G yI �I J CL �M �M -N NP �Q �Q =R dT �U V DW �Y �[ �[ �\ _ �` �`
a a �e �e
f f .i @i �i �m jo }o �o r �s �s t 5v .} F} �~ �� �� Ƀ .� 2� � � �� �� �� �� � � �� � SetTimeZoneRedirection ) 6 Description Enables or disables time zone redirection. 5 a42c9160500003S ROOT\cimv2\TerminalServices\ms_409 ���� � �� �� * � ����� � __PARAMETERS abstract TimeZoneRedirection uint32
� ? In
� ? f �� ID )
� � f ��� uint32 __ �� a42c9160500003S ROOT\cimv2\TerminalServices\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � AddDirectConnectLicenseServer ` m Description This method is deprecated and will return WBEM_E_NOT_SUPPORTED without doing any operations. / a42c9160500003S ROOT\cimv2\TerminalServices\ms_409 ���� � �� �� * � ����� � __PARAMETERS abstract LicenseServerName string
� = In
� = d �� ID )
� � d ��� string __ �� a42c9160500003S ROOT\cimv2\TerminalServices\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � DeleteDirectConnectLicenseServer � � Description This method is deprecated and will return WBEM_E_NOT_SUPPORTED without doing any operations. / a42c9160500003S ROOT\cimv2\TerminalServices\ms_409 ���� � �� �� * � ����� � __PARAMETERS abstract LicenseServerName string
� = In
� = d �� ID )
� � d ��� string __ �� a42c9160500003S ROOT\cimv2\TerminalServices\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � UpdateDirectConnectLicenseServer ,
9
Description This method is deprecated and will return WBEM_E_NOT_SUPPORTED without doing any operations. / a42c9160500003S ROOT\cimv2\TerminalServices\ms_409 ���� � �� �� * � ����� � __PARAMETERS abstract LicenseServerList string
� = In
� = d �� ID )
� � d ��� string __ �� a42c9160500003S ROOT\cimv2\TerminalServices\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint3 �3 M S F T _ S t o r a g e O b j e c t yR|�C�� X MSFT_StorageObject 6 % ��& . 6 C � � ' U d � � 7 O �
�
�
�
�
� � � � � � � � 3 ! � � �_UUUU����������������������������������������������������������������������������������� � MSFT_ResiliencySetting Description ResiliencySetting is a detailed description of the resiliency capabilities offered by a storage pool. A storage pool can have one or more of these settings. It specifies a series of properties with a minimum, maximum, and default value. The minimum and maximum values may not reflect the current capabilities of the storage pool, but rather the ideal range of capabilities offered by the subsystem. The default values will be used when creating new virtual disks unless overridden. ClassVersion 1.0 AMENDMENT LOCALE MS_409 Description
� o w � string Description A system set description of the capabilities of the resiliency setting, including (but not limited to) when a setting should be used, its strengths and drawbacks, performance information, and any other information that the vendor feels is helpful to the user. InterleaveDefault B +
� � � �
uint64 Description This field describes the desired number of bytes that will form a strip in common striping-based resiliency settings. The strip is defined as the size of the portion of a stripe that lies on one physical disk. Thus, Interleave * NumberOfColumns will yield the total size of one stripe. Units Bytes InterleaveMax : +
� ` h u G N uint64 Description This field describes the maximum number of bytes that can form a strip in common striping-based resiliency settings. The strip is defined as the size of the portion of a stripe that lies on one physical disk. Units Bytes InterleaveMin 2 +
� � � � � � uint64 Description This field describes the minimum number of bytes that can form a strip in common striping-based resiliency settings. The strip is defined as the size of the portion of a stripe that lies on one physical disk. Units Bytes Name
� � � � string Description A system set, user-friendly, display-oriented string which describes the resiliency setting. NumberOfColumnsDefault 0
� { � � uint16 Description This field is a user-settable preference for the number of underlying physical disks across which data should be striped. NumberOfColumnsMax .
� K S ` uint16 Description This field describes the maximum number of underlying physical disks across which data can be striped in the common striping-based resiliency settings. NumberOfColumnsMin ,
� 9
A
N
uint16 Description This field describes the minimum number of underlying physical disks across which data can be striped in the common striping-based resiliency settings. NumberOfDataCopiesDefault
$
� . 6 C uint16 Description This field is a user-settable preference for the number of complete data copies to maintain. Its value must be within the range defined by NumberofDataCopiesMin and NumberOfDataCopiesMax (inclusive). For new concrete pools, the default should be inherited from the corresponding primordial pool's capability. In the case of the primordial pool, the initial value for this field is left to the Storage Management Provider software. NumberOfDataCopiesMax "
� 6
>
K
uint16 Description This field reports the maximum number of complete copies of data that can be maintained by the storage pool. NumberOfDataCopiesMin
� �
uint16 Description This field reports the minimum number of complete copies of data that will be maintained by the storage pool. NumberOfGroupsDefault N
� � � � uint16 Description This field describes the desired number of light parities that will be formed for parity-based resiliency settings. If the resiliency setting is not parity-based, this field will be set to 1. NumberOfGroupsMax L
� � � � uint16 Description This field describes the maximum number of light parities that can be formed for parity-based resiliency settings. If the resiliency setting is not parity-based, this field will be set to 1. NumberOfGroupsMin J
� � � uint16 Description This field describes the minimum number of light parities that can be formed for parity-based resiliency settings. If the resiliency setting is not parity-based, this field will be set to 1. ParityLayout P +
� � � uint16 Description This field specifies whether a parity-based resiliency setting is using a rotated or non-rotated parity layout. If the resiliency setting is not parity based, this field must be set to NULL Values � Non-rotated Parity Rotated Parity PhysicalDiskRedundancyDefault
*
� _ g t uint16 Description This field is a user-settable preference for how many physical disk failures a virtual disk should be able to withstand before data loss occurs. PhysicalDiskRedundancyMax (
� M U b uint16 Description This field reports the maximum number of tolerable physical disk failures that could occur before data loss would occur. PhysicalDiskRedundancyMin &
� # + 8 uint16 Description This field reports the minimum number of tolerable physical disk failures that can occur before data loss would occur. �
� � n � SetDefaults + 8 � Description This method allows a user to modify the default values for this resiliency setting.The updated values will take effect only for subsequent virtual disk creations and are not retroactively applied. Values R [ j } � � � � � S � \ � � E � Success Not Supported Unspecified Error Timeout Failed Invalid Parameter Access denied There are not enough resources to complete the operation. Cannot connect to the storage provider. The storage provider cannot connect to the storage subsystem. This operation is not supported on primordial storage pools. The storage pool could not complete the operation because its health or operational status does not permit it. The storage pool could not complete the operation because its configuration is read-only. The value for PhysicalDiskRedundancy is outside of the supported range of values. The value for NumberOfDataCopies is outside of the supported range of values. The value for Interleave is outside of the supported range of values. The value for NumberOfColumns is outside of the supported range of values. The value for NumberOfGroups is outside of the supported range of values. � a42c9160500003S ROOT\Microsoft\Windows\Storage\MS_409 ���� � �V �� � l f � * c �
� U�������������������l
� __PARAMETERS abstract NumberOfDataCopiesDefault uint16
� E In
� E l �� The desired number of full data copies to maintain. This value must be between NumberofDataCopiesMin and NumberofDataCopiesMax. Description )
� E l �� � ID 6
� � l �� � _ uint16 PhysicalDiskRedundancyDefault uint16
� � In
� � �� The desired level of physical disk failure tolerance. This value must be between PhyscialDiskRedundancyMin and PhysicalDiskRedundancyMax. Description ) �FX
` � ��R( [~8 &2,�U �Aap V �ԝ��C�� 8 6 + � �� � I W ] � � � � � � � � e s | � E ^ : N X u } � T
b
N i { � �
�
UUU������������������������������������������������������ � LocalServiceSecuritySettings Description LocalServiceSecuritySettings ServiceModel UUID {f5905497-65ad-4f5a-997c-7fcc359c896f} DetectReplays 6
� � � � d q � �� boolean Description A Boolean value that specifies whether replay attacks against the channel are detected and dealt with automatically. DisplayName DetectReplays InactivityTimeout e C
� � � � ^ k ~ � � �� datetime Description A value that specifies the maximum number of pending security sessions that the service supports. DisplayName InactivityTimeout subtype interval IssuedCookieLifetime e C
� � [ h ~ � � �� datetime Description A TimeSpan that specifies the lifetime issued to all new security cookies. DisplayName IssuedCookieLifetime subtype interval MaxCachedCookies
6
� � � � F S � �� sint32 Description A value that specifies the maximum number of cookies that can be cached. DisplayName MaxCachedCookies MaxClockSkew e C
� � � � N [ i r � �� datetime Description A TimeSpan that specifies the maximum time difference between the system clocks of the two communicating parties. DisplayName MaxClockSkew subtype interval MaxPendingSessions 6
� � � � $ 1 � �� sint32 Description The maximum number of pending connections on the service. DisplayName MaxPendingSessions MaxStatefulNegotiations 6
� � � � ! � �� sint32 Description A value that specifies the number of security negotiations that can be active concurrently. DisplayName MaxStatefulNegotiations NegotiationTimeout e C
� � � � $ 1 E N � �� datetime Description A TimeSpan that specifies the maximum duration for the security negotiation phase between server and client. DisplayName NegotiationTimeout subtype interval ReconnectTransportOnFailure 6
� � � � S ` � �� boolean Description A Boolean value that specifies whether connections using WS-Reliable messaging will attempt to reconnect after transport failures. DisplayName ReconnectTransportOnFailure ReplayCacheSize 6
� � � � 6
C
� �� sint32 Description A value that specifies the number of cached nonces used for replay detection. DisplayName ReplayCacheSize ReplayWindow e
$ C
� �
�
�
- ; D � �� datetime Description A TimeSpan that specifies the duration in which individual message nonces are valid. DisplayName ReplayWindow subtype interval SessionKeyRenewalInterval e ( C
� � � � @ M h q � �� datetime Description A TimeSpan that specifies the duration after which the initiator will renew the key for the security session. DisplayName SessionKeyRenewalInterval subtype interval SessionKeyRolloverInterval e , C
� � � � w
�
�
�
� �� datetime Description A TimeSpan that specifies the time interval a previous session key is valid on incoming messages during a key renewal. DisplayName SessionKeyRolloverInterval subtype interval TimestampValidityDuration e
0 C
� ) 6 ~ � � � � �� datetime Description A TimeSpan that specifies the duration in which a time stamp is valid. DisplayName TimestampValidityDuration subtype interval � B i n d i n g E l e m e n t �ԝ��C�� BindingElement 6 % � �� � = K Q y � h / H
� � � � � � K a UU�������������������������� � SecurityBindingElement Description SecurityBindingElement ServiceModel UUID {8a39d0c4-c412-4095-b882-7b16104516c6} AllowInsecureTransport 6
� � � � C P � �� boolean Description A boolean value that specifies if security should be enabled with insecure transports. DisplayName AllowInsecureTransport DefaultAlgorithmSuite 6
� � � � � �� string Description Specifies the algorithms to use with the binding. DisplayName DefaultAlgorithmSuite EnableUnsecuredResponse 6
� � � � � � � �� boolean Description A boolean value that specifies if the response can be unsecured. DisplayName EnableUnsecuredResponse IncludeTimestamp 6
� ` i v � � � �� boolean Description A boolean value that specifies if each message contains a timestamp. DisplayName IncludeTimestamp KeyEntropyMode
6
� / 7 D p } � �� string Description The source of entropy used to create keys. DisplayName KeyEntropyMode LocalServiceSecuritySettings
6
� � ! b o � �� object:LocalServiceSecuritySettings Description The binding specific security properties for the local service. DisplayName LocalServiceSecuritySettings MessageSecurityVersion 6
� � � � & 3 � �� string Description The version used for message security. DisplayName MessageSecurityVersion SecurityHeaderLayout 6
� � � � � � �� string Description The order of elements in the security header for this binding. DisplayName SecurityHeaderLayout � S e c u r i t y B i n d i n g E l e m e n t �ԝ��C�� # SecurityBindingElement 6 � �� � " 0 = _ e � � b � �����������������������������������; � AsymmetricSecurityBindingElement ServiceModel Description AsymmetricSecurityBindingElement UUID {d0235521-1976-4480-a962-16aba137f34a} MessageProtectionOrder 6
� � � � = J � �� string Description The order of message encryption and signing for this binding. DisplayName MessageProtectionOrder RequireSignatureConfirmation 6
� � � � � �� boolean Description Whether the binding requires signature confirmation. DisplayName RequireSignatureConfirmation � S e c u r i t y B i n d i n g E l e m e n t �ԝ��C�� # SecurityBindingElement 6 � �� � ! / < ] c � � ` ~ �����������������������������������9 � SymmetricSecurityBindingElement ServiceModel Description SymmetricSecurityBindingElement UUID {4660a5d3-197e-4d58-8643-f9853b1049c1} MessageProtectionOrder 6
� � � � ; H � �� string Description The order of message encryption and signing for this binding. DisplayName MessageProtectionOrder RequireSignatureConfirmation 6
� � � � � �� boolean Description Whether the binding requires signature confirmation. DisplayName RequireSignatureConfirmation � S e c u r i t y B i n d i n g E l e m e n t �ԝ��C� SecurityBindingElement 6 � �� � ! / < ] c ����������������������������� � TransportSecurityBindingElement ServiceModel Description TransportSecurityBindingElement UUID {213f2c06-42ba-4124-8f19-f4ba22ce8f25} � J� M S F T _ S t o r a g e O b j e c t vR|�C��* � MSFT_StorageObject 6 � �� ! 6 � � L Z � � ) � � p ~ T \ � � |
�
� � * #
-
� � � � = D � � � � � � 2! B! �! �! 1" E" 1# C# u$ �$ �$ % �% �% L& V& �' �' �_UUUUUU��������������������������������������������������������������������������������������������������������������������������������) � MSFT_Disk Description A disk object models the operating system's concept of a disk device. The disk may be directly attached to the computer system, or a virtual disk exposed to the system through the use of a Storage Management Provider. ClassVersion 1.0 AMENDMENT LOCALE MS_409 AdapterSerialNumber .
� b j w string Description A string representation of the Adapter's serial number. AllocatedSize F +
� �
> E uint64 Description The amount of space currently used on the disk. Units Bytes BootFromDisk z
� � � � boolean Description This property indicates that the computer is configured to start off of this disk. On computers with BIOS firmware, this is the first disk that the firmware detects during startup. On computers that use EFI firmware, this is the disk that contains the EFI System Partition (ESP). If there are no disks or multiple disks with an ESP partition, this flag is not set for any disk. BusType f +
� Y a n � � uint16 Description Denotes the I/O bus type used by this disk. Values �
, 1 7 > C I M R [ p � � � Unknown SCSI ATAPI ATA 1394 SSA Fibre Channel USB RAID iSCSI SAS SATA SD MMC Virtual File Backed Virtual Storage Spaces NVMe SCM UFS FirmwareVersion
2
� � � � string Description A string representation of the disk's firmware version. FriendlyName
� U ] j string Description FriendlyName is a user-friendly, display-oriented string to identify the disk. Guid n
� � � string Description The GPT guid of the disk. This property is only valid on GPT disks and will be NULL for all other disk types. HealthStatus d +
� � � � ' uint16 Description The health status of the Volume.
0 - 'Healthy': The disk is functioning normally.
1 - 'Warning': The disk is still functioning, but has detected errors or issues that require administrator intervention.
2 - 'Unhealthy': The volume is not functioning, due to errors or failures. The volume needs immediate attention from an administrator. Values 7 @ I Healthy Warning Unhealthy IsBoot x
� � � � boolean Description This property indicates that the computer has booted off of this disk. IsClustered v
�
(
5
boolean Description If IsClustered is TRUE, this disk is used in a clustered environment. IsHighlyAvailable ! |
� �
�
�
boolean Description If IsHighlyAvailable is TRUE, the disk is highly available. IsScaleOut " ~
� F O \ boolean Description If IsScaleOut is TRUE, the disk is scaled out. IsSystem t
� � � � boolean Description If IsSystem is TRUE, this disk contains the system partition. LargestFreeExtent V +
� c k x
uint64 Description This field indicates the largest contiguous block of free space on the disk. This is also the largest size of a partition which can be created on the disk. Units Bytes Location
� Y
a
n
string Description Location contains the PnP location path of the disk. The format of this string depends on the bus type. If the bus type is SCSI, SAS, or PCI RAID, the format is <AdapterPnpLocationPath>#<BusType>(P<PathId>T<TargetId>L<LunId>). If the bus type is IDE, ATA, PATA, or SATA, the format is <AdapterPnpLocationPath>#<BusType>(C<PathId>T<TargetId>L<LunId>). For example, a SCSI location may look like: PCIROOT(0)#PCI(1C00)#PCI(0000)#SCSI(P00T01L01). Note: For Hyper-V and VHD images, this member is NULL because the virtual controller does not return the location path. LogicalSectorSize N +
� � � � � uint32 Description This field indicates the logical sector size of the disk in bytes. For example: a 4K native disk will report 4096, while a 512 emulated disk will report 512. Units Bytes Manufacturer 6
� � � � string Description A string representation of the disk's hardware manufacturer. Model :
� p x � string Description A string representation of the disk's model. Number
&
� � � � uint32 Description The operating system's number for the disk. Disk 0 is typically the boot device. Disk numbers may not necessarily remain the same across reboots. OfflineReason r +
� � � � < D uint16 Description If IsOffline is TRUE, this property informs the user of the specific reason for the disk being offline.
1 - 'Policy': The user requested the disk to be offline.
2 - 'Redundant Path': The disk is used for multi-path I/O.
3 - 'Snapshot': The disk is a snapshot disk.
4 - 'Collision': There was a signature or identifier collision with another disk.
5 - 'Resource Exhaustion': There were insufficient resources to bring the disk online.
6 - 'Critical Write Failures': There were critical write failures on the disk.
7 - 'Data Integrity Scan Required': A data integrity scan is required. Values d l | � � � � Policy Redundant Path Snapshot Collision Resource Exhaustion Critical Write Failures Data Integrity Scan Required OperationalStatus ` +
� ) 1 > � � uint16 Description An array of values that denote the current operational status of the volume.
0 - 'Unknown': The operational status is unknown.
1 - 'Other': A vendor-specific OperationalStatus has been specified by setting the OtherOperationalStatusDescription property.
2 - 'OK': The disk is responding to commands and is in a normal operating state.
3 - 'Degraded': The disk is responding to commands, but is not running in an optimal operating state.
4 - 'Stressed': The disk is functioning, but needs attention. For example, the disk might be overloaded or overheated.
5 - 'Predictive Failure': The disk is functioning, but a failure is likely to occur in the near future.
6 - 'Error': An error has occurred.
7 - 'Non-Recoverable Error': A non-recoverable error has occurred.
8 - 'Starting': The disk is in the process of starting.
9 - 'Stopping': The disk is in the process of stopping.
10 - 'Stopped': The disk was stopped or shut down in a clean and orderly fashion.
11 - 'In Service': The disk is being configured, maintained, cleaned, or otherwise administered.
12 - 'No Contact': The storage provider has knowledge of the disk, but has never been able to establish communication with it.
13 - 'Lost Communication': The storage provider has knowledge of the disk and has contacted it successfully in the past, but the disk is currently unreachable.
14 - 'Aborted': Similar to Stopped, except that the disk stopped abruptly and may require configuration or maintenance.
15 - 'Dormant': The disk is reachable, but it is inactive.
16 - 'Supporting Entity in Error': This status value does not necessarily indicate trouble with the disk, but it does indicate that another device or connection that the disk depends on may need attention.
17 - 'Completed': The disk has completed an operation. This status value should be combined with OK, Error, or Degraded, depending on the outcome of the operation.
0xD010 - 'Online': In Windows-based storage subsystems, this indicates that the object is online.
0xD011 - 'Not Ready': In Windows-based storage subsystems, this indicates that the object is not ready.
0xD012 - 'No Media': In Windows-based storage subsystems, this indicates that the object has no media present.
0xD013 - 'Offline': In Windows-based storage subsystems, this indicates that the object is offline.
0xD014 - 'Failed': In Windows-based storage subsystems, this indicates that the object is in a failed state. Values ' + 5 ? S Z q { � � � � � � � � � ! ! ! !! *! Unknown Other OK Degraded Stressed Predictive Failure Error Non-Recoverable Error Starting Stopping Stopped In Service No Contact Lost Communication Aborted Dormant Supporting Entity in Error Completed Vendor Specific Online Not Ready No Media Offline Failed PartitionStyle h
� n! v! ~! uint16 Values �! �! �! Unknown MBR GPT Path
� �! �! �! string Description Path can be used to open an operating system handle to the disk device. PhysicalSectorSize R +
� ~" �" �" ## *# uint32 Description This field indicates the physical sector size of the disk in bytes. For example: both 4K native disks and 512 emulated disks will report 4096. Units Bytes ProvisioningType ^ +
� |# �# �# G$ O$ uint16 Description Denotes the provisioning type of the disk device.
1 - 'Thin' means that the storage for the disk is allocated on-demand.
2 - 'Fixed' means that the storage is allocated up front. Values _$ h$ n$ Unknown Thin Fixed SerialNumber *
� �$ �$ �$ string Description A string representation of the disk's serial number. Signature j
� 1% 9% F% uint32 Description The MBR signature of the disk. This property is only valid on MBR disks and will be NULL for all other disk types. Size > +
� �% & & >& E& uint64 Description The total size of the disk, measured in bytes. Units Bytes UniqueId @
� �& �& �& string Description UniqueId of a disk contains the VPD Page 0x83 information that uniquely identifies this disk. The following types are accepted (in order of precedence): 8 - SCSI Name String; 3 - FCPH Name; 2 - EUI64, 1 - Vendor Id, 0 - Vendor Specific. If the disk is an exposed VirtualDisk, UniqueId is used map the association between the two objects. UniqueIdFormat $ +
� 3( ;( H( �( �( uint16 Description UniqueIdFormat informs the user what VPD Page 0x83 descriptor type was used to populate the UniqueId field. Values �( �( �( �( ) Vendor Specific Vendor Id EUI64 FCPH Name SCSI Name String %� � 00 $5 05 �8 "= r@ y@ rE aT ;[ I[ �^ �` �c �c %f )f yi �i �k �k �n �n r �y �| �| j� x� F� � ͥ � � � o� �� u� �� � � CreatePartition / < ) 1 Description This method will attempt to create a new partition on the disk. By default, it creates a data partition using the largest available free extent. On MBR disks, CreatePartition will automatically create an extended partition when needed. Values � � � � � � � 2 Q ` � � 9 ] u � � Q } � � � ) U K } Success Not Supported Unspecified Error Timeout Failed Invalid Parameter Disk is in use Object Not Found Size Not Supported Not enough available capacity Access denied There are not enough resources to complete the operation. Cache out of date You must specify a size by using either the Size or the UseMaximumSize parameter. You can specify only one of these parameters at a time. The disk has not been initialized. The disk is read only. The disk is offline. The disk's partition limit has been reached. The specified partition alignment is not valid. It must be a multiple of the disk's sector size. A parameter is not valid for this type of partition. The specified partition type is not valid. Only the first 2 TB are usable on MBR disks. The specified offset is not valid. There is no media in the device. Operation not supported on a non-empty removable disk. The specified partition layout is invalid. The specified object is managed by the Microsoft Failover Clustering component. The disk must be in cluster maintenance mode and the cluster resource status must be online to perform this operation. The requested access path is already in use. Cannot assign access paths to hidden partitions. The access path is not valid. �) a42c9160500003S ROOT\Microsoft\Windows\Storage\MS_409 ���� � �") ' ��
z # � � � � � i # U � � V ~ * o � UU�������������������������������������� � __PARAMETERS abstract Size uint64
� 0 In
� 0 W �� Bytes Units )
� 0 W ��� � This parameter specifies the desired size (measured in bytes) for the partition. This must be equal to or less than the size specified by the disk's LargestFreeExtent property. This parameter cannot be used with UseMaximumSize. Description 6
� 0 W ��� � � � ID C
� U W ��� � � � uint64 UseMaximumSize boolean
� In
� � �� If set to TRUE, the partition will fill the largest free extent on the disk. This parameter cannot be used with the Size parameter. Description )
� � ��Z � ID 6
� � � ��Z � � boolean
Offset uint64
� In
� 0 �� Bytes Units
)
� 0 ��e ^ This parameter specifies the partition offset (measured in bytes). If the offset is not aligned and the Alignment parameter is not specified, the offset is rounded up or down to the closest alignment boundary depending on the size of the disk on which the partition is created. Description
6
� 0 ��e ^ � � ID
C
� ` 0 ��e ^ � � uint64 Alignment uint32
� � In
� � � �� Bytes Units )
� � � ��� � ID 6
� g � ��� � uint32 g DriveLetter char16 g
� � In g
� � � �� This parameter allows the user to specify a drive letter for the partition at the time of creation. This parameter cannot be used in conjunction with AssignDriveLetter. If both parameters are specified, an Invalid Parameter error will be returned. If the drive letter is not available, the partition will be created, but error '42002' will be returned. Description g )
� � � ��E � ID g 6
� � � ��E � � char16 AssignDriveLetter boolean
� � In
� � &
�� If AssignDriveLetter is set to TRUE, the next available drive letter will be assigned to the created partition. If no more drive letters are available, the partition will be created with no drive letter. This parameter cannot be used in conjunction with DriveLetter. If both parameters are specified, an Invalid Parameter error will be returned. Description )
� � &
��� T
ID 6
� ; &
��� T
� boolean MbrType uint16
� _ In
� _ � �� Specifies the MBR partition type. MbrType can only be set if the disk's PartitionStyle property is set to 1 - 'MBR', otherwise an error will be returned. If this parameter is not specified, CreatePartition will default to type 6 - 'Huge'. Description )
� _ � ���
� " ' FAT12 FAT16 Extended Huge IFS FAT32 Values 6
� _ � ���
� . �
ID C
� � � ���
� . �
z uint16 GptType string
� � In
� � �� Specifies the GPT partition type. GptType is only valid if the disk's PartitionStyle property is set to 2 - 'GPT', otherwise an error will be returned. If this parameter is not specified, CreatePartition will default to {ebd0a0a2-b9e5-4433-87c0-68b6b72699c7} - 'Basic Data'. Description )
� � ��[ G � � � � � System Partition Microsoft Reserved Basic data LDM Metadata LDM Data Microsoft Recovery Values 6
� � ��[ G � ID C
� � ��[ G � e string IsHidden boolean
� � In
� � �� If TRUE, the partition will not be able to receive a drive letter assignment, nor will mount manager assign a volume GUID name. The partition will not be enumerated by the FindFirstVolume and FindNextVolume functions. The partition can be opened by its associated volume device name (i.e. \?GLOBALROOT\Device\HarddiskVolumeX). Description )
� � ��| 4 ID 6
� ��| 4 � boolean " IsActive boolean "
� - In "
� - U �� If TRUE, the partition's MBR active bit will be set, and the partition will become bootable. This parameter is only valid for MBR disks. Description " )
� - U ��
� ID " 6
� � U ��
� Q boolean __ �� a42c9160500003S ROOT\Microsoft\Windows\Storage\MS_409 ���� � ��
�� * � � ` �
������������7 � __PARAMETERS abstract
CreatedPartition object
� < Out
� < c �� ID
)
� � c ���
object:MSFT_Partition
ExtendedStatus object
� Out
� - �� ID
)
� � - ��\ object:MSFT_StorageExtendedStatus ReturnValue uint32
� uint32 out
� �� 2
� ^ uint32 out
� ^ f �� __ � GetRegisteredLicenseServerList � � Description Gets the list of known license servers. If there are no known license servers, returns an empty array. a42c9160500003S ROOT\cimv2\TerminalServices\ms_409 ���� � �� �� * � � ( ��������R � __PARAMETERS abstract RegisteredLSList string
� < out
� < c �� ID )
� � c ��� string ReturnValue uint32
� uint32 out
� # �� __ � GetSpecifiedLicenseServerList U b Description Retrieves the list of specified license servers. a42c9160500003S ROOT\cimv2\TerminalServices\ms_409 ���� � �� �� � ' * � ��������Q � __PARAMETERS abstract SpecifiedLSList string
� ; out
� ; b �� ID )
� � b ��� string ReturnValue uint32
� uint32 out
� " �� __ � SetSpecifiedLicenseServerList � � Description Updates the list of specified license servers, replacing any existing specified license servers. ) a42c9160500003S ROOT\cimv2\TerminalServices\ms_409 ���� � �� �� * � ����� � __PARAMETERS abstract SpecifiedLSList string
� ; In
� ; b �� ID )
� � b ��� string __ �� a42c9160500003S ROOT\cimv2\TerminalServices\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � EmptySpecifiedLicenseServerList D Q Description Removes all license servers from the list of specified license servers. � a42c9160500003S ROOT\cimv2\TerminalServices\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � SetPrimaryLicenseServer ] j Description Sets the given license server as the first entry in the list of specified license servers. / a42c9160500003S ROOT\cimv2\TerminalServices\ms_409 ���� � �� �� * � ����� � __PARAMETERS abstract LicenseServerName string
� = In
� = d �� ID )
� � d ��� string __ �� a42c9160500003S ROOT\cimv2\TerminalServices\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � AddLSToSpecifiedLicenseServerList �# �# Description Adds the given license server to the end of the list of specified license servers. / a42c9160500003S ROOT\cimv2\TerminalServices\ms_409 ���� � �� �� * � ����� � __PARAMETERS abstract LicenseServerName string
� = In
� = d �� ID )
� � d ��� string __ �� a42c9160500003S ROOT\cimv2\TerminalServices\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � RemoveLSFromSpecifiedLicenseServerList $( 1( Description Removes the given license server from the list of specified license servers. / a42c9160500003S ROOT\cimv2\TerminalServices\ms_409 ���� � �� �� * � ����� � __PARAMETERS abstract LicenseServerName string
� = In
� = d �� ID )
� � d ��� string __ �� a42c9160500003S ROOT\cimv2\TerminalServices\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � GetLicensingAadInfo m, z, Description Retrieves the registration token value set earlier by the administrator. a42c9160500003S ROOT\cimv2\TerminalServices\ms_409 ���� � �� �� * � [ � �
� O U����������������� � __PARAMETERS abstract LicensingClientId string
� = out
� = d �� ID )
� � d ��� string TokenLength uint32
� � out
� � �� ID )
� � ��K uint32 TenantAadToken string
� � out
� � � �� ID )
� A � �� string ReturnValue uint32
� � uint32 out
� � � �� __ � Initialize N5 [5 A6 I6 Description This method initializes a RAW disk with a particular partition style. If no partition style is specified, GPT will be selected by default. If the disk is already initialized, this method will fail with a well defined error code. Values �6 �6 �6 �6 �6 �6 �6 �6 �6 7 D7 W7 7 �7 �7 Success Not Supported Unspecified Error Timeout Failed Invalid Parameter Disk is in use Object Not Found Access denied There are not enough resources to complete the operation. Cache out of date The disk has already been initialized. The specified partition type is not valid. The disk is not large enough to support a GPT partition style. The specified object is managed by the Microsoft Failover Clustering component. The disk must be in cluster maintenance mode and the cluster resource status must be online to perform this operation. k a42c9160500003S ROOT\Microsoft\Windows\Storage\MS_409 ���� � �� �� * � �� � __PARAMETERS abstract PartitionStyle uint16
� : In
� : a �� Specifies the desired partition style for the disk. If no value is given, Initialize will default to 2 - 'GPT'. Description )
� : a �� � P U MBR GPT Values 6
� : a �� � Z D ID C
� � a �� � Z D � uint16 __ �L a42c9160500003S ROOT\Microsoft\Windows\Storage\MS_409 ���� � �� �� * � A ��������k � __PARAMETERS abstract
ExtendedStatus object
� : Out
� : a �� ID
)
� � a ��� object:MSFT_StorageExtendedStatus ReturnValue uint32
� 4 uint32 out
� 4 < �� __ � Clear �@ �@ -B 5B Description This method removes partition information and uninitializes a disk, sending it back into a RAW state. The caller must specify RemoveData, RemoveOEM or both with this method unless they first delete all data partitions, known OEM partitions, and ESP partitions on the disk. This requirement excludes metadata partitions such as the MSR, the LDM metadata partition, and unknown OEM partitions. Values �B �B �B �B �B �B �B �B �B #C 2C mC �C �C �C �C .D �D �D �D Success Not Supported Unspecified Error Timeout Failed Invalid Parameter Disk is in use Object Not Found Method Parameters Checked - Job Started Access Denied There are not enough resources to complete the operation. Cache out of date The disk has not been initialized. The disk is read only. The disk is offline. Cannot clear with OEM partitions present. To clear OEM partitions, use the RemoveOEM flag. Cannot clear with data partitions present. To clear data partitions, use the RemoveData flag. Operation not supported on a critical disk. There is no media in the device. The specified object is managed by the Microsoft Failover Clustering component. The disk must be removed from the cluster to perform this operation. � a42c9160500003S ROOT\Microsoft\Windows\Storage\MS_409 ���� � �} �� * ~ � E �
� � � ( U�����������O
� __PARAMETERS abstract RemoveData boolean
� 6 In
� 6 ^ �� This parameter indicates that it is OK to remove data partitions from the disk. If this parameter is FALSE or NULL, Clear will fail in the presence of a data partition. Description )
� 6 ^ ��6 � ID 6
� � ^ ��6 � z boolean RemoveOEM boolean
� � In
� � �� This parameter indicates that it is OK to remove OEM and other special partitions. If this parameter is FALSE or not specified, Clear will fail in the presence of these types of partitions. Description )
� � ��� > ID 6
� � ��� > A boolean ZeroOutEntireDisk boolean
� � In
� � � �� If TRUE, this parameter instructs Clear to zero out the entire disk in addition to removing all partition information. If the parameter is FALSE or NULL, only the first and last megabyte of the disk is zeroed. Description )
� � � ���
ID 6
� l � ���
$ boolean Sanitize boolean
� � In
� � � �� If TRUE, this parameter instructs Clear to send command to the disk to physically obliterate data. Description )
� � � ��K � ID 6
� � � ��K � � boolean RunAsJob boolean
� � In
� � $ �� This parameter controls the asynchronous behavior the method will follow.
If TRUE, this method will make use of the CreatedStorageJob out parameter when the request is taking a long time to service. If a storage job has been created to track the operation, this method will return 4096 - 'Method Parameters Checked - Job Started'. Note, even if RunAsJob is TRUE, the method can still return a result if it has finished in sufficient time.
If FALSE or NULL, this method will follow default WMI asynchronous behavior as determined by the client's method for invocation (i.e. synchronous unless requested otherwise). Description )
� � $ ��� R ID 6
� F
$ ��� R � boolean � � Implemented Description The Resume method resumes a paused print queue. The method can return the following values:
0 - Success.
5 - Access denied.
Other - For integer values other than those listed above, refer to the documentation on the Win32 error codes. ValueMap � � � 0 5 .. Values � � � Success Access denied Other y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � CancelAllJobs 6 � ��� � , 4 Implemented Description The CancelAllJobs method cancels and removes all print jobs from the printer queue including the job currently printing. The method can return the following values:
0 - Success.
5 - Access denied.
Other - For integer values other than those listed above, refer to the documentation on the Win32 error codes. ValueMap " % ( 0 5 .. Values D M \ Success Access denied Other y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � AddPrinterConnection A ;
��C
��P
]
x � � � Static Implemented Description The AddPrinterConnection method provides a connection to an existing printer on the network and adds it to the list of available printers on the computer system. If successful, applications will be able to use this printer for print jobs. If unsuccessful the printer is not installed. The method can return the following values:
0 - Success.
5 - Access denied.
1801 - Invalid printer name.
1930 - Incompatible printer driver.
Other - For integer values other than those listed above, refer to the documentation on the Win32 error codes. ValueMap � � � � � 0 5 1801 1930 .. Values � � � � f
Success Access denied Invalid printer name The printer driver is not compatible with a policy enabled on your computer that blocks NT 4.0 drivers Other ae442007200009F ROOT\CIMV2 ���� � �� �� * � ���� � __PARAMETERS abstract Name string
� 0 In
� 0 W �� The Name parameter specifies a friendly name for the printer. This may be overridden if the name has alreadybeen set by the printer. Description )
� 0 W �� � X MappingStrings 6
� 0 W �� � Z P ID C
� W �� � Z P � string __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � RenamePrinter 6 > ��K X ] g � � Implemented Description The RenamePrinter method renames a printer. The method can return the following values:
0 - Success.
5 - Access denied.
1801 - Invalid printer name.
Other - For integer values other than those listed above, refer to the documentation on the Win32 error codes. ValueMap { ~ � � 0 5 1801 .. Values � � � � Success Access denied Invalid printer name Other � ae442007200009F ROOT\CIMV2 ���� � �� �� * s ����� � __PARAMETERS abstract NewPrinterName string
� : In
� : a �� The NewPrinterName parameter specifies the new printer name. Description )
� : a ��� � MappingStrings 6
� : a ��� � ID C
� � a ��� � o string __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � PrintTestPage 6 � ��� � � � � � Implemented Description The PrintTestPage method prints a test page. The method can return the following values:
0 - Success.
5 - Access denied.
Other - For integer values other than those listed above, refer to the documentation on the Win32 error codes. ValueMap � � � 0 5 .. Values � � � Success Access denied Other y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � SetDefaultPrinter 6 � ��� � � � Implemented Description The SetDefaultPrinter method sets the printer to be the default printer for the user who executes the method. The method can return the following values:
0 - Success.
Other - For integer values other than those listed above, refer to the documentation on the Win32 error codes. ValueMap � � 0 .. Values Success Other y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � GetSecurityDescriptor C � �� ! ! �" �" U# _# �# �# implemented description Retrieves a structural representation of the printer's security descriptor.
The method returns an integer value that can be interpreted as follows:
0 - Successful completion.
2 - The user does not have access to the requested information.
8 - Unknown failure.
9 - The user does not have adequate privileges.
21 - The specified parameter is invalid.
Other - For integer values other than those listed above, refer to Win32 error code documentation. Values �" # # (# ;# N# Success Access denied Unknown failure Privilege missing Invalid parameter Other ValueMap {# ~# �# �# �# �# 0 2 8 9 21 .. Privileges �# SeSecurityPrivilege % ae442007200009F ROOT\CIMV2 ���� � �� �� * � � ; ��������e � __PARAMETERS abstract
Descriptor object
� 6 out
� 6 ] �� ID
)
� � ] ��� object:Win32_SecurityDescriptor ReturnValue uint32
� . uint32 out
� . 6 �� __ � SetSecurityDescriptor C ?' ��L' Y' ) ) �) �) �) �) implemented description Sets security descriptor on the printer to the specified structure.
The method returns an integer value that can be interpreted as follows:
0 - Successful completion.
2 - The user does not have access to the requested information.
8 - Unknown failure.
9 - The user does not have adequate privileges.
21 - The specified parameter is invalid.
Other - For integer values other than those listed above, refer to Win32 error code documentation. Values 8) A) P) a) t) �) Success Access denied Unknown failure Privilege missing Invalid parameter Other ValueMap �) �) �) �) �) �) 0 2 8 9 21 .. Privileges �) SeSecurityPrivilege ae442007200009F ROOT\CIMV2 ���� � �� �� * � ����� � __PARAMETERS abstract
Descriptor object
� 6 in
� 6 ] �� ID
)
� � ] ��� object:Win32_SecurityDescriptor __ �y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ �8DAA5B22069FB6ABEB9CC6BF0071DCCD3AD247D51A9 C_93D683378335762C284317F9836C36B73320C30A8A815437365079222449D208 R_45999BE1E716B224CDC60BBAEC2E4A9422A7548870411AB5310F9D9DCF7A8F92 CD_961B71EE3CEF77853FD06FD1FD078D670615B8B606936AC4407F5BADB29E35F4.114.3817460899.3583 C_556C6D300BDEA99DE8588E2B5D8DB1D5A33F34F7DA1F6E6A0DA0951B22252081 CR_0AFC43F6F954497AA8887334BB937F82532036AD13DD27C64055852F3060BED7 C_8757FA834BF17A34F40DA9E567F73EB3C0F519BA77B457CB4D641370202A1355 CR_5C6828A3364FB35ACCB00567C7BCB4FAA9D96E7DAA4FEE16FD257A946F33EA50 R_FFF2AE454B5EBA423321420C962DDADA7E00808CE9D4E5B4FF81481A2E9CA1B6 CD_C4C4AC3CDD7A9E38A340BB56FE91B2D1BB13CEAA14A840B9C15B1953B57A1EE9.111.332899179.1609 CR_A810B8BCB28B4593289F5B14287BCC8F9F33A8E5A5BE4903C9226502B53FB3AA R_F29100A757BDE75968386F1F8F50FAF18D4793B63DC12FB4378C18D9CD66C352 CD_829131EDC6839DA24011A54FBEA38B1D13A2BDFBD97A229CCB462F4A95FA5DB7.147.79437559.423 CR_4B66FACE2F9688020890084420324926AA3CF21932AD39E8C9ACEA5209F73583 C_259A5E159C9BC70687CA1D3524FF3E5AFC0180D51D46E1351D0D2A9510F67A46 C_CCDB0F33BA6966E88C9C16D64D85DE69D152BBDDCA55C4187234D7D768C27675 R_2A9212E5C5A3E7B6904A9AD5755292499E2868895335A7FB104CA7C39F4970DA R_4C5229B4915A098FA9E249BF643245728F52EEA4263D760742E82296F3E1B97E CR_CCDB0F33BA6966E88C9C16D64D85DE69D152BBDDCA55C4187234D7D768C27675 R_4F0DC2D766DE63D22C2118312C7C8A4306FD995CC443322263FCAFC5C5AE9AB8 CD_FD01511EE67712BF18E22D5987177172AC0FC136DA3801B80EDFACBDC4A53CCF.254.3459394932.2564 CR_8757FA834BF17A34F40DA9E567F73EB3C0F519BA77B457CB4D641370202A1355 R_F7113F6F79893405611B3E0C1184CFF87E4747F2432D2CE16AC2FA972D4FCE30 CD_AC9AD25BD40B6722261E256701F4549D4AD6E3CDC6187FFACB6CAF3D4F5CC978.266.2771419343.680 CR_B860282B4A1153A407ECADB9A68A7564DFACE81902C1C29A9243B46F5679275A R_F2BF551D2C47E413C4BD58FCB0E48E0B3211C53383EC4051E655BB8319ADD47D CR_6FFBA8B5854E9C5C5C698A9277971D04E447B67166A26CB7D9DD0D9F278C2D8B C_F888AA6AC586756C18E219B06406D7BCD62E2EB0C94B51FB48F127652DA7E3EB CR_FE8C3873BDAD1853EA9CE4F9A8CC51817A3AA40D4095EE7168936C23511B49CF C_DBC9D7448979766FC3AA5E546B9F7F37A6E0C06BC06D343F27EAFCD412F13D2A NS_8B6812A49FF95A56BD1A2DF47F355C035587BE9FBA56C9E3DC5C16762C0879F9 KI_FD1C1D414B71B5082C266A650E31EF6D5019382724244B685F217C0AAE00A921 I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.292.3624726292.180 NS_892F8DB69C4EDFBC68165C91087B7A08323F6CE5B5EF342C0F93E02A0590BFC4 KI_41C53E6DB1ACF2453CEFD41398198E613F10DFF47709ECAB1D7F037756AC8CE7 I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.10.3704842052.368 NS_E1DD43413ED9FD9C458D2051F082D1D739399B29035B455F09073926E5ED9870 CI_CFF41370C70E26A169C5F7CC5594050646C5B9BC0F0D1F0FC4733FA2AA35939C IL_675C8C02435D74D2BF9FB2F1ACC8A427A072276AD5C19F68D5A3EC506D13F5D8.118.43113917.299 ing PUAProtection G �
� ; B L uint8 ValueMap \ _ b 0 1 2 QuarantinePurgeItemsAfterDelay
� � uint32 QuickScanIncludeExclusions A
� � � uint8 ValueMap 0 1 RandomizeScheduleTaskTimes 0 �
� R boolean RealTimeScanDirection
� � � � uint8 ValueMap � � � 0 1 2 RemediationScheduleDay
� uint8 ValueMap E H K N Q T W Z ] 0 1 2 3 4 5 6 7 8 RemediationScheduleTime e
� � datetime RemoteEncryptionProtectionAggressiveness %
� � � uint8 ValueMap 0 1 2 RemoteEncryptionProtectionConfiguredState
� y � � uint8 ValueMap � � � � 0 1 2 4 RemoteEncryptionProtectionExclusions
&
� � string RemoteEncryptionProtectionMaxBlockTime !
� > uint32 RemoveScanningThreadPoolCap � B
� � boolean ReportDynamicSignatureDroppedEvent H
� � boolean ReportingAdditionalActionTimeOut 8
� uint32 ReportingCriticalFailureTimeOut <
� ` uint32 ReportingNonCriticalTimeOut @
� � uint32 ScanAvgCPULoadFactor J
� � uint8 ScanOnlyIfIdleEnabled Q
� boolean ScanParameters S
� c j t uint8 ValueMap � � 1 2 ScanPurgeItemsAfterDelay M
� � uint32 ScanScheduleDay T
� ! ! ! uint8 ValueMap =! @! C! F! I! L! O! R! U! 0 1 2 3 4 5 6 7 8 ScanScheduleOffset t $
� �! uint32 ScanScheduleQuickScanTime e U
� �! datetime ScanScheduleTime e Y
� " datetime SchedulerRandomizationTime 1 �
� M" uint32 ServiceHealthReportInterval D
� �" uint32 SevereThreatDefaultAction F �
� �" �" �" uint8 ValueMap # # # # # # ## 1 2 3 6 8 9 10 SharedSignaturesPath S �
� \# string SharedSignaturesPathUpdateAtScheduledTimeOnly T �
� �# boolean SignatureAuGracePeriod # c
� �# uint32 SignatureBlobFileSharesSources + ~
� 9$ string SignatureBlobUpdateInterval , �
� }$ uint32 SignatureDefinitionUpdateFileSharesSources $ g
� �$ string SignatureDisableUpdateOnStartupWithoutEngine % k
� %% boolean SignatureFallbackOrder & m
� e% string SignatureFirstAuGracePeriod " _
� �% uint32 SignatureScheduleDay ' q
� �% �% & uint8 ValueMap ,& /& 2& 5& 8& ;& >& A& D& 0 1 2 3 4 5 6 7 8 SignatureScheduleTime e ( r
� }& datetime SignatureUpdateCatchupInterval ) v
� �& uint32 SignatureUpdateInterval * z
� ' uint32 SubmitSamplesConsent . �
� P' W' a' uint8 ValueMap u' x' {' ~' 0 1 2 3 ThreatIDDefaultAction_Actions A �
� �' �' �' uint8 ValueMap �' ( ( ( ( ( ( 1 2 3 6 8 9 10 ThreatIDDefaultAction_Ids @ �
� M( sint64 ThrottleForScheduledScanOnly ! ]
� �( boolean TrustLabelProtectionStatus p
� �( uint32 UILockdown ? �
� ) boolean UnknownThreatDefaultAction B �
� Z) a) k) uint8 ValueMap �) �) �) �) �) �) �) 1 2 3 6 8 9 10 �� 4 �� ,� 4� c� �� }� �� �� �� m�� Set ��, �� implemented static b� WIN-F6NF7R6I6PJ ROOT\Microsoft\Windows\Defender ���� � ��� g ��� �] 5^ �\ e] �M mN ,c �c V5 �5 �E F G H RF �F !j �j @i �i � � < � � =
�
� ^ c � 1A B _B �B _H �H 4I �I �Z �[ / �/ * � 5+ �+ l@ �@ �n Eo �/ M0 �0 1 �o p ep �p LP �P �N 4O W wW DV �V d1 �1 mb �b '\ �\ �U �U F_ �_ �+ x, �, ;- �` Ua �( U) �f fg ` �` �- . &2 �2 �2 `3 �3 ;4 �4 5 T. �. 8f �f �W 6X se �e �d !e �T 2U GD %E �O �O �^ �^ cL �L Q �Q �K L C �C �q kr .q �q �Y �Z � � � U d � T sT �< �= �h �h 5: ; �& ^' *M �M y; e< �g 2h �j tk �k �l �X gY OS �S �Q GR �R �R N? @ � W �l �m �) * � q � � � � �
� � 2 � ' � n �n � S � + | � G � � � i � v 4 � � � �c cd � � S o* �* � > �> J uJ �J OK 7 � I$ �$ �% L& � ~ � W � ! p � k! ]" �" ,# # �# % �% �' �( �7 �8 �6 Q7 � �a b %6 �6 �8 �9 UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU���������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������r � __PARAMETERS abstract DisableAutoExclusions boolean
� A In
� A i �� ID )
� � i ��� boolean ExclusionPath string
� � In
� � # �� ID )
� � # ��Q string ExclusionExtension string
� � In
� � � �� ID )
� J � �� string
ExclusionProcess string
� v In
� v � �� ID
)
� � ��� string ExclusionIpAddress string
� 4 In
� 4 [ �� ID )
� � [ ��� string QuarantinePurgeItemsAfterDelay uint32
� � In
� � % �� ID )
� � % ��S uint32 RealTimeScanDirection uint8
� � In
� � � �� # & ) 0 1 2 ValueMap )
� � � ��, ID 6
� � � ��, m uint8 RemediationScheduleDay uint8
� � In
� � �� b e h k n q t w z 0 1 2 3 4 5 6 7 8 ValueMap )
� � ��} : ID 6
� ��} : � uint8 e RemediationScheduleTime datetime e
� 8 In e
� 8 a �� ID e )
� � a ��� datetime RemoteEncryptionProtectionConfiguredState uint8
� In
� 7 �� y | � 0 1 2 4 ValueMap )
� 7 ��� e ID 6
� 7 ��� e � uint8
RemoteEncryptionProtectionMaxBlockTime uint32
� O In
� O v �� ID
)
� � v ���
uint32 ! RemoteEncryptionProtectionAggressiveness uint8 !
� #
In !
� #
I
�� �
�
�
0 1 2 ValueMap ! )
� #
I
���
w
ID ! 6
� I
���
w
�
uint8 " RemoteEncryptionProtectionExclusions string "
� X In "
� X �� ID " )
� � ��� string
& BruteForceProtectionConfiguredState uint8
&
� ' In
&
� ' M �� � � � � 0 1 2 4 ValueMap
& )
� ' M ��� { ID
& 6
� $
M ��� { �
uint8 ' BruteForceProtectionMaxBlockTime uint32 '
� _
In '
� _
�
�� ID ' )
� �
�
���
uint32 + BruteForceProtectionAggressiveness uint8 +
� - In +
� - S �� � � � 0 1 2 ValueMap + )
� - S ��� � ID + 6
� # S ��� � � uint8 , BruteForceProtectionExclusions string ,
� \ In ,
� \ � �� ID , )
� � � ��� string 0 BruteForceProtectionLocalNetworkBlocking boolean 0
� 0 In 0
� 0 X �� ID 0 )
� � X ��� boolean 2 BruteForceProtectionSkipLearningPeriod boolean 2
� In 2
� , �� ID 2 )
� � , ��Z boolean 4 ReportingAdditionalActionTimeOut uint32 4
� � In 4
� � � �� ID 4 )
� b � ��' uint32 8 ReportingCriticalFailureTimeOut uint32 8
� � In 8
� � � �� ID 8 )
� - � ��� uint32 < ReportingNonCriticalTimeOut uint32 <
� d In <
� d � �� ID < )
� � � ��� uint32 @ ServiceHealthReportInterval uint32 @
� + In @
� + R �� ID @ )
� � R ��� uint32 D ReportDynamicSignatureDroppedEvent boolean D
� � In D
� � ! �� ID D )
� � ! ��O boolean F ScanAvgCPULoadFactor uint8 F
� � In F
� � � �� ID F )
� J � �� uint8 G CheckForSignaturesBeforeRunningScan boolean G
� � In G
� � � �� ID G )
� � ��� boolean I ScanPurgeItemsAfterDelay uint32 I
� N In I
� N u �� ID I )
� � u ��� uint32 M ScanOnlyIfIdleEnabled boolean M
� In M
� 7 �� ID M )
� � 7 ��e boolean O ScanParameters uint8 O
� � In O
� � � �� + . 1 2 ValueMap O )
� � � ��1 ID O 6
� � � ��1 r uint8 P ScanScheduleDay uint8 P
� � In P
� �
�� ` c f i l o r u x 0 1 2 3 4 5 6 7 8 ValueMap P )
� �
��{ 8 ID P 6
�
��{ 8 � uint8 e Q ScanScheduleQuickScanTime datetime e Q
� 8 In e Q
� 8 a �� ID e Q )
� � a ��� datetime e U ScanScheduleTime datetime e U
� � In e U
� � ! �� ID e U )
� � ! ��O datetime Y ThrottleForScheduledScanOnly boolean Y
� � In Y
� � � �� ID Y )
� U � �� boolean ! [ SignatureFirstAuGracePeriod uint32 ! [
� � In ! [
� � � �� ID ! [ )
� � ��� ! uint32 " _ SignatureAuGracePeriod uint32 " _
� O In " _
� O v �� ID " _ )
� � v ��� " uint32 # c SignatureDefinitionUpdateFileSharesSources string # c
� % In # c
� % L �� ID # c )
� � L ��z # string $ g SignatureDisableUpdateOnStartupWithoutEngine boolean $ g
� � In $ g
� � % �� ID $ g )
� � % ��S $ boolean % i SignatureFallbackOrder string % i
� � In % i
� � � �� ID % i )
� Q! � ��! % string & m SignatureScheduleDay uint8 & m
� �! In & m
� �! �! �� �! " " " " " " " " 0 1 2 3 4 5 6 7 8 ValueMap & m )
� �! �! ��" �! ID & m 6
� �" �! ��" �! Y" & uint8 e ' n SignatureScheduleTime datetime e ' n
� �" In e ' n
� �" �" �� ID e ' n )
� c# �" ��(# ' datetime ( r SignatureUpdateCatchupInterval uint32 ( r
� �# In ( r
� �# �# �� ID ( r )
� /$ �# ���# ( uint32 ) v SignatureBlobFileSharesSources string ) v
� i$ In ) v
� i$ �$ �� ID ) v )
� �$ �$ ���$ ) string * z SignatureUpdateInterval uint32 * z
� ,% In * z
� ,% S% �� ID * z )
� �% S% ���% * uint32 + ~ SignatureBlobUpdateInterval uint32 + ~
� �% In + ~
� �% & �� ID + ~ )
� �& & ��H& + uint32 , � MAPSReporting uint8 , �
� �& In , �
� �& �& �� ' ' ' 0 1 2 ValueMap , � )
� �& �& ��' ' ID , � 6
� �' �& ��' ' Z' , uint8 - � SubmitSamplesConsent uint8 - �
� �' In - �
� �' �' �� 9( <( ?( B( 0 1 2 3 ValueMap - � )
� �' �' ��E( %( ID - � 6
� �( �' ��E( %( �( - uint8 . � DisablePrivacyMode boolean . �
� �( In . �
� �( #) �� ID . � )
� �) #) ��Q) . boolean / � RandomizeScheduleTaskTimes __ �� a42c9160500003S ROOT\Microsoft\Windows\Storage\MS_409 ���� � �h
�� * ~ � S � ������������* � __PARAMETERS abstract f CreatedStorageJob ref f
� = Out f
� = a �� If RunAsJob is set to TRUE and this method takes a while to execute, this parameter returns a reference to the storage job used to track the long running operation. Description f )
� = a ��6 � ID f 6
� � a ��6 � z ref:MSFT_StorageJob
ExtendedStatus object
� � Out
� � �� ID
)
� � ��O object:MSFT_StorageExtendedStatus ReturnValue uint32
� � uint32 out
� � � �� __ � ConvertStyle g[ t[ �[ �[ Description This method converts the partition style of an already initialized disk. Values \ \ *\ =\ F\ N\ a\ q\ �\ �\ �\ �\ ] ] 2] _] �] �] Success Not Supported Unspecified Error Timeout Failed Invalid Parameter Disk is in use Object Not Found Access Denied There are not enough resources to complete the operation. Cache out of date The disk has not been initialized. The disk is read only. The disk is offline. Operation not supported on a critical disk. Cannot convert the style of a disk with data or other known partitions on it. The disk is not large enough to support a GPT partition style. The specified object is managed by the Microsoft Failover Clustering component. The disk must be removed from the cluster to perform this operation. � a42c9160500003S ROOT\Microsoft\Windows\Storage\MS_409 ���� � �� �� * � ��4 � __PARAMETERS abstract PartitionStyle uint16
� : In
� : a �� � � MBR GPT Values )
� : a ��� � ID 6
� , a ��� � � uint16 __ �L a42c9160500003S ROOT\Microsoft\Windows\Storage\MS_409 ���� � �� �� * � A ��������k � __PARAMETERS abstract
ExtendedStatus object
� : Out
� : a �� ID
)
� � a ��� object:MSFT_StorageExtendedStatus ReturnValue uint32
� 4 uint32 out
� 4 < �� __ � Offline �c d "d *d Description Takes the disk offline. Values
bd kd zd �d �d �d �d �d �d �d e 0e ]e Success Not Supported Unspecified Error Timeout Failed Invalid Parameter Disk is in use Object Not Found Access Denied There are not enough resources to complete the operation. Cache out of date Operation not supported on a critical disk. The specified object is managed by the Microsoft Failover Clustering component. The disk must be in cluster maintenance mode and the cluster resource status must be online to perform this operation. L a42c9160500003S ROOT\Microsoft\Windows\Storage\MS_409 ���� � �� �� * � A ��������k � __PARAMETERS abstract
ExtendedStatus object
� : Out
� : a �� ID
)
� � a ��� object:MSFT_StorageExtendedStatus ReturnValue uint32
� 4 uint32 out
� 4 < �� __ � Online �i �i �i �i Description Brings the disk online. Values j
j j ,j 5j =j Pj `j rj �j �j �j Success Not Supported Unspecified Error Timeout Failed Invalid Parameter Disk is in use Object Not Found Access Denied There are not enough resources to complete the operation. Cache out of date The specified object is managed by the Microsoft Failover Clustering component. The disk must be in cluster maintenance mode and the cluster resource status must be online to perform this operation. L a42c9160500003S ROOT\Microsoft\Windows\Storage\MS_409 ���� � �� �� * � A ��������k � __PARAMETERS abstract
ExtendedStatus object
� : Out
� : a �� ID
)
� � a ��� object:MSFT_StorageExtendedStatus ReturnValue uint32
� 4 uint32 out
� 4 < �� __ � SetAttributes o %o �o �o Description Sets various attributes and properties of the disk. The disk must be online for most attributes to be set. Values �o �o �o p p p ,p <p Np ]p �p �p �p �p q Hq Success Not Supported Unspecified Error Timeout Failed Invalid Parameter Disk is in use Object Not Found Access Denied There are not enough resources to complete the operation. Cache out of date The disk has not been initialized. The disk is offline. A parameter is not valid for this type of partition. Operation not supported on a critical disk. The specified object is managed by the Microsoft Failover Clustering component. The disk must be in cluster maintenance mode and the cluster resource status must be online to perform this operation. � a42c9160500003S ROOT\Microsoft\Windows\Storage\MS_409 ���� � � �� P � * ( � � ����������� � __PARAMETERS abstract IsReadOnly boolean
� 6 In
� 6 ^ �� If TRUE, the disk will be made read-only. If FALSE, the disk will become writable. Descr� %� ��Zd� 4�?Ƴ � 8�;�
� ��x�
Y �[Mf .
'���� " V̝��C�� 4 ��' ��4 < B j v � � � 5 B t � � � " ( U����������������������������Z � Win32_SecuritySettingAccess abstract Association Locale UUID {8502C587-5FBB-11D2-AAC1-006008C78BC7} AccessMask
� � � �� uint32 GuidInheritedObjectType
� � � �� string GuidObjectType
� - � �� string Inheritance
� l � �� uint32 SecuritySetting f '
� � � �� � �� ref:Win32_SecuritySetting Trustee f '
� � �� � �� ref:Win32_SID Type
� R � �� uint32 � W̝��C� 4 ��) ��6 > D l � � � > K } � � � + 1 U����������������������������c � Win32_SecuritySettingAuditing abstract Association Locale UUID {8502C588-5FBB-11D2-AAC1-006008C78BC7} AuditedAccessMask
� � � �� uint32 GuidInheritedObjectType
� � � �� string GuidObjectType
� 6 � �� string Inheritance
� u � �� uint32 SecuritySetting f '
� � � �� � �� ref:Win32_SecuritySetting Trustee f '
� � �� � �� ref:Win32_SID Type
� [ � �� uint32 � _ _ T r u s t e e X̝��C�� __Trustee ) �� ! ' O W � � g l � � � � W����������������������������� � Win32_Trustee abstract Locale UUID {8502C589-5FBB-11D2-AAC1-006008C78BC7} Domain @ )
� � � ��� � string WritePrivileges � � SeSecurityPrivilege SeRestorePrivilege Name @ )
� � ��! 2 string WritePrivileges > S SeSecurityPrivilege SeRestorePrivilege SID ` )
� � � ��� � uint8 WritePrivileges � � SeSecurityPrivilege SeRestorePrivilege SidLength @ )
� 2 � ��: K uint32 WritePrivileges W l SeSecurityPrivilege SeRestorePrivilege SIDString @ )
� � � ��� � string WritePrivileges � � SeSecurityPrivilege SeRestorePrivilege � _ _ A C E Y̝��C�g " __ACE ) �� # K W � � k t � � � , 5 W��������������������������������� � Win32_ACE abstract Locale UUID {8502C58A-5FBB-11D2-AAC1-006008C78BC7} AccessMask @ )
� � � ��� � uint32 WritePrivileges � � SeSecurityPrivilege SeRestorePrivilege AceFlags @ )
� � ��% 6 uint32 WritePrivileges B W SeSecurityPrivilege SeRestorePrivilege AceType @ )
� � � ��� � uint32 WritePrivileges � � SeSecurityPrivilege SeRestorePrivilege GuidInheritedObjectType @ )
� I � ��Q b string WritePrivileges n � SeSecurityPrivilege SeRestorePrivilege GuidObjectType @ )
� � � ��� � string WritePrivileges SeSecurityPrivilege SeRestorePrivilege Trustee
@ )
� l � ��� � object:Win32_Trustee WritePrivileges � � SeSecurityPrivilege SeRestorePrivilege � � _ _ S e c u r i t y D e s c r i p t o r Z̝��C� __SecurityDescriptor ) ��$ , 2 Z h � � � � 2 9 � � W�����������������������������w � Win32_SecurityDescriptor abstract Locale UUID {8502C58B-5FBB-11D2-AAC1-006008C78BC7} ControlFlags @ )
� � � ��� � uint32 WritePrivileges � � SeSecurityPrivilege SeRestorePrivilege DACL
` 4
� 5 � �� � ��G X object:Win32_ACE WritePrivileges d y SeSecurityPrivilege SeRestorePrivilege Group
@ 4
� � � �� � ��� � object:Win32_Trustee WritePrivileges SeSecurityPrivilege SeRestorePrivilege Owner
@ 4
� { � �� � ��� � object:Win32_Trustee WritePrivileges � � SeSecurityPrivilege SeRestorePrivilege SACL
` 4
� � �� � ��1 B object:Win32_ACE WritePrivileges N c SeSecurityPrivilege SeRestorePrivilege e � W i n 3 2 _ S e c u r i t y S e t t i n g \̝��C�| Win32_SecuritySetting 6 � �� � " , 4 : b t � � ������������������������� � Win32_LogicalFileSecuritySetting SECRCW32 Locale UUID {8502C58C-5FBB-11D2-AAC1-006008C78BC7} OwnerPermissions
� � � �� boolean Path '
� � � �� � �� string | � � � � � @ � GetSecurityDescriptor ) @ L � ��� � Privileges X m SeSecurityPrivilege SeRestorePrivilege implemented ValueMap � � � � � � 0 2 8 9 21 .. % ae442007200009F ROOT\cimv2 ���� � �� �� * � � ; ��������e � __PARAMETERS abstract
Descriptor object
� 6 OUT
� 6 ] �� ID
)
� � ] ��� object:Win32_SecurityDescriptor ReturnValue uint32
� . uint32 out
� . 6 �� __ � SetSecurityDescriptor ) 5 A v ��� � Privileges M b SeSecurityPrivilege SeRestorePrivilege implemented ValueMap � � � � � � 0 2 8 9 21 .. ae442007200009F ROOT\cimv2 ���� � �� �� * � ����� � __PARAMETERS abstract
Descriptor object
� 6 IN
� 6 ] �� ID
)
� � ] ��� object:Win32_SecurityDescriptor __ �y ae442007200009F ROOT\cimv2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � W i n 3 2 _ S e c u r i t y S e t t i n g O f O b j e c t ]̝��C�� ' Win32_SecuritySettingOfObject 6 � �� � $ . 6 < d m � � e��������E � Win32_SecuritySettingOfLogicalFile SECRCW32 Locale UUID {8502C58D-5FBB-11D2-AAC1-006008C78BC7} Element f@ )
� � � � � �� ref:CIM_LogicalFile Override Element Setting f@ )
� 2 < � �� ref:Win32_LogicalFileSecuritySetting Override Setting � ���
m ID 6
� { ? ���
m 3 string AccountOU string
� � In
� � � �� The AccountOU optionally specifies the pointer to a constant null-terminated character string that contains the RFC 1779 format name of the organizational unit (OU) for the computer account. If you specify this parameter, the string must contain a full path, for example, OU=testOU, DC=domain, DC=Domain,DC=com. Otherwise, this parameter must be NULL. Description )
� � � ��W
� ID 6
� �
� ��W
� �
string FJoinOptions uint32
� In
� 2 �� The FJoinOptions parameter contains a set of bit flags defining the join options. This parameter can be one or more of the following values:
Join Domain - Joins the computer to a domain. If this value is not specified, joins the computer to a workgroup. 0 bit - Join Domain - If not present, a workgroup is joined.
1 bit - Acct Create - Creates the account on the domain.
2 bit - Acct Delete - Delete the account when a domain is left.
4 bit - Win9X Upgrade - The join operation is occurring as part of an upgrade of Windows 95/98 to Windows NT/Windows 2000.
5 bit - Domain Join If Joined - Allows a join to a new domain even if the computer is already joined to a domain.
6 bit - Join Unsecure - Performs an unsecured join.
7 bit - Machine Password Passed - Indicates that the machine (not user) password is passed. This option is only valid for unsecure joins
8 bit - Deferred SPN Set - Specifies that writing SPN and DnsHostName attributes on the computer object should be deferred until the rename that will follow the join.
18 bit - Install Invocation - The APIs were invoked during install.
The method returns a 0 if no options are involved. Description )
� 2 ��� ` V c p } � � � � � Join Domain Acct Create Acct Delete Win9X Upgrade Domain Join If Joined Join Unsecure Machine Password Passed Deferred SPN Set Install Invocation BitValues 6
� 2 ��� ` � . ID C
� � 2 ��� ` � . @ uint32 __ �� a42c9160500003S ROOT\CIMV2\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � UnjoinDomainOrWorkgroup �9 �9 �= �= Description The UnjoinDomainOrWorkgroup method un-joins or removes a computer system from a domain or workgroup. This method is only available on Windows 2000 platforms and beyond. The method can return the following values:
0 - Success.
Other - For integer values other than those listed above, refer to Win32 error code documentation.
Password and Username must use a high authentication level (i.e. no less than RPC_C_AUTHN_LEVEL_PKT_PRIVACY) when they connect to winmgmt (i.e. in the call to obtain the IWbemServices interface) or SetProxyBlanket on their IWbemServices ptr. If they are local to winmgmt then this is not a concern because their authentication level is as good as RPC_C_AUTHN_LEVEL_PKT_PRIVACY as well as their client request never goes over the wire to get to the winmgmt.
If Password and Username are left null, the provider does not care.
If the provider determines that the authentication level is too low and a Password or Username has been specified then WBEM_E_ENCRYPTED_CONNECTION_REQUIRED will be returned. Values �= �= Success Other � a42c9160500003S ROOT\CIMV2\ms_409 ���� � �e
�� h
� * Q �
������������I
� __PARAMETERS abstract Password string
� 4 In
� 4 [ �� If the UserName parameter specifies an account name, the Password parameter must point to the password to use when connecting to the domain controller. Otherwise, this parameter must be NULL.
Password and Username must use a high authentication level (i.e. no less than RPC_C_AUTHN_LEVEL_PKT_PRIVACY) when they connect to winmgmt (i.e. in the call to obtain the IWbemServices interface) or SetProxyBlanket on their IWbemServices ptr. If they are local to winmgmt then this is not a concern because their authentication level is as good as RPC_C_AUTHN_LEVEL_PKT_PRIVACY as well as their client request never goes over the wire to get to the winmgmt.
If Password and Username are left null, the provider does not care.
If the provider determines that the authentication level is too low and a Password or Username has been specified then WBEM_E_ENCRYPTED_CONNECTION_REQUIRED will be returned. Description )
� 4 [ �� � ID 6
� � [ �� � M string UserName string
� � In
� � � �� The Username parameter is a pointer to a constant null-terminated character string that specifies the account name to use when connecting to the domain controller. The string must specify either a domain NetBIOS name and user account (for example, "REDMOND\user") or the user principal name (UPN) of the user in the form of an Internet-style login name (for example, "someone@microsoft.com"). If this parameter is NULL, the caller's context is used. Blank password is passed by using an empty string
Password and Username must use a high authentication level (i.e. no less than RPC_C_AUTHN_LEVEL_PKT_PRIVACY) when they connect to winmgmt (i.e. in the call to obtain the IWbemServices interface) or SetProxyBlanket on their IWbemServices ptr. If they are local to winmgmt then this is not a concern because their authenticatioiption )
� 6 ^ ��� � ID 6
� l ^ ��� � $ boolean Signature uint32
� � In
� � � �� Sets the MBR signature of the disk. This parameter is only valid when the disk's PartitionStyle property is set to 1 - 'MBR'. An error will be returned if the disk is any other partition style. Description )
� � � ��� � ID 6
� 6 � ��� � � uint32 Guid string
� V In
� V } �� Sets the GPT guid of the disk. This parameter is only valid when the disk's PartitionStyle property is set to 2 - 'GPT'. An error will be returned if the disk is any other partition style. Description )
� V } ��i � ID 6
� � } ��i � � string __ �L a42c9160500003S ROOT\Microsoft\Windows\Storage\MS_409 ���� � �� �� * � A ��������k � __PARAMETERS abstract
ExtendedStatus object
� : Out
� : a �� ID
)
� � a ��� object:MSFT_StorageExtendedStatus ReturnValue uint32
� 4 uint32 out
� 4 < �� __ � Refresh } %} �} �} Description This method refreshes the cached disk layout information. This is useful when the backing disk has changed size (if the backing data store is a VHD or a virtual disk). Values
~ ~ &~ 9~ B~ J~ ]~ m~ ~ �~ �~ �~ Success Not Supported Unspecified Error Timeout Failed Invalid Parameter Disk is in use Object Not Found Access Denied There are not enough resources to complete the operation. Cache out of date The disk has not been initialized. The disk is offline. L a42c9160500003S ROOT\Microsoft\Windows\Storage\MS_409 ���� � �� �� * � A ��������k � __PARAMETERS abstract
ExtendedStatus object
� : Out
� : a �� ID
)
� � a ��� object:MSFT_StorageExtendedStatus ReturnValue uint32
� 4 uint32 out
� 4 < �� __ � CreateVolume �� �� � �� Description This method creates a single volume using the remaining space on the disk. Values $ �� �� �� �� �� ǃ ڃ � �� %� 9� X� g� �� Ȅ
� 5� M� c� �� х � ц g� �� �� ܇ � .� v� �� � E� n� �� � Success Not Supported Unspecified Error Timeout Failed Invalid Parameter Disk is in use Object Not Found Method Parameters Checked - Job Started Size Not Supported Not enough available capacity Access denied There are not enough resources to complete the operation. An unexpected I/O error has occurred The operation is not supported while the cluster is being upgraded. The disk has already been initialized. The disk is read only. The disk is offline. The disk's partition limit has been reached. The disk is not large enough to support a GPT partition style. Operation not supported on a non-empty removable disk. The specified object is managed by the Microsoft Failover Clustering component. The disk must be in cluster maintenance mode and the cluster resource status must be online to perform this operation. The specified object is managed by the Microsoft Failover Clustering component. The disk must be removed from the cluster to perform this operation. The requested access path is already in use. The access path is not valid. The specified cluster size is invalid. The specified file system is not supported The volume cannot be quick formatted The cluster size must be a multiple of the disk's physical sector size Cannot perform the requested operation when the drive is read only You must specify a name for this volume Starting offset of the thinly provisioned or DAX partition is not aligned to a cluster boundary. Cannot connect to the storage provider. The storage provider cannot connect to the storage subsystem. Failover clustering could not be enabled for this storage object. Failover clustering was enabled for the storage object but it failed to come online. � a42c9160500003S ROOT\Microsoft\Windows\Storage\MS_409 ���� � �) �� � 2 � � ' 8 * � E U U������������������ � __PARAMETERS abstract FriendlyName string
� 8 In
� 8 _ �� This parameter allows the user to specify the FriendlyName at the time of the volume creation. FriendlyNames are expected to be descriptive, however they are not required to be unique. The filesystem's label will be set to this friendly name. Description )
� 8 _ ��� � ID 6
�
_ ��� � � string FileSystem uint16
� 3 In
� 3 Z �� Specifies the file system to format the created volume. Specifying a CSV file system is only supported on a storage spaces subsystem. For CSV the disk must be clusterable and the volume created will be a cluster shared volume. Description )
� 3 Z ��l � � � � � NTFS ReFS CSVFS_NTFS CSVFS_ReFS Values 6
� 3 Z ��l � � � ID C
� � Z ��l � � � 4 uint16 AccessPath string
� � In
� � � �� If set to a valid access path, the system will attempt to use this path as a way to access the local volume. If the access path could not be set, or this parameter was left NULL, a new access path will be automatically assigned. Description )
� � � ��� ID 6
� v � ��� . string
AllocationUnitSize uint32
� � In
� � � �� Bytes Units
)
� � � �� � Specifies the allocation unit size to use when formatting the volume. Description
6
� � � �� � � > ID
C
� + � �� � � > � uint32 RunAsJob boolean
� O In
� O M [̝��C�� 6 � �� � * 2 8 ` � Win32_SecurityDescriptorHelper SECRCW32 Locale UUID {A502B5A5-B91A-41d1-83D6-BBFA55076333} � el SEC > D / {A5 B q w f
-BB u
�
a � � � ~ m � � � � �
� � Win32SDToSDDL ) ��6 �� implemented static ae442007200009F ROOT\cimv2 ���� � �� �� * � ����� � __PARAMETERS abstract
Descriptor object
� 6 in
� 6 ] �� ID
)
� � ] ��� object:__SecurityDescriptor __ �� ae442007200009F ROOT\cimv2 ���� � �� �� � * � ��������F � __PARAMETERS abstract SDDL string
� 0 out
� 0 W �� ID )
� � W ��� string ReturnValue uint32
� uint32 out
� �� __ � Win32SDToBinarySD \ ��i �� implemented static ae442007200009F ROOT\cimv2 ���� � �� �� * � ����� � __PARAMETERS abstract
Descriptor object
� 6 in
� 6 ] �� ID
)
� � ] ��� object:__SecurityDescriptor __ �� ae442007200009F ROOT\cimv2 ���� � �� �� * � � ��������H � __PARAMETERS abstract BinarySD uint8
� 4 out
� 4 Z �� ID )
� � Z ��� uint8 ReturnValue uint32
� uint32 out
� �� __ � SDDLToWin32SD �
���
�� implemented static � ae442007200009F ROOT\cimv2 ���� � �f �� * � ����� � __PARAMETERS abstract SDDL string
� 0 in
� 0 W �� ID )
� � W ��� string __ � ae442007200009F ROOT\cimv2 ���� � �� �� * � � 7 ��������a � __PARAMETERS abstract
Descriptor object
� 6 out
� 6 ] �� ID
)
� � ] ��� object:__SecurityDescriptor ReturnValue uint32
� * uint32 out
� * 2 �� __ � SDDLToBinarySD � ��� �� implemented static � ae442007200009F ROOT\cimv2 ���� � �f �� * � ����� � __PARAMETERS abstract SDDL string
� 0 in
� 0 W �� ID )
� � W ��� string __ �� ae442007200009F ROOT\cimv2 ���� � �� �� * � � ��������H � __PARAMETERS abstract BinarySD uint8
� 4 out
� 4 Z �� ID )
� � Z ��� uint8 ReturnValue uint32
� uint32 out
� �� __ � BinarySDToWin32SD � ��� �� implemented static � ae442007200009F ROOT\cimv2 ���� � �� �� * � ����� � __PARAMETERS abstract BinarySD uint8
� 4 in
� 4 Z �� ID )
� � Z ��� uint8 __ � ae442007200009F ROOT\cimv2 ���� � �� �� * � � 7 ��������a � __PARAMETERS abstract
Descriptor object
� 6 out
� 6 ] �� ID
)
� � ] ��� object:__SecurityDescriptor ReturnValue uint32
� * uint32 out
� * 2 �� __ � BinarySDToSDDL � �� �� implemented static � ae442007200009F ROOT\cimv2 ���� � �� �� * � ����� � __PARAMETERS abstract BinarySD uint8
� 4 in
� 4 Z �� ID )
� � Z ��� uint8 __ �� ae442007200009F ROOT\cimv2 ���� � �� �� � * � ��������F � __PARAMETERS abstract SDDL string
� 0 out
� 0 W �� ID )
� � W ��� string ReturnValue uint32
� uint32 out
� �� __ � ������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������N � c � l 9 � { i ] B � � Z � � � � ! T � � E � H � ` � � 6 < � x ? � Q 3 � � ~ � o r 0 � f � * ' � � - � u � $ W K � � � � � � K K K K ' K K A K + K K 4 K ; K K K B K 9 K 8 K = K 3 K , K # K K $ K ( K K K K D K K * K K C K K
K K K 6 K K K 1 K 2 K ? K & K K / K K 0 K K
K K K E I K K ) K K @ K K 7 K % K " K E H K E F K ! K K 5 K K > K . K K - K < K K E G K K E J K : L �� WP EQ �� � �
����O
�[�D �� ���� ���KL�
��I�L�
GK�M I��JV� � ��G� ����DDH�T
J�H� ��N���� INS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805 CD_E5893386A7B4C018092F4F8B136F60610FB13ED7B0A8A3475C8F55E3E9FBCB90.12.3299740158.2627 CD_DAA0835D90559AB1BED3F4706FE66DA711EF5A48A581A0339267CD41A8EB5EF9.15.3610201880.1086 CD_E66D2A11AD2317154A9C2C61CC140BA5F198CC545A25F24736AE23D74E16B49B.14.888501879.840 CD_F10840352061CD18DB7516F60841E629D131C524C9F2F089E5D2B510560FC583.18.3232000347.476 CD_E2929E24A4D3F33074BBFC9EB2E285BE087B76057F553B22FB5CA19B172B3C4A.18.2149172405.471 CD_FE8C3873BDAD1853EA9CE4F9A8CC51817A3AA40D4095EE7168936C23511B49CF.18.3492460709.479 CD_F2BEF717752C099CDF2C7677200AF2332E7D1E48B470B17CCD440B8D710B7A38.21.3627670180.2773 CD_E6B31A90E686795D9E916C75179C5E297CC54460E452CC51EA148281AD5C6D23.22.1.22615 CD_F78D535F784AB5BF2A7DF53DE5ACAAF1C73DACC48189425DF45543879C147259.21.132774014.562 CD_FBD11BA7DCC0C416362AC2A1F8EEFD82230A37B2505B7C99363ED198FE2F89CA.25.3460497225.2139 CD_E4E3C277AFADB65E535A86CD5AAE23B1AEF585A2BE1A21A282B170B7F4278F9E.25.1729832560.4005 CD_E707FBA0E2CA2FF8FDB82241C8B012B9A1B221B3B69ACD6A3EDCF3E478558D31.29.2446013766.433 CD_FF89590C844CBA58D43564BFAF3A9C1E0ACA3DFA20CB42FA7E832F2021AD16C0.29.435770083.692 CD_F9C9BF1D438816A18A92B3E8522F73D7F60F0DD6F678D67DAD4AE3DD5EBC727E.30.3756143792.586 CD_F8E20627EC0277AD3D6139BDD1CFFCE8B83EB1D53C7352CA749209255434ABB0.30.834940166.553 CD_FCB8F5186AFCE657559BD1E3B7945F03AFA3222D1F02A94B0C21BFF34C6501B2.31.3860767201.494 CD_F7113F6F79893405611B3E0C1184CFF87E4747F2432D2CE16AC2FA972D4FCE30.32.405818276.491 CD_F2BF551D2C47E413C4BD58FCB0E48E0B3211C53383EC4051E655BB8319ADD47D.32.2986520540.441 CD_ECDF6473AEB5680FD494BFD070A3EC2B36A681EE68A62E383213B3D773EF9B61.32.1064038475.460 CD_DDEDD07282B8324F60B5A48A479C1B42607AE5EA149F90058D5C2368C1337E02.34.2398702152.523 CD_ED2E871CAA85DB91DA82D43856C298DADCDDAA2D7C9D06C8655F1779E6509A4E.34.1838294881.522 CD_F22CF0C74A9002156D476F4DBA031C7F3F706A1A94FD4FF91611BCB6BD8FBB7C.28.217926199.415 CD_E0728E680677E2DC755DB0B32FACA9688F4B71D12279046ADFB604C5714997EF.35.3758254210.467 CD_EA2F4ED6B8AA0BEEE14A7235028BAD0C1DDD97703732E8317B8FE1581E43A3CF.36.4272389465.632 CD_EAB06445AE40CB0AB3321BBA04962C98586E49396B67AFD5B74F4985163D9EC2.37.3294439487.464 CD_FFF2AE454B5EBA423321420C962DDADA7E00808CE9D4E5B4FF81481A2E9CA1B6.37.2831662292.465 CD_DA8AC0D78FD1B90698550FC0FF5C609171143A2B0FA32F0B779BC5DC2D3441C8.37.864522318.961 CD_F29100A757BDE75968386F1F8F50FAF18D4793B63DC12FB4378C18D9CD66C352.37.3019511460.445 CD_E7845F3041269988C5A1847DE98EF0D88E59CE50ED3A8AA1E310C1A1F393BB81.39.2861410353.239 CD_FFBBEEB41878AC75CD38671CF9A4CECEB2F673622833FAA9EA04376FB4297330.39.4219888631.346 CD_E444CD7B23739F9E179DAD07B13CB31D8D111ED6AEEFD52B89FB204BF93A5A2C.40.3967179084.580 CD_DFF237252232921ADE7987E5391E4968B2F362CE0BB4B63D377328B49C8CC5FA.40.3318970472.486 CD_EC31DBAC8296A2F597184183FC259C7595AD4BCCFF23FB0BD832DE414BDE578A.40.564606974.553 CD_DC39EB125CD5896A582C9CCFCFEF5267AF9611EEF285D00CC4FF5DF7F8AE6FFC.40.2401993180.573 CD_F888AA6AC586756C18E219B06406D7BCD62E2EB0C94B51FB48F127652DA7E3EB.41.816992337.278 CD_DF35CAA9032B2BC8E9E68BEFAD5091A66EF205D46DBC51F13F62EC987E8BBEAC.42.1591768111.652 CD_DD1327FC08EE6F810BD5622CD5EFD1804CFB8E69E3B82381F2E13055AC3B4DBB.42.3686988596.648 CD_F58FFC0FC8B956F0D972BCF0F695E0980C1562E6A9119DDB8C681A1382993AFE.51.2999611180.1004 CD_F61D3A37372046376CAFA47C2FBD5009ED63EA8C65A1E072429CA32FDA52CF26.61.4228735253.629 CD_FD5A09758773146E01CAB43EAC38C6EEFB9A870C8F888B5F24F7E89AF0CC12B8.61.4246736417.668 CD_F08FCE87204BA565CC8D5019202DC93CAE2C1D89D6CA6369E7617C4B178BC16E.65.4024363835.656 CD_DED77797B1689BED6B94AFBF9C743E829865A2A20644965BAF07B0D354CDC951.65.3744806773.647 CD_F4663152AE3837F467703D43AFBBB6630C1BA3529FA8A88B46C0496F26CBAAD5.67.743912387.705 CD_E837FA5B478BEDED44320E3A480DE1EA4A5820B99185EB351156356529FE5C28.66.4078414594.675 CD_F4AD89F24C5E59F704DEBE5DF4920F1D71930B871988589A8D9D698640C4E7BA.68.759003584.4858 CD_DBC9D7448979766FC3AA5E546B9F7F37A6E0C06BC06D343F27EAFCD412F13D2A.69.4041748166.1673 CD_E2B2F2A9C4A7BE777C95CFBAC1ADF577ACC960E4E5C2F6E896E757D1BB542084.69.3876305335.450 CD_EB74DE80A4ECAF39B636937B76E6D45F7589467EC770ADEAD91605298392EEDE.71.1265180002.2074 CD_E52BD2BB65ED90ABABACDFC8937D94C5808CFF6C3FD9A7BEE235CE9F6DF64BCB.74.3696766750.580 CI_0899307408A32040A6DA19C0B1EC2745A3D604BAA9DFFE8EE4B75C3D91E16109 IL_9BCEBFBD099FD1DBA49B8E7BCF49EE9762FC2EFF302F652F7F56BF3EDE25D1FA.74.2012741747.324 CD_EA78D27F46C798D1329821D7CEABFD06DD3833EE6512664694DD451E0D988F35.74.49643918.601 CD_F27728D32A3636F45280AD3F71C73821FAB17D765ED15BCD09B89B7007E5475A.74.243341125.667 CD_EA2A17F7F9011AC9DF174FA64700FA87A332EAD70BB23C4338DE684F34E350D6.74.1032337576.600 CD_FDBDC2AD47D9111246F3C36A212EEF164FF61E31A8B334E0CB50FB22BA107100.75.3176850422.1017 CD_E6695722F42AFD2A38B87A3A03743A182D780F4AE622B7E7DF87DC65E7D101EB.75.2677860362.535 CD_F8DBCCC9EC3564253249A34557C34EC79D44268E23A36532F093DF4A918D7FBA.58.141872249.248 CD_ED63447AC10EFFD570567110ECFD7E57B65338C366F9DC0975F468A0220F367B.71.1395542195.287 CD_EC97D00816B4530E92B0346A6B6B453699A71F2B879F99F794A6FF9189BD53FF.76.3476459758.502 IL_84C50CAE138BE8DBF0961918247F6BEE4A1E2653F7AB56ED2DAD85047B7399C8.76.1708835371.305 IL_1DD976C2C1EC41AE2C2E9AE437798C835C95C683651B2DFFD6DE00EF8BD37B9B.77.361952316.331 CD_EC87315EA07FEB82B95B6ECC853900B53DFD9FAE520CF4C1FE8CD7F52B679C09.78.1.8441 CD_DDFBE2B8C9C0EB71960ADB33E49F91EDA6D2896A8A0783F02D140DCEC2F9FEC6.77.3229620855.485 CD_F7E10C2E2B48C52ACA99548FFAFB6BFFFF056CE9E9128CD48CB817FDF7995302.92.2792443909.637 CD_E69678D95075FB6BA6844B84FE0DE69C85BE49AC691754C5A6AA3AE728E45697.93.537382131.1847 CD_FD01511EE67712BF18E22D5987177172AC0FC136DA3801B80EDFACBDC4A53CCF.93.3602332609.1404 CD_F3ED82F33431603D84B59AD5C9C4CA59DF4FDC6F04E98BD4826D692A26D5A5C0.94.1541798991.769 CD_E306E17928F5CE290021F4389D925B031C7FC2C7179F9BCEC2F74EEFB178968D.93.2852555444.468 CD_F32492DA8D1952EDCCAB707AFA3F69E046829AB6D46D4B2279EAC5E6BCBBB3FB.95.1.8483 CD_FC64B24C83B6ED14EEC6C8C71996B5B6C6A9B3D7C971730102A87962981FF379.97.4166999816.689 CD_E54AC9C8AF2DF17AF3B8C0CB2919B6D7164B0CD443D51BA17AD5F6B6FC0AB970.99.3878393682.614 IL_25E364819A71426ED5E19DF77CD3F52F56BEBD4EC6ED9A7E80FD26BFFF23148E.99.215545925.358 CD_DC75EB8D61AF59F2FEB9BAFCC51C26F93B19442C9F5E9F7C071B8627E9152155.148.1486986551.333 IL_9FD082137700729C3A00983D83A072D395DC7E5AA5061738FF9BBDA92779EC8F.110.3507967102.317 CD_FAB579260306CF6BFF8AA42E9AAC8900DD8AC191A796F9430DC39085EEC7005A.267.621531155.789 w �� This parameter controls the asynchronous behavior the method will follow.
If TRUE, this method will make use of the CreatedStorageJob out parameter when the request is taking a long time to service. If a storage job has been created to track the operation, this method will return 4096 - 'Method Parameters Checked - Job Started'. Note, even if RunAsJob is TRUE, the method can still return a result if it has finished in sufficient time.
If FALSE or NULL, this method will follow default WMI asynchronous behavior as determined by the client's method for invocation (i.e. synchronous unless requested otherwise). Description )
� O w ��
� ID 6
� � w ��
� Q boolean __ �� a42c9160500003S ROOT\Microsoft\Windows\Storage\MS_409 ���� � �z �� � D * � � � B � U����������������� � __PARAMETERS abstract
CreatedVolume object
� 9 Out
� 9 ` �� ID
)
� � ` ��� object:MSFT_Volume f CreatedStorageJob ref f
� Out f
� ' �� If RunAsJob is set to TRUE and this method takes a while to execute, this parameter returns a reference to the storage job used to track the long running operation. Description f )
� ' ��� V ID f 6
� � ' ��� V @ ref:MSFT_StorageJob
ExtendedStatus object
� � Out
� � � �� ExtendedStatus allows the storage provider to return extended (implementation specific) error information. Description
)
� � � ��� ID
6
�
� ��� � object:MSFT_StorageExtendedStatus ReturnValue uint32
� v uint32 out
� v ~ �� __ � EnableHighAvailability � � �� Ħ Description This method enables High Availability and Scale Out features on this disk. These features are only available to disks that belong to a highly available storage subsystem. Values � !� 0� C� L� T� g� w� �� �� �� � ,� D� �� �� � .� W� �� Success Not Supported Unspecified Error Timeout Failed Invalid Parameter Disk is in use Object Not Found Method Parameters Checked - Job Started Access denied An unexpected I/O error has occurred The operation is not supported while the cluster is being upgraded. The disk is read only. High Availability could not be enabled for this storage object. Scale Out could not be enabled for this storage object. The specified file system is not supported Cannot perform the requested operation when the drive is read only Cannot connect to the storage provider. The storage provider cannot connect to the storage subsystem. Failover clustering was enabled for the storage object but it failed to come online. + a42c9160500003S ROOT\Microsoft\Windows\Storage\MS_409 ���� � �� �� � � * j ����& � __PARAMETERS abstract ScaleOut boolean
� 4 In
� 4 \ �� This parameter allows the user to specify whether the disk should enable Scale Out features. By default, this parameter is 'True', enabling Scale Out. Description )
� 4 \ ��" � ID 6
� � \ ��" � f boolean RunAsJob boolean
� � In
� � � �� This parameter controls the asynchronous behavior the method will follow.
If TRUE, this method will make use of the CreatedStorageJob out parameter when the request is taking a long time to service. If a storage job has been created to track the operation, this method will return 4096 - 'Method Parameters Checked - Job Started'. Note, even if RunAsJob is TRUE, the method can still return a result if it has finished in sufficient time.
If FALSE or NULL, this method will follow default WMI asynchronous behavior as determined by the client's method for invocation (i.e. synchronous unless requested otherwise). Description )
� � � ��� ) ID 6
� � ��� ) � boolean __ �P a42c9160500003S ROOT\Microsoft\Windows\Storage\MS_409 ���� � ��
�� * R# C I M _ J o b d͝��C�- | CIM_Job [ � �� � ' ? ��O Y i q w � � � � � � � � 2 9 |
�
� � � � , Z e i u � � � � � � F R 2 > �WUUU���������������������������������������������������������������������������������������������������������������������� � Win32_PrintJob CIMWin32 Description The Win32_PrintJob class represents a print job generated by a Win32 application. Any unit of work generated by the Print command of an application running on a Win32 system is a descendent (or member) of this class.
Example: A print document created by an Office 97 application SupportsDelete DeleteBy DeleteInstance Locale UUID {8502C4DF-5FBB-11D2-AAC1-006008C78BC7} Color p 6
� � � ��� � c s string Description The Color property indicates whether the document is to be printed in color or monochrome. Some color printers have the capability to print using true black instead of a combination of Yellow, Cyan, and Magenta. This usually creates darker and sharper text for documents. This option is only useful for color printers that support true black printing. MappingStrings { Win32API|Printing and Print Spooler Structures|DEVMODE|dmColor DataType
4 6
� � �� # 3 string Description The DataType property indicates the format of the data for this print job. This instructs the printer driver to eithertranslate the data (generic text, PostScript, or PCL) before printing, or to print in a raw format (for graphics and pictures).
Example: TEXT MappingStrings ; Win32API|Printing and Print Spooler Structures|JOB_INFO_4|pDatatype Document 8 6
� � � ��� � � � string Description The Document property specifies the name of the print job. The user sees this name when viewing documents waiting to be printed.
Example: Microsoft Word - Review.doc MappingStrings � Win32API|Printing and Print Spooler Structures|JOB_INFO_4|pDocument DriverName < 6
� 8 � ��@ M � � string Description The DriverName property indicates the name of the printer driver used for the print job. MappingStrings � Win32API|Printing and Print Spooler Structures|JOB_INFO_4|pDriverName HostPrintQueue @ 6
� Z � ��b o � � string Description The HostPrintQueue property contains the name of the computer on which the print job was created. MappingStrings � Win32API|Printing and Print Spooler Structures|JOB_INFO_4|pMachineName JobId D 6
� } � ��� � #
3
uint32 Description The JobId property indicates the identifier number of the job. It is used by other methods as a handle to a single job spooling to the printer. MappingStrings ;
Win32API|Printing and Print Spooler Structures|JOB_INFO_4|JobId Name @ N
� �
� �� � ���
�
�
` p string Override Name Description The Name property contains the name of the printer to which the print job is being spooled. MappingStrings x Win32API|Printing and Print Spooler Structures|JOB_INFO_4|pPrinterName Notify @ 6
� � �� & 3 string Override Notify Description User to be notified upon job completion or failure. This property is restricted to 16 characters under Windows 9x platforms. PagesPrinted H 6
�
� ��
�
�
uint32 Description The PagesPrinted property specifies the number of pages that have been printed. This value may be zero if the print job does not contain page delimiting information. MappingStrings �
Win32API|Printing and Print Spooler Structures|JOB_INFO_4|PagesPrinted PaperLength P C
� } � ��� � � � � uint32 Units tenths of a millimeter Description The PaperLength property indicates the length of the paper.
Example: 2794 MappingStrings Win32API|Printing and Print Spooler Structures|DEVMODE|dmPaperLength PaperSize T 6
� � � ��� �
string Description The PaperSize property indicates the size of the paper.
Example: A4 or Letter MappingStrings % Win32API|Printing and Print Spooler Structures|DEVMODE|dmPaperSize PaperWidth X C
� � � ��� � � � C S uint32 Units tenths of a millimeter Description The PaperWidth property indicates the width of the paper.
Example: 2159 MappingStrings [ Win32API|Printing and Print Spooler Structures|DEVMODE|dmPaperWidth Parameters L 6
� � � ��� � � string Description The Parameters property indicates optional parameters to send to the print processor. See the PrintProcessor member for more information. MappingStrings � Win32API|Printing and Print Spooler Structures|JOB_INFO_4|pParameters PrintProcessor \ 6
� E � ��M Z � � string Description The PrintProcessor property indicates the print processor service used to process the print job. A printer processor works in conjunction with the printer driver to provide additional translation of printer data for the printer, and can also be used to provide special options such as a title page for the job. MappingStrings � Win32API|Printing and Print Spooler Structures|JOB_INFO_4|pPrintProcessor Size ` C
� L � ��T [ b o � � uint32 Units bytes Description The Size property indicates the size of the print job. MappingStrings � Win32API|Printing and Print Spooler Structures|JOB_INFO_4|Size SizeHigh d C
� Z � ��b i p } � � uint32 Units bytes Description The SizeHigh property indicates the size of the print job if the Size property exceeds 4,294,967,295 bytes. MappingStrings Win32API|Printing and Print Spooler Structures|JOB_INFO_4|SizeHigh StatusMask h C
� � � ��� � $ � � uint32 Description The StatusMask property specifies a bitmap of the possible statuses relating to this print job. BitValues X ` g q { � � � � � � � Paused Error Deleting Spooling Printing Offline Paperout Printed Deleted Blocked_DevQ User_Intervention_Req Restart MappingStrings � Win32API|Printing and Print Spooler Structures|JOB_INFO_4|Status TotalPages l 6
� � � ��� � B R uint32 Description The TotalPages property specifies the number of pages required to complete the job. This value may be zero if the print job does not contain page-delimiting information. MappingStrings Z Win32API|Printing and Print Spooler Structures|JOB_INFO_4|TotalPages . 2 � � N R � � Pause 6 = ��J W � � � � Implemented Description The Pause method pauses a job in a print queue. If the job was currently printing, no other job will be printed. If the job wasn't printing yet, another unpaused print job may begin printing. The method can return the following values:
0 - Success.
5 - Access denied.
Other - For integer values other than those listed above, refer to the documentation on the Win32 error codes. ValueMap � � � 0 5 .. Values ' Success Access denied Other y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� ��M�p s ���� w Pq�Z } lo�C� � ���ef y dO�y� C I M _ P a r a l l e l C o n t r o l l e r /ʝ��C�/ _ CIM_ParallelController 6 � �� � & , T ^ � � �����������������������������������������������������������������������������������������������U � Win32_ParallelPort CIMWin32 Locale UUID {8502C4C2-5FBB-11D2-AAC1-006008C78BC7} DeviceID @ A
� � � �� � ��� � � � string Override DeviceId MappingStrings � WMI OSAutoDiscovered V )
� / � ��8 H boolean MappingStrings P WMI � C I M _ S e t t i n g 0ʝ��C�I h CIM_Setting
6 � �� � ) 1 7 _ v
� � . ; � � g z � � < L � � � � P g � � � ( 0 � � V
^
0 D � � ` j #
2
�
�
R ` � � } � - UUUUUU�������������������������������������������������������������������������������������������������� � Win32_SerialPortConfiguration CIMWin32 Locale UUID {8502C4EB-5FBB-11D2-AAC1-006008C78BC7} AbortReadWriteOnError )
� � � ��� � boolean MappingStrings � Win32API|Communication Structures|DCB|fAbortOnError BaudRate )
� D � ��L \ uint32 MappingStrings d Win32API|Communication Structures|DCB|BaudRate BinaryModeEnabled )
� � � ��� � boolean MappingStrings � Win32API|Communication Structures|DCB|fBinary BitsPerByte )
� r � ��z � uint32 MappingStrings � Win32API|Communication Structures|DCB|ByteSize ContinueXMitOnXOff )
�
� �� & boolean MappingStrings . Win32API|Communication Structures|DCB|fTXContinueOnXoff CTSOutflowControl )
� � � ��� � boolean MappingStrings � Win32API|Communication Structures|DCB|fOutxCtsFlow DiscardNULLBytes )
� O � ��X h boolean MappingStrings p Win32API|Communication Structures|DCB|fNull DSROutflowControl
)
� � � ��� boolean MappingStrings Win32API|Communication Structures|DCB|fOutxDsrFlow DSRSensitivity )
� � � ��� � boolean MappingStrings � Win32API|Communication Structures|DCB|fDsrSensitivity DTRFlowControlType " 6
� 3 � ��; E q � string ValueMap U ] f Enable Disable Handshake MappingStrings � Win32API|Communication Structures|DCB|fDtrControl EOFCharacter
& )
� � �� uint32 MappingStrings ! Win32API|Communication Structures|DCB|EofChar ErrorReplaceCharacter * )
� � � ��� � uint32 MappingStrings � Win32API|Communication Structures|DCB|ErrorChar ErrorReplacementEnabled . )
� ? � ��H X boolean MappingStrings ` Win32API|Communication Structures|DCB|fErrorChar EventCharacter 0 )
� � � ��� � uint32 MappingStrings � Win32API|Communication Structures|DCB|EvtChar IsBusy 4 )
� g � ��p � boolean MappingStrings � Win32API|File Functions|CreateFile Name 6 A
�
� �� � ��
!
string MaxLen MappingStrings )
Win32Registry|Hardware\DeviceMap\SerialComm Parity : 6
� �
� ���
�
�
�
string MappingStrings �
Win32API|Communication Structures|DCB|Parity ValueMap # ) None Odd Even Mark Space ParityCheckEnabled > )
� { � ��� � boolean MappingStrings � Win32API|Communication Structures|DCB|fParity RTSFlowControlType @ )
� � �� ( string ValueMap < D M X Enable Disable Handshake Toggle StopBits D 6
� � � ��� � �
string MappingStrings � Win32API|Communication Structures|DCB|StopBits ValueMap
1 1.5 2 XOffCharacter H )
� i
� ��q
�
uint32 MappingStrings �
Win32API|Communication Structures|DCB|XoffChar XOffXMitThreshold L )
� � �� uint32 MappingStrings # Win32API|Communication Structures|DCB|XoffLim XOnCharacter P )
� � � ��� � uint32 MappingStrings � Win32API|Communication Structures|DCB|XonChar XOnXMitThreshold T )
� / � ��7 G uint32 MappingStrings O Win32API|Communication Structures|DCB|XonLim XOnXOffInFlowControl X )
� � � ��� � uint32 MappingStrings � Win32API|Communication Structures|DCB|fInX XOnXOffOutFlowControl \ )
� d � ��l | uint32 MappingStrings � Win32API|Communication Structures|DCB|fOutX � W i n 3 2 _ D e v i c e S e t t i n g s 1ʝ��C�= Win32_DeviceSettings 6 � �� � # + 1 Y b � e��������� � Win32_SerialPortSetting CIMWin32 Locale UUID {8502C4FE-5FBB-11D2-AAC1-006008C78BC7} Element f@ 6
� � � ��� � � � ref:Win32_SerialPort Override Element MappingStrings � WMI|Win32_SerialPort Setting f@ 6
� J � ��m w � � ref:Win32_SerialPortConfiguration Override Setting MappingStrings � WMI|Win32_SerialPortConfiguration 60 � C I M _ P h y s i c a l C o n n e c t o r 2ʝ��C�M Q CIM_PhysicalConnector 6 � �� � ' - U d . � � S ] � � ���U����������������������������������������������������������������������������j � Win32_PortConnector CIMWin32 Locale UUID {FAF76B92-798C-11D2-AAD1-006008C78BC7} ConnectorType ` > 6
� � � ��� � � � uint16 Override ConnectorType MappingStrings � SMBIOS|Type 8|Internal/External Connector Type ExternalReferenceDesignator F )
� e � ��m } string MappingStrings � SMBIOS|Type 8|External Reference Designator InternalReferenceDesignator B )
� � �� string MappingStrings & SMBIOS|Type 8|Internal Reference Designator PortType J )
� � � ��� � uint16 MappingStrings � SMBIOS|Type 8|Port Type Tag @
( N
� . � ��6 � ��> H M ] string MaxLen Override Tag MappingStrings e WMI �
C I M _ C o m p o n e n t @ʝ��C�G CIM_Component ) ��' / 5 ] m " 1 e��������� � Win32_COMApplicationClasses abstract Locale UUID {0F73ED51-8ED9-11d2-B340-00105A1F8569} GroupComponent f@ A
� � � �� � ��� � � ref:Win32_COMApplication Override GroupComponent MappingStrings WMI|Win32_COMApplication PartComponent f@ A
� � � �� � ��� � � � ref:Win32_COMClass Override PartComponent MappingStrings � WMI|Win32_COMClass �E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C �̝��C� ȝ��C�� � �������� ^ � __InstanceProviderRegistration \\.\root\cimv2:__Win32Provider.Name="Msft_ProviderSubSystem" n level is as good as RPC_C_AUTHN_LEVEL_PKT_PRIVACY as well as their client request never goes over the wire to get to the winmgmt.
If Password and Username are left null, the provider does not care.
If the provider determines that the authentication level is too low and a Password or Username has been specified then WBEM_E_ENCRYPTED_CONNECTION_REQUIRED will be returned. Description )
� � � ��� ID 6
� N
� ���
string FUnjoinOptions uint32
� x
In
� x
�
�� The FUnjoinOptions parameter specifies the unjoin options. If this parameter is NETSETUP_ACCT_DELETE, the account is disabled when the unjoin occurs. Note that this option does not delete the account. Currently, there are no other unjoin options defined.
2 bit - Acct Delete - Delete the account when a domain is left.
The method returns a 0 if no options are involved. Description )
� x
�
��D �
� Acct Delete BitValues 6
� x
�
��D �
� � ID C
� A
�
��D �
� � � uint32 __ �� a42c9160500003S ROOT\CIMV2\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � __ �� a42c9160500003S ROOT\CIMV2\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � UnjoinDomainOrWorkgroup �9 �9 �= �= Description The UnjoinDomainOrWorkgroup method un-joins or removes a computer system from a domain or workgroup. This method is only available on Windows 2000 platforms and beyond. The method can return the following values:
0 - Success.
Other - For integer values other than those listed above, refer to Win32 error code documentation.
Password and Username must use a high authentication level (i.e. no less than RPC_C_AUTHN_LEVEL_PKT_PRIVACY) when they connect to winmgmt (i.e. in the call to obtain the IWbemServices interface) or SetProxyBlanket on their IWbemServices ptr. If they are local to winmgmt then this is not a concern because their authentication level is as good as RPC_C_AUTHN_LEVEL_PKT_PRIVACY as well as their client request never goes over the wire to get to the winmgmt.
If Password and Username are left null, the provider does not care.
If the provider determines that the authentication level is too low and a Password or Username has been specified then WBEM_E_ENCRYPTED_CONNECTION_REQUIRED will be returned. Values �= �= Success Other � a42c9160500003S ROOT\CIMV2\ms_409 ���� � �e
�� h
� * Q �
������������I
� __PARAMETERS abstract Password string
� 4 In
� 4 [ �� If the UserName parameter specifies an account name, the Password parameter must point to the password to use when connecting to the domain controller. Otherwise, this parameter must be NULL.
Password and Username must use a high authentication level (i.e. no less than RPC_C_AUTHN_LEVEL_PKT_PRIVACY) when they connect to winmgmt (i.e. in the call to obtain the IWbemServices interface) or SetProxyBlanket on their IWbemServices ptr. If they are local to winmgmt then this is not a concern because their authentication level is as good as RPC_C_AUTHN_LEVEL_PKT_PRIVACY as well as their client request never goes over the wire to get to the winmgmt.
If Password and Username are left null, the provider does not care.
If the provider determines that the authentication level is too low and a Password or Username has been specified then WBEM_E_ENCRYPTED_CONNECTION_REQUIRED will be returned. Description )
� 4 [ �� � ID 6
� � [ �� � M string UserName string
� � In
� � � �� The Username parameter is a pointer to a constant null-terminated character string that specifies the account name to use when connecting to the domain controller. The string must specify either a domain NetBIOS name and user account (for example, "REDMOND\user") or the user principal name (UPN) of the user in the form of an Internet-style login name (for example, "someone@microsoft.com"). If this parameter is NULL, the caller's context is used. Blank password is passed by using an empty string
Password and Username must use a high authentication level (i.e. no less than RPC_C_AUTHN_LEVEL_PKT_PRIVACY) when they connect to winmgmt (i.e. in the call to obtain the IWbemServices interface) or SetProxyBlanket on their IWbemServices ptr. If they are local to winmgmt then this is not a concern because th __ � Resume 6 � ��� � � Implemented Description The Resume method continues a paused print job. The method can return the following values:
0 - Success.
5 - Access denied.
Other - For integer values other than those listed above, refer to the documentation on the Win32 error codes. ValueMap
0 5 .. Values / 8 G Success Access denied Other y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � � �� � ��� � � � ; K ref:Win32_Printer Override Dependent Description The Win32_Printer dependent reference represents the Win32_Printer MappingStrings S WMI|Win32_Printer �3E6DB1ACF2453CEFD41398198E613F10DFF47709ECAB1D7F037756AC8CE7 IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.100.3308323286.368 CI_FD1C1D414B71B5082C266A650E31EF6D5019382724244B685F217C0AAE00A921 IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.100.2056642214.180 CR_0359987C58272876B4E70E901F284C82B892B0C1E02B693AD3548D264D28EC8A C_2A2D6E6AC8E9DC7CFD3B145ECD6507F431971D2D607AF7EC159B3B5EAE53046F C_4B73D65E2FE4553C66EBB3CAEECF929ED3C6295923490BCF82E45AB15E13C3B2 C_8AD8BB59AD76539933CA61E487AC9890B90072B3A3E2702B40F21CB1F591E761 C_9F036BA68CA921AFF06984BDB9CEE80E8A2696D8DB098A0C679A6507C62F4DAD CR_0427B3D7710F368D831E2478F76F011E2ADE4882C334EE5ECDBD3047B1FDDE39 R_78AB2C692DAA3A4CDADED46AFA07DE51142E7138D313F37FE748C3A17F36D445 CR_0685F0E7DE4E9ADE69B83CB6CC4B69291D69C22AD0E71A095A2E4AEBC8EC8B85 R_0B8D0CD35EF9C37B2A0F0A7A5A12FCC21F082587427AFAC5F5A4AE61B8034D36 R_760A5CD37813CDB0802F97A15FFFC44EE06FFB8EC97E61F0CF228A37D3D46FFB R_8105231C8A3F2DF94C9C7F6EBD5BD2604617F4A36486778B9E1603208DF83C44 CR_09118298CC8EE9F900C2AC9CB3704C71C7C2F2B7198EBC74799BC99713851937 C_40BEEFCD86669714A96D09FC1ADF38E568E0B01D634EF8F9AD700B7740B2B19A C_5D3D82E165425301EA97694D98E5FD2162C162CBCCEECEC5C4215C7B648589FC C_6A626287DB2D297B2933F0627963C6CDBB9ED9EDBC6F1EE6B68A428340040D87 C_DA3DC1260150EA9B0B2628C0C2AA81125377900B91EB681EA05BC31E6A7900FC R_61BD99E07DD9B896C168C32D63CDE78875D8845FB21EAF979A76CC25C89D073F CR_0A58F1099E1858890A23C17CEB7DF497DF64C99BE6E6E018304675E56C7BEE40 R_5250EC9304AFCED3B4B4C6E595A1730CDF3C33CD4C1A0C35D2E9C70B3EAA91C7 CR_0AFC43F6F954497AA8887334BB937F82532036AD13DD27C64055852F3060BED7 C_211E06180BCB1B723514A6B61A4F9437E8B7FAF07E83A8E52C3887B5E0B0CDFC CD_FFBBEEB41878AC75CD38671CF9A4CECEB2F673622833FAA9EA04376FB4297330.154.3096554623.372 C_C067A199C1ACCE03298DA4A596E9323C2C865C447DF4449AEE4DAF3E29B9DD32 CR_009060D2904B4B02AF55083DEF7BC672283599AF1BEDA6D3B9EC703CB3D5B011 C_15DD3B0DCF2819EDB87C4363412C3F99792BF1AFEF4BDC92585A3BCD2CD95F12 C_C5E17D61729E7377496CB88367D8A18CD6A24A14E576524968A24894CCE3FA5F C_A393FEDC8D8439E642FD70414F2815F8C5D6DC216A8FBF3F8BB710BDED38BED7 C_4DA19C7C1345D18991969860D5303884780EF4410093048FC0F1820643E62177 CD_FD5A09758773146E01CAB43EAC38C6EEFB9A870C8F888B5F24F7E89AF0CC12B8.183.2091946193.811 C_A2392D279E55559D3F1D33DB8F42981C4F8134A3716602C2005C822A63CFED06 C_805206C561285684F42D728C26661B4F548F5E54321B06170E013CB108084182 C_F08FCE87204BA565CC8D5019202DC93CAE2C1D89D6CA6369E7617C4B178BC16E C_214CE1426D6101A6A1828EB7583A1623D82AD7602F044FE3634C76546F0199F7 C_293C515626057C49BE9FEBCADE3529905E03FDEE2BB0FB67FF107DAC390E7179 C_7BD86541C4D37094DD12C29DFB358834E34ADB28AD42E60E36A946EB5619F833 CD_FDBDC2AD47D9111246F3C36A212EEF164FF61E31A8B334E0CB50FB22BA107100.215.2359986792.1323 CR_006AB7DFED58A8FB352581D21227922FA9FD887AC08F63A547BAEA9722B5F62B R_D3C9044B159C496421A96D1C29415B1FCCE8B1F381A6F6000E544FCF3C9C536C R_9E0CE8EFA5382EFCF4A61BAE5C006427367204E75B0194A869F998F4EEE5DBDD CR_0A4592DF371B0F1C9E35DCF899DDC0B30F2B23CFF106F5805254E0E64E1E04F4 R_2B7C33A8279680277817A99329ABE8DC59107022EF9DBDB1B01C276CB7BD1FDC turnValue uint32
� . uint32 out
� . 6 �� __ � SetLaunchSecurityDescriptor � � x � description Sets security descriptor to the specified structure.
The method returns an integer value that can be interpreted as follows:
0 - Successful completion.
Other - HRESULT Win32 error code.
Values � � Success Other ae442007200009F ROOT\CIMV2\ms_409 ���� � �� �� * � ����� � __PARAMETERS abstract
Descriptor object
� 6 in
� 6 ] �� ID
)
� � ] ��� object:Win32_SecurityDescriptor __ �� ae442007200009F ROOT\CIMV2\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � GetAccessSecurityDescriptor h u H
P
description Retrieves a structural representation of the object's security descriptor.
The method returns an integer value that can be interpreted as follows:
0 - Successful completion.
Other - HRESULT Win32 error code.
Values \
e
Success Other , ae442007200009F ROOT\CIMV2\ms_409 ���� � �� �� * � � ; ��������e � __PARAMETERS abstract
Descriptor object
� 6 out
� 6 ] �� ID
)
� � ] ��� object:Win32_SecurityDescriptor ReturnValue uint32
� . uint32 out
� . 6 �� __ � SetAccessSecurityDescriptor �
�
� � description Sets security descriptor to the specified structure.
The method returns an integer value that can be interpreted as follows:
0 - Successful completion.
Other - HRESULT Win32 error code.
Values � � Success Other ae442007200009F ROOT\CIMV2\ms_409 ���� � �� �� * � ����� � __PARAMETERS abstract
Descriptor object
� 6 in
� 6 ] �� ID
)
� � ] ��� object:Win32_SecurityDescriptor __ �� ae442007200009F ROOT\CIMV2\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� �� >@ �p�{F ] ��h"�
R O O T \ c i m v 2 _ _ E v e n t P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 6 8 5 7 7 3 7 2 C 6 6 A 7 B 2 0 6 5 8 4 8 7 F B D 9 5 9 A A 1 5 4 E F 5 4 B 5 F 9 3 5 D C C 5 6 6 3 E 9 2 2 8 B 4 4 3 2 2 8 0 5 \ K I _ 0 8 9 9 3 0 7 4 0 8 A 3 2 0 4 0 A 6 D A 1 9 C 0 B 1 E C 2 7 4 5 A 3 D 6 0 4 B A A 9 D F F E 8 E E 4 B 7 5 C 3 D 9 1 E 1 6 1 0 9 \ I _ 2 5 E 3 6 4 8 1 9 A 7 1 4 2 6 E D 5 E 1 9 D F 7 7 C D 3 F 5 2 F 5 6 B E B D 4 E C 6 E D 9 A 7 E 8 0 F D 2 6 B F F F 2 3 1 4 8 E m i s s C I M _ C o m p u t e r S y s t e m GtR|�C�� - CIM_ComputerSystem ) ( � ��� � � J g + E I
U
�_U������������������������������������������� � CIM_UnitaryComputerSystem Description A class derived from CIM_ComputerSystem that represents a desktop, mobile, network PC, server or other type of a single node computer system. AMENDMENT LOCALE InitialLoadInfo
� string Description This object contains the data needed to find either the initial load device (its key) or the boot service to request the operating system to start up. In addition, the load parameters (ie, a pathname and parameters) may also be specified. LastLoadInfo
� F N [ string Description This object contains the data identifying either the initial load device (its key) or the boot service that requested the last operating system load. In addition, the load parameters (ie, a pathname and parameters) may also be specified. PowerManagementCapabilities +
� � � � a i uint16 Description Indicates the specific power-related capabilities of a computer system and its associated running operating system. The values, 0="Unknown", 1="Not Supported", and 2="Disabled" are self-explanatory. The value, 3="Enabled" indicates that the power management features are currently enabled but the exact feature set is unknown or the information is unavailable. "Power Saving Modes Entered Automatically" (4) describes that a system can change its power state based on usage or other criteria. "Power State Settable" (5) indicates that the SetPowerState method is supported. "Power Cycling Supported" (6) indicates that the SetPowerState method can be invoked with the PowerState parameter set to 5 ("Power Cycle"). "Timed Power On Supported" (7) indicates that the SetPowerState method can be invoked with the PowerState parameter set to 5 ("Power Cycle") and the Time parameter set to a specific date and time, or interval, for power-on. Values � � � � � � � Unknown Not Supported Disabled Enabled Power Saving Modes Entered Automatically Power State Settable Power Cycling Supported Timed Power On Supported PowerManagementSupported $
� q z � boolean Description Boolean indicating that the ComputerSystem, with its running OperatingSystem, supports power management. This boolean does not indicate that power management features are currently enabled, or if enabled, what features are supported. Refer to the PowerManagementCapabilities array for this information. If this boolean is false, the integer value 1 for the string, "Not Supported", should be the only entry in the PowerManagementCapabilities array. PowerState
& +
� �
�
�
%
uint16 Description Indicates the current power state of the computer system and its associated operating system. Regarding the power saving states, these are defined as follows: Value 4 (Unknown) indicates that the system is known to be in a power save mode, but its exact status in this mode is unknown; 2 (Low Power Mode) indicates that the system is in a power save state but still functioning, and may exhibit degraded performance; 3 (Standby) describes that the system is not functioning but could be brought to full power 'quickly'; and value 7 (Warning) indicates that the computerSystem is in a warning state, though also in a power save mode. Values
Q
Z
f
�
�
�
�
�
�
�
Unknown Full Power Power Save - Low Power Mode Power Save - Standby Power Save - Unknown Power Cycle Power Off Power Save - Warning Power Save - Hibernate Power Save - Soft Off ResetCapability ( +
� V ^ k � � uint16 Description If enabled (value = 4), the unitary computer system can be reset via hardware (e.g. the power and reset buttons). If disabled (value = 3), hardware reset is not allowed. In addition to Enabled and Disabled, other values for the property are also defined - "Not Implemented" (5), "Other" (1) and "Unknown" (2). Values � � � � � Other Unknown Disabled Enabled Not Implemented � e � \ � SetPowerState - Description SetPowerState method defines the desired power state of a computer system and its running operating system, and when the system should be put into that state. The PowerState parameter is specified as one of the valid integer values defined for the property, PowerState. The Time parameter (for all state changes but 5, "Power Cycle") indicates when the power state should be set, either as a regular date-time value or as an interval value (where the interval begins when the method invocation is received). When the PowerState parameter is equal to 5, "Power Cycle", the Time parameter indicates when the system should power on again. power off is immediate. SetPowerState should return 0 if successful, 1 if the specified power state and time requests are not supported, and some other value if any other error occurred. o a42c9160500003S ROOT\CIMV2\ms_409 ���� � � �� * r � 1 ������r � __PARAMETERS abstract PowerState uint16
� 6 IN
� 6 ] �� � � � � % Full Power Power Save - Low Power Mode Power Save - Standby Power Save - Other Power Cycle Power Off Hibernate Soft Off Values )
� 6 ] ��/ � ID 6
� � ] ��/ � n uint16 e Time datetime e
� � IN e
� � � �� ID e )
� h � ��- datetime __ �� a42c9160500003S ROOT\CIMV2\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � C I M _ M e d i a A c c e s s D e v i c e ttR|�C�� j CIM_MediaAccessDevice ) � ��� ����������������������������������������������������������������������������������������������������������� � CIM_DiskDrive Description The CIM_DiskDrive class represents a physical disk drive as seen by the operating system. The features of the drive seen through this object correspond to the logical and management characteristics of the drive and, in some cases may not reflect the actual physical characteristics of the device. Any interface to a physical drive is a member of this class. Any object based on another logical device would not be a member of this class.
Example: IDE Fixed Disk. AMENDMENT LOCALE � __ �CALE � � � ��ɝP [ A��� s DP�� �� � 5 7 E 5 F 3 A D D 9 E 2 4 2 C 4 E 9 F 9 E D F 7 9 A A 9 7 F 7 9 E 7 9 1 1 C 5 A 8 B 9 0 2 E C 1 5 0 D 6 4 4 2 E 3 B 8 5 A 5 A A ,̝��C�ȝ��C�� ���M 9 i � __Win32Provider {A3E41207-BE04-492a-AFF0-19E880FF7545} NetworkServiceHost MS_Shutdown_Event_Provider
C I M _ S y s t e m HtR|�C�G CIM_System ) ! d ��o w � �������������������������� � CIM_ComputerSystem Description A class derived from CIM_System that is a special collection of CIM_ManagedSystemElement instances. This collection provides compute capabilities and serves as aggregation point to associate one or more of the following elements: file system, operating system, processor and memory (volatile and/or non-volatile storage). AMENDMENT LOCALE NameFormat @ +
� � � � @ H string Description The CIM_ComputerSystem object and its derivatives are Top Level Objects of CIM. They provide the scope for numerous components. Having unique CIM_System keys is required. A heuristic is defined to create the CIM_ComputerSystem name to attempt to always generate the same name, independent of discovery protocol. This prevents inventory and management problems where the same asset or entity is discovered multiple times, but can not be resolved to a single object. Use of the heuristic is optional, but recommended.
The NameFormat property identifies how the computer system name is generated, using a heuristic. The heuristic is outlined, in detail, in the CIM V2 Common Model specification. It assumes that the documented rules are traversed in order, to determine and assign a name. The NameFormat values list defines the precedence order for assigning the computer system name. Several rules do map to the same Value.
Note that the CIM_ComputerSystem Name calculated using the heuristic is the system's key value. Other names can be assigned and used for the CIM_ComputerSystem that better suit the business, using Aliases. Values � � � � � � � � � � � � � � IP Dial HID NWA HWA X25 ISDN IPX DCC ICD E.164 SNA OID/OSI Other om � C I M _ N u m e r i c S e n s o r YtR|�C�� t CIM_NumericSensor ) � ��� � � $ j � � & 3 y � � � " - s ~ � � + q � � � * E ���WUU�������������������������������������������������������������������������������������������������������������� � CIM_CurrentSensor Description This class exists for backward compatibility to earlier CIM Schema definitions. With additions to Sensor and NumericSensor in V2.2, it is no longer necessary. A CurrentSensor can be defined by setting the SensorType property, inherited from Sensor, to 4 ("Current"). Other properties of this class are hard-coded to constant values to correspond to definitions in the sensor hierarchy. AMENDMENT LOCALE CurrentReading @ 2
� � � sint32 Units milliamps LowerThresholdCritical @ 8
� P X _ sint32 Units milliamps LowerThresholdFatal @ <
� � � � sint32 Units milliamps LowerThresholdNonCritical @ @
� sint32 Units milliamps MaxReadable @ D
� _ g n sint32 Units milliamps MinReadable @ H
� � � � sint32 Units milliamps NominalReading @ L
� sint32 Units milliamps NormalMax @ P
� Y a h sint32 Units milliamps NormalMin @ T
� � � � sint32 Units milliamps Resolution @ X
� � uint32 Units tenths of milliamps Tolerance @ \
� W _ f sint32 Units milliamps UpperThresholdCritical @ `
� � � � sint32 Units milliamps UpperThresholdFatal @ d
� sint32 Units milliamps UpperThresholdNonCritical @ h
� q y � sint32 Units milliamps � C I M _ L o g i c a l E l e m e n t �tR|�C� CIM_LogicalElement 6
E ��P ] m u � � � � � / � � U�����������������������k � CIM_Service Description A CIM_Service is a Logical Element that contains the information necessary to represent and manage the functionality provided by a Device and/or SoftwareFeature. A Service is a general-purpose object to configure and manage the implementation of functionality. It is not the functionality itself. AMENDMENT DisplayName Services (CIM) LOCALE CreationClassName +
� � � � � � string Description CreationClassName indicates the name of the class or the subclass used in the creation of an instance. When used with the other key properties of this class, this property allows all instances of this class and its subclasses to be uniquely identified. DisplayName Class Name Name )
� * 2 ? � �� string Description The Name property uniquely identifies the service and provides an indication of the functionality that is managed. This functionality is described in more detail in the object's Description property. Started +
� K T a � � boolean Description Started is a boolean indicating whether the service has been started (TRUE), or stopped (FALSE). DisplayName Started StartMode
8
� * 2 ? � � � � string Description StartMode is a string value indicating whether the Service is automatically started by a System, Operating System, etc. or only started upon request. DisplayName Start Mode Values Automatic Manual SystemCreationClassName +
� h p } � � string Description The scoping System's CreationClassName. DisplayName System Class Name SystemName +
� ! Q ^ string Description The name of the system that hosts this service DisplayName System Name A � � z � } � � StartService , Description The StartService method places the Service in the started state. It returns an integer value of 0 if the Service was successfully started, 1 if the request is not supported and any other number to indicate an error. In a subclass, the set of possible return codes could be specified, using a ValueMap qualifier on the method. The strings to which the ValueMap contents are 'translated' may also be specified in the subclass as a Values array qualifier. � a42c9160500003S ROOT\CIMV2\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � StopService � � Description The StopService method places the service in the stopped state. It returns an integer value of 0 if the service was successfully stopped, 1 if the request is not supported and any other number to indicate an error. � a42c9160500003S ROOT\CIMV2\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ �amps �I Other om �amps � � � __ � � ��� � �7K
� y��� Q tE�, � O �� n �$"�L � ����4 � T r a n s p o r t B i n d i n g E l e m e n t �ԝ��C�= 9 ! TransportBindingElement 6 � �� � + 9 F q w � � � � � � � � s � � � � � h v �UU������������������������������������������������������X � ConnectionOrientedTransportBindingElement ServiceModel Description ConnectionOrientedTransportBindingElement UUID {4cdec0d4-b0c4-4ea7-8d75-40236a87f3ed} ChannelInitializationTimeout e C
� % � � � � � �� datetime Description The Timespan that specifies how long the channel initialization has to complete before timing out. DisplayName ChannelInitializationTimeout subtype interval ConnectionBufferSize 6
� ! ) 6 � � � �� sint32 Description The size of the buffer used to transmit a chunk of the serialized message on the wire from the client or service. DisplayName ConnectionBufferSize HostNameComparisonMode 6
� ) 1 > � � � �� string Description A value that indicates whether the hostname is used to reach the service when matching on the URI. DisplayName HostNameComparisonMode MaxBufferSize " 6
� " / W d � �� sint32 Description The maximum size of the buffer to use. DisplayName MaxBufferSize MaxOutputDelay e * C
� � � � j w � � � �� datetime Description The maximum interval of time that a chunk of a message or a full message can remain buffered in memory before being sent out. DisplayName MaxOutputDelay subtype interval MaxPendingAccepts
. 6
� � � � � � �� sint32 Description The maximum number of pending asynchronous accept threads that are available for processing incoming connections on the service. DisplayName MaxPendingAccepts MaxPendingConnections & 6
� D Q � �� sint32 Description The maximum number of pending connections. DisplayName MaxPendingConnections TransferMode 2 6
� � � � = J � �� string Description A value that specifies whether the messages are buffered or streamed with the connection-oriented transport. DisplayName TransferMode � B i n d i n g E l e m e n t �ԝ��C�� BindingElement 6 , � �� � K Y _ � � �����4 � CompositeDuplexBindingElement Description CompositeDuplexBindingElement ServiceModel UUID {11A902C8-E95E-4450-9B6F-6DDC9ACDF06E} ClientBaseAddress 6
� � � � ! � �� string Description The base address of the client. DisplayName ClientBaseAddress � B i n d i n g E l e m e n t �ԝ��C� BindingElement 6 # � �� � 9 G M u � 5 J � � U����������� � OneWayBindingElement Description OneWayBindingElement ServiceModel UUID {346b65dd-bbb9-43c8-a254-779b2aff95f9} ChannelPoolSettings
6
� � � � � �� object:ChannelPoolSettings Description The channel pool settings. DisplayName ChannelPoolSettings MaxAcceptedChannels 6
� � � � � � � �� sint32 Description The maximum number of accepted channels. DisplayName MaxAcceptedChannels PacketRoutable 6
� C L Y z � � �� boolean Description Whether the packet is routable. DisplayName PacketRoutable in � �ԝ��C��
6 " � �� � 7 E K s � ^ l I i U������������& � ChannelPoolSettings Description ChannelPoolSettings ServiceModel UUID {73b1292c-60a2-405d-a008-a13632059431} IdleTimeout e C
� � � � 1 > K T � �� datetime Description The maximum time the connection can be idle before being disconnected. DisplayName IdleTimeout subtype interval LeaseTimeout e C
� � � � ( 6 ? � �� datetime Description The maximum time for a lease operation to complete before timing out. DisplayName LeaseTimeout subtype interval MaxOutboundChannelsPerEndpoint 6
� � � � � � �� sint32 Description The maximum number of outbound channels per endpoint. DisplayName MaxOutboundChannelsPerEndpoint 2- �) C o n n e c t i o n O r i e n t e d T r a n s p o r t B i n d i n g E l e m e n t �ԝ��C� K 3 ConnectionOrientedTransportBindingElement + 6 � �� � * 7 S Y � � P j _ n * > ! ���U����������������������������������������������������������������������� � TcpTransportBindingElement ServiceModel Description TcpTransportBindingElement UUID {600c8260-c838-4aa6-b818-553f6308ad8b} ConnectionPoolSettings
> 6
� � � + 8 � �� object:TcpConnectionPoolSettings Description The connection pool settings. DisplayName ConnectionPoolSettings ExtendedProtectionPolicy
B 6
� � � � 8 E � �� object:ExtendedProtectionPolicy Description The extended protection policy used by the server to validate incoming client connections. DisplayName ExtendedProtectionPolicy ListenBacklog 6 6
� � � � � �� sint32 Description The maximum number of queued connection requests that can be pending. DisplayName ListenBacklog PortSharingEnabled
: 6
� � � � � � � �� boolean Description A boolean value that specifies whether TCP port sharing is enabled for this connection. DisplayName PortSharingEnabled TeredoEnabled < 6
� e n { � � �� boolean Description A Boolean value that specifies whether Teredo (a technology for addressing clients that are behind firewalls) is enabled. DisplayName TeredoEnabled � B i n d i n g E l e m e n t �ԝ��C�� BindingElement 6 % 2 � �� � W e k � � �����D � WindowsStreamSecurityBindingElement Description WindowsStreamSecurityBindingElement ServiceModel UUID {2a3cf567-a736-4138-a085-0f8f99665572} ProtectionLevel 6
� � � � & 3 � �� string Description The ProtectionLevel for the TCP stream. DisplayName ProtectionLevel � �ԝ��C�� 6 ( � �� � C Q W � ( 9 � � � � F ^ U��������������������� � XmlDictionaryReaderQuotas Description XmlDictionaryReaderQuotas ServiceModel UUID {e1d18625-d144-4121-99e7-72b7bfb0e4c1} MaxArrayLength 6
� � � � � �� sint32 Description The maximum allowed array length. DisplayName MaxArrayLength MaxBytesPerRead 6
� } � � � � � �� sint32 Description The maximum allowed bytes returned per read. DisplayName MaxBytesPerRead MaxDepth 6
� , 4 A j w � �� sint32 Description The maximum nested node depth per read. DisplayName MaxDepth MaxNameTableCharCount 6
� � � � " / � �� sint32 Description The maximum characters allowed in a table name. DisplayName MaxNameTableCharCount MaxStringContentLength 6
� � � � � � � �� sint32 Description The maximum characters allowed in XML element content. DisplayName MaxStringContentLength � �9 C I M _ S e t t i n g e͝��C�|9 � CIM_Setting
C � �� � & 3 � � �
L S � � �
�
l t � � & � � � � M X \ g e! k! �" �" $ %$ S% ^% b& n& �' �' G) R) �* �* �, �, h. ~. �/ �/ �2 �2 �4 �4 6 6 UUUUUUU����������������������������������������������������������������������������������������������������������������������������������7 � Win32_PrinterConfiguration CIMWin32 Description The Win32_PrinterConfiguration class defines the configuration for a printer device. This includes capabilities such as resolution, color, fonts, and orientation. Locale UUID {8502C4E9-5FBB-11D2-AAC1-006008C78BC7} BitsPerPel A
� i q �� � ��} � � � uint32 DEPRECATED Description The BitsPerPel property contains the number of bits per pixel for the output device Win32 printer. This member is used by display drivers and not by printer drivers.
Example: 8.
This property has been deprecated because it is not applicable to printers. There is no replacement value. MappingStrings � Win32API|Printing and Print Spooler Structures|DEVMODE|dmBitsPerPel Collate 6
� W � ��` m � boolean Description The Collate property specifies whether to collate the pages that are printed. To collate is to print out the entire document before printing the next copy, as opposed to printing out each page of the document the required number times. This property is ignored unless the printer driver indicates support for collation.
Values: TRUE or FALSE. If TRUE, the printer collates all documents. MappingStrings
Win32API|Printing and Print Spooler Structures|DEVMODE|dmCollate Color P
� � � ��� � * 2 Q [ m } uint32 Description The Color property indicates whether the document is to be printed in color or monochrome. Some color printers have the capability to print using true black instead of a combination of Yellow, Cyan, and Magenta. This usually creates darker and sharper text for documents. This option is only useful for color printers that support true black printing. Values > J Monochrome Color ValueMap g j 1 2 MappingStrings � Win32API|Printing and Print Spooler Structures|DEVMODE|dmColor Copies 6
� � �� & � � uint32 Description The Copies property indicates the number of copies to be printed. The printer driver must support printing multi-page copies.
Example: 2 MappingStrings � Win32API|Printing and Print Spooler Structures|DEVMODE|dmCopies DeviceName 6
� Y � ��a n O
_
string Description The DeviceName property specifies the friendly name of the printer. This name is unique to the type of printer and may be truncated because of the limitations of the string from which it is derived.
Example PCL/HP LaserJet MappingStrings g
Win32API|Printing and Print Spooler Structures|DEVMODE|dmDeviceName DisplayFlags A
� �� � �� * � � uint32 DEPRECATED Description The DisplayFlags property contains two bits of information about the display. This member communicates whether the display device is monochrome or colored, and interlaced or non-interlaced, by masking its value with the DM_GRAYSCALE and DM_INTERLACED masks respectively.
This property has been deprecated because it is not applicable to printers. There is no replacement value. MappingStrings � Win32API|Printing and Print Spooler Structures|DEVMODE|dmDisplayFlags DisplayFrequency " A
� h
p
�� � ��|
�
� � uint32 DEPRECATED Description The DisplayFrequency property indicates the refresh frequency of the display The refresh frequency for a monitor is the number of times the screen is redrawn per second.
This property has been deprecated because it is not applicable to printers. There is no replacement value. MappingStrings � Win32API|Printing and Print Spooler Structures|DEVMODE|dmDisplayFrequency DitherType
& P
� o � ��w � ' t | � � uint32 Description The DitherType property indicates the dither type of the printer. This member can assume predefined values of 1 to 5, or driver-defined values from 6 to 256. Line art dithering is a special dithering method that produces well defined borders between black, white, and gray scalings. It is not suitable for images that include continuous graduations in intensity and hue such as scanned photographs. MappingStrings / Win32API|Printing and Print Spooler Structures|DEVMODE|dmDitherType Values � � � � � No Dithering Coarse Brush Fine Brush Line Art Greyscale ValueMap � � � � � 1 2 3 4 5 DriverVersion * 6
� U � ��] j uint32 Description The DriverVersion property indicates the version number of the Win32 printer driver. The version numbers are created and maintained by the driver manufacturer. MappingStrings $ Win32API|Printing and Print Spooler Structures|DEVMODE|dmDriverVersion Duplex . 6
� � � ��� � \ l boolean Description The Duplex property indicates whether printing is done on one or both sides.
Values: TRUE or FALSE. If TRUE, printing is done on both sides. MappingStrings t Win32API|Printing and Print Spooler Structures|DEVMODE|dmDuplex FormName
0 6
� � �� � � string Description The FormName property indicates the name of the form used for the print job. This property is used only on Windows NT/Windows 2000 systems.
Example: Legal MappingStrings � Win32API|Printing and Print Spooler Structures|DEVMODE|dmFormName HorizontalResolution x C
� w � �� � � � � � uint32 Units dots per inch Description The HorizontalResolution property indicates the print resolution along the X axis (width) of the print job. This value is only set when the PrintQuality property of this class is positive and is similar to the XResolution property. MappingStrings � Win32API|Printing and Print Spooler Structures|DEVMODE|dmPrintQuality ICMIntent 4 P
� S � ��[ h " 2 ~ � � � uint32 Description The ICMIntent (Image Color Matching Intent) property indicates the specific value of one of the three possible color matching methods (called intents) that should be used by default. ICM applications establish intents by using the ICM functions. This property can assume predefined values of 1 to 3, or driver-defined values from 4 to 256. Non-ICM applications can use this value to determine how the printer handles color printing jobs. MappingStrings : Win32API|Printing and Print Spooler Structures|DEVMODE|dmICMIntent Values � � � Saturation Contrast Exact Color ValueMap � � � 1 2 3 ICMMethod 8 P
� E � ��M Z � � � � # - uint32 Description The ICMMethod (Image Color Matching Method) property specifies how ICM is handled. For a non-ICM application, this property determines if ICM is enabled or disabled. For ICM applications, the system examines this property to determine which part of the computer system handles ICM support. MappingStrings � Win32API|Printing and Print Spooler Structures|DEVMODE|dmICMMethod Values � Disabled Windows Device Driver Device ValueMap A D G J 1 2 3 4 LogPixels < N
� � � �� � ��� � � � uint32 DEPRECATED Units pixels `�?P � ڛ�F+
��2� � H �bn � , X e S q l P k g _ h a d r _ t r a n s p o r t _ d u m p _ f a i l u r e _ m e s s a g e
Y��7 �k / 6 XeSqlPkg_hadr_transport_dump_failure_message . ) � ��% 0
> J � � I T � � � K W � � D R n
�
WU��������������������������������������������x � hadr_transport_dump_failure_message EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid err_major )
� 6 > � �� sint32 WmiDataId err_minor )
� � � � �� sint32 WmiDataId err_severity )
� � � � �� sint32 WmiDataId err_state $ )
� 8 @ � �� sint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId message_log_id
( 6
� (
� ��3 > object:guid WmiDataId Extension Guid message_type P
� � � � ��� j � � ( uint32 WmiDataId XEMapId ValueMap * � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � 25 24 3 4 1 2 41 19 36 8 28 27 16 15 20 21 23 22 0 9 18 17 11 38 14 13 39 6 30 35 12 32 29 7 31 5 34 33 26 40 37 10 Values * � � 5 K d v � � � � ! = ` z � � � � � = X u � � � � � 0 V x � � � � �
7
U
HadrMsgTypeBackupInfoMsg HadrMsgTypeBackupSyncMsg HadrMsgTypeConfigAck HadrMsgTypeConfigFail HadrMsgTypeConfigSyn HadrMsgTypeConfigSynAck HadrMsgTypeCount HadrMsgTypeDBReplicaStatusChange HadrMsgTypeDownloadAgConfigMsg HadrMsgTypeEstablishDB HadrMsgTypeExtendedRecoveryForksMsg HadrMsgTypeExtendedRecoveryForksRequestMsg HadrMsgTypeFileMetadataMsg HadrMsgTypeFileMetadataRequestMsg HadrMsgTypeFsBlockEndMsg HadrMsgTypeFsDirCreateMsg HadrMsgTypeFsFileDataMsg HadrMsgTypeFsFileRequestMsg HadrMsgTypeInvalid HadrMsgTypeLogBlockMsg HadrMsgTypeLogFileMetadataMsg HadrMsgTypeLogFileMetadataRequestMsg HadrMsgTypeLogProgressMsg HadrMsgTypeOfflinePrimaryAg HadrMsgTypePageCopyMsg HadrMsgTypePageRequestMsg HadrMsgTypePaxosMsg HadrMsgTypePing HadrMsgTypePreConfigMsg HadrMsgTypePreConfigReceivedAndConfigSyn HadrMsgTypePrimaryProgressMsg HadrMsgTypePrimaryReplicaFileListMsg HadrMsgTypePrimaryReplicaInfoMsg HadrMsgTypePrimarySync HadrMsgTypeReportFaultOnReplica HadrMsgTypeReset HadrMsgTypeSeedingCancelMsg HadrMsgTypeSeedingRequestMsg HadrMsgTypeSyncLogProgressMsg HadrMsgTypeTestConfigMsg HadrMsgTypeUpdateAgConfigMsg HadrMsgTypeVLFHeaderMsg RemainingLength 6
� �
�
�
�
� �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� H P [ h � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g Y��7 �W XeSqlPkg
C � ��0 = t z � � � � c����� � XeSqlPkg_hadr_transport_dump_preconfig_message Description Use this event to help trace HADR preconfig messages. Guid {EF0D6A96-6A78-4A03-873E-78026CCFCD3F} locale MS\0x409 DisplayName hadr_transport_dump_preconfig_message �. X e S q l P k g _ h a d r _ t r a n s p o r t _ d u m p _ p r e c o n f i g _ m e s s a g e Y��7 �P P 8 XeSqlPkg_hadr_transport_dump_preconfig_message 0 ) � ��' 2
@ L � V g � � � � $ 1 { � � " / y � � � � WUU�����������������������������������������������������������������������������"
� hadr_transport_dump_preconfig_message EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid configuration_number
8 )
� C K
� �� sint64 WmiDataId current_version ( )
� � � � �� uint64 WmiDataId dataloss_number 0 )
� � � �� sint64 WmiDataId endpoint
H C
� g o
� ��z � � � string WmiDataId StringTermination NullTerminated Format w FragmentId 6
� � � �� uint32 WmiDataId Description FragmentId max_version )
� h p � �� uint64 WmiDataId message_log_id
@ 6
� � � � ��� � object:guid WmiDataId Extension Guid message_type P
� d l � ��w j � � � � uint32 WmiDataId XEMapId ValueMap * 6 : > A D G J N R V Y ] a e i m q u y | � � � � � � � � � � � � � � � � � � � � � 25 24 3 4 1 2 41 19 36 8 28 27 16 15 20 21 23 22 0 9 18 17 11 38 14 13 39 6 30 35 12 32 29 7 31 5 34 33 26 40 37 10 Values * � � � � � � * L l � � � � . I c � � � � � ) A \ q � � � �
,
D
e
w
�
�
�
�
HadrMsgTypeBackupInfoMsg HadrMsgTypeBackupSyncMsg HadrMsgTypeConfigAck HadrMsgTypeConfigFail HadrMsgTypeConfigSyn HadrMsgTypeConfigSynAck HadrMsgTypeCount HadrMsgTypeDBReplicaStatusChange HadrMsgTypeDownloadAgConfigMsg HadrMsgTypeEstablishDB HadrMsgTypeExtendedRecoveryForksMsg HadrMsgTypeExtendedRecoveryForksRequestMsg HadrMsgTypeFileMetadataMsg HadrMsgTypeFileMetadataRequestMsg HadrMsgTypeFsBlockEndMsg HadrMsgTypeFsDirCreateMsg HadrMsgTypeFsFileDataMsg HadrMsgTypeFsFileRequestMsg HadrMsgTypeInvalid HadrMsgTypeLogBlockMsg HadrMsgTypeLogFileMetadataMsg HadrMsgTypeLogFileMetadataRequestMsg HadrMsgTypeLogProgressMsg HadrMsgTypeOfflinePrimaryAg HadrMsgTypePageCopyMsg HadrMsgTypePageRequestMsg HadrMsgTypePaxosMsg HadrMsgTypePing HadrMsgTypePreConfigMsg HadrMsgTypePreConfigReceivedAndConfigSyn HadrMsgTypePrimaryProgressMsg HadrMsgTypePrimaryReplicaFileListMsg HadrMsgTypePrimaryReplicaInfoMsg HadrMsgTypePrimarySync HadrMsgTypeReportFaultOnReplica HadrMsgTypeReset HadrMsgTypeSeedingCancelMsg HadrMsgTypeSeedingRequestMsg HadrMsgTypeSyncLogProgressMsg HadrMsgTypeTestConfigMsg HadrMsgTypeUpdateAgConfigMsg HadrMsgTypeVLFHeaderMsg min_version )
� f n � �� uint64 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� S [ f s � �� uint32 WmiDataId Description SequenceNumber server_name D C
� � � � ���
string WmiDataId StringTermination NullTerminated Format w � X e S q l P k g Y��7 �l XeSqlPkg
C � ��. ; � � � � � � c����� � XeSqlPkg_hadr_transport_dump_dropped_message Description Use this event to trace dropped HADR transport messages throughout the system. Guid {4E608F75-2CB7-440C-BB82-B1E1142664FF} locale MS\0x409 DisplayName hadr_transport_dump_dropped_message �E2C8D89C70E59F6A34B44D3F52C6.3260.2299521010.3558 CD_0AB7BBED56D14920869CD440C3CE895C3D6E7F9018DB2CE4963CBB32D1B7CA7B.3262.236649288.1305 CD_0B5AAAB118F988B4C68B2740600B61C8981003CC080FE852D5AF14F1A379A2C0.3267.3052567418.1928 Sequence �e] kЗـ I ��N� & G[� nb� � ]?�� � �|C�� � �&z2 � 5 7 E 5 F 3 A D D 9 E 2 4 2 C 4 E 9 F 9 E D F 7 9 A A 9 7 F 7 9 E 7 9 1 1 C 5 A 8 B 9 0 2 E C 1 5 0 D 6 4 4 2 E 3 B 8 5 A 5 A A M̝��C�ȝ��C�� �?����M 9 W � __Win32Provider {d63a5850-8f16-11cf-9f47-00aa00bf345c} NetworkServiceHost SECRCW32 E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C N̝��C� ȝ��C�� � ��������P i � __InstanceProviderRegistration \\.\root\cimv2:__Win32Provider.Name="SECRCW32" X WQL:UnarySelect
R O O T \ c i m v 2 _ _ I n s t a n c e P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 6 8 5 7 7 3 7 2 C 6 6 A 7 B 2 0 6 5 8 4 8 7 F B D 9 5 9 A A 1 5 4 E F 5 4 B 5 F 9 3 5 D C C 5 6 6 3 E 9 2 2 8 B 4 4 3 2 2 8 0 5 \ K I _ E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C \ I _ 3 4 0 C B E 7 8 E C D C 1 4 7 C C 0 D 8 E 0 8 D 2 5 E 2 8 D 5 8 1 2 D D 3 5 2 A 6 0 2 0 A 7 8 4 7 8 6 0 B 2 3 A 3 D 7 4 7 C 8 4 7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D O̝��C�
ȝ��C�e N � __MethodProviderRegistration \\.\root\cimv2:__Win32Provider.Name="SECRCW32"
C I M _ C o m p o n e n t K̝��C�p CIM_Component ) ! � ��� � � G V ������� � Win32_UserInDomain Description The Win32_UserInDomain relationship identifies the user accounts associated with a NT domain. AMENDMENT LOCALE GroupComponent f@ )
� � � � � �� ref:Win32_NTDomain Description The Antecedent reference represents the domain the user account exists in. PartComponent f@ )
� � � � � �� ref:Win32_UserAccount Description The Dependent reference represents the user accounts that exists on the domain. n. �
C I M _ C o m p o n e n t L̝��C�n CIM_Component ) " � ��� � � J Y ������� � Win32_GroupInDomain Description The Win32_GroupInDomain relationship identifies the group accounts associated with a NT domain. AMENDMENT LOCALE GroupComponent f@ )
� � � � � �� ref:Win32_NTDomain Description The Antecedent reference represents the domain the user account exists in. PartComponent f@ )
� � � � � �� ref:Win32_Group Description The Dependent reference represents the group accounts that exists on the domain. th �
C I M _ S y s t e m JtR|�C�X P CIM_System ) � ��� � � d p � � � � S p 2 H � � �
�
� � � � q
�
> O $ � � � � � � _ o �_UUU��������������������������������������������������������������������������. � Win32_NTDomain Description The Win32_NTDomain class represents a NT Domain. A domain is a single security boundary of a Windows NT computer network. Active Directory is made up of one or more domains. On a standalone workstation, the domain is the computer itself. A domain can span more than one physical location. Every domain has its own security policies and security relationships with other domains. When multiple domains are connected by trust relationships and share a common schema, configuration, and global catalog, you have a domain tree. Multiple domain trees can be connected together into a forest. All the domains in a forest also share a common schema, configuration, and global catalog. AMENDMENT LOCALE ClientSiteName
� ) string Description The ClientSiteName property indicates the name of the site where the domain controller is configured to be in. This value may be NULL if the site that the computer named by ComputerName cannot be found (for example, if the DS administrator has not associated the subnet that the computer is in with a valid site). DcSiteName
� � � � string Description The DcSiteName property indicates the name of the site where the domain controller is located. This value may be NULL if the domain controller is not in a site (for example, the domain controller is a Windows NT 4.0 domain controller). DnsForestName
� � � � string Description The DnsForestName property indicates the name of the domain at the root of the DS tree. The DNS-style name (for example, microsoft.com.) will be returned if available. DomainControllerAddress $
� � � � string Description The DomainControllerAddress property indicates the address of the discovered domain controller. DomainControllerAddressType
( +
� � � � � sint32 Description Indicates the type of address specified in DomainControllerAddress. The following valid values are presented in order, DS_INET_ADDRESS = Address is a string IP address (for example, \\157.55.94.74) of the domain controller. DS_NETBIOS_ADDRESS = The NetBIOS name (for example, \\phoenix) of the domain controller. Values
DS_INET_ADDRESS DS_NETBIOS_ADDRESS DomainControllerName ,
� t | � string Description The DomainControllerName property indicates the computer name of the discovered domain controller. DomainGuid 0
� %
-
:
string Description The GUID of the domain. This member will be zero if the domain controller does not have a Domain GUID (for example, the domain controller is not a Windows 2000 domain controller). DomainName
4
� ' / < string Description The DomainName property indicates the name of the domain. The DNS-style name (for example, microsoft.com.) will be returned if available. DSDirectoryServiceFlag 8
� " boolean Description Directory Service (DS) flag indicating that the domain controller is a directory service server for the domain. DSDnsControllerFlag :
� � � � boolean Description Directory Service (DS) flag indicating that the Domain Controller Name is in DNS format (for example, www.mynode.com or 135.5.33.19). DSDnsDomainFlag <
� �
�
�
boolean Description Directory Service (DS) flag indicating that the DomainName is in DNS format(for example, www.mynode.com or 135.5.33.19). DSDnsForestFlag >
� { � � boolean Description Directory Service (DS) flag indicating that the DnsForestName is in DNS format (for example, www.mynode.com or 135.5.33.19). DSGlobalCatalogFlag @
� P Y f boolean Description Directory Service (DS) flag indicating that the domain controller is a Global Catalog (GC) server for DnsForestName. DSKerberosDistributionCenterFlag B
� * 3 @ boolean Description Directory Service (DS) flag indicating that the domain controller is a Kerberos Key Distribution Center for the domain. DSPrimaryDomainControllerFlag D
�
boolean Description Directory Service (DS) flag indicating that the domain controller is the Primary Domain Controller (PDC) of the domain. DSTimeServiceFlag F
� � � � boolean Description Directory Service (DS) flag indicating that the domain controller is running the Windows Time service for the domain. DSWritableFlag H
� � � � boolean Description Directory Service (DS) flag indicating that the domain controller hosts a write able DS or Security Accounts Manager (SAM). �ain. th � n. � � � Y{{ � Q ���� � �k@fl
�
��+ v �i� � ���G � �o�1 j
E v e n t T r a c e �ӝ��C�% EventTrace 6 � �� ( 4 : b j t { ! ( u��������� � MsftDiscFormat2MsfAddress Description IMAPI2 MSF guid {0e85a5a5-4d5c-44b7-8bda-5b7ab54f7e9f} locale MS\0x409 Flags R
� � � � � � � L T � � uint32 Description Enable Flags ValueDescriptions ! R � MsftDiscFormat2MsfAddress_DebugConstructor Flag MsftDiscFormat2MsfAddress_DebugDestructor Flag MsftDiscFormat2MsfAddress_DebugGeneral Flag DefineValues � � $ MsftDiscFormat2MsfAddress_DebugConstructor MsftDiscFormat2MsfAddress_DebugDestructor MsftDiscFormat2MsfAddress_DebugGeneral Values d � � MsftDiscFormat2MsfAddress_DebugConstructor MsftDiscFormat2MsfAddress_DebugDestructor MsftDiscFormat2MsfAddress_DebugGeneral ValueMap � 0x00000001 0x00000002 0x00000004 Level _
� � � � � � � � ` j � � uint32 Description Levels ValueDescriptions � � A [ Abnormal exit or termination Severe errors that need logging Warnings such as allocation failure Includes non-error cases Detailed traces from intermediate steps DefineValues � � � � � TRACE_LEVEL_FATAL TRACE_LEVEL_ERROR TRACE_LEVEL_WARNING TRACE_LEVEL_INFORMATION TRACE_LEVEL_VERBOSE Values 3 : A J W Fatal Error Warning Information Verbose ValueMap � � � � � 0x1 0x2 0x3 0x4 0x5 ValueType index �
E v e n t T r a c e �ӝ��C�o EventTrace 6 � ��! . H N v ~ � � k r ���������� � MsftDiscFormat2StreamInterleave Description IMAPI2 Interleave Stream guid {0e85a5a5-4d5c-44b7-8bda-5b7ab54f7e9e} locale MS\0x409 Flags R
� � � % � � � � - 7 uint32 Description Enable Flags ValueDescriptions 5 l � MsftDiscFormat2StreamInterleave_DebugConstructor Flag MsftDiscFormat2StreamInterleave_DebugDestructor Flag MsftDiscFormat2StreamInterleave_DebugGeneral Flag DefineValues � % V MsftDiscFormat2StreamInterleave_DebugConstructor MsftDiscFormat2StreamInterleave_DebugDestructor MsftDiscFormat2StreamInterleave_DebugGeneral Values � � � MsftDiscFormat2StreamInterleave_DebugConstructor MsftDiscFormat2StreamInterleave_DebugDestructor MsftDiscFormat2StreamInterleave_DebugGeneral ValueMap G S _ 0x00000001 0x00000002 0x00000004 Level _
� � � � � � � ] e � � � � uint32 Description Levels ValueDescriptions ' E f � � Abnormal exit or termination Severe errors that need logging Warnings such as allocation failure Includes non-error cases Detailed traces from intermediate steps DefineValues � / H TRACE_LEVEL_FATAL TRACE_LEVEL_ERROR TRACE_LEVEL_WARNING TRACE_LEVEL_INFORMATION TRACE_LEVEL_VERBOSE Values } � � � � Fatal Error Warning Information Verbose ValueMap � � � � � 0x1 0x2 0x3 0x4 0x5 ValueType index EL �
E v e n t T r a c e �ӝ��C�z EventTrace 6 � ��" / J P x � � � v } ��������� � MsftDiscFormat2StreamConcatenate Description IMAPI2 Concatenate Stream guid {0e85a5a5-4d5c-44b7-8bda-5b7ab54f7e9d} locale MS\0x409 Flags R
� � � ' � � � � 8 B uint32 Description Enable Flags ValueDescriptions 7 o � MsftDiscFormat2StreamConcatenate_DebugConstructor Flag MsftDiscFormat2StreamConcatenate_DebugDestructor Flag MsftDiscFormat2StreamConcatenate_DebugGeneral Flag DefineValues � + ] MsftDiscFormat2StreamConcatenate_DebugConstructor MsftDiscFormat2StreamConcatenate_DebugDestructor MsftDiscFormat2StreamConcatenate_DebugGeneral Values � � MsftDiscFormat2StreamConcatenate_DebugConstructor MsftDiscFormat2StreamConcatenate_DebugDestructor MsftDiscFormat2StreamConcatenate_DebugGeneral ValueMap R ^ j 0x00000001 0x00000002 0x00000004 Level _
� � � � � � h p � � � � uint32 Description Levels ValueDescriptions 2 P q � � Abnormal exit or termination Severe errors that need logging Warnings such as allocation failure Includes non-error cases Detailed traces from intermediate steps DefineValues � % : S TRACE_LEVEL_FATAL TRACE_LEVEL_ERROR TRACE_LEVEL_WARNING TRACE_LEVEL_INFORMATION TRACE_LEVEL_VERBOSE Values � � � � � Fatal Error Warning Information Verbose ValueMap � � � � � 0x1 0x2 0x3 0x4 0x5 ValueType index �
E v e n t T r a c e �ӝ��C�J EventTrace 6 � �� * G M u } � � F M ���������� � MsftDiscFormat2StreamRandom Description IMAPI2 Pseudo-Random Stream guid {0e85a5a5-4d5c-44b7-8bda-5b7ab54f7e9c} locale MS\0x409 Flags R
� � � $ � � k s uint32 Description Enable Flags ValueDescriptions 4 g � MsftDiscFormat2StreamRandom_DebugConstructor Flag MsftDiscFormat2StreamRandom_DebugDestructor Flag MsftDiscFormat2StreamRandom_DebugGeneral Flag DefineValues � A MsftDiscFormat2StreamRandom_DebugConstructor MsftDiscFormat2StreamRandom_DebugDestructor MsftDiscFormat2StreamRandom_DebugGeneral Values � � � MsftDiscFormat2StreamRandom_DebugConstructor MsftDiscFormat2StreamRandom_DebugDestructor MsftDiscFormat2StreamRandom_DebugGeneral ValueMap " . : 0x00000001 0x00000002 0x00000004 Level _
� � � � � � � � 8 @ � � � � uint32 Description Levels ValueDescriptions A f � Abnormal exit or termination Severe errors that need logging Warnings such as allocation failure Includes non-error cases Detailed traces from intermediate steps DefineValues � � �
# TRACE_LEVEL_FATAL TRACE_LEVEL_ERROR TRACE_LEVEL_WARNING TRACE_LEVEL_INFORMATION TRACE_LEVEL_VERBOSE Values X _ f o | Fatal Error Warning Information Verbose ValueMap � � � � � 0x1 0x2 0x3 0x4 0x5 ValueType index TR � R S O P _ P o l i c y S e t t i n g �ӝ��C�� 8 RSOP_PolicySetting �� & 9 ` s � � � � % L c � � �^U���������� � � ��������������������������������� � RSOP_PolmkrSetting Abstract Locale polmkrBaseCseGuid
� X string polmkrBaseGpeGuid $
� � string polmkrBaseGpoDisplayName
� � string polmkrBaseGpoGuid
�
string polmkrBaseHash
(
� D string polmkrBaseInstanceXml 0
� � string polmkrBaseKeyValues ,
� � string � R S O P _ P o l m k r S e t t i n g �ӝ��C�� 8 RSOP_PolmkrSetting ��! ������������, * . ��������������������������������) � RSOP_PolmkrProSetting Abstract Locale � R S O P _ P o l m k r P r o S e t t i n g �ӝ��C�( 8 RSOP_PolmkrProSetting ' + ] i ������������, * . ��������������������������������� � RSOP_PolmkrEnvironmentSetting Locale id @
� U � �� string precedence @
� � � �� uint32 � �{�� � 0T�
� � Tm�� - 2Z"�� � {�qBn - �� > �z�
> \�i
? ݊��V H $��<� D �@5�� C J��% F �s@Yk { G0C�� � �� � � # M s f t _ W m i P r o v i d e r _ O p e r a t i o n E v e n t _ P r e �̝��C�� < - Msft_WmiProvider_OperationEvent_Pre % + 2 Y j � � � � ��W���������������������������������������������������������� � Msft_WmiProvider_ExecMethodAsyncEvent_Pre Flags 0
� Q Uint32 InputParameters
4
� � Object MethodName
,
� � String ObjectPath (
� � String �# M s f t _ W m i P r o v i d e r _ O p e r a t i o n E v e n t _ P r e �̝��C�H 7 - Msft_WmiProvider_OperationEvent_Pre % & M V } � ��W����������������������������������������������������� � Msft_WmiProvider_NewQuery_Pre Query 0
� E string QueryId (
� u uint32 QueryLanguage
,
� � string �# M s f t _ W m i P r o v i d e r _ O p e r a t i o n E v e n t _ P r e �̝��C�� / - Msft_WmiProvider_OperationEvent_Pre % " + �����������������������������������������������R � Msft_WmiProvider_CancelQuery_Pre QueryId (
� J uint32 �# M s f t _ W m i P r o v i d e r _ O p e r a t i o n E v e n t _ P r e �̝��C�F 7 - Msft_WmiProvider_OperationEvent_Pre % " ) P _ � � ��W����������������������������������������������������� � Msft_WmiProvider_AccessCheck_Pre Query
,
� H string QueryLanguage (
� ~ string Sid 0
� � uint8 �# M s f t _ W m i P r o v i d e r _ O p e r a t i o n E v e n t _ P r e �̝��C�� / - Msft_WmiProvider_OperationEvent_Pre % $ + �����������������������������������������������R � Msft_WmiProvider_ProvideEvents_Pre Flags (
� J uint32 �$ M s f t _ W m i P r o v i d e r _ O p e r a t i o n E v e n t _ P o s t �̝��C�� @ . Msft_WmiProvider_OperationEvent_Post & + 2 Y j � � � � � ��W�������������������������������������������������������������/ � Msft_WmiProvider_GetObjectAsyncEvent_Post Flags
,
� Q Uint32 ObjectParameter
4
� � Object ObjectPath (
� � String ResultCode 0
� � Uint32 StringParameter
8
� ' String �$ M s f t _ W m i P r o v i d e r _ O p e r a t i o n E v e n t _ P o s t �̝��C�� @ . Msft_WmiProvider_OperationEvent_Post & * 7 ^ e � � � � � ��W�������������������������������������������������������������/ � Msft_WmiProvider_PutClassAsyncEvent_Post ClassObject
(
� V Object Flags
,
� � Uint32 ObjectParameter
4
� � Object ResultCode 0
� � Uint32 StringParameter
8
� ' String �$ M s f t _ W m i P r o v i d e r _ O p e r a t i o n E v e n t _ P o s t �̝��C�� @ . Msft_WmiProvider_OperationEvent_Post & - 8 _ f � � � � � ��W�������������������������������������������������������������0 � Msft_WmiProvider_DeleteClassAsyncEvent_Post ClassName (
� W String Flags
,
� � Uint32 ObjectParameter
4
� � Object ResultCode 0
� � Uint32 StringParameter
8
� ( String �$ M s f t _ W m i P r o v i d e r _ O p e r a t i o n E v e n t _ P o s t �̝��C�� @ . Msft_WmiProvider_OperationEvent_Post & 1 8 _ p � � � � ��W�������������������������������������������������������������9 � Msft_WmiProvider_CreateClassEnumAsyncEvent_Post Flags
,
� W Uint32 ObjectParameter
4
� � Object ResultCode 0
� � Uint32 StringParameter
8
� � String SuperclassName (
� 1 String �$ M s f t _ W m i P r o v i d e r _ O p e r a t i o n E v e n t _ P o s t �̝��C�� @ . Msft_WmiProvider_OperationEvent_Post & - 4 [ k � � � � � ��W�������������������������������������������������������������5 � Msft_WmiProvider_PutInstanceAsyncEvent_Post Flags
,
� S Uint32 InstanceObject
(
� � Object ObjectParameter
4
� � Object ResultCode 0
� � Uint32 StringParameter
8
� - String �$ M s f t _ W m i P r o v i d e r _ O p e r a t i o n E v e n t _ P o s t �̝��C�� @ . Msft_WmiProvider_OperationEvent_Post & 0 7 ^ o � � � � �
��W�������������������������������������������������������������4 � Msft_WmiProvider_DeleteInstanceAsyncEvent_Post Flags
,
� V Uint32 ObjectParameter
4
� � Object ObjectPath (
� � String ResultCode 0
� � Uint32 StringParameter
8
� , String �$ M s f t _ W m i P r o v i d e r _ O p e r a t i o n E v e n t _ P o s t �̝��C�� @ . Msft_WmiProvider_OperationEvent_Post & 4 ? f m � � � � � ��W�������������������������������������������������������������7 � Msft_WmiProvider_CreateInstanceEnumAsyncEvent_Post ClassName (
� ^ String Flags
,
� � Uint32 ObjectParameter
4
� � Object ResultCode 0
� � Uint32 StringParameter
8
� / String �$ M s f t _ W m i P r o v i d e r _ O p e r a t i o n E v e n t _ P o s t �̝��C� D . Msft_WmiProvider_OperationEvent_Post & + 2 Y j � � � � � ( 9 ��W����������������������������������������������������������������` � Msft_WmiProvider_ExecQueryAsyncEvent_Post Flags 0
� Q Uint32 ObjectParameter
8
� � Object Query
,
� � String QueryLanguage (
� � String ResultCode 4
� Uint32 StringParameter <
� X String �$ M s f t _ W m i P r o v i d e r _ O p e r a t i o n E v e n t _ P o s t �̝��C�b H . Msft_WmiProvider_OperationEvent_Post & , 3 Z k � � � � � 0 < c t ��WU��������������������������������������������������������������������� � Msft_WmiProvider_ExecMethodAsyncEvent_Post Flags 0
� R Uint32 InputParameters
4
� � Object MethodName
,
� � String ObjectParameter
<
� � Object ObjectPath (
� ( String ResultCode
8
� [ Uint32 StringParameter @
� � String �$ M s f t _ W m i P r o v i d e r _ O p e r a t i o n E v e n t _ P o s t �̝��C�� < . Msft_WmiProvider_OperationEvent_Post & ' N W ~ � � � ��W���������������������������������������������������������� � Msft_WmiProvider_NewQuery_Post Query 0
� F string QueryId (
� v uint32 QueryLanguage
,
� � string Result 4
� � uint32 � >ۓZ0 V N��Ɔ � ��v9n � ��AW s �� J� �
d��
� � �9u
8 ��y{� � lv�B� 8 � jB� � �E5;� r ��3 r /Kإ s �X�� | Q"�)� x � w ��@� z l�m� � M S F T _ W m i S e l f E v e n t �̝��C� + MSFT_WmiSelfEvent ! / V l � � � � �� 1 X ^ _U������������������������������������������ � Msft_WmiProvider_OperationEvent HostingGroup $
� N String HostingSpecification
� � Uint32 Locale
� � String Namespace
� � String
� String TransactionIdentifer
� P String User
� } String � M s f t _ W m i P r o v i d e r _ O p e r a t i o n E v e n t �̝��C�� + ) Msft_WmiProvider_OperationEvent ! �������������������������������������������% � Msft_WmiProvider_OperationEvent_Pre � M s f t _ W m i P r o v i d e r _ O p e r a t i o n E v e n t �̝��C�� + ) Msft_WmiProvider_OperationEvent ! �������������������������������������������& � Msft_WmiProvider_OperationEvent_Post � M s f t _ W m i P r o v i d e r _ O p e r a t i o n E v e n t �̝��C� @ ) Msft_WmiProvider_OperationEvent ! . 5 \ j � � � � 8 D ��W������������������������������������������������������������k � Msft_WmiProvider_ComServerLoadOperationEvent Clsid (
� T String InProcServer 0
� � boolean InProcServerPath
4
� � String LocalServer 2
� � boolean LocalServerPath 8
� 0 String ServerName
,
� c String � M s f t _ W m i P r o v i d e r _ O p e r a t i o n E v e n t �̝��C�c D ) Msft_WmiProvider_OperationEvent ! 5 < c q � � � � ? K r ~ ��WU����������������������������������������������������������������� � Msft_WmiProvider_ComServerLoadOperationFailureEvent Clsid (
� [ String InProcServer 0
� � boolean InProcServerPath
4
� � String LocalServer 2
� � boolean LocalServerPath 8
� 7 String ResultCode <
� j uint32 ServerName
,
� � String � M s f t _ W m i P r o v i d e r _ O p e r a t i o n E v e n t �̝��C�� I ) Msft_WmiProvider_OperationEvent ! % , S a � � � � � / ; b s � � ��WU���������������������������������������������������������������������� � Msft_WmiProvider_LoadOperationEvent Clsid (
� K String InProcServer 0
� � boolean InProcServerPath
4
� � String LocalServer 2
� � boolean LocalServerPath 8
� ' String ServerName
,
� Z String Synchronisation @
� � uint32 ThreadingModel <
� � uint32 � M s f t _ W m i P r o v i d e r _ O p e r a t i o n E v e n t �̝��C�� M ) Msft_WmiProvider_OperationEvent ! , 3 Z h � � � � � 6 B i u � � � � ��WU������������������������������������������������������������������������� � Msft_WmiProvider_LoadOperationFailureEvent Clsid (
� R String InProcServer 0
� � boolean InProcServerPath
4
� � String LocalServer 2
� � boolean LocalServerPath 8
� . String ResultCode D
� a uint32 ServerName
,
� � String Synchronisation @
� � uint32 ThreadingModel <
� uint32 � M s f t _ W m i P r o v i d e r _ O p e r a t i o n E v e n t �̝��C�� + ) Msft_WmiProvider_OperationEvent ! �������������������������������������������/ � Msft_WmiProvider_InitializationOperationEvent � M s f t _ W m i P r o v i d e r _ O p e r a t i o n E v e n t �̝��C�� / ) Msft_WmiProvider_OperationEvent ! 6 B �����������������������������������������������i � Msft_WmiProvider_InitializationOperationFailureEvent ResultCode (
� a uint32 � M s f t _ W m i P r o v i d e r _ O p e r a t i o n E v e n t �̝��C�� + ) Msft_WmiProvider_OperationEvent ! �������������������������������������������' � Msft_WmiProvider_UnLoadOperationEvent �# M s f t _ W m i P r o v i d e r _ O p e r a t i o n E v e n t _ P r e �̝��C� 3 - Msft_WmiProvider_OperationEvent_Pre % * 1 X d ��������������������������������������������������� � Msft_WmiProvider_GetObjectAsyncEvent_Pre Flags
,
� P Uint32 ObjectPath (
� � String �# M s f t _ W m i P r o v i d e r _ O p e r a t i o n E v e n t _ P r e �̝��C� 3 - Msft_WmiProvider_OperationEvent_Pre % ) 6 ] d ��������������������������������������������������� � Msft_WmiProvider_PutClassAsyncEvent_Pre ClassObject
(
� U Object Flags
,
� � Uint32 �# M s f t _ W m i P r o v i d e r _ O p e r a t i o n E v e n t _ P r e �̝��C� 3 - Msft_WmiProvider_OperationEvent_Pre % , 7 ^ e ��������������������������������������������������� � Msft_WmiProvider_DeleteClassAsyncEvent_Pre ClassName (
� V String Flags
,
� � Uint32 �# M s f t _ W m i P r o v i d e r _ O p e r a t i o n E v e n t _ P r e �̝��C� 3 - Msft_WmiProvider_OperationEvent_Pre % 0 7 ^ n ��������������������������������������������������� � Msft_WmiProvider_CreateClassEnumAsyncEvent_Pre Flags
,
� V Uint32 SuperclassName (
� � String �# M s f t _ W m i P r o v i d e r _ O p e r a t i o n E v e n t _ P r e �̝��C� 3 - Msft_WmiProvider_OperationEvent_Pre % , 3 Z j ��������������������������������������������������� � Msft_WmiProvider_PutInstanceAsyncEvent_Pre Flags
,
� R Uint32 InstanceObject
(
� � Object �# M s f t _ W m i P r o v i d e r _ O p e r a t i o n E v e n t _ P r e �̝��C� 3 - Msft_WmiProvider_OperationEvent_Pre % / 6 ] i ��������������������������������������������������� � Msft_WmiProvider_DeleteInstanceAsyncEvent_Pre Flags
,
� U Uint32 ObjectPath (
� � String �# M s f t _ W m i P r o v i d e r _ O p e r a t i o n E v e n t _ P r e �̝��C� 3 - Msft_WmiProvider_OperationEvent_Pre % 3 > e l ��������������������������������������������������� � Msft_WmiProvider_CreateInstanceEnumAsyncEvent_Pre ClassName (
� ] String Flags
,
� � Uint32 �# M s f t _ W m i P r o v i d e r _ O p e r a t i o n E v e n t _ P r e �̝��C�Q 7 - Msft_WmiProvider_OperationEvent_Pre % * 1 X _ � � ��W����������������������������������������������������� � Msft_WmiProvider_ExecQueryAsyncEvent_Pre Flags 0
� P Uint32 Query
,
� ~ String QueryLanguage (
� � String � ~ � | � ������������� � __PARAMETERS abstract f CreatedStorageJob ref f
� = Out f
� = a �� If RunAsJob is set to TRUE and this method takes a while to execute, this parameter returns a reference to the storage job used to track the long running operation. Description f )
� = a ��6 � ID f 6
� � a ��6 � z ref:MSFT_StorageJob
ExtendedStatus object
� � Out
� � �� ExtendedStatus allows the storage provider to return extended (implementation specific) error information. Description
)
� � ��� O ID
6
� G ��� O � object:MSFT_StorageExtendedStatus ReturnValue uint32
� � uint32 out
� � � �� __ � DisableHighAvailability �� �� ^� f� Description This method disables High Availability and Scale Out features of this disk. No data will be lost, however acces to the disk may be interrupted as part of this operation. Values �� ü Ҽ � � �� � � +� T� c� �� ν � (� b� �� Ҿ �� :� Success Not Supported Unspecified Error Timeout Failed Invalid Parameter Disk is in use Object Not Found Method Parameters Checked - Job Started Access denied An unexpected I/O error has occurred The operation is not supported while the cluster is being upgraded. The disk is read only. High Availability could not be disabled for this storage object. Scale Out could not be disabled for this storage object. The specified file system is not supported Cannot perform the requested operation when the drive is read only Cannot connect to the storage provider. The storage provider cannot connect to the storage subsystem. Failed to offline the storage object in Failover cluster. D a42c9160500003S ROOT\Microsoft\Windows\Storage\MS_409 ���� � �� �� * : ��� � __PARAMETERS abstract RunAsJob boolean
� 4 In
� 4 \ �� This parameter controls the asynchronous behavior the method will follow.
If TRUE, this method will make use of the CreatedStorageJob out parameter when the request is taking a long time to service. If a storage job has been created to track the operation, this method will return 4096 - 'Method Parameters Checked - Job Started'. Note, even if RunAsJob is TRUE, the method can still return a result if it has finished in sufficient time.
If FALSE or NULL, this method will follow default WMI asynchronous behavior as determined by the client's method for invocation (i.e. synchronous unless requested otherwise). Description )
� 4 \ ��� � ID 6
� ~ \ ��� � 6 boolean __ �P a42c9160500003S ROOT\Microsoft\Windows\Storage\MS_409 ���� � ��
�� * ~ � | � ������������� � __PARAMETERS abstract f CreatedStorageJob ref f
� = Out f
� = a �� If RunAsJob is set to TRUE and this method takes a while to execute, this parameter returns a reference to the storage job used to track the long running operation. Description f )
� = a ��6 � ID f 6
� � a ��6 � z ref:MSFT_StorageJob
ExtendedStatus object
� � Out
� � �� ExtendedStatus allows the storage provider to return extended (implementation specific) error information. Description
)
� � ��� O ID
6
� G ��� O � object:MSFT_StorageExtendedStatus ReturnValue uint32
� � uint32 out
� � � �� __ � ModuleName string
� � In
� � �� ID )
� ~ ��C string resourceProperty uint8
� � In
� � � �� ID )
� 9 � ��� uint8 __ �* a42c9160500003S ROOT\Microsoft\Windows\DesiredStateConfiguration\MS_409 ���� � �� �� * � � ( ������R � __PARAMETERS abstract RebootRequired boolean
� : Out
� : b �� ID )
� � b ��� boolean ReturnValue uint32
� uint32 out
� # �� __ � ResourceTest W[ d[ Description Execute Test on a provider directly H a42c9160500003S ROOT\Microsoft\Windows\DesiredStateConfiguration\MS_409 ���� � ��
�� � G � * � ������������@ � __PARAMETERS abstract ResourceType string
� 8 In
� 8 _ �� ID Description The LogPixels property contains the number of pixels per logical inch. This member is valid only with devices that work with pixels (this excludes devices such as printers).
This property has been deprecated because it is not applicable to printers. There is no replacement value. MappingStrings Win32API|Printing and Print Spooler Structures|DEVMODE|dmLogPixels MediaType @ P
� � � ��� � � �
! ! B! L! uint32 Description The MediaType property specifies the type of media being printed on. The property can be set to a predefined value or a driver-defined value greater than or equal to 256. For Windows 95 and later; Windows 2000. MappingStrings � Win32API|Printing and Print Spooler Structures|DEVMODE|dmMediaType Values "! ,! :! Standard Transparency Glossy ValueMap \! _! b! 1 2 3 Name D N
� �! � �� � ���! �! �! F" V" string MaxLen Description The Name property indicates the name of the printer with which this configuration is associated. MappingStrings ^" Win32API|Printing and Print Spooler Structures|PRINTER_INFO_5|pPrinterName Orientation H P
� # � �� # *# u# }# �# �# �# �# uint32 Description The Orientation property indicates the printing orientation of the paper. Values �# �# Portrait Landscape ValueMap �# �# 1 2 MappingStrings �# Win32API|Printing and Print Spooler Structures|DEVMODE|dmOrientation PaperLength L C
� v$ � ��~$ �$ �$ �$ �$ % uint32 Units tenths of a millimeter Description The PaperLength property indicates the length of the paper.
Example: 2794 MappingStrings
% Win32API|Printing and Print Spooler Structures|DEVMODE|dmPaperLength PaperSize P 6
� �% � ���% �% & & string Description The PaperSize property indicates the size of the paper.
Example: A4 or Letter MappingStrings & Win32API|Printing and Print Spooler Structures|DEVMODE|dmPaperSize PaperWidth T C
� �& � ���& �& �& �& <' L' uint32 Units tenths of a millimeter Description The PaperWidth property indicates the width of the paper.
Example: 2159 MappingStrings T' Win32API|Printing and Print Spooler Structures|DEVMODE|dmPaperWidth PelsHeight X N
� (
( �� � ��( ( %( 2( �( �( uint32 DEPRECATED Units pixels Description The PelsHeight property indicates the height of the displayable surface.
This property has been deprecated because it is not applicable to printers. There is no replacement value. MappingStrings ) Win32API|Printing and Print Spooler Structures|DEVMODE|dmPelsHeight PelsWidth \ N
� �) �) �� � ���) �) �) �) �* �* uint32 DEPRECATED Units pixels Description The PelsWidth property indicates the width of the displayable surface.
This property has been deprecated because it is not applicable to printers. There is no replacement value. MappingStrings �* Win32API|Printing and Print Spooler Structures|DEVMODE|dmPelsWidth PrintQuality ` P
� ]+ � ��e+ r+ , 0, , �, �, �, uint32 Description The PrintQuality property indicates one of four quality levels of the print job. If a positive value is specified, the quality is measured in dots per inch.
Example: Draft MappingStrings 8, Win32API|Printing and Print Spooler Structures|DEVMODE|dmPrintQuality Values �, �, �, �, Draft Low Medium High ValueMap �, �, �, �, -1 -2 -3 -4 Scale d C
� ;- � ��C- J- S- `- . . uint32 Units percent Description The Scale property specifies the factor by which the printed output is to be scaled. For example a scale of 75 reduces the print output to 3/4 its original height and width. MappingStrings (. Win32API|Printing and Print Spooler Structures|DEVMODE|dmScale SpecificationVersion h 6
� �. � ���. �. d/ t/ uint32 Description The SpecificationVersion property indicates the version number of the initialization data for the device associated with the Win32 printer. MappingStrings |/ Win32API|Printing and Print Spooler Structures|DEVMODE|dmSpecVersion TTOption l P
� *0 � ��20 ?0 2 2 ^2 f2 �2 �2 uint32 Description The TTOption property specifies how TrueType(r) fonts should be printed. There are 3 possible values:
Bitmap - Prints TrueType fonts as graphics. This is the default action for dot-matrix printers.
Download - Downloads TrueType fonts as soft fonts. This is the default action for printers that use the Printer Control Language (PCL).
Substitute - Substitutes device fonts for TrueType fonts. This is the default action for PostScript(r) printers. MappingStrings 2 Win32API|Printing and Print Spooler Structures|DEVMODE|dmTTOption Values v2 ~2 �2 Bitmap Download Substitute ValueMap �2 �2 �2 1 2 3 VerticalResolution | C
� 3 � ��$3 +3 :3 G3 04 @4 uint32 Units dots per inch Description The VerticalResolution property indicates the print resolution along the Y axis (height) of the print job. This value is only set when the PrintQuality property of this class is positive, and is similar to the YResolution property. MappingStrings H4 Win32API|Printing and Print Spooler Structures|DEVMODE|dmYResolution XResolution p N
� �4 � ���4 �� 5 5 !5 .5 �5 �5 uint32 DEPRECATED Units dots per inch Description The XResolution property has been deprecated to theHorizontalResolution property. Please refer to the description of that property. MappingStrings �5 Win32API|Printing and Print Spooler Structures|DEVMODE|dmPrintQuality YResolution t N
� |6 � ���6 ���6 �6 �6 �6 77 G7 uint32 DEPRECATED Units dots per inch Description The YResolution property has been deprecated to theVerticalResolution property. Please refer to the description of that property. MappingStrings O7 Win32API|Printing and Print Spooler Structures|DEVMODE|dmYResolution � __ �� WIN-F6NF7R6I6PJ ROOT\cimv2\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � Advertise ? L � Description This method will advertise an associated Win32_Product using the installation package provided through PackageLocation and any command line options that are supplied. The method can return the following values:
0 - Success.
2147549445 - RPC Server Fault Error.
Other - For integer values other than those listed above, refer to the documentation on error codes returned by the Windows Installer API and the Win32 error codes. Values 1 Success RPC Server Fault Error Other | WIN-F6NF7R6I6PJ ROOT\cimv2\ms_409 ���� � �" �� � � h o *
����������� � __PARAMETERS abstract PackageLocation string
� ; in
� ; b �� The path to the package that is to be advertised Description )
� ; b ��� � ID 6
� N b ��� � string Options string
� q in
� q � �� The command line options for the advetisement. These should be in the form of property=setting Description )
� q � ��' � ID 6
� � � ��' � k string AllUsers boolean
� � in
� � � �� DEPRECATED. The AllUsers input parameter has been deprecated as the functionality implied is not supported. The operation will effect all users on the machine.
Indicates whether the operation should be applied to the current user (FALSE) or all users on the machine (TRUE). Description )
� � � ��B - ID 6
� � � ��B - � boolean __ �� WIN-F6NF7R6I6PJ ROOT\cimv2\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � Reinstall e r � � Description This method will reinstall the associated instance of Win32_Product using the specified reinstallation mode. The method can return the following values:
0 - Success.
2147549445 - RPC Server Fault Error.
Other - For integer values other than those listed above, refer to the documentation on error codes returned by the Windows Installer API and the Win32 error codes. Values � Success RPC Server Fault Error Other k WIN-F6NF7R6I6PJ ROOT\cimv2\ms_409 ���� � � �� * � ��D � __PARAMETERS abstract ReinstallMode uint16
� 9 In
� 9 ` �� Specifies the reinstall mode Description )
� 9 ` ��� �
) ; M X d q { � � FileMissing FileOlderVersion FileEqualVersion FileExact FileVerify FileReplace UserData MachineData Shortcut Package Values 6
� 9 ` ��� � � � ID C
� < ` ��� � � � � uint16 __ �� WIN-F6NF7R6I6PJ ROOT\cimv2\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � Upgrade >% K% �& �& Description This method will upgrade the associated Win32_Product using the upgrade package provided through PackageLocation and any command line options that are supplied. The method can return the following values:
0 - Success.
2147549445 - RPC Server Fault Error.
Other - For integer values other than those listed above, refer to the documentation on error codes returned by the Windows Installer API and the Win32 error codes. Values ' ' *' Success RPC Server Fault Error Other � WIN-F6NF7R6I6PJ ROOT\cimv2\ms_409 ���� � �M �� i k * ��������� � __PARAMETERS abstract PackageLocation string
� ; in
� ; b �� The path to the package that contains the upgrade Description )
� ; b ��� � ID 6
� O b ��� � string Options string
� r in
� r � �� The command line options for the upgrade. These should be in the form of property=setting Description )
� r � ��# � ID 6
� � � ��# � g string __ �� WIN-F6NF7R6I6PJ ROOT\cimv2\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � Configure �, �, . . Description This method will configure the associated instance of Win32_Product to the specified install state and level. The method can return the following values:
0 - Success.
2147549445 - RPC Server Fault Error.
Other - For integer values other than those listed above, refer to the documentation on error codes returned by the Windows Installer API and the Win32 error codes. Values !. *. B. Success RPC Server Fault Error Other � WIN-F6NF7R6I6PJ ROOT\cimv2\ms_409 ���� � �� �� V ' * � � � ��������� � __PARAMETERS abstract InstallState uint16
� 8 in
� 8 _ �� � � � Default Local Source Values )
� 8 _ ��� � ID 6
� < _ ��� � � uint16 InstallLevel uint16
� d in
� d � �� � � � Default Minimum Maximum Values )
� d � ��� � ID 6
� k � ��� � # uint16 Options string
� � in
� � � �� The command line options for config 2B ��j��B 8 A �� ( ��3 C Q ^ V e � � [ h � � 6 ? � ! �! �! # # �$ �$ �% �% �& ' �, �, �? �? j@ ~@ UUU����������������������������������������������������A � CIM_Error Indication Version 2.22.1 Exception UMLPackagePath CIM::Interop Description CIM_Error is a specialized class that contains information about the severity, cause, recommended actions and other data related to the failure of a CIM Operation. Instances of this type MAY be included as part of the response to a CIM Operation. CIMStatusCode
, R
� � � � 4
<
" , ' k � uint32 Description The CIM status code that characterizes this instance.
This property defines the status codes that MAY be return by a conforming CIM Server or Listener. Note that not all status codes are valid for each operation. The specification for each operation SHOULD define the status codes that may be returned by that operation.
The following values for CIM status code are defined:
1 - CIM_ERR_FAILED. A general error occurred that is not covered by a more specific error code.
2 - CIM_ERR_ACCESS_DENIED. Access to a CIM resource was not available to the client.
3 - CIM_ERR_INVALID_NAMESPACE. The target namespace does not exist.
4 - CIM_ERR_INVALID_PARAMETER. One or more parameter values passed to the method were invalid.
5 - CIM_ERR_INVALID_CLASS. The specified Class does not exist.
6 - CIM_ERR_NOT_FOUND. The requested object could not be found.
7 - CIM_ERR_NOT_SUPPORTED. The requested operation is not supported.
8 - CIM_ERR_CLASS_HAS_CHILDREN. Operation cannot be carried out on this class since it has instances.
9 - CIM_ERR_CLASS_HAS_INSTANCES. Operation cannot be carried out on this class since it has instances.
10 - CIM_ERR_INVALID_SUPERCLASS. Operation cannot be carried out since the specified superclass does not exist.
11 - CIM_ERR_ALREADY_EXISTS. Operation cannot be carried out because an object already exists.
12 - CIM_ERR_NO_SUCH_PROPERTY. The specified Property does not exist.
13 - CIM_ERR_TYPE_MISMATCH. The value supplied is incompatible with the type.
14 - CIM_ERR_QUERY_LANGUAGE_NOT_SUPPORTED. The query language is not recognized or supported.
15 - CIM_ERR_INVALID_QUERY. The query is not valid for the specified query language.
16 - CIM_ERR_METHOD_NOT_AVAILABLE. The extrinsic Method could not be executed.
17 - CIM_ERR_METHOD_NOT_FOUND. The specified extrinsic Method does not exist.
18 - CIM_ERR_UNEXPECTED_RESPONSE. The returned response to the asynchronous operation was not expected.
19 - CIM_ERR_INVALID_RESPONSE_DESTINATION. The specified destination for the asynchronous response is not valid.
20 - CIM_ERR_NAMESPACE_NOT_EMPTY. The specified Namespace is not empty.
21 - CIM_ERR_INVALID_ENUMERATION_CONTEXT. The enumeration context supplied is not valid.
22 - CIM_ERR_INVALID_OPERATION_TIMEOUT. The specified Namespace is not empty.
23 - CIM_ERR_PULL_HAS_BEEN_ABANDONED. The specified Namespace is not empty.
24 - CIM_ERR_PULL_CANNOT_BE_ABANDONED. The attempt to abandon a pull operation has failed.
25 - CIM_ERR_FILTERED_ENUMERATION_NOT_SUPPORTED. Filtered Enumeratrions are not supported.
26 - CIM_ERR_CONTINUATION_ON_ERROR_NOT_SUPPORTED. Continue on error is not supported.
27 - CIM_ERR_SERVER_LIMITS_EXCEEDED. The WBEM Server limits have been exceeded (e.g. memory, connections, ...).
28 - CIM_ERR_SERVER_IS_SHUTTING_DOWN. The WBEM Server is shutting down.
29 - CIM_ERR_QUERY_FEATURE_NOT_SUPPORTED. The specified Query Feature is not supported. Values �
�
�
�
, ? V r � � � � � 1 O i � � � � 2 T � � � � CIM_ERR_FAILED CIM_ERR_ACCESS_DENIED CIM_ERR_INVALID_NAMESPACE CIM_ERR_INVALID_PARAMETER CIM_ERR_INVALID_CLASS CIM_ERR_NOT_FOUND CIM_ERR_NOT_SUPPORTED CIM_ERR_CLASS_HAS_CHILDREN CIM_ERR_CLASS_HAS_INSTANCES CIM_ERR_INVALID_SUPERCLASS CIM_ERR_ALREADY_EXISTS CIM_ERR_NO_SUCH_PROPERTY CIM_ERR_TYPE_MISMATCH CIM_ERR_QUERY_LANGUAGE_NOT_SUPPORTED CIM_ERR_INVALID_QUERY CIM_ERR_METHOD_NOT_AVAILABLE CIM_ERR_METHOD_NOT_FOUND CIM_ERR_UNEXPECTED_RESPONSE CIM_ERR_INVALID_RESPONSE_DESTINATION CIM_ERR_NAMESPACE_NOT_EMPTY CIM_ERR_INVALID_ENUMERATION_CONTEXT CIM_ERR_INVALID_OPERATION_TIMEOUT CIM_ERR_PULL_HAS_BEEN_ABANDONED CIM_ERR_PULL_CANNOT_BE_ABANDONED CIM_ERR_FILTERED_ENUMERATION_NOT_SUPPORTED CIM_ERR_CONTINUATION_ON_ERROR_NOT_SUPPORTED CIM_ERR_SERVER_LIMITS_EXCEEDED CIM_ERR_SERVER_IS_SHUTTING_DOWN CIM_ERR_QUERY_FEATURE_NOT_SUPPORTED DMTF Reserved ValueMap � � � � � � � � � � � � � � � � � � � � � � � � � 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 .. MappingStrings 3 P DSP0201.DMTF|ERROR.CODE|2.3 DSP0200.DMTF|CIMError|1.3 ModelCorrespondence � CIM_Error.CIMStatusCodeDescription CIMStatusCodeDescription 0 8
� ! � � % : string Description A free-form string containing a human-readable description of CIMStatusCode. This description MAY extend, but MUST be consistent with, the definition of CIMStatusCode. MappingStrings �
DSP0201.DMTF|ERROR.DESCRIPTION|2.3 DSP0200.DMTF|CIMError|1.3 ModelCorrespondence B CIM_Error.CIMStatusCode ErrorSource
" +
� � � � F [ string Description The identifying information of the entity (i.e., the instance) generating the error. If this entity is modeled in the CIM Schema, this property contains the path of the instance encoded as a string parameter. If not modeled, the property contains some identifying string that names the entity that generated the error. The path or identifying string is formatted per the ErrorSourceFormat property. ModelCorrespondence c CIM_Error.ErrorSourceFormat ErrorSourceFormat & E
� � � � 4 I � � � � uint16 Description An array containing the dynamic content of the message. ModelCorrespondence U l CIM_Error.ErrorSource CIM_Error.OtherErrorSourceFormat ValueMap � � � � 0 1 2 .. Values � � � � Unknown Other CIMObjectPath DMTF Reserved ErrorType E
� a i v z � � � � uint16 Description Primary classification of the error. The following values are defined:
2 - Communications Error. Errors of this type are principally associated with the procedures and/or processes required to convey information from one point to another.
3 - Quality of Service Error. Errors of this type are principally associated with failures that result in reduced functionality or performance.
4 - Software Error. Error of this type are principally associated with a software or processing fault.
5 - Hardware Error. Errors of this type are principally associated with an equipment or hardware failure.
6 - Environmental Error. Errors of this type are principally associated with a failure condition relating the to facility, or other environmental considerations.
7 - Security Error. Errors of this type are associated with security violations, detection of viruses, and similar issues.
8 - Oversubscription Error. Errors of this type are principally associated with the failure to allocate sufficient resources to complete the operation.
9 - Unavailable Resource Error. Errors of this type are principally associated with the failure to access a required resource.
10 -Unsupported Operation Error. Errors of this type are principally associated with requests that are not supported. ValueMap � � � � � � � � � � � � 0 1 2 3 4 5 6 7 8 9 10 .. Values # * @ Z j z � � � � � Unknown Other Communications Error Quality of Service Error Software Error Hardware Error Environmental Error Security Error Oversubscription Error Unavailable Resour �' �xR|�C�� 6 $ ) 6 X ��c k s � � � � U������' � MSFT_FileStorageTier ClassVersion 1.0 Description This class manages file pinning. AMENDMENT LOCALE MS_409 DesiredStorageTierClass
� � � � uint16 Values � � � Auto Capacity Performance PlacementStatus
� 2 : B uint16 Values V _ s � Unknown Completely on tier Partially on tier Not on tier State
� � � � uint16 Values � � � Unknown OK Insufficient Capacity In Process Pending % in MEN _ �
� D W � w s ~ ! -# �$ � Get # 0 i q Description This method gets the tier information for pinned files. Values � � � � � � �
C � � L � Success Not Supported Unspecified Error Timeout Failed Invalid Parameter File not found. The specified volume does not support storage tiers. The Storage Tiers Management service detected that the specified volume is in the process of being dismounted. The file identifier specified is not valid on the volume. Storage tier operations must be called on the clustering node that owns the metadata volume. The specified storage tier could not be found on the volume. Confirm that the storage tier name is valid. The Storage Tiers Management service is already optimizing the storage tiers on the specified volume. The requested object type cannot be assigned to a storage tier. R
a42c9160500003S ROOT\Microsoft\Windows\Storage\MS_409 ���� � �� �� � � * � u � 7 Q � � J � U��������������������; � __PARAMETERS abstract FilePath string
� 4 In
� 4 [ �� ID )
� � [ ��� string g VolumeDriveLetter char16 g
� � In g
� � �� ID g )
� � ��F char16 VolumePath string
� � In
� � � �� ID )
� 7 � ��� string
Volume object
� Y In
� Y � �� ID
)
� � � ��� object:MSFT_Volume PinnedState uint16
� In
� C �� ID )
� � C ��q uint16 PinnedStorageTierClass uint16
� � In
� � �� ID )
� n ��3 uint16 AllocatedStorageTierClass uint16
� � In
� � � �� ID )
� 3 � ��� uint16 __ �B a42c9160500003S ROOT\Microsoft\Windows\Storage\MS_409 ���� � �� �� * � � < ��������f � __PARAMETERS abstract
FileStorageTier object
� ; Out
� ; b �� ID
)
� � b ��� object:MSFT_FileStorageTier ReturnValue uint32
� / uint32 out
� / 7 �� __ � Set + a i Description This method is used to pin a file to a storage tier. Values � � � � � � � ; � � D � Success Not Supported Unspecified Error Timeout Failed Invalid Parameter File not found. The specified volume does not support storage tiers. The Storage Tiers Management service detected that the specified volume is in the process of being dismounted. The file identifier specified is not valid on the volume. Storage tier operations must be called on the clustering node that owns the metadata volume. The specified storage tier could not be found on the volume. Confirm that the storage tier name is valid. The Storage Tiers Management service is already optimizing the storage tiers on the specified volume. The requested object type cannot be assigned to a storage tier. � a42c9160500003S ROOT\Microsoft\Windows\Storage\MS_409 ���� � � �� 1 � n � � W � * � U�������������������� � __PARAMETERS abstract FilePath string
� 4 In
� 4 [ �� ID )
� � [ ��� string DesiredStorageTierFriendlyName string
� � In
� � % �� ID )
� � % ��S string DesiredStorageTierUniqueId string
� � In
� � � �� ID )
� T � �� string DesiredStorageTierClass uint16
� � In
� � � �� ID )
� � ��� uint16
DesiredStorageTier object
� E In
� E l �� ID
)
� � l ��� object:MSFT_StorageTier __ �� a42c9160500003S ROOT\Microsoft\Windows\Storage\MS_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out )
� > e ��� � ID
6
� L e ��� � object:MSFT_NetBranchCacheDataCacheExtension Force boolean
� � In
� � � �� Indicates the operation should not prompt for confirmation Description )
� � � ��% � ID 6
� � � ��% � i boolean __ �� a42c9160500003S ROOT\StandardCimV2\MS_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � Remove_BCDataCacheExtensionByPath d q Description Deletes a cache file. � a42c9160500003S ROOT\StandardCimV2\MS_409 ���� � � �� U 6 * � ������� � __PARAMETERS abstract Path string
� 0 In
� 0 W �� Specifies the cache file to operate on. Description )
� 0 W ��� � ID 6
� ; W ��� � � string Force boolean
� \ In
� \ � �� Indicates the operation should not prompt for confirmation Description )
� \ � ��� � ID 6
� z � ��� � 2 boolean __ �� a42c9160500003S ROOT\StandardCimV2\MS_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � Set_BCCacheByCache �% �% Description Modifies the cache file configuration. E a42c9160500003S ROOT\StandardCimV2\MS_409 ���� � �� �� * � - � y i L b 9 � � � � U��������������������������� � __PARAMETERS abstract
Cache object
� 1 In
� 1 X �� The cache which should be modified Description
)
� 1 X ��� � ID
6
� 6 X ��� � � object:MSFT_NetBranchCacheCache MoveTo string
� q In
� q � �� Specifies the new location on disk for this this cache file. Description )
� q � �� � ID 6
� � � �� � H string Percentage uint32
� � In
� � � �� Specifies the new size (in terms of disk percentage) of this cache file. Description )
� � � ��U ID 6
� � � ��U � uint32 SizeBytes uint64
� In
� - �� Specifies the new size of this cache file. Description )
� - ��� [ ID 6
� - ��� [ � uint64 Defragment boolean
� 9 In
� 9 a �� Indicates the cache should be defragmented Description )
� 9 a ��� � ID 6
� G a ��� � � boolean PassThru boolean
� l In
� l � �� Indicates the modified cache should be output Description )
� l � ��� � ID 6
� } � ��� � 5 boolean Force boolean
� � In
� � � �� Indicates the operation should not prompt for confirmation Description )
� � � ��1 � ID 6
� � � ��1 � u boolean __ �8 a42c9160500003S ROOT\StandardCimV2\MS_409 ���� � �� �� * � � = ��������g � __PARAMETERS abstract
cmdletOutput object
� 8 Out
� 8 _ �� ID
)
� � _ ��� object:MSFT_NetBranchCacheCache ReturnValue uint32
� 0 uint32 out
� 0 8 �� __ � Set_BCCacheByPath �9 �9 Description Modifies the cache file configuration. a42c9160500003S ROOT\StandardCimV2\MS_409 ���� � �� �� � � d T 7 M $ * � � � � � U��������������������������� � __PARAMETERS abstract Path string
� 0 In
� 0 W �� Specifies the cache file to operate on. Description )
� 0 W ��� � ID 6
� : W ��� � � string MoveTo string �
C I M _ S e n s o r ^ҝ��C�� � CIM_Sensor 6 �� & - 5 ; c m X c & � � b n � � � � � � t � Z g $ 1 �
�
�
� � N Y L
X
, � � $ � � G _ 4 � ���������UUUUU���������������������������������� ���� ����������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������� � CIM_NumericSensor Abstract Version 2.8.0 Locale UUID {4c7acd5c-b440-442a-8c85-9c09bc36ada8} Accuracy / � +
� � � � � � sint32 Units Hundredths of Percent MappingStrings � 9 MIF.DMTF|Temperature Probe|002.19 MIF.DMTF|Electrical Current Probe|001.19 MIF.DMTF|Voltage Probe|001.19 BaseUnits $ � +
� � � � � � uint16 ValueMap B � � � � � � � � � � � � � � � � � � � � $ ( , 0 4 8 < @ D H L P T X \ ` d h l p t x | � � � � � � � � � � � � � � 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 ModelCorrespondence � � CIM_NumericSensor.UnitModifier CIM_NumericSensor.RateUnits CurrentReading ' �
� R Z j sint32 MappingStrings z � � MIF.DMTF|Temperature Probe|002.5 MIF.DMTF|Electrical Current Probe|001.5 MIF.DMTF|Voltage Probe|001.5 EnabledThresholds 9 �
� " * 4 uint16 ValueMap P S V Y \ _ 0 1 2 3 4 5 Hysteresis 1 �
� � uint32 IsLinear 0 �
� � boolean LowerThresholdCritical 4 �
� # sint32 MappingStrings 3 V � MIF.DMTF|Temperature Probe|002.13 MIF.DMTF|Electrical Current Probe|001.13 MIF.DMTF|Voltage Probe|001.13 LowerThresholdFatal 6 �
� � � � sint32 MappingStrings + U MIF.DMTF|Temperature Probe|002.15 MIF.DMTF|Electrical Current Probe|001.15 MIF.DMTF|Voltage Probe|001.15 LowerThresholdNonCritical 2 � )
� � � ��� � sint32 MappingStrings � ; MIF.DMTF|Temperature Probe|002.11 MIF.DMTF|Electrical Current Probe|001.11 MIF.DMTF|Voltage Probe|001.11 MaxReadable + �
� � � � sint32 MappingStrings � � MIF.DMTF|Temperature Probe|002.9 MIF.DMTF|Electrical Current Probe|001.9 MIF.DMTF|Voltage Probe|001.9 MinReadable , �
� ] e u sint32 MappingStrings � � � MIF.DMTF|Temperature Probe|002.10 MIF.DMTF|Electrical Current Probe|001.10 MIF.DMTF|Voltage Probe|001.10 NominalReading ( �
� -
5
E
sint32 MappingStrings U
w
�
MIF.DMTF|Temperature Probe|002.6 MIF.DMTF|Electrical Current Probe|001.6 MIF.DMTF|Voltage Probe|001.6 NormalMax ) �
� �
�
sint32 MappingStrings ? h MIF.DMTF|Temperature Probe|002.7 MIF.DMTF|Electrical Current Probe|001.7 MIF.DMTF|Voltage Probe|001.7 NormalMin * �
� � � � sint32 MappingStrings � 0 MIF.DMTF|Temperature Probe|002.8 MIF.DMTF|Electrical Current Probe|001.8 MIF.DMTF|Voltage Probe|001.8 RateUnits & � +
� � � � �
uint16 ValueMap
� � � � � � � � � � 0 1 2 3 4 5 6 7 8 9 ModelCorrespondence
/
CIM_NumericSensor.UnitModifier CIM_NumericSensor.BaseUnits Resolution - �
� �
�
�
uint32 MappingStrings �
�
�
MIF.DMTF|Temperature Probe|002.17 MIF.DMTF|Electrical Current Probe|001.17 MIF.DMTF|Voltage Probe|001.17 SettableThresholds : �
� X ` j uint16 ValueMap � � � � � � 0 1 2 3 4 5 SupportedThresholds 8 �
� � � � uint16 ValueMap
0 1 2 3 4 5 Tolerance . �
� P X d sint32 Deprecated p � CIM_NumericSensor.Resolution CIM_NumericSensor.Accuracy UnitModifier % �
� � � sint32 ModelCorrespondence
* CIM_NumericSensor.BaseUnits CIM_NumericSensor.RateUnits UpperThresholdCritical 5 �
� � � � sint32 MappingStrings � � MIF.DMTF|Temperature Probe|002.14 MIF.DMTF|Electrical Current Probe|001.14 MIF.DMTF|Voltage Probe|001.14 UpperThresholdFatal 7 �
� ` h x sint32 MappingStrings � � � MIF.DMTF|Temperature Probe|002.16 MIF.DMTF|Electrical Current Probe|001.16 MIF.DMTF|Voltage Probe|001.16 UpperThresholdNonCritical 3 � )
� F � ��N ^ sint32 MappingStrings n � � MIF.DMTF|Temperature Probe|002.12 MIF.DMTF|Electrical Current Probe|001.12 MIF.DMTF|Voltage Probe|001.12 � " � � � � [ � RestoreDefaultThresholds | ae442007200009F ROOT\Hardware ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � GetNonLinearFactors � � Deprecated � No Value ae442007200009F ROOT\Hardware ���� � �� �� * � ����� � __PARAMETERS abstract SensorReading sint32
� 9 IN
� 9 ` �� ID )
� � ` ��� sint32 __ �_ ae442007200009F ROOT\Hardware ���� � � �� * � L � � E D � � U���������������������n � __PARAMETERS abstract Accuracy sint32
� 4 OUT
� 4 [ �� ID )
� � [ ��� sint32 Resolution uint32
� � OUT
� � �� ID )
� | ��A uint32 Tolerance sint32
� � OUT
� � � �� ID )
� 2 � ��� sint32 Hysteresis uint32
� X OUT
� X �� ID )
� � ��� uint32 ReturnValue uint32
� 7 uint32 out
� 7 ? �� 7��� � � ��w 1 �
G� P ���
; &��3 $ ���W � �nG
'v�) � X 8� � _ _ E v e n t C o n s u m e r U͝��C�� 8 __EventConsumer ��
& / � � F P �
� � � � > J � � oUU���������� ����������������������������������������� � SMTPEventConsumer AMENDMENT LOCALE BccLine ,
� [ c p string Description The email addresses of those persons to be included on the BCC: line. CcLine
(
� � � string Description The email addresses of those persons to be included on the CC: line. FromLine
� | � � string Description From line for the email message. If NULL, a from line will be constructed of the form WinMgmt@MachineName HeaderFields 0
� 6 > K string Description The header fields will be inserted into the SMTP email header without interpretation. Message
� � � � string Description The body of the email message. Name )
� I � ��Q ^ string Description A unique name identifying this instance of the SMTPEventConsumer. ReplyToLine
� � � � string Description Reply-To line for the email message. If NULL, no Reply-To field will be used. SMTPServer
� v ~ � string Description Local SMTP Server Subject
� � � � string Description The subject of the email message. ToLine $
� ? G T string Description The email addresses of those persons to be included on the TO: line. Addresses must be separated by commas or semicolons. � _ _ E v e n t C o n s u m e r V͝��C�� " __EventConsumer # 0 b h � � � � 4 @ o��������� ���������������� r � ActiveScriptEventConsumer locale KillTimeout
� Z � �� uint32 Name
� � � �� string ScriptFilename
� � � �� string ScriptingEngine '
� " * �� � �� string not_null ScriptText
� j � �� string �5 7 E 5 F 3 A D D 9 E 2 4 2 C 4 E 9 F 9 E D F 7 9 A A 9 7 F 7 9 E 7 9 1 1 C 5 A 8 B 9 0 2 E C 1 5 0 D 6 4 4 2 E 3 B 8 5 A 5 A A W͝��C�ȝ��C�� ���C �� 9 ^ � __Win32Provider {266c72e7-62e8-11d1-ad89-00c04fd8fdff} SelfHost ActiveScriptEventConsumer C F F 4 1 3 7 0 C 7 0 E 2 6 A 1 6 9 C 5 F 7 C C 5 5 9 4 0 5 0 6 4 6 C 5 B 9 B C 0 F 0 D 1 F 0 F C 4 7 3 3 F A 2 A A 3 5 9 3 9 C X͝��C�ȝ��C�� H % � � __EventConsumerProviderRegistration - ActiveScriptEventConsumer \\.\root\subscription:__Win32Provider.Name="ActiveScriptEventConsumer" R O O T \ s u b s c r i p t i o n # _ _ E v e n t C o n s u m e r P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ E 1 D D 4 3 4 1 3 E D 9 F D 9 C 4 5 8 D 2 0 5 1 F 0 8 2 D 1 D 7 3 9 3 9 9 B 2 9 0 3 5 B 4 5 5 F 0 9 0 7 3 9 2 6 E 5 E D 9 8 7 0 \ K I _ C F F 4 1 3 7 0 C 7 0 E 2 6 A 1 6 9 C 5 F 7 C C 5 5 9 4 0 5 0 6 4 6 C 5 B 9 B C 0 F 0 D 1 F 0 F C 4 7 3 3 F A 2 A A 3 5 9 3 9 C \ I _ 5 1 D 5 5 4 8 2 B 7 A F 4 8 9 4 C 5 7 C 3 4 6 4 5 7 2 B F 1 6 B 3 F 5 0 5 6 8 D 4 C 9 7 1 3 2 E 3 E E 1 8 E 2 9 7 A 7 9 6 D F 9 t r a c _ _ E v e n t C o n s u m e r Z͝��C�� __EventConsumer ��& . ; � � � n z o��������� ���������������� � ActiveScriptEventConsumer AMENDMENT LOCALE KillTimeout
� g o | uint32 description Number of seconds that the script is allowed to run, if zero script will not be terminated. ScriptFilename
� * string description Filename of a script file to be run, note that this is intended as an alternative to specifying the text of the script in ScriptText. Results are undefined if both properties are assigned values. ScriptingEngine
� - 5 B string description Name of the scripting engine, ex: VBScript ScriptText
� � � � string Description Text of the script, expressed in a language known to the scripting engine. � C I M _ S e r v i c e A c c e s s P o i n t `͝��C�� E CIM_ServiceAccessPoint � � �� � " / � � " J ��Z d q ��� � � �� � � Q ^ ' � � � � s � R _ ��WU������������������������������������������������������������������
� Win32_TCPIPPrinterPort CIMWin32 Description The Win32_TCPIPPrinterPort class represents a TCP//IP service access point. For example a TCP/IP printer port.
Note: The SE_LOAD_DRIVER_PRIVILEGE privilege is required on this class. Privileges � SeLoadDriverPrivilege Locale UUID {553644e9-f998-48c3-b037-26e5909f4333} SupportsCreate CreateBy PutInstance SupportsDelete DeleteBy DeleteInstance SupportsUpdate ByteCount 0 6
� � � �� 7 G boolean Description The ByteCount property, when true, causes the computer to count the number of bytes in a document before sending them to the printer and the printer to report back the number of bytes actually read. This is used for diagnostics when one discovers that bytes are missing from the print output. MappingStrings O HostAddress
( 6
� � � ��� � string Description The HostAddress property indicates the address of device or print server MappingStrings PortNumber 6 6
� k � ��s � � uint32 Description The PortNumber property indicates the number of the TCP port used by the port monitor to communitcate with the device. MappingStrings Protocol $ C
� m � ��u � s { � � uint32 Description The Protocol property has two values: 'Raw' indicates printing directly to a device and 'Lpr' indicates printing to device or print server; LPR is a legacy protocol, which will eventually be replaced by RAW. Some printers support only LPR. Values � � Raw Lpr MappingStrings � Queue
2 6
� � � ��� t � string Description The Queue property is used with the LPR protocol to indicate the name of the print queue on the server. MappingStrings � SNMPCommunity , 6
� � � ��� � Y i string Description The SNMPCommunity property contains a security level value for the device. For example 'public'. MappingStrings q SNMPDevIndex < 6
� � � ��� � 8 H uint32 Description The property SNMPDevIndex indicates the SNMP index number of this device for the SNMP agent. MappingStrings P SNMPEnabled : 6
� � � ��� � j
z
boolean Description The SNMPEnabled property, when true, indicates that this printer supports RFC1759 (Simple Network Management Protocol) and can provide rich status information from the device. MappingStrings �
�F D 1 C 1 D 4 1 4 B 7 1 B 5 0 8 2 C 2 6 6 A 6 5 0 E 3 1 E F 6 D 5 0 1 9 3 8 2 7 2 4 2 4 4 B 6 8 5 F 2 1 7 C 0 A A E 0 0 A 9 2 1 n͝��C�Cȝ��C�$ � __SystemSecurity M S F T _ S C M E v e n t L o g E v e n t �͝��C��
MSFT_SCMEventLogEvent ! * 6 ������������A � MSFT_NetRevertedToLastKnownGood EventId 3221232479 EventType � n�g� �l�
� � R�
Pu � w֏#Z � ('��3 � ,hk�, � �"�% � z��� � ���B
� �� � �T�m � a�"
� [��
� �.�� �
� 7���� 2�;�� ���v� �m�� ? � tC � RPߎ� � � l � �8��� � S��� � ��guq z �͝��C�� ( } � � � [ g U���������������������� � HNet_BackupIpConfiguration Connection f 2
� h � �� � �� � �� ref:HNet_Connection DefaultGateway '
� � � �� � �� string EnableDHCP '
� � �� � �� uint32 IPAddress '
� S � �� � �� string SubnetMask '
� � � �� � �� string � �͝��C�� ' ����| � HNet_ConnectionAutoconfig Connection f 2
� g � �� � �� � �� ref:HNet_Connection �D 5 4 7 2 B B 4 0 0 0 4 0 3 F 6 D 6 C D B 0 F 5 9 5 8 0 4 C E 6 2 C 0 D 2 9 2 5 4 9 7 9 6 5 2 6 C A 9 E 7 7 7 3 7 9 8 E 5 F 2 4 �͝��C�͝��C�U ���� : � HNet_IcsSettings {23bc497f-13f0-47a1-9e88-048f6eefdf60} C 0 C 0 2 5 C 3 8 9 8 1 E 5 8 E E 5 0 C B 7 B B 4 E 4 7 8 6 C B A 1 4 F D 9 3 3 E 6 3 8 8 6 1 E A 3 A 6 A 2 E 0 C 8 0 6 2 1 1 E �͝��C�}͝��C�I � HNet_FwIcmpSettings Default 3 1 1 B 2 4 D 4 7 1 F A 4 7 0 B E 2 3 5 F B 9 5 E 8 5 2 9 1 D E 8 C 5 6 E B 6 F A 6 C F 9 B 1 E E B 6 8 7 1 E 4 3 B B D 9 1 2 C �͝��C�{͝��C�i B �� H � HNet_PortMappingProtocol {230e423d-7b3a-4e6e-9d4d-91f73561364a} 1700 3 1 1 B 2 4 D 4 7 1 F A 4 7 0 B E 2 3 5 F B 9 5 E 8 5 2 9 1 D E 8 C 5 6 E B 6 F A 6 C F 9 B 1 E E B 6 8 7 1 E 4 3 B B D 9 1 2 C �͝��C�{͝��C�i B �� H � HNet_PortMappingProtocol {f831dd6e-85d0-4f7d-8ac0-bb2099682c4e} 1701 3 1 1 B 2 4 D 4 7 1 F A 4 7 0 B E 2 3 5 F B 9 5 E 8 5 2 9 1 D E 8 C 5 6 E B 6 F A 6 C F 9 B 1 E E B 6 8 7 1 E 4 3 B B D 9 1 2 C �͝��C�{͝��C�i B �� H � HNet_PortMappingProtocol {59e81c3b-ae09-4bc5-9ebc-7605ab74d37b} 1702 3 1 1 B 2 4 D 4 7 1 F A 4 7 0 B E 2 3 5 F B 9 5 E 8 5 2 9 1 D E 8 C 5 6 E B 6 F A 6 C F 9 B 1 E E B 6 8 7 1 E 4 3 B B D 9 1 2 C �͝��C�{͝��C�i B �� n H � HNet_PortMappingProtocol {90c8f61d-43f3-45cc-8ff0-e719748b3851} 1703 3 1 1 B 2 4 D 4 7 1 F A 4 7 0 B E 2 3 5 F B 9 5 E 8 5 2 9 1 D E 8 C 5 6 E B 6 F A 6 C F 9 B 1 E E B 6 8 7 1 E 4 3 B B D 9 1 2 C �͝��C�{͝��C�i B �� � H � HNet_PortMappingProtocol {80be1943-684e-41b9-82e5-32b18d858a2c} 1704 3 1 1 B 2 4 D 4 7 1 F A 4 7 0 B E 2 3 5 F B 9 5 E 8 5 2 9 1 D E 8 C 5 6 E B 6 F A 6 C F 9 B 1 E E B 6 8 7 1 E 4 3 B B D 9 1 2 C �͝��C�{͝��C�i B �� � H � HNet_PortMappingProtocol {f5c5796c-de7a-456b-891f-03a2e006e07c} 1705 3 1 1 B 2 4 D 4 7 1 F A 4 7 0 B E 2 3 5 F B 9 5 E 8 5 2 9 1 D E 8 C 5 6 E B 6 F A 6 C F 9 B 1 E E B 6 8 7 1 E 4 3 B B D 9 1 2 C �͝��C�{͝��C�i B �� P H � HNet_PortMappingProtocol {cd1887dd-be99-4a92-8006-e9a52db53df4} 1706 3 1 1 B 2 4 D 4 7 1 F A 4 7 0 B E 2 3 5 F B 9 5 E 8 5 2 9 1 D E 8 C 5 6 E B 6 F A 6 C F 9 B 1 E E B 6 8 7 1 E 4 3 B B D 9 1 2 C �͝��C�{͝��C�i B ��� H � HNet_PortMappingProtocol {3c6434d0-257b-4516-9222-4fa0467d67f9} 1707 3 1 1 B 2 4 D 4 7 1 F A 4 7 0 B E 2 3 5 F B 9 5 E 8 5 2 9 1 D E 8 C 5 6 E B 6 F A 6 C F 9 B 1 E E B 6 8 7 1 E 4 3 B B D 9 1 2 C �͝��C�{͝��C�i B ��
= H � HNet_PortMappingProtocol {01d925f1-cf6a-4352-8aac-b139b1a80cb4} 1708
E v e n t T r a c e �͝��C�� EventTrace ) � �� 9 A K R I����y � CscNetApi guid {361f227c-aa14-4d19-9007-0c8d1a8a541b} locale MS\0x409 Flags
� q uint32 d1 �
E v e n t T r a c e �͝��C�� EventTrace ) � �� 6 > H O I����v � CscApi guid {19EE4CF9-5322-4843-B0D8-BAB81BE4E81E} locale MS\0x409 Flags
� n uint32 -B �
E v e n t T r a c e �͝��C�� EventTrace ) � ��
5 = G N E����u � CscUm guid {5e23b838-5b71-47e6-b123-6fe02ef573ef} locale MS\0x409 Flags
� m uint32 b1 �
E v e n t T r a c e �͝��C�� EventTrace ) � ��
; C M T M����{ � CscFastSync guid {791cd79c-65b5-48a3-804c-786048994f47} locale MS\0x409 Flags
� s uint32 -4 �
E v e n t T r a c e �͝��C�� EventTrace ) � �� : B L S M����z � CscDclUser guid {d5418619-c167-44d9-bc36-765beb5d55f3} locale MS\0x409 Flags
� r uint32 44 �
E v e n t T r a c e �͝��C� EventTrace ) � �� : B L S z � E��������� � CscService guid {89D89015-C0DF-414c-BC48-F50E114832BC} locale MS\0x409 Flags
� r uint32 Level
� � uint32 ic �
E v e n t T r a c e �͝��C�v EventTrace 6 � �� 5 ; c k u | u����
� Regular Description Service Control Manager Trace guid {ebcca1c2-ab46-4a1d-8c2a-906c2ff25f39} locale MS\0x409 Flags R
� � � � � � � � � � � uint32 Description Enable Flags ValueDescriptions j v � � � � � � � � � ! / 9 H R ] j v ERROR Flag WARNING Flag TRACE Flag INFO Flag SECURITY Flag CONFIG Flag DEPEND Flag DEPEND_DUMP Flag CONFIG_API Flag LOCK_API Flag ACCOUNT Flag USECOUNT Flag NETBIOS Flag THREADS Flag BSM Flag SHUTDOWN Flag WHY Flag BOOT Flag HANDLE Flag LOCKS Flag CONTROL Flag DefineValues � � � ! . : D M W ` i n x } � � � ERROR WARNING TRACE INFO SECURITY CONFIG DEPEND DEPEND_DUMP CONFIG_API LOCK_API ACCOUNT USECOUNT NETBIOS THREADS BSM SHUTDOWN WHY BOOT HANDLE LOCKS CONTROL Values � " * 2 ? K U ^ h q z � � � � � ERROR WARNING TRACE INFO SECURITY CONFIG DEPEND DEPEND_DUMP CONFIG_API LOCK_API ACCOUNT USECOUNT NETBIOS THREADS BSM SHUTDOWN WHY BOOT HANDLE LOCKS CONTROL ValueMap & 2 > J V b n z � � � � � � � � � � � 0x00000001 0x00000002 0x00000004 0x00000008 0x00000010 0x00000020 0x00000040 0x00000080 0x00000100 0x00000200 0x00000400 0x00000800 0x00001000 0x00002000 0x00004000 0x00008000 0x00010000 0x00020000 0x00040000 0x00080000 0x00100000 CO � _ _ E x t r i n s i c E v e n t �͝��C�O
__ExtrinsicEvent ������������ � MSFT_SCMEvent �
M S F T _ S C M E v e n t �͝��C�T
MSFT_SCMEvent ������������ � MSFT_SCMEventLogEvent � M S F T _ S C M E v e n t L o g E v e n t �͝��C��
MSFT_SCMEventLogEvent ) ������������4 � MSFT_NetBadAccount EventId 3221232480 EventType � M S F T _ S C M E v e n t L o g E v e n t �͝��C�h MSFT_SCMEventLogEvent + ' 3 > X � � � � _��������������������� � MSFT_NetCallToFunctionFailed EventId 3221232477 EventType InsertionStringTemplates d t %FunctionName% %%%%%Error% Error
� � uint32 FunctionName
� � string � �jj��b �� % - � MSProcessorClass AMENDMENT LOCALE ms_409 � � �G M S F T _ S t o r a g e O b j e c t �xR|�C�G : MSFT_StorageObject 6 d r w ��� � � � N k � � � � � � � � ! D C � � �_U������������������������������������������������������^
� MSFT_FileServer Description A file server object models the subsystems concept of a file server. ClassVersion 1.0 AMENDMENT LOCALE MS_409 FileSharingProtocols
. +
� � � � 0 8 uint16 Description The file sharing protocols supported by the file server. Values D I NFS SMB FileSharingProtocolVersions 2
� � � � string Description Specifies the file sharing protocol versions supported. FriendlyName
� ' 4 string Description A user-friendly string representing the name of the file server. Friendly name can be set using the SetFriendlyName method. HealthStatus +
� �
� � uint16 Description Denotes the current health status of the file server.
0 - 'Healthy': TBD.
1 - 'Warning': TBD.
2 - 'Unhealthy': TBD.5 - 'Unknown': TBD. Values � � � � Healthy Warning Unhealthy Unknown HostNames
� $ string Description HostNames are semi-unique (scoped to the owning storage subsystem), human-readable strings used to identify a file server. There is a separate host name element per file sharing protocol. OperationalStatus " +
� - 5 B � � uint16 Description Indicates the current operating conditions of the file server. Unlike HealthStatus, this field indicates the status of hardware, software, and infrastructure issues related to this server, and can contain multiple values. Various operational statuses are defined. Many of the enumeration's values are self-explanatory. Values � � � * 1 H R \ e q } � � � � � � � �
Unknown Other OK Degraded Stressed Predictive Failure Error Non-Recoverable Error Starting Stopping Stopped In Service No Contact Lost Communication Aborted Dormant Supporting Entity in Error Completed Power Mode Relocating Microsoft Reserved Read-only Incomplete Microsoft Reserved OtherOperationalStatusDescription
&
� p x � string Description A string representation of the vendor defined operational status. This field should only be set if the OperationalStatus array contains 1 - 'Other'. SupportsContinuouslyAvailableFileShare ,
� o x � boolean Description If TRUE the file server will support continuously available file shares. SupportsFileShareCreation *
�
,
boolean Description If TRUE the server supports file share creation. < 4 ,# :# & P* �2 �2 �4 �6 �; � CreateFileShare / < ^ f Description This method creates a file share Values � � � � � � * > M � � � H � � � Success Not Supported Unspecified Error Timeout Failed Invalid Parameter Method Parameters Checked - Job Started Size Not Supported Access denied There are not enough resources to complete the operation. The operation is not supported while the cluster is being upgraded. The requested access path is already in use. The access path is not valid. You must specify a name for this file share. You must specify a sharing protocol for this file share. You must specify a volume for this file share. Unable to find the mount point of the volume. The specified sharing protocol is not supported. a42c9160500003S ROOT\Microsoft\Windows\Storage\MS_409 ���� � �� �� � � � V 8 �
* = x
�
: � � UU�������������������������
� __PARAMETERS abstract Name string
� 0 In
� 0 W �� Name is a semi-unique (scoped to the owning file server), human-readable string used to identify a file share. Description )
� 0 W ��� � ID 6
� � W ��� � 9 string Description string
� � In
� � � �� Specifies a description of the share. This field can be used to store extra free-form information, such as notes or details about the intended usage. Description )
� � � ��� � ID 6
� � ��� � � string
SourceVolume object
� H In
� H o �� The volume on which the share is to be created. Description
)
� H o ��� � ID
6
� Z o ��� � object:MSFT_Volume VolumeRelativePath string
� � In
� � � �� The volume relative path of an existing directory to share. If this parameter is not provided, an empty share will be created. Description )
� � � ��i � ID 6
� � � ��i � � string ContinuouslyAvailable boolean
� & In
� & N �� If TRUE the share will be continuously available. Description )
� & N ��� | ID 6
� ; N ��� | � boolean EncryptData boolean
� c In
� c � �� If TRUE the share will be encrypted during transport. Description )
� c � ��� � ID 6
� | � ��� � 4 boolean FileSharingProtocol uint16
� � In
� � � �� The file sharing protocol used by the share if the server supports more than one protocol. Description )
� � � ��] � � NFS CIFS(SMB) Values 6
� � � ��] � � ID C
� ^
� ��] � �
uint16 RunAsJob boolean
� �
In
� �
�
�� This parameter controls the asynchronous behavior the method will follow.
If TRUE, this method will make use of the CreatedStorageJob out parameter when the request is taking a long time to service. If a storage job has been created to track the operation, this method will return 4096 - 'Method Parameters Checked - Job Started'. Note, even if RunAsJob is TRUE, the method can still return a result if it has finished in sufficient time.
If FALSE or NULL, this method will follow default WMI asynchronous behavior as determined by the client's method for invocation (i.e. synchronous unless requested otherwise). Description )
� �
�
��@
�
ID 6
� �
�
��@
�
�
boolean є �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty ޓ vN � MSFT_CliFormat LIST FULL � Y w � � � � * Q * 2! �# �% k( �* J- �/ �3 7 �9 ,< C �F >J \L u 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier ; � ! � � � MSFT_CliProperty ConfigOptions The ConfigOptions property contains strings that describe the configuration of the jumpers and switches located on the base board. ConfigOptions 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � G N � MSFT_CliProperty Depth The depth of the physical package in inches. Depth 6 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � h u � MSFT_CliProperty Description The Description property provides a textual description of the object. Description 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � I Q � MSFT_CliProperty Height The height of the physical package in inches. Height S 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � � MSFT_CliProperty HostingBoard Boolean indicating that this card is a motherboard or, more generically, a baseboard in a chassis. HostingBoard � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier z � � � � MSFT_CliProperty HotSwappable A physical package can be hot swapped if it is possible to replace the element with a physically different but equivalent one while the containing package has power applied to it (i.e., is 'on'). HotSwappable D 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier
� v � � MSFT_CliProperty InstallDate The InstallDate property is datetime value indicating when the object was installed. InstallDate � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � n | � � MSFT_CliProperty Manufacturer The name of the organization responsible for producing the physical element. Manufacturer � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ( � MSFT_CliQualifier MaxLen # 256 � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier P U \ � MSFT_CliProperty Model The name by which the physical element is generally known. Model d � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 64 a�mR� � ��Q ߂1� � >dWc
> @�oP� b ��" � �B'� ) F��X) H �B�0q C I M _ D e p e n d e n c y ^˝��C�} CIM_Dependency ) & 3 � �� � � u�������� � CIM_SoftwareFeatureSAPImplementation Description An association between a service access point and how it is implemented in software. The cardinality of this association is many-to-many. A SAP may be provided by more than one software feature, operating in conjunction. And, any software feature may provide more than one service access point. a When many software features are associated with single SAP, it is assumed that these elements operate in conjunction to provide the access point. If different implementations of a SAP exist, each of these implementations would result in individual instantiations of the service access point object. These individual instantiations would then have associations to the unique implementations. AMENDMENT LOCALE Antecedent f@
� A Z g ref:CIM_SoftwareFeature Description The antecedent software feature. Dependent f@
� � � � ref:CIM_ServiceAccessPoint Description The dependent service access point. � C I M _ D e p e n d e n c y _˝��C�K CIM_Dependency ) * 7 � ��� � � o z u��������� � CIM_SoftwareFeatureServiceImplementation Description An association between a service and how it is implemented in software. The cardinality of this association is many-to-many. A service may be provided by more than one software feature, operating in conjunction. And, any software Feature may provide more than one service. When multiple software features are associated with a single service, it is assumed that these elements operate in conjunction to provide the service. If different implementations of a service exist, each of these implementations would result in individual instantiations of the service object. These individual instantiations would then have associations to the unique implementations. AMENDMENT LOCALE Antecedent f@
� ' @ M ref:CIM_SoftwareFeature Description The antecedent software feature. Dependent f@
� � � � ref:CIM_Service Description The dependent service. � C I M _ D e p e n d e n c y `˝��C�_ CIM_Dependency ) # � ��� � � N Y u��������� � CIM_SAPSAPDependency Description CIM_SAPSAPDependency is an association between a service access point and another service access point indicating that the latter is required in order for the former service access point to utilize or connect with its service. For example, to print at a network printer, local print access points must utilize underlying network-related SAPs, or protocol endpoints, in order to send the print request. AMENDMENT LOCALE Antecedent f@
� * ref:CIM_ServiceAccessPoint Description The required service access point. Dependent f@
� � � � ref:CIM_ServiceAccessPoint Description The service access point that is dependent on an underlying SAP. � C I M _ S e r v i c e A c c e s s B y S A P a˝��C�� CIM_ServiceAccessBySAP ) ) � ��� � � u��������� � CIM_BootServiceAccessBySAP Description CIM_BootServiceAccessBySAP is the relationship between a boot service and its access points. AMENDMENT LOCALE Antecedent f@
� � � � ref:CIM_BootService Description The boot service. Dependent f@
� > O \ ref:CIM_BootSAP Description An access point for the boot service. � C I M _ S e r v i c e A c c e s s B y S A P b˝��C� CIM_ServiceAccessBySAP ) , � ��� � � * u��������� � CIM_ClusterServiceAccessBySAP Description CIM_ClusterServiceAccessBySAP is the relationship between a clustering service and its access points. AMENDMENT LOCALE Antecedent f@
� � � ref:CIM_ClusteringService Description The clustering service. Dependent f@
� V m z ref:CIM_ClusteringSAP Description An access point for the clustering service. � C I M _ D e p e n d e n c y c˝��C�� CIM_Dependency ) ' 9 ��D L X � � u��������Z � CIM_ServiceSAPDependency Description CIM_ServiceSAPDependency is an association between a service and a service access point indicating that the referenced SAP is utilized by the service to provide its functionality. For example, boot services may invoke BIOS' disk services (interrupts) in order to function. AMENDMENT LOCALE Antecedent f@
� � � � ref:CIM_ServiceAccessPoint Description The required service access point Dependent f@
� % ref:CIM_Service Description The service that is dependent on an underlying SAP. � C I M _ E l e m e n t S e t t i n g ~˝��C�� CIM_ElementSetting ) + � ��� � � � � ���������z � Win32_PageFileElementSetting Description The Win32_PageFileElementSetting class represents an association between the initial settings of a page file and the state of those setting during normal use. AMENDMENT LOCALE Element f@ )
� 7 D � �� ref:Win32_PageFileUsage Description The Element reference represents the properties of a page file while the Win32 system is in use. Setting f@ )
� � � �� ref:Win32_PageFileSetting Description The Setting reference represents the initial settings of a page file when the Win32 system is starting up. � C I M _ S o f t w a r e F e a t u r e NtR|�C�
CIM_SoftwareFeature ) � ��� � � ������������������������������ � CIM_BIOSFeature Description CIM_BIOSFeature represents the capabilities of the low-level software that is used to bring up and configure a computer system. AMENDMENT LOCALE CharacteristicDescriptions
� � STRING Description An array of free-form strings providing more detailed explanations for any of the BIOS features indicated in the Characteristics array. Note, each entry of this array is related to the entry in the Characteristics array that is located at the same index. Characteristics +
� Y a n � � UINT16 Description An array of integers that specify the features supported by the BIOS. For example, one can specify that PnP capabilities are provided (value=9) or that infrared devices are supported (21). The value, 3, is not valid in the CIM schema since in DMI it represents that no BIOS features are supported. In this case, this object should not be instantiated. Values ? F O Z g t � � � � � � � � 2 F S \ ` f k z Other Unknown Undefined ISA Support MCA Support EISA Support PCI Support PCMCIA Support PnP Support APM Support Upgradeable BIOS BIOS Shadowing Allowed VL VESA Support ESCD Support LS-120 Support ACPI Support I2O Boot Support USB Legacy Support AGP Support PC Card IR 1394 I2C Smart Battery PC-98 � C I M _ S e r v i c e A c c e s s P o i n t �tR|�C�� CIM_ServiceAccessPoint )
T ��_ ����������������������g � CIM_BootSAP Description A representation of the access points of a boot service. AMENDMENT LOCALE �C-98 � up. � � � � � � � � � � �_�� � }�0@ L U?X�� G k�e�� H ]� � ��� m ]R�` � � P�& �ۻ�) � ���� � ��� �
�jj��h ) �� " ( P Y � � U��������
� AcpiPct WMI localeid MS\0x409 guid {313e88e0-a4fd-11d8-b301-505054503030} Control
)
� � � � �� object:AcpiGenAddr WmiDataId Status
)
� � � �� object:AcpiGenAddr WmiDataId ) � M S P r o c e s s o r C l a s s �jj�� % MSProcessorClass A �� � �� � ! + 5 ; c k � � � � ; E � � � � 2 7 � � � � UU�����������������������������������7 � ProcessorBiosInfo WMI WMIProv localeid MS\0x409 guid {313e88de-a4fd-11d8-b301-505054503030} Active
� � � �� boolean ApicId )
� � � � �� uint32 WmiDataId InstanceName '
� 3 � �� � �� string NtNumber )
� | � � �� uint32 WmiDataId PBlk )
� � � � �� uint32 WmiDataId PBlkLen
)
� ' � �� uint32 WmiDataId Pct
)
� n ~ � �� object:AcpiPct WmiDataId ProcessorId )
� � � � �� uint32 WmiDataId Pss
)
� , � �� object:AcpiPss WmiDataId � W M I E v e n t �jj�� WMIEvent
N �� � �� � ' / 9 F n t � � � � / = _�����������������������z � ProcessorPerfStateEvent WMI WmiProv Locale MS\0x409 Description New Processor Performance States Event guid {66A9B302-F9DB-4864-B0F1-843905E8080F} Active
� � � �� boolean HighestState )
� $ � �� uint32 WmiDataId InstanceName '
� r � �� � �� string � W M I E v e n t �jj�� WMIEvent
N �� � �� � " + 3 = J o u � � � � 0 > _�����������������������{ � ProcessorThrottleStateEvent WMI WmiProv Locale MS\0x409 Description New Processor Throttle States Event guid {B3C848A7-B870-4C47-AD52-685CC8FACAC9} Active
� � � �� boolean HighestState )
� % � �� uint32 WmiDataId InstanceName '
� s � �� � �� string � W M I E v e n t �jj��� WMIEvent
N �� � �� � $ , 6 C d j � � � � _������������������ � ProcessorCStateEvent WMI WmiProv Locale MS\0x409 Description New Processor Idle States Event guid {1C9D482E-93CE-4b9e-BDEC-23653CE0CE28} Active
� � � �� boolean InstanceName '
� � �� � �� string � �jj��U 6 �� $ . ; I O w � � � & 0 � � U������������ � ProcessorAcpiCstState WMI Locale MS\0x409 Description ACPI C-state guid {E5639664-C4FC-11DA-82C4-000D5692A4BC} Latency )
� � � � �� uint16 WmiDataId PowerConsumption )
� � �� uint32 WmiDataId Register
)
� g { � �� object:AcpiGenAddr WmiDataId StateType )
� � � � �� uint8 WmiDataId � �jj��� 6 �� ) 6 A G o v � � e��������F � ProcessorAcpiCst WMI Locale MS\0x409 Description ACPI _CST guid {E5639665-C4FC-11DA-82C4-000D5692A4BC} Count )
� � � � �� uint32 WmiDataId State
6
� ) � ��4 ? object:ProcessorAcpiCstState WmiDataId WmiSizeIs Count � M S P r o c e s s o r C l a s s �jj��� ) MSProcessorClass N �� � �� � $ , 6 C ^ d
� � � � ' ; � � � � 7 E � � � � + 6 � � UU���������������������������������������� � ProcessorBiosCStates WMI WmiProv Locale MS\0x409 Description ACPI 1.0 and 2.0 C-states guid {E5639666-C4FC-11DA-82C4-000D5692A4BC} Active
� � � �� boolean Cst
" )
� � �� object:ProcessorAcpiCst WmiDataId CStateVersionInUse )
� r z � �� uint32 WmiDataId FadtC2Latency )
� � � � �� uint16 WmiDataId FadtC3Latency )
� $ , � �� uint16 WmiDataId InstanceName '
� z � �� � �� string NtNumber
)
� � � � �� uint32 WmiDataId Reserved1 )
� � �� uint32 WmiDataId Reserved2 )
� m u � �� uint32 WmiDataId Reserved3 )
� � � � �� uint64 WmiDataId � �jj��� 6 ��! ) 3 @ Y _ � � � � . 5 � � � 2 = � � � � UU������������������������������/ � ProcessorAcpiCsdDependency WMI Locale MS\0x409 Description ACPI C-state dependency guid {A9ECEFF6-C502-11DA-82C4-000D5692A4BC} CoordType )
� � � � �� uint32 WmiDataId Domain )
� # � �� uint32 WmiDataId Index )
� l t � �� uint32 WmiDataId NumberOfEntries )
� � � � �� uint8 WmiDataId NumProcessors
)
� ' � �� uint32 WmiDataId Reserved1 )
� t | � �� uint32 WmiDataId Reserved2 )
� � � � �� uint64 WmiDataId Revision )
� $ � �� uint8 WmiDataId � M S P r o c e s s o r C l a s s �jj��� MSProcessorClass N �� � �� � ( 2 ? J P x � � � � � U��������������� � ProcessorAcpiCsd WMI WmiProv Locale MS\0x409 Description ACPI _CSD guid {A9ECEFF7-C502-11DA-82C4-000D5692A4BC} Active
� � � �� boolean Count )
� � � � �� uint32 WmiDataId Dependency
6
� T w � ��� � object:ProcessorAcpiCsdDependency WmiDataId WmiSizeIs Count InstanceName '
� � � �� � �� string � �jj��}
) � < ��G O W ^ � � p � U������������ � PerformanceState Description Processor Performance State AMENDMENT LOCALE ms_409 Flags +
� � � � � � � � uint32 DisplayName Flags Description Processor State Flags Frequency +
� # � 0 A � N uint32 DisplayName Processor Speed Description Processor Frequency in Megahertz PercentFrequency +
� � � � � � � � uint32 DisplayName Performance Percentage Description Percentage of Highest Frequency � �516C00D1C2619B3BF158EB32BB01A9128EAFB2BC6528F8EF8668287B67.2713.1994497491.1106 NIC driver. iv � ����� {Q�2� e ��:� � ���l
\ " 9�^ � _���T � NqIu6 � ]~�# �k�]� } z_� M S P r o c e s s o r C l a s s " �jj��� MSProcessorClass ) � A ��L T \ n � � Y j
� � r � U���������������������������� � ProcessorStatus Description Processor Performance Information AMENDMENT LOCALE ms_409 CurrentPerfState +
� � � � � � � � uint32 DisplayName Current Performance State Description Current Processor Performance State LastRequestedThrottle +
� Y a � n � � � uint32 DisplayName Last requested throttle Description Last requested throttle percentage LastTransitionResult +
� � 4 � A uint32 DisplayName Last transition result Description Last transition result LowestPerfState +
� � � � � � � � uint32 DisplayName Lowest Processor Performance State Description Lowest Processor Performance State PerfStates
+
� R l � y � � � object:PerformanceStates DisplayName Processor Performance States Description Processor Performance States ThrottleValue +
�
� B � O uint32 DisplayName Current stop-clock throttle value Description Current stop-clock throttle value UsingLegacyInterface +
� � � � � � � uint32 DisplayName Is Legacy Interface Enabled Description Is Legacy Interface Enabled � # �jj��M ) � , ��7 ? G R � � g r � � B J U�������������������������� � AcpiPssState Description Acpi _PSS State AMENDMENT LOCALE ms_409 BmLatency +
� � � � � � � � uint32 DisplayName Bus Master Latency Description Bus Master Latency in microseconds Control +
� ' / � < K � X uint32 DisplayName Control Value Description Control Value Frequency +
� � � � � � � � uint32 DisplayName Processor Speed Description Processor Frequency in Megahertz Latency +
� B J � W k � x uint32 DisplayName Transition Latency Description Maximum transition latency in microseconds Power +
� � � � � � uint32 DisplayName Power Consumption Description Current Power Consumption in milliwatts Status +
� � � � � � � � uint32 DisplayName Status Value Description Status Value � $ �jj��� ) � 4 ��? G O V � � E��������w � AcpiPss Description Processor Performance States AMENDMENT LOCALE ms_409 Count +
� � � � � � � � uint32 DisplayName Number of _PSS States Description Total number of _PSS States State
+
� % : � G T � a object:AcpiPssState DisplayName _PSS States Description Array of _PSS States um � % �jj��D )
� 6 ��A I Q Z � � R ] � � G Q U�������������������������� � AcpiGenAddr Description Generic Address Descriptor AMENDMENT LOCALE ms_409 Address +
� � � � � � � � uint64 DisplayName Address Description Address AddressSpaceID +
� � % 5 � B uint32 DisplayName AddressSpaceID Description AddressSpaceID BitOffset +
� � � � � � � � uint32 DisplayName BitOffset Description BitOffset BitWidth +
� � & 0 � = uint32 DisplayName BitWidth Description BitWidth Reserved +
� � � � � � � � uint32 DisplayName Reserved Description Reserved � & �jj��� ) � 9 ��D L T ] � � U��������� � AcpiControlStatus Description ACPI control and status AMENDMENT LOCALE ms_409 Control
+
� � � � � � � � object:AcpiGenAddr DisplayName Control register Description ACPI control register Status
+
� . B � O ` � m object:AcpiGenAddr DisplayName Status register Description ACPI status register A � ' �jj��� ) � ! ��, 4 < E � � 5��������o � AcpiPct Description Acpi _PCT AMENDMENT LOCALE ms_409 Control
+
� ~ � � � � � � object:AcpiGenAddr DisplayName Control Value Description Acpi _PCT control register Status
+
� , � 9 G � T object:AcpiGenAddr DisplayName Status Value Description Acpi _PCT status register at � M S P r o c e s s o r C l a s s ( �jj��� MSProcessorClass ) � A ��L T \ d � � ] c � � ~ � � � � U���������������������������� � ProcessorBiosInfo Description ACPI Bios Processor Information AMENDMENT LOCALE ms_409 ApicId +
� � � � � � � � uint32 DisplayName APIC Id Description Processors APIC Id NtNumber +
� ' � 4 ? � L uint32 DisplayName NT Number Description OS Processor Id PBlk +
� � � � � � � � uint32 DisplayName PBLK Address Description Processor Control Block Address PBlkLen +
� / 7 � D Q � ^ uint32 DisplayName PBLK Length Description Processor Control Block Length Pct
+
� � � � � � � � object:AcpiPct DisplayName _PCT Description Acpi _PCT object ProcessorId +
� D L � Y g � t uint32 DisplayName Processor Id Description Acpi Processor Id Pss
+
� � � � � � � � object:AcpiPss DisplayName _PSS Description Acpi _PSS object � W M I E v e n t ) �jj��W WMIEvent
��$ , 4 B ����������������� � ProcessorPerfStateEvent AMENDMENT LOCALE ms_409 HighestState +
� { � � � � � � uint32 DisplayName Fastest Available Processor Performance State Description Fastest Available Processor Performance State � W M I E v e n t * �jj��U WMIEvent
��( 0 8 F ����������������� � ProcessorThrottleStateEvent AMENDMENT LOCALE ms_409 HighestState +
� � � � � � � uint32 DisplayName Fastest Available Processor Throttle State Description Fastest Available Processor Throttle State � + �jj��� ��" * 2 ; � � t ~ U������������ � ProcessorAcpiCstState AMENDMENT LOCALE ms_409 Latency +
� t | � � � � � uint16 DisplayName Latency Description Maximum transition latency in microseconds PowerConsumption +
� � + > � K uint32 DisplayName Power consumption Description Average power consumption in milliwatts Register
+
� � � � � � � � object:AcpiGenAddr DisplayName Register Description Control register StateType +
� E L � Y e � r uint8 DisplayName State type Description Acpi C-state type (1=C1, 2=C2, ... NT ��� , �{���� a � WDMClassesOfDriver MSWmi_PnPInstanceNames C:\Windows\system32\kernelbase.dll[MofResourceName] __ �� a42c9160500003S ROOT\Microsoft\Windows\Storage\MS_409 ���� � �� �� * � � J � � H � U����������������� � __PARAMETERS abstract
CreatedFileShare object
� < Out
� < c �� ID
)
� � c ��� object:MSFT_FileShare f CreatedStorageJob ref f
� Out f
� - �� If RunAsJob is set to TRUE and this method takes a while to execute, this parameter returns a reference to the storage job used to track the long running operation. Description f )
� - �� \ ID f 6
� � - �� \ F ref:MSFT_StorageJob
ExtendedStatus object
� � Out
� � � �� ExtendedStatus allows the storage provider to return extended (implementation specific) error information. Description
)
� � � ��� ID
6
� � ��� �
object:MSFT_StorageExtendedStatus ReturnValue uint32
� | uint32 out
� | � �� __ � DeleteObject X# e# �# �# Description This method deletes file server. If the file server contains any file shares, these shares must be removed first. Values $ )$ 8$ K$ T$ \$ o$ �$ �$ �$ �$ :% c% �% �% Success Not Supported Unspecified Error Timeout Failed Invalid Parameter Method Parameters Checked - Job Started Access denied There are not enough resources to complete the operation. Cache out of date The operation is not supported while the cluster is being upgraded. Cannot connect to the storage provider. The storage provider cannot connect to the storage subsystem. This operation is not supported for local file servers. The file server still contains file shares. D a42c9160500003S ROOT\Microsoft\Windows\Storage\MS_409 ���� � �� �� * : ��� � __PARAMETERS abstract RunAsJob boolean
� 4 In
� 4 \ �� This parameter controls the asynchronous behavior the method will follow.
If TRUE, this method will make use of the CreatedStorageJob out parameter when the request is taking a long time to service. If a storage job has been created to track the operation, this method will return 4096 - 'Method Parameters Checked - Job Started'. Note, even if RunAsJob is TRUE, the method can still return a result if it has finished in sufficient time.
If FALSE or NULL, this method will follow default WMI asynchronous behavior as determined by the client's method for invocation (i.e. synchronous unless requested otherwise). Description )
� 4 \ ��� � ID 6
� ~ \ ��� � 6 boolean __ �P a42c9160500003S ROOT\Microsoft\Windows\Storage\MS_409 ���� � ��
�� * ~ � | � ������������� � __PARAMETERS abstract f CreatedStorageJob ref f
� = Out f
� = a �� If RunAsJob is set to TRUE and this method takes a while to execute, this parameter returns a reference to the storage job used to track the long running operation. Description f )
� = a ��6 � ID f 6
� � a ��6 � z ref:MSFT_StorageJob
ExtendedStatus object
� � Out
� � �� ExtendedStatus allows the storage provider to return extended (implementation specific) error information. Description
)
� � ��� O ID
6
� G ��� O � object:MSFT_StorageExtendedStatus ReturnValue uint32
� � uint32 out
� � � �� __ � SetFriendlyName �2 �2 3 3 Description This method allows the file server to be renamed. Values O3 X3 g3 z3 �3 �3 �3 �3 �3 -4 V4 �4 Success Not Supported Unspecified Error Timeout Failed Invalid Parameter Access denied There are not enough resources to complete the operation. The operation is not supported while the clu�
b?@ � Y��N� { OI�^ � R S O P _ P o l i c y S e t t i n g 1uR|�C�g � RSOP_PolicySetting ) % � ��� % � � > H � � � o � � � ; \ � � o � � � ) I � q u # � � � h
$ @ �
g � � � X
s
�
�
Y t � � � � � r � � ^ y � � T h O ] A ^ % � � �_UUUUUUUU�����������������������������������������������������������������������������������������������������������������������������������������R � RSOP_IEAKPolicySetting Description Policy object for registry or Administrative Templates extension.Policy settings in an .adm file involve settings values on registrykeys which is abstracted by this class. AMENDMENT LOCALE categories j
� % 2 sint32 DisplayName Categories channels f
� t | � sint32 DisplayName Channels customFavorites Z
� � � � sint32 DisplayName Custom Favorites customizeAnimatedBitmaps *
� = F S boolean DisplayName Customize Animated Bitmaps customizeLogoBitmaps <
� � � � boolean DisplayName Customize Logo Bitmaps customLinks ^
� - sint32 DisplayName Custom Links deleteAdminCreatedFavoritesOnly X +
� � � � � � boolean Description DisplayName Delete Admin Created Favorites Only deleteExistingChannels b +
� 0 9 F H U boolean Description DisplayName Delete Existing Channels deleteExistingFavorites V +
� � � � � � boolean Description DisplayName Delete Existing Favorites deleteExistingToolbarButtons N
� K T a boolean DisplayName Delete Existing Toolbar Buttons enableDesktopChannelBarByDefault d +
� � � � � boolean Description DisplayName Enable Desktop Channel Bar By Default enableTrustedPublisherLockdown ' � +
� � � � � � boolean Description If false, program settings are not customized. DisplayName Enable Trusted Publisher Lockdown homePageURL n +
� > F S U b string Description DisplayName Home Page URL id @ 6
� � � � � � � �� string Description Inherited from RSOP_PolicySetting. DisplayName ID importAuthenticodeSecurityInfo & � +
� \ e r � � boolean Description If false, authenticode security information is not customized. DisplayName Import Authenticode Security Info importContentRatingsSettings % � +
� 9 B O � � boolean Description If false, content ratings settings are not customized. DisplayName Import Content Ratings Settings importedZoneCount $ | +
�
F
S
uint32 Description Number of zones imported from another machine. DisplayName Imported Zone Count importProgramSettings ( � +
� �
�
�
�
boolean Description If false, program settings are not customized. DisplayName Import Program Settings importSecurityZoneSettings # z +
� y � � � � boolean Description If false, security zone settings are not customized. DisplayName Import Security Zone Settings largeAnimatedBitmapName ,
� 6 > K string DisplayName Large Animated Bitmap Name largeAnimatedBitmapPath
0
� � � � string DisplayName Large Animated Bitmap Path largeCustomLogoBitmapName >
� $
,
9
string DisplayName Large Custom Logo Bitmap Name largeCustomLogoBitmapPath B
� �
�
�
string DisplayName Large Custom Logo Bitmap Path onlineHelpPageURL " v +
� ' 4 6 C string Description DisplayName Online Help Page URL placeFavoritesAtTopOfList T +
� � � � � � boolean Description DisplayName Place Favorites At Top Of List precedence @ 6
� B J W { � � �� uint32 Description Inherited from RSOP_PolicySetting. DisplayName Precedence preferenceMode
� � � � boolean DisplayName Preference Mode searchBarURL ! r +
� > F S U b string Description DisplayName Search Bar URL smallAnimatedBitmapName 4
� � � � string DisplayName Small Animated Bitmap Name smallAnimatedBitmapPath 8
� - 5 B string DisplayName Small Animated Bitmap Path smallCustomLogoBitmapName F
� � � � string DisplayName Small Custom Logo Bitmap Name smallCustomLogoBitmapPath J
� ( 5 string DisplayName Small Custom Logo Bitmap Path titleBarCustomText +
� � � � + 8 string Description Text that appears in the IE browser title bar after the standard string, "Microsoft Internet Explorer provided by." DisplayName Title Bar Custom Text titleBarText +
� � � � $ 1 string Description Text that appears in the IE browser title bar, including the standard string "Microsoft Internet Explorer provided by." DisplayName Title Bar Text toolbarBackgroundBitmapPath
& +
� � � � � � string Description Path of the bitmap used as the background for the toolbar. DisplayName Toolbar Background Bitmap Path toolbarButtons P
� Q Y f sint32 DisplayName Delete Existing Toolbar Buttons userAgentText " +
� � � � 4 A string Description String to be appended to the userAgent property value of the navigator object. DisplayName User Agent Text � 2uR|�C�c ) # b ��m u � ' 4 � � R _ � �
� � K c UU������������������������������� � RSOP_IEToolbarButton Description Toolbar button object for the IE browser, used for IEAK RSoP. AMENDMENT LOCALE actionPath +
� � � �
string Description Script file or executable to run when the button is pressed. DisplayName Action Path buttonOrder 6
� x � ��� � � � sint32 Description Order of the button in a list. DisplayName Button Order caption +
�
< I string Description Caption string is required. DisplayName Caption hotIconPath
� � � � string DisplayName Hot Icon Path iconPath
� � � � string DisplayName Icon Path rsopID 6
� Q � ��Y f � � string Description Foreign key to RSOP_PolicySetting. DisplayName RSOP ID rsopPrecedence 6
� � � ��� - : uint32 Description Foreign key to RSOP_PolicySetting. DisplayName RSOP Precedence showOnToolbarByDefault
� � � � boolean DisplayName Show On Toolbar By Default �
E v e n t T r a c e �uR|�C�[ EventTrace ) - ��8 @ G ]����� � TSClientTrace Description TS Client Trace AMENDMENT LOCALE Flags +
� � � � � � uint32 Description Enable Flags Values � � � TS_TRACE_LEVEL_NRM TS_TRACE_LEVEL_ERROR TS_TRACE_LEVEL_ASSERT ce � ��OP / ��h� C j��� Y �ߍ� � C I M _ M a n a g e d E l e m e n t >wR|�C�� " CIM_ManagedElement ) # � ��� � � � � � � � � �U�������������������������������� � MSFT_MTEventProvider Description Encapsulates the properties of Windows event provider. Can also be used to enumerate all the event providers in the computer. AMENDMENT LOCALE MS_409 DisplayName
� � � string Description The localized display name of the Windows event provider. If it is not indicated in the provider's manifest or not present in the provider's resource file, then it is set equal to the Name of the provider. DisplayPath
� ( string Description The localized display path of the Windows event provider. This display path is similar to what Windows Event Viewer uses to create hierarchical tree nodes for identification of event providers. ExportedChannelsCount
� . 6 C uint32 Description The number of event channels exported by the event provider. Name )
� � � ��� � string Description The unique and language neutral identifier of the Windows event provider. E
w { � � � �
� GetChannels + Description Gets all the event channels that are exported by the given event provider. * a42c9160500003S ROOT\Microsoft\Windows\ManagementTools\MS_409 ���� � �� �� * � k � ��������� � __PARAMETERS abstract
Result object
� 2 Out
� 2 Y �� The list of one or more event channels. Description
)
� 2 Y ��� � ID
6
� = Y ��� � � object:MSFT_MTEventChannel ReturnValue uint32
� � uint32 out
� � � �� __ � GetProvidersAndWindowsEventChannels � � Description Gets the list of those event providers that export at least one event channel. Also gets the list of those event channels that are connected to Windows event logs. p a42c9160500003S ROOT\Microsoft\Windows\ManagementTools\MS_409 ���� � ��
�� * # I � � ������������s � __PARAMETERS abstract
EventProviders object
� : Out
� : a �� The list of those event providers that export at least one event channel. Description
)
� : a ��� � ID
6
� g a ��� � object:MSFT_MTEventProvider
WindowsEventChannels object
� � Out
� � � �� The list of those event channels that are connected to Windows event logs. Description
)
� � � ��N ID
6
� � � ��N � object:MSFT_MTEventChannel ReturnValue uint32
� < uint32 out
� < D �� __ � ?wR|�C�+ ) ! � ��� � � � y � � � C M � � ( 3 U��������������������������� � MSFT_MTEventRecord Description Represents the detailed information of an event in a particular log generated by a specific source. AMENDMENT LOCALE MS_409 Description
� � � � string Description The text description of the event. Id )
� N � ��V c uint32 Description The ID of the event. Level
� � � � uint16 Description The level of the event. Log
� string Description The log this event was read from. RecordId
� y � � uint32 Description The record ID of the event in the event log. Source
� � � string Description The source that logged the event. Timestamp e
� _ i v datetime Description The logged time of the event. � C I M _ M a n a g e d E l e m e n t @wR|�C� % CIM_ManagedElement ) & � ��� � � � . < � � 9 A � } � z � �U����������������������������������f � MSFT_MTLogicalProcessor Description The Logical Processor data object. Statistic data is calculated based on current interval seconds setting. AMENDMENT LOCALE MS_409 CpuId )
� � � � �� uint16 Description Identification number of logical processor. CurrentIndex
� h p } uint16 Description Current data sample index. Increment at every data sample. IntervalSeconds
� � � uint16 Description Current data collection interval in seconds. NodeId )
� x � � � �� uint16 Description Identification number of NUMA node or processor socket. If empty, it presents aggregated NUMA or Socket itself. Parking
� 3 < I boolean Description Indicate whether the processor is in parked state. Privileged
� � � � real32 Description Historical statistics of percentage of privileged kernel utilization on the logical processor, logging latest 60 samples at each interval defined in IntervalSeconds (second). Utilization
� � � � real32 Description Historical statistics of percentage of utilization on the logical processor, logging latest 60 samples at each interval defined in IntervalSeconds (second). � xR|�C�v 6 ! . � ��� � � � a l ��������� � CIM_Dependency Version 2.10.0 Description CIM_Dependency is a generic association used to establish dependency relationships between ManagedElements. AMENDMENT LOCALE MS_409 Antecedent f )
� � � �� ref:CIM_ManagedElement Description Antecedent represents the independent object in this association. Dependent f )
� � � ��� � ref:CIM_ManagedElement Description Dependent represents the object that is dependent on the Antecedent. _M � ���` P o�hH� X �j�_ Z ě�0b h �o9N� X e S q l P k g _ f f v _ p a g e _ a u d i t _ f a i l e d K^��7 �� > ( XeSqlPkg_ffv_page_audit_failed ) � �� " 0 < � � = K ? H � � 5 A � � O ^ � � . � � ! 3 � � d t WUU����������������������������������������������������������� � ffv_page_audit_failed EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid error_count )
� * 2 � �� sint32 WmiDataId failure_kind P
� � � � ��� � � � � � sint32 WmiDataId XEMapId ValueMap � � � � 2 0 3 1 Values $ 0 FirstPage FirstPfsPage SecondPage SecondPfsPage file_id )
� � � �� uint16 WmiDataId first_begin_lsn
& C
� � �
� �� * 2 string WmiDataId StringTermination NullTerminated Format w first_name " C
� � � � ��� � � � string WmiDataId StringTermination NullTerminated Format w FragmentId 6
� # + 6 C � �� uint32 WmiDataId Description FragmentId logical_db_id
6 6
� � � � ��� � object:guid WmiDataId Extension Guid page_id )
� � �� uint32 WmiDataId physical_db_id
2 6
� r
� ��� � object:guid WmiDataId Extension Guid RemainingLength 6
� � � � �� uint32 WmiDataId Description RemainingLength second_begin_lsn . C
� � � � ��� � � � string WmiDataId StringTermination NullTerminated Format w second_name * C
� # + � ��6 I Y a string WmiDataId StringTermination NullTerminated Format w SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g L^��7 �0 XeSqlPkg
C � �� , ^ d � � � � c����� � XeSqlPkg_ffv_page_id_mismatch Description Page ID mismatch during Foreign File validation. Guid {9d5a7ee8-ab95-4e0b-890c-2996e7512a80} locale MS\0x409 DisplayName ffv_page_id_mismatch � X e S q l P k g _ f f v _ p a g e _ i d _ m i s m a t c h M^��7 � > ' XeSqlPkg_ffv_page_id_mismatch ) � �� ! / ; � � A O C L � � 9 E � � S b � � L ] � � v � % � � WUU����������������������������������������������������������� � ffv_page_id_mismatch EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid expected_page_id )
� . 6 � �� uint32 WmiDataId failure_kind P
� � � � ��� � � � � � sint32 WmiDataId XEMapId ValueMap � � � � 2 0 3 1 Values ( 4 FirstPage FirstPfsPage SecondPage SecondPfsPage file_id )
� � � � �� uint16 WmiDataId first_begin_lsn
& C
� �
� �� . 6 string WmiDataId StringTermination NullTerminated Format w first_name " C
� � � � ��� � � � string WmiDataId StringTermination NullTerminated Format w FragmentId 6
� ' / : G � �� uint32 WmiDataId Description FragmentId logical_db_id
6 6
� � � � ��� � object:guid WmiDataId Extension Guid physical_db_id
2 6
� # 0
� ��; F object:guid WmiDataId Extension Guid RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength second_begin_lsn . C
� 5 = � ��H [ k s string WmiDataId StringTermination NullTerminated Format w second_name * C
� � � � ��� �
string WmiDataId StringTermination NullTerminated Format w SequenceNumber 6
� i q | � � �� uint32 WmiDataId Description SequenceNumber snapshot_page_id )
� � � � �� uint32 WmiDataId � X e S q l P k g N^��7 �@ XeSqlPkg
C � ��# 0 j p � � � � c����� � XeSqlPkg_ffv_page_post_read_error Description Foreign File validator encountered error post page read. Guid {be88f60c-084c-4465-b451-edc38f05e894} locale MS\0x409 DisplayName ffv_page_post_read_error �! X e S q l P k g _ f f v _ p a g e _ p o s t _ r e a d _ e r r o r O^��7 �� 1 + XeSqlPkg_ffv_page_post_read_error # ) � �� % 3 ? � � � � � � U d � � $ 4 � � ( 9 � � 2 A WUU����������������������������������������������� � ffv_page_post_read_error EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid begin_lsn " C
� E M � ��X k { � string WmiDataId StringTermination NullTerminated Format w file_id )
� � � � �� uint16 WmiDataId FragmentId 6
� ) 1 < I � �� uint32 WmiDataId Description FragmentId logical_db_id
* 6
� � � � ��� � object:guid WmiDataId Extension Guid page_id )
� � �� uint32 WmiDataId physical_db_id
& 6
� x �
� ��� � object:guid WmiDataId Extension Guid post_read_error P
� � ��# F , 6 � � uint32 WmiDataId XEMapId ValueMap v z � � � � � � � � � � � � -8 -12 -10 -4 -3 -11 -13 -9 0 -6 -2 -5 -7 -1 -14 Values � # : N ` u � � � � � � BUFERR_AUDITFAILURE BUFERR_BAD_KEY BUFERR_BAD_PROTECTION BUFERR_BADCHECKSUM BUFERR_BADPAGEID BUFERR_CANT_DECRYPT BUFERR_ENCRYPTION_CHECKSUM BUFERR_OFFLINE_FILE BUFERR_OK BUFERR_RESTORE_PENDING BUFERR_SHORTTRANSFER BUFERR_SIMULATED BUFERR_STALEREAD BUFERR_TORNPAGE BUFFER_MISSING_KEY RemainingLength 6
� } � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
�
" � �� uint32 WmiDataId Description SequenceNumber snapshot_name C
� � � � ��� � � � string WmiDataId StringTermination NullTerminated Format w � w �9 A B 5 3 8 0 6 E 8 8 6 6 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0 � ���� ͝��C�n xC���� M � WMIBinaryMofResource C:\Windows\system32\drivers\ndis.sys[MofResourceName] !� �Ν��C�_ ) � �� � � StdRegProv Locale RegProv �� : � O oca Z � � � � l ] i � . � � � � X g � ! �" �" �" S( �) �) * . 1 1 M1 [5 P8 `8 �8
> �? �? �? �C �F �F G �L N N ON ]R NU fU �U [ �\ �\ �\ �` �c �c d �i k #k Rk `o Mr Zr �r �v �y �y z ~ � � � �� ʅ � CreateKey % ��2 �� implemented static � ae442007200009F ROOT\Default ���� � �= �� * � � C ������ � __PARAMETERS abstract hDefKey uint32
� 3 IN
� 3 Z �� ID )
� � Z ��� uint32 sSubKeyName string
� � IN
� � �� ID )
� z ��? string __ �{ ae442007200009F ROOT\Default ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � DeleteKey t ��� �� implemented static � ae442007200009F ROOT\Default ���� � �= �� * � � C ������ � __PARAMETERS abstract hDefKey uint32
� 3 IN
� 3 Z �� ID )
� � Z ��� uint32 sSubKeyName string
� � IN
� � �� ID )
� z ��? string __ �{ ae442007200009F ROOT\Default ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � EnumKey � ��� �� implemented static � ae442007200009F ROOT\Default ���� � �= �� * � � C ������ � __PARAMETERS abstract hDefKey uint32
� 3 IN
� 3 Z �� ID )
� � Z ��� uint32 sSubKeyName string
� � IN
� � �� ID )
� z ��? string __ �� ae442007200009F ROOT\Default ���� � �� �� � * � ��������H � __PARAMETERS abstract sNames string
� 2 out
� 2 Y �� ID )
� � Y ��� string ReturnValue uint32
� uint32 out
� �� __ � EnumValues � ��� �� implemented static � ae442007200009F ROOT\Default ���� � �= �� * � � C ������ � __PARAMETERS abstract hDefKey uint32
� 3 IN
� 3 Z �� ID )
� � Z ��� uint32 sSubKeyName string
� � IN
� � �� ID )
� z ��? string __ �] ae442007200009F ROOT\Default ���� � �
�� � � * � � > ������������� � __PARAMETERS abstract sNames string
� 2 out
� 2 Y �� ID )
� � Y ��� string Types sint32
� � out
� � �� ID )
� u ��: sint32 ReturnValue uint32
� � uint32 out
� � � �� __ � DeleteValue � ��� �� implemented static
ae442007200009F ROOT\Default ���� � ��
�� * � � C � � ���������8 � __PARAMETERS abstract hDefKey uint32
� 3 IN
� 3 Z �� ID )
� � Z ��� uint32 sSubKeyName string
� � IN
� � �� ID )
� z ��? string sValueName string
� � in
� � � �� ID )
� 0 � ��� string __ �{ ae442007200009F ROOT\Default ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � SetDWORDValue � ��� �� implemented static z ae442007200009F ROOT\Default ���� � �% �� * � � C � � J � ��������� � � __PARAMETERS abstract hDefKey uint32
� 3 IN
� 3 Z �� ID )
� � Z ��� uint32 sSubKeyName string
� � IN
� � �� ID |�! ` � ��RQ
{ ~���� ��U�� Z ���`D � + X e S o s P k g _ m e m o r y _ b r o k e r _ r i n g _ b u f f e r _ r e c o r d e d �^��7 �� q 5 XeSosPkg_memory_broker_ring_buffer_recorded - ) � ��$ / = I � � � � # 8 � � � � 8 D � � Z f � � P Y � � � _ e � � 5 E � � WUUU������������������������������������������������������������������������������������������������������������ � memory_broker_ring_buffer_recorded EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid broker ` C
� L T � ��_ r � � string WmiDataId StringTermination NullTerminated Format w call_stack
h C
� � � � ��� object WmiDataId Extension Variant XEVLD callstack currently_allocated P )
� o w � �� sint64 WmiDataId currently_predicated
H )
� � �
� �� sint64 WmiDataId delta_time $ )
� % - � �� uint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId id )
� � � � �� uint32 WmiDataId memory_ratio ( )
� G O � �� sint64 WmiDataId new_target
0 )
� � �
� �� sint64 WmiDataId notification d C
� � ��" 5 E M string WmiDataId StringTermination NullTerminated Format w overall 8 )
� � � � �� sint64 WmiDataId pool_metadata_id )
� � � � �� uint32 WmiDataId previously_allocated X )
� L T � �� sint64 WmiDataId rate @ )
� � � � �� sint64 WmiDataId RemainingLength 6
� $ � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber timestamp0 )
� � � �� uint64 WmiDataId � X e S o s P k g �^��7 �S XeSosPkg
C � ��4 A l r � � � � _����� � XeSosPkg_memory_broker_clerks_ring_buffer_recorded Description Memory broker clerks ring buffer recorded Guid {2355007e-95b9-498e-88da-c0be54f9c12c} locale MS\0x409 DisplayName memory_broker_clerks_ring_buffer_recorded �2 X e S o s P k g _ m e m o r y _ b r o k e r _ c l e r k s _ r i n g _ b u f f e r _ r e c o r d e d �^��7 �� m < XeSosPkg_memory_broker_clerks_ring_buffer_recorded 4 ) � ��+ 6 D P � � � . @ � �
T f � � & p � � z � � � 3 ? � � � � WUUU���������������������������������������������������������������������������������������������������������; � memory_broker_clerks_ring_buffer_recorded EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid call_stack
d C
� W _ � ��j u ~ � object WmiDataId Extension Variant XEVLD callstack clerk_name ` C
� � � � �� # + string WmiDataId StringTermination NullTerminated Format w external_benefit @ )
� w � �� real64 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId id )
� A I � �� uint32 WmiDataId internal_benefit
8 )
� � �
� �� real64 WmiDataId internal_freed_pages X )
� � � �� sint64 WmiDataId periodic_freed_pages
P )
� ] e
� �� sint64 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� J R ] j � �� uint32 WmiDataId Description SequenceNumber simulated_pages ( )
� � � � �� sint64 WmiDataId simulation_benefit 0 )
� ( � �� real64 WmiDataId timestamp0 )
� v ~ � �� uint64 WmiDataId total_pages )
� � � � �� sint64 WmiDataId value_of_memory H )
� ( 0 � �� real64 WmiDataId � X e S o s P k g �^��7 �2 XeSosPkg
C � ��) 6 V \ � � � � _����� � XeSosPkg_scheduler_ring_buffer_recorded Description Scheduler ring buffer recorded Guid {a22ce15e-710e-4280-8558-25622bb11d68} locale MS\0x409 DisplayName scheduler_ring_buffer_recorded �' X e S o s P k g _ s c h e d u l e r _ r i n g _ b u f f e r _ r e c o r d e d �^��7 �0 P 1 XeSosPkg_scheduler_ring_buffer_recorded ) ) � �� + 9 A � � � � 2 | � � � F W � � = M � � . = � � � � E Q � � WUUU����������������������������������������������������������������������������� � scheduler_ring_buffer_recorded EventType EventVersion action D C
� � � � ��� � � � string WmiDataId StringTermination NullTerminated Format w ActivityId
N
� ; H S ` l �� � ��x � object:guid WmiDataId Description ActivityId ActivityID Extension Guid call_stack
H C
� � � � ���
object WmiDataId Extension Variant XEVLD callstack disk_io_completed < )
� i q � �� uint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId id )
� 3 ; � �� uint32 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength scheduler_address
4
� ! ) � ��4 �� object WmiDataId Pointer SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber source_worker
, 4
� � ��% �� object WmiDataId Pointer target_worker
0 4
� �
� ��� �� object WmiDataId Pointer ticks $ )
� � � � �� uint64 WmiDataId timer_expired
@ )
� 2 :
� �� uint32 WmiDataId timestamp0 )
� � � � �� uint64 WmiDataId worker_signal_time 4 )
� � � � �� uint64 WmiDataId �aId �9 A B 5 3 8 0 6 E 8 8 6 6 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0 � ���� ͝��C�n xC���� M � WMIBinaryMofResource C:\Windows\system32\drivers\ndis.sys[MofResourceName] urceName] ourceName] }J�M` � ���_ ���k �#!� � G�f� L-�� /�&� �QӪ
3��z� �L���
� ��!� ɡP�� J�
u� U �� ��Dd �3& " 4�H
�3�~R ��=�b ����x ~t`~ 4 3 C 8 6 C 3 E 5 B 2 B 7 F 1 D D 0 4 4 3 A 6 D A 4 E 1 7 A A 9 5 D 6 5 F 5 6 E E 0 C 1 9 C F 4 F D 3 B 5 D 9 A 5 F 6 3 C 5 2 2 �"�U�T�u͝��C�o 0 9 �� N � HNet_Connection {047525BC-A893-436A-91E8-557852561637} Ethernet Instance 0 A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 �"�U�T�v͝��C�| �� Z � HNet_ConnectionProperties HNet_Connection.Guid="{047525BC-A893-436A-91E8-557852561637}" R O O T \ M i c r o s o f t \ H o m e N e t H N e t _ C o n n e c t i o n P r o p e r t i e s
C o n n e c t i o n � N S _ 5 1 1 6 2 6 F A E 4 F 5 7 D B D 2 0 D F 5 C D 4 4 A 4 1 D A E C E D 2 8 C F 7 B 3 F D 8 B 1 2 0 1 2 C 7 F 4 B 5 8 F 4 4 E 6 6 5 \ K I _ A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 \ I _ 5 A B E 0 A 3 C 0 3 A 4 B D C 6 C E 5 A C 2 2 6 1 4 4 B A 9 8 A B D 8 1 F C 1 9 0 5 8 9 D 6 1 F 4 F B 6 7 A 3 4 2 5 2 F 7 4 F D X 4 3 C 8 6 C 3 E 5 B 2 B 7 F 1 D D 0 4 4 3 A 6 D A 4 E 1 7 A A 9 5 D 6 5 F 5 6 E E 0 C 1 9 C F 4 F D 3 B 5 D 9 A 5 F 6 3 C 5 2 2 �"�U�T�u͝��C�f 0 9 �� E � HNet_Connection {D12DED2F-AEFC-4788-A733-FAA9E04B44C7} Ethernet 2 A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 �"�U�T�v͝��C�| �� Z � HNet_ConnectionProperties HNet_Connection.Guid="{D12DED2F-AEFC-4788-A733-FAA9E04B44C7}" R O O T \ M i c r o s o f t \ H o m e N e t H N e t _ C o n n e c t i o n P r o p e r t i e s
C o n n e c t i o n � N S _ 5 1 1 6 2 6 F A E 4 F 5 7 D B D 2 0 D F 5 C D 4 4 A 4 1 D A E C E D 2 8 C F 7 B 3 F D 8 B 1 2 0 1 2 C 7 F 4 B 5 8 F 4 4 E 6 6 5 \ K I _ A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 \ I _ 5 A 8 2 1 8 7 B A D F D 0 5 C B F 9 0 D D A D A B 6 2 8 3 3 2 B F 3 B 6 4 F E A B C 1 C 8 9 9 9 5 4 6 5 9 A 9 4 C F 1 2 8 C 8 1 ��4 3 C 8 6 C 3 E 5 B 2 B 7 F 1 D D 0 4 4 3 A 6 D A 4 E 1 7 A A 9 5 D 6 5 F 5 6 E E 0 C 1 9 C F 4 F D 3 B 5 D 9 A 5 F 6 3 C 5 2 2 �"�U�T�u͝��C�q 0 9 �� P � HNet_Connection {0A645F4E-68C0-4C76-B4A3-0921C9718BDD} Local Area Connection A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 �"�U�T�v͝��C�| �� Z � HNet_ConnectionProperties HNet_Connection.Guid="{0A645F4E-68C0-4C76-B4A3-0921C9718BDD}" R O O T \ M i c r o s o f t \ H o m e N e t H N e t _ C o n n e c t i o n P r o p e r t i e s
C o n n e c t i o n � N S _ 5 1 1 6 2 6 F A E 4 F 5 7 D B D 2 0 D F 5 C D 4 4 A 4 1 D A E C E D 2 8 C F 7 B 3 F D 8 B 1 2 0 1 2 C 7 F 4 B 5 8 F 4 4 E 6 6 5 \ K I _ A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 \ I _ 4 1 F 4 0 B 0 A E D 8 0 D A 6 4 6 B B 3 A 5 4 C 3 4 C B D A F 7 2 A D B 4 E 6 4 1 4 1 4 1 6 C 5 4 3 4 8 9 2 B 2 4 E B 7 F 4 2 9 ��4 3 C 8 6 C 3 E 5 B 2 B 7 F 1 D D 0 4 4 3 A 6 D A 4 E 1 7 A A 9 5 D 6 5 F 5 6 E E 0 C 1 9 C F 4 F D 3 B 5 D 9 A 5 F 6 3 C 5 2 2 �"�U�T�u͝��C�f 0 9 �� E � HNet_Connection {2DBE1C3C-12E7-4095-90AF-AC78BF10DD42} Ethernet 2 A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 �"�U�T�v͝��C�| �� Z � HNet_ConnectionProperties HNet_Connection.Guid="{2DBE1C3C-12E7-4095-90AF-AC78BF10DD42}" R O O T \ M i c r o s o f t \ H o m e N e t H N e t _ C o n n e c t i o n P r o p e r t i e s
C o n n e c t i o n � N S _ 5 1 1 6 2 6 F A E 4 F 5 7 D B D 2 0 D F 5 C D 4 4 A 4 1 D A E C E D 2 8 C F 7 B 3 F D 8 B 1 2 0 1 2 C 7 F 4 B 5 8 F 4 4 E 6 6 5 \ K I _ A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 \ I _ 6 3 1 0 7 F 0 6 1 0 D 2 0 6 9 9 8 9 5 2 C 3 8 8 A 6 8 4 3 8 6 1 6 0 A 4 D C D E F 3 7 F A 7 5 D A 7 E 7 E 7 9 4 B 0 0 5 E 0 3 5 9 A B 5 3 8 0 6 E 8 8 6 6 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0 �b��5� ͝��C�x �f3��5��� W � WMIBinaryMofResource C:\Windows\System32\drivers\en-US\ACPI.sys.mui[ACPIMOFResource] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �b��5�
͝��C�� �f3��5� ` � WDMClassesOfDriver ACPITrace C:\Windows\System32\drivers\en-US\ACPI.sys.mui[ACPIMOFResource] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4
�b��5�
͝��C�� # �f3��5� d � WDMClassesOfDriver AMLIEvalData1 C:\Windows\System32\drivers\en-US\ACPI.sys.mui[ACPIMOFResource] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �b��5�
͝��C�� . �f3��5� o � WDMClassesOfDriver AMLIEvalData1_TypeGroup1 C:\Windows\System32\drivers\en-US\ACPI.sys.mui[ACPIMOFResource] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ^�b��5�
͝��C�z " -e3 �5� W � WDMClassesOfDriver PortClsEvent C:\Windows\System32\Drivers\portcls.SYS[PortclsMof] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/pl\}�
͝��C�� ��
�S}� ] � WDMClassesOfDriver WMIEvent C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/pl\}�
͝��C�� $ ��
�S}� c � WDMClassesOfDriver MS_WmiInternal C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ͣn�^��
͝��C�v J.3�� S � WDMClassesOfDriver WMIEvent C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 Σn�^��
͝��C�| $ J.3�� Y � WDMClassesOfDriver MS_WmiInternal C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 9 A B 5 3 8 0 6 E 8 8 6 6 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0 %�n�^�� ͝��C�l �2��2�� K � WMIBinaryMofResource C:\Windows\System32\drivers\monitor.sys[MonitorWMI] is.sys.mui[MofResourceName] 9 A B 5 3 8 0 6 E 8 8 6 6 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0 %�n�^�� ͝��C�l �2��2�� K � WMIBinaryMofResource C:\Windows\System32\drivers\monitor.sys[MonitorWMI] [MofResourceName] 9 A B 5 3 8 0 6 E 8 8 6 6 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0 %�n�^�� ͝��C�l �2��2�� K � WMIBinaryMofResource C:\Windows\System32\drivers\monitor.sys[MonitorWMI] \Windows\system32\kernelbase.dll[MofResourceName] ame] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 Σn�^��
͝��C�| $ J.3�� Y � WDMClassesOfDriver MS_WmiInternal C:\Windows\system32\kernelbase.dll[MofResourceName] �m NvR|�C�� 6 % 2 b ��m u } � MSFT_OdbcDsnTask ClassVersion 1.0 Description Task provider for ODBC Data Source Name (DSN). AMENDMENT LOCALE MS_409 �l � _Od U � 0 on 5 f �! (& sk :& y& !1 �5 a S �5 6 �J :O END MO �O T �X �X �X {g l � Get # Description Retrieves one or more ODBC DSNs from the system. B a42c9160500003S ROOT\Microsoft\Windows\Wdac\MS_409 ���� � ��
�� � � " 4 * D 1 � U����������������� � __PARAMETERS abstract Name string
� 0 In
� 0 W �� Specifies one or more ODBC DSNs by DSN name. You can use wildcard characters. The default is to return all ODBC DSNs. Description )
� 0 W ��� � ID 6
� � W ��� � @ string DriverName string
� � In
� � � �� Gets only ODBC DSNs that are using the specified ODBC driver. You can use wildcard characters. The default is to return all ODBC DSNs. Description )
� � � ��� ID 6
� � ��� � string Platform string
� ; In
� ; b �� The platform architecture of the ODBC DSN to retrieve. Possible values are '32-bit', '64-bit' or 'All'. The default is 'All'. This is the platform architecture on the remote machine if this command is executed in a remote CIM session. Description )
� ; b ��| � ID 6
� b ��| � � string DsnType string
� + In
� + R �� The type of the ODBC DSN to retrieve. Possible values are 'User', 'System' or 'All'. The default is 'All'. Description )
� + R ��� � ID 6
� x R ��� � 0 string __ �� a42c9160500003S ROOT\Microsoft\Windows\Wdac\MS_409 ���� � �& �� * 9 � � �������� � __PARAMETERS abstract
cmdletOutput object
� 8 Out
� 8 _ �� The output is an array of CIM objects of type MSFT_OdbcDsn, each of which represents an ODBC DSN. Description
)
� 8 _ ��� � ID
6
� } _ ��� � 5 object:MSFT_OdbcDsn ReturnValue uint32
� � uint32 out
� � � �� __ � Add F S Description Adds an ODBC DSN. ) a42c9160500003S ROOT\Microsoft\Windows\Wdac\MS_409 ���� � �� �� t t
� * V � � � � � U�����������������������F � __PARAMETERS abstract Name string
� 0 In
� 0 W �� The name of the ODBC DSN to create. You cannot use wildcard characters. Description )
� 0 W ��� � ID 6
� Z W ��� � string DriverName string
� � In
� � � �� The name of the ODBC driver for the new ODBC DSN. You cannot use wildcard characters. Description )
� � � ��, � ID 6
� � � ��, � p string SetPropertyValue string
� � In
� � �� Specifies the property values of the new ODBC DSN. Format as an array of strings where each string is: <key>=<value>. Description )
� � ��� 9 ID 6
� < ��� 9 � string PassThru boolean
� ` In
� ` � �� Passes the object created by this cmdlet through the pipeline. By default, this cmdlet does not pass any objects through the pipeline. Description )
� ` � ��> � ID 6
� � � ��> � � boolean Platform string
� � In
� � �� The platform architecture of the ODBC DSN you are adding. Possible values are '32-bit' or '64-bit'. The default is '32-bit' on a 32-bit process and '64-bit' on a 64-bit process. This is the platform architecture on the remote machine if this command is executed in a remote CIM session. Description )
� � ��d D ID 6
� � ��d D � string DsnType string
� In
� : �� The type of the ODBC DSN to add. Possible values are 'User' or 'System'. Description )
� : ��� h ID 6
� > : ��� h � string boolean / �
� �) In / �
� �) �) �� ID / � )
� T* �) ��* / boolean 0 � SchedulerRandomizationTime uint32 0 �
� �* In 0 �
� �* �* �� ID 0 � )
� + �* ���* 0 uint32 1 � DisableBehaviorMonitoring boolean 1 �
� P+ In 1 �
� P+ x+ �� ID 1 � )
� �+ x+ ���+ 1 boolean 2 � DisableIntrusionPreventionSystem boolean 2 �
� , In 2 �
� , F, �� ID 2 � )
� �, F, ��t, 2 boolean 3 � DisableIOAVProtection boolean 3 �
� �, In 3 �
� �, - �� ID 3 � )
� r- - ��7- 3 boolean 4 � DisableRealtimeMonitoring boolean 4 �
� �- In 4 �
� �- �- �� ID 4 � )
� 9. �- ���- 4 boolean 5 � DisableScriptScanning boolean 5 �
� k. In 5 �
� k. �. �� ID 5 � )
� �. �. ���. 5 boolean 6 � DisableArchiveScanning boolean 6 �
� // In 6 �
� // W/ �� ID 6 � )
� �/ W/ ���/ 6 boolean 7 � DisableCatchupFullScan boolean 7 �
� �/ In 7 �
� �/ 0 �� ID 7 � )
� �0 0 ��I0 7 boolean 8 � DisableCatchupQuickScan boolean 8 �
� �0 In 8 �
� �0 �0 �� ID 8 � )
� I1 �0 ��1 8 boolean 9 � DisableEmailScanning boolean 9 �
� z1 In 9 �
� z1 �1 �� ID 9 � )
� 2 �1 ���1 9 boolean : � DisableRemovableDriveScanning boolean : �
� E2 In : �
� E2 m2 �� ID : � )
� �2 m2 ���2 : boolean ; � DisableRestorePoint boolean ; �
� 3 In ; �
� 3 .3 �� ID ; � )
� �3 .3 ��\3 ; boolean < � DisableScanningMappedNetworkDrivesForFullScan boolean < �
� �3 In < �
� �3 4 �� ID < � )
� r4 4 ��74 < boolean = � DisableScanningNetworkFiles boolean = �
� �4 In = �
� �4 �4 �� ID = � )
� ;5 �4 �� 5 = boolean > � ApplyDisableNetworkScanningToIOAV boolean > �
� y5 In > �
� y5 �5 �� ID > � )
�
6 �5 ���5 > boolean ? � UILockdown boolean ? �
� 16 In ? �
� 16 Y6 �� ID ? � )
� �6 Y6 ���6 ? boolean @ � ThreatIDDefaultAction_Ids sint64 @ �
� �6 In @ �
� �6 7 �� ID @ � )
� �7 7 ��M7 @ sint64 A � ThreatIDDefaultAction_Actions uint8 A �
� �7 In A �
� �7 �7 �� 58 88 ;8 >8 A8 D8 G8 1 2 3 6 8 9 10 ValueMap A � )
� �7 �7 ��K8 8 ID A � 6
� �8 �7 ��K8 8 �8 A uint8 B � UnknownThreatDefaultAction uint8 B �
� 9 In B �
� 9 /9 �� }9 �9 �9 �9 �9 �9 �9 1 2 3 6 8 9 10 ValueMap B � )
� 9 /9 ���9 ]9 ID B � 6
� : /9 ���9 ]9 �9 B uint8 C � LowThreatDefaultAction uint8 C �
� M: In C �
� M: s: �� �: �: �: �: �: �: �: 1 2 3 6 8 9 10 ValueMap C � )
� M: s: ���: �: ID C � 6
� `; s: ���: �: ; C uint8 D � ModerateThreatDefaultAction uint8 D �
� �; In D �
� �; �; ��
<
< < < < < < 1 2 3 6 8 9 10 ValueMap D � )
� �; �; �� < �; ID D � 6
� �< �; �� < �; a< D uint8 E � HighThreatDefaultAction uint8 E �
� �< In E �
� �< = �� O= R= U= X= [= ^= a= 1 2 3 6 8 9 10 ValueMap E � )
� �< = ��e= /= ID E � 6
� �= = ��e= /= �= E uint8 F � SevereThreatDefaultAction uint8 F �
� "> In F �
� "> H> �� �> �> �> �> �> �> �> 1 2 3 6 8 9 10 ValueMap F � )
� "> H> ���> v> ID F � 6
� 5? H> ���> v> �> F uint8 G � PUAProtection uint8 G �
� ]? In G �
� ]? �? �� �? �? �? 0 1 2 ValueMap G � )
� ]? �? ���? �? ID G � 6
� S@ �? ���? �? @ G uint8 H � DisableBlockAtFirstSeen boolean H �
� �@ In H �
� �@ �@ �� ID H � )
� A �@ ���@ H boolean I � CloudBlockLevel uint8 I �
� BA In I �
� BA hA �� �A �A �A �A �A 0 1 2 4 6 ValueMap I � )
� BA hA ���A �A ID I � 6
� FB hA ���A �A �A I uint8 J � CloudExtendedTimeout uint32 J �
� uB In J �
� uB �B �� ID J � )
� C �B ���B J uint32 K � EnableNetworkProtection uint8 K �
� 8C In K �
� 8C ^C �� �C �C �C 0 1 2 ValueMap K � )
� 8C ^C ���C �C ID K � 6
� .D ^C ���C �C �C K uint8 L � EnableControlledFolderAccess uint8 L �
� eD In L �
� eD �D �� �D �D �D �D �D 0 1 2 3 4 ValueMap L � )
� eD �D ���D �D ID L � 6
� iE �D ���D �D !E L uint8 M � AttackSurfaceReductionOnlyExclusions string M �
� �E In M �
� �E �E �� ID M � )
� 8F �E ���E M string N � AttackSurfaceReductionRules_Ids string N �
� sF In N �
� sF �F �� ID N � )
� G �F ���F N string O � AttackSurfaceReductionRules_Actions uint8 O �
� BG In O �
� BG hG �� �G �G �G �G �G 0 1 2 5 6 ValueMap O � )
� BG hG ���G �G ID O � 6
� FH hG ���G �G �G O uint8 P � ControlledFolderAccessAllowedApplications string P �
� �H In P �
� �H �H �� ID P � )
� I �H ���H P string Q � ControlledFolderAccessProtectedFolders string Q �
� \I In Q �
� \I �I �� ID Q � 6
� � � ��' � k string
Name string
� � In
� � � �� Specifies one or more ODBC drivers by driver name. You can use wildcard characters. Description
)
� � � ��} ( ID
6
� � ��} ( � string Platform string
� - In
� - T �� The platform architecture of the ODBC driver. Possible values are '32-bit', '64-bit' or 'All'. The default is '32-bit' on a 32-bit process and '64-bit' on a 64-bit process. This is the platform architecture on the remote machine if this command is executed in a remote CIM session. Description )
� - T ��� � ID 6
� ) T ��� � � string __ �� a42c9160500003S ROOT\Microsoft\Windows\Wdac\MS_409 ���� � �8 �� * ? � � �������� � __PARAMETERS abstract
cmdletOutput object
� 8 Out
� 8 _ �� The output is an array of CIM objects of type MSFT_OdbcDriver, each of which represents an ODBC driver. Description
)
� 8 _ ��� � ID
6
� � _ ��� � ; object:MSFT_OdbcDriver ReturnValue uint32
� � uint32 out
� � � �� __ �FB5A9EBA2D.2138.4038187515.8043 CD_BBA26CEBD94E02C63A4812F98BAF8B828E20477373D54CAFB6CE9D30D952E46C.2131.1.48955 CD_BDB1FB83B60E9BD18231450213923BBA0EC1BFB3618EC2AD0ABF9ED38791F05A.2145.3908396418.5279 CD_C85BEC05E1DE78CAC5454E6D33A2BAFD69D28B4057355776F41B00B3DF99855E.2130.1015595837.400 CD_D13827DA0ED443FFD82DBB415FC1698F7DC60C2E8774ABDA878946AA14F41C91.2141.1096110500.4998 CD_AC0E04BCEB92E102AEC34A4105C7658C51A4608468C8FB7D34B6466CE5EDF05E.2145.544499295.1030 CD_73C8D20F8CA3C376F0CE63F48C27E4D700E969BEE425C758839EF39468252510.2145.4037767141.631 CD_A8E00DF275B2FB47AB36B812E4750AD4FD2F723726632F4293D0ED256BF3B071.2152.706525937.2167 CD_AF2AF60829ACDBE308127B32BFD1BBDF676C4E12F2E511DCE55236AD4CD567EC.2152.1720060068.650 CD_6BE9B1C8C5C3B4255DA0665A39E69608A741A6E82E2CE4B5CCEEE025A6A87F82.2152.1984179526.1753 CD_18800683F0AC1EF87B0E6101BC5367F7C19783D4C31994E5DF533A6065E582AD.2152.2385304039.3091 CD_10C4E860C968580648DC441565AA0E8E7188A06B6B5DE086FEEF7868F45558D5.190.875488910.524 CD_85D421B84B5B7251EBC11B8632E5849431920BE0B65D215F3D35E1300F5D0BE1.2145.2301218419.990 CD_9611302718E7A15BA3E862472FA9FA8DC245F3CD224631FF3A3E4FA636E2150F.2153.2166186665.3699 �Oo� � � ys� � �}W�u 2V!�� ���s� l � s( B
Y�Z ��f e ���� f w�%t1 g ��f9� f �z�� . �l?, �
E v e n t T r a c e �ӝ��C�� EventTrace 6 � �� * 0 X ` j q � � e�������� � MsftUtils Description IMAPI2 Utilities guid {0e85a5a5-4d5c-44b7-8bda-5b7ab54f7e94} locale MS\0x409 Flags R
� � � � � u � � � I S uint32 Description Enable Flags ValueDescriptions 8 X MsftUtils_DebugConstructor Flag MsftUtils_DebugDestructor Flag MsftUtils_DebugGeneral Flag DefineValues � � � MsftUtils_DebugConstructor MsftUtils_DebugDestructor MsftUtils_DebugGeneral Values � 1 MsftUtils_DebugConstructor MsftUtils_DebugDestructor MsftUtils_DebugGeneral ValueMap c o { 0x00000001 0x00000002 0x00000004 Level _
� � + � � y � � � uint32 Description Levels ValueDescriptions C a � � � Abnormal exit or termination Severe errors that need logging Warnings such as allocation failure Includes non-error cases Detailed traces from intermediate steps DefineValues # 6 K d TRACE_LEVEL_FATAL TRACE_LEVEL_ERROR TRACE_LEVEL_WARNING TRACE_LEVEL_INFORMATION TRACE_LEVEL_VERBOSE Values � � � � � Fatal Error Warning Information Verbose ValueMap � � � � � 0x1 0x2 0x3 0x4 0x5 ValueType index �
E v e n t T r a c e �ӝ��C�� EventTrace 6 � �� % 7 = e m w ~ � � u��������: � FileSystemImageTracing Description IMAPI2FS Tracing guid {F8036571-42D9-480A-BABB-DE7833CB059C} locale MS\0x409 Flags R
� � � � � � ` j uint32 Description Enable Flags ValueDescriptions ( Q y � Trace information from the constructors Trace information from the destructors General Debugging Information Trace all function entry/exits DefineValues � � � � Constructor Destructor General FunctionEntryExit Values + 8 D M Constructor Destructor General FunctionEntryExit ValueMap ~ � � � 0x00000001 0x00000002 0x00000004 0x00000008 Level _
� " * 7 ? R � � � � ( 3 uint32 Description Levels ValueDescriptions j � � � � Abnormal exit or termination Severe errors that need logging Warnings such as allocation failure Includes non-error cases Detailed traces from intermediate steps DefineValues 7 J ] r � TRACE_LEVEL_FATAL TRACE_LEVEL_ERROR TRACE_LEVEL_WARNING TRACE_LEVEL_INFORMATION TRACE_LEVEL_VERBOSE Values � � � � � Fatal Error Warning Information Verbose ValueMap # 0x1 0x2 0x3 0x4 0x5 ValueType index 0x �
E v e n t T r a c e �ӝ��C�� EventTrace 6 � ��
' - U ] g n e����� � ImapiV1Shim Description IMAPI1 Shim guid {1FF10429-99AE-45bb-8A67-C9E945B9FB6C} locale MS\0x409 Flags R
� � � � � + 9 J R c m uint32 Description Enable Flags ValueDescriptions General Debugging Information DefineValues A General Values Z General ValueMap u 0x00000001 � �ӝ��C� A � �� � & L Y [ ��f s � � � � 3 G ����� � Win32_UserStateConfigurationControls Win32_UserStateConfigurationProvider Description singleton inpartition { local-system FolderRedirection N
� � � �� � ��� � � � � uint8 description Controls whether the computer's folder redirection feature settings are configured by using UST Manageability WMI classes or by using Group Policy. Values � � GroupPolicy WMI ValueMap � � 0 1 OfflineFiles N
� M � �� � ��T a � � ! uint8 description Controls whether the computer's Offline files feature settings are configured by using UST Manageability WMI classes or by using Group Policy. Values GroupPolicy WMI ValueMap - 0 0 1 RoamingUserProfile N
� � � �� � ��� � N V t ~ uint8 description Controls whether the computer's roaming user profile feature settings are configured by using UST Manageability WMI classes or by using Group Policy. Values b o GroupPolicy WMI ValueMap � � 0 1 by �5 7 E 5 F 3 A D D 9 E 2 4 2 C 4 E 9 F 9 E D F 7 9 A A 9 7 F 7 9 E 7 9 1 1 C 5 A 8 B 9 0 2 E C 1 5 0 D 6 4 4 2 E 3 B 8 5 A 5 A A �ӝ��C�ȝ��C�� p1 ���T �� ��9 z � __Win32Provider {b67c0b5e-c0ff-41c6-885d-5bdcd71837aa} LocalSystemHostOrSelfHost Win32_UserStateConfigurationProvider E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C �ӝ��C� ȝ��C�� �� ���� ��l � � __InstanceProviderRegistration \\.\root\CIMV2:__Win32Provider.Name="Win32_UserStateConfigurationProvider" t WQL:UnarySelect
R O O T \ C I M V 2 _ _ I n s t a n c e P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 6 8 5 7 7 3 7 2 C 6 6 A 7 B 2 0 6 5 8 4 8 7 F B D 9 5 9 A A 1 5 4 E F 5 4 B 5 F 9 3 5 D C C 5 6 6 3 E 9 2 2 8 B 4 4 3 2 2 8 0 5 \ K I _ E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C \ I _ 5 1 1 F 4 7 8 9 E 4 4 2 2 A 6 F B C 0 9 5 B 2 4 C E A 0 F C 3 7 1 9 7 5 7 6 2 D 1 3 3 8 2 D 7 3 9 A 2 A 7 E D 6 6 3 8 F F 2 4 0 0 6 d R S O P _ P o l m k r P r o S e t t i n g �ӝ��C�# 8 RSOP_PolmkrProSetting " & X d ������������, * . ��������������������������������� � RSOP_PolmkrFolderSetting Locale id @
� P � �� string precedence @
� � � �� uint32 � R S O P _ P o l m k r P r o S e t t i n g �ӝ��C�$ 8 RSOP_PolmkrProSetting # ' Y e ������������, * . ��������������������������������� � RSOP_PolmkrIniFileSetting Locale id @
� Q � �� string precedence @
� � � �� uint32 � R S O P _ P o l m k r P r o S e t t i n g �ӝ��C�% 8 RSOP_PolmkrProSetting $ ( Z f ������������, * . ��������������������������������� � RSOP_PolmkrRegistrySetting Locale id @
� R � �� string precedence @
� � � �� uint32 � R S O P _ P o l m k r P r o S e t t i n g �ӝ��C�$ 8 RSOP_PolmkrProSetting # ' Y e ������������, * . ��������������������������������� � RSOP_PolmkrPrinterSetting Locale id @
� Q � �� string precedence @
� � � �� uint32 � R S O P _ P o l m k r P r i n t e r S e t t i n g �ӝ��C�� 8 # RSOP_PolmkrPrinterSetting ( 4 ������������B @ D ��������������������������������[ � RSOP_PolmkrLocalPrinterSetting Locale precedence @
� S uint32 �6 4 6 5 9 A B 9 F 8 F 1 C 4 B 5 6 8 D B 6 4 3 8 B A E 1 1 B 2 6 E E 8 F 9 3 C B 5 F 8 1 9 5 E 2 1 E 8 C 3 8 3 D 6 C 4 4 C C 4 1 �wR|�C�ȝ��C�,
� __NAMESPACE MS_409 }J�M` � ���_ ���k �#!� � G�f� L-�� /�&� �QӪ
3��z� �L���
� ��!� ɡP�� J�
u� U �� ��Dd �3& " 4�H
�3�~R ��=�b ����x ~t`~ 4 3 C 8 6 C 3 E 5 B 2 B 7 F 1 D D 0 4 4 3 A 6 D A 4 E 1 7 A A 9 5 D 6 5 F 5 6 E E 0 C 1 9 C F 4 F D 3 B 5 D 9 A 5 F 6 3 C 5 2 2 �"�U�T�u͝��C�o 0 9 �� N � HNet_Connection {047525BC-A893-436A-91E8-557852561637} Ethernet Instance 0 A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 �"�U�T�v͝��C�| �� Z � HNet_ConnectionProperties HNet_Connection.Guid="{047525BC-A893-436A-91E8-557852561637}" R O O T \ M i c r o s o f t \ H o m e N e t H N e t _ C o n n e c t i o n P r o p e r t i e s
C o n n e c t i o n � N S _ 5 1 1 6 2 6 F A E 4 F 5 7 D B D 2 0 D F 5 C D 4 4 A 4 1 D A E C E D 2 8 C F 7 B 3 F D 8 B 1 2 0 1 2 C 7 F 4 B 5 8 F 4 4 E 6 6 5 \ K I _ A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 \ I _ 5 A B E 0 A 3 C 0 3 A 4 B D C 6 C E 5 A C 2 2 6 1 4 4 B A 9 8 A B D 8 1 F C 1 9 0 5 8 9 D 6 1 F 4 F B 6 7 A 3 4 2 5 2 F 7 4 F D X 4 3 C 8 6 C 3 E 5 B 2 B 7 F 1 D D 0 4 4 3 A 6 D A 4 E 1 7 A A 9 5 D 6 5 F 5 6 E E 0 C 1 9 C F 4 F D 3 B 5 D 9 A 5 F 6 3 C 5 2 2 �"�U�T�u͝��C�f 0 9 �� E � HNet_Connection {D12DED2F-AEFC-4788-A733-FAA9E04B44C7} Ethernet 2 A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 �"�U�T�v͝��C�| �� Z � HNet_ConnectionProperties HNet_Connection.Guid="{D12DED2F-AEFC-4788-A733-FAA9E04B44C7}" R O O T \ M i c r o s o f t \ H o m e N e t H N e t _ C o n n e c t i o n P r o p e r t i e s
C o n n e c t i o n � N S _ 5 1 1 6 2 6 F A E 4 F 5 7 D B D 2 0 D F 5 C D 4 4 A 4 1 D A E C E D 2 8 C F 7 B 3 F D 8 B 1 2 0 1 2 C 7 F 4 B 5 8 F 4 4 E 6 6 5 \ K I _ A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 \ I _ 5 A 8 2 1 8 7 B A D F D 0 5 C B F 9 0 D D A D A B 6 2 8 3 3 2 B F 3 B 6 4 F E A B C 1 C 8 9 9 9 5 4 6 5 9 A 9 4 C F 1 2 8 C 8 1 ��4 3 C 8 6 C 3 E 5 B 2 B 7 F 1 D D 0 4 4 3 A 6 D A 4 E 1 7 A A 9 5 D 6 5 F 5 6 E E 0 C 1 9 C F 4 F D 3 B 5 D 9 A 5 F 6 3 C 5 2 2 �"�U�T�u͝��C�q 0 9 �� P � HNet_Connection {0A645F4E-68C0-4C76-B4A3-0921C9718BDD} Local Area Connection A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 �"�U�T�v͝��C�| �� Z � HNet_ConnectionProperties HNet_Connection.Guid="{0A645F4E-68C0-4C76-B4A3-0921C9718BDD}" R O O T \ M i c r o s o f t \ H o m e N e t H N e t _ C o n n e c t i o n P r o p e r t i e s
C o n n e c t i o n � N S _ 5 1 1 6 2 6 F A E 4 F 5 7 D B D 2 0 D F 5 C D 4 4 A 4 1 D A E C E D 2 8 C F 7 B 3 F D 8 B 1 2 0 1 2 C 7 F 4 B 5 8 F 4 4 E 6 6 5 \ K I _ A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 \ I _ 4 1 F 4 0 B 0 A E D 8 0 D A 6 4 6 B B 3 A 5 4 C 3 4 C B D A F 7 2 A D B 4 E 6 4 1 4 1 4 1 6 C 5 4 3 4 8 9 2 B 2 4 E B 7 F 4 2 9 ��4 3 C 8 6 C 3 E 5 B 2 B 7 F 1 D D 0 4 4 3 A 6 D A 4 E 1 7 A A 9 5 D 6 5 F 5 6 E E 0 C 1 9 C F 4 F D 3 B 5 D 9 A 5 F 6 3 C 5 2 2 �"�U�T�u͝��C�f 0 9 �� E � HNet_Connection {2DBE1C3C-12E7-4095-90AF-AC78BF10DD42} Ethernet 2 A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 �"�U�T�v͝��C�| �� Z � HNet_ConnectionProperties HNet_Connection.Guid="{2DBE1C3C-12E7-4095-90AF-AC78BF10DD42}" R O O T \ M i c r o s o f t \ H o m e N e t H N e t _ C o n n e c t i o n P r o p e r t i e s
C o n n e c t i o n � N S _ 5 1 1 6 2 6 F A E 4 F 5 7 D B D 2 0 D F 5 C D 4 4 A 4 1 D A E C E D 2 8 C F 7 B 3 F D 8 B 1 2 0 1 2 C 7 F 4 B 5 8 F 4 4 E 6 6 5 \ K I _ A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 \ I _ 6 3 1 0 7 F 0 6 1 0 D 2 0 6 9 9 8 9 5 2 C 3 8 8 A 6 8 4 3 8 6 1 6 0 A 4 D C D E F 3 7 F A 7 5 D A 7 E 7 E 7 9 4 B 0 0 5 E 0 3 5 9 A B 5 3 8 0 6 E 8 8 6 6 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0 �b��5� ͝��C�x �f3��5��� W � WMIBinaryMofResource C:\Windows\System32\drivers\en-US\ACPI.sys.mui[ACPIMOFResource] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �b��5�
͝��C�� �f3��5� ` � WDMClassesOfDriver ACPITrace C:\Windows\System32\drivers\en-US\ACPI.sys.mui[ACPIMOFResource] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4
�b��5�
͝��C�� # �f3��5� d � WDMClassesOfDriver AMLIEvalData1 C:\Windows\System32\drivers\en-US\ACPI.sys.mui[ACPIMOFResource] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �b��5�
͝��C�� . �f3��5� o � WDMClassesOfDriver AMLIEvalData1_TypeGroup1 C:\Windows\System32\drivers\en-US\ACPI.sys.mui[ACPIMOFResource] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ^�b��5�
͝��C�z " -e3 �5� W � WDMClassesOfDriver PortClsEvent C:\Windows\System32\Drivers\portcls.SYS[PortclsMof] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/pl\}�
͝��C�� ��
�S}� ] � WDMClassesOfDriver WMIEvent C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/pl\}�
͝��C�� $ ��
�S}� c � WDMClassesOfDriver MS_WmiInternal C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ͣn�^��
͝��C�v J.3�� S � WDMClassesOfDriver WMIEvent C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 Σn�^��
͝��C�| $ J.3�� Y � WDMClassesOfDriver MS_WmiInternal C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 9 A B 5 3 8 0 6 E 8 8 6 6 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0 (�n�^�� ͝��C�l �2��2�� K � WMIBinaryMofResource C:\Windows\System32\drivers\monitor.sys[MonitorWMI] is.sys.mui[MofResourceName] 9 A B 5 3 8 0 6 E 8 8 6 6 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0 (�n�^�� ͝��C�l �2��2�� K � WMIBinaryMofResource C:\Windows\System32\drivers\monitor.sys[MonitorWMI] [MofResourceName] 9 A B 5 3 8 0 6 E 8 8 6 6 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0 (�n�^�� ͝��C�l �2��2�� K � WMIBinaryMofResource C:\Windows\System32\drivers\monitor.sys[MonitorWMI] \Windows\system32\kernelbase.dll[MofResourceName] ame] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 Σn�^��
͝��C�| $ J.3�� Y � WDMClassesOfDriver MS_WmiInternal C:\Windows\system32\kernelbase.dll[MofResourceName] }J�M` � ���_ ���k �#!� � G�f� L-�� /�&� �QӪ
3��z� �L���
� ��!� ɡP�� J�
u� U �� ��Dd �3& " 4�H
�3�~R ��=�b ����x ~t`~ 4 3 C 8 6 C 3 E 5 B 2 B 7 F 1 D D 0 4 4 3 A 6 D A 4 E 1 7 A A 9 5 D 6 5 F 5 6 E E 0 C 1 9 C F 4 F D 3 B 5 D 9 A 5 F 6 3 C 5 2 2 �"�U�T�u͝��C�o 0 9 �� N � HNet_Connection {047525BC-A893-436A-91E8-557852561637} Ethernet Instance 0 A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 �"�U�T�v͝��C�| �� Z � HNet_ConnectionProperties HNet_Connection.Guid="{047525BC-A893-436A-91E8-557852561637}" R O O T \ M i c r o s o f t \ H o m e N e t H N e t _ C o n n e c t i o n P r o p e r t i e s
C o n n e c t i o n � N S _ 5 1 1 6 2 6 F A E 4 F 5 7 D B D 2 0 D F 5 C D 4 4 A 4 1 D A E C E D 2 8 C F 7 B 3 F D 8 B 1 2 0 1 2 C 7 F 4 B 5 8 F 4 4 E 6 6 5 \ K I _ A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 \ I _ 5 A B E 0 A 3 C 0 3 A 4 B D C 6 C E 5 A C 2 2 6 1 4 4 B A 9 8 A B D 8 1 F C 1 9 0 5 8 9 D 6 1 F 4 F B 6 7 A 3 4 2 5 2 F 7 4 F D X 4 3 C 8 6 C 3 E 5 B 2 B 7 F 1 D D 0 4 4 3 A 6 D A 4 E 1 7 A A 9 5 D 6 5 F 5 6 E E 0 C 1 9 C F 4 F D 3 B 5 D 9 A 5 F 6 3 C 5 2 2 �"�U�T�u͝��C�f 0 9 �� E � HNet_Connection {D12DED2F-AEFC-4788-A733-FAA9E04B44C7} Ethernet 2 A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 �"�U�T�v͝��C�| �� Z � HNet_ConnectionProperties HNet_Connection.Guid="{D12DED2F-AEFC-4788-A733-FAA9E04B44C7}" R O O T \ M i c r o s o f t \ H o m e N e t H N e t _ C o n n e c t i o n P r o p e r t i e s
C o n n e c t i o n � N S _ 5 1 1 6 2 6 F A E 4 F 5 7 D B D 2 0 D F 5 C D 4 4 A 4 1 D A E C E D 2 8 C F 7 B 3 F D 8 B 1 2 0 1 2 C 7 F 4 B 5 8 F 4 4 E 6 6 5 \ K I _ A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 \ I _ 5 A 8 2 1 8 7 B A D F D 0 5 C B F 9 0 D D A D A B 6 2 8 3 3 2 B F 3 B 6 4 F E A B C 1 C 8 9 9 9 5 4 6 5 9 A 9 4 C F 1 2 8 C 8 1 ��4 3 C 8 6 C 3 E 5 B 2 B 7 F 1 D D 0 4 4 3 A 6 D A 4 E 1 7 A A 9 5 D 6 5 F 5 6 E E 0 C 1 9 C F 4 F D 3 B 5 D 9 A 5 F 6 3 C 5 2 2 �"�U�T�u͝��C�q 0 9 �� P � HNet_Connection {0A645F4E-68C0-4C76-B4A3-0921C9718BDD} Local Area Connection A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 �"�U�T�v͝��C�| �� Z � HNet_ConnectionProperties HNet_Connection.Guid="{0A645F4E-68C0-4C76-B4A3-0921C9718BDD}" R O O T \ M i c r o s o f t \ H o m e N e t H N e t _ C o n n e c t i o n P r o p e r t i e s
C o n n e c t i o n � N S _ 5 1 1 6 2 6 F A E 4 F 5 7 D B D 2 0 D F 5 C D 4 4 A 4 1 D A E C E D 2 8 C F 7 B 3 F D 8 B 1 2 0 1 2 C 7 F 4 B 5 8 F 4 4 E 6 6 5 \ K I _ A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 \ I _ 4 1 F 4 0 B 0 A E D 8 0 D A 6 4 6 B B 3 A 5 4 C 3 4 C B D A F 7 2 A D B 4 E 6 4 1 4 1 4 1 6 C 5 4 3 4 8 9 2 B 2 4 E B 7 F 4 2 9 ��4 3 C 8 6 C 3 E 5 B 2 B 7 F 1 D D 0 4 4 3 A 6 D A 4 E 1 7 A A 9 5 D 6 5 F 5 6 E E 0 C 1 9 C F 4 F D 3 B 5 D 9 A 5 F 6 3 C 5 2 2 �"�U�T�u͝��C�f 0 9 �� E � HNet_Connection {2DBE1C3C-12E7-4095-90AF-AC78BF10DD42} Ethernet 2 A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 �"�U�T�v͝��C�| �� Z � HNet_ConnectionProperties HNet_Connection.Guid="{2DBE1C3C-12E7-4095-90AF-AC78BF10DD42}" R O O T \ M i c r o s o f t \ H o m e N e t H N e t _ C o n n e c t i o n P r o p e r t i e s
C o n n e c t i o n � N S _ 5 1 1 6 2 6 F A E 4 F 5 7 D B D 2 0 D F 5 C D 4 4 A 4 1 D A E C E D 2 8 C F 7 B 3 F D 8 B 1 2 0 1 2 C 7 F 4 B 5 8 F 4 4 E 6 6 5 \ K I _ A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 \ I _ 6 3 1 0 7 F 0 6 1 0 D 2 0 6 9 9 8 9 5 2 C 3 8 8 A 6 8 4 3 8 6 1 6 0 A 4 D C D E F 3 7 F A 7 5 D A 7 E 7 E 7 9 4 B 0 0 5 E 0 3 5 9 A B 5 3 8 0 6 E 8 8 6 6 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0 �b��5� ͝��C�x �f3��5��� W � WMIBinaryMofResource C:\Windows\System32\drivers\en-US\ACPI.sys.mui[ACPIMOFResource] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �b��5�
͝��C�� �f3��5� ` � WDMClassesOfDriver ACPITrace C:\Windows\System32\drivers\en-US\ACPI.sys.mui[ACPIMOFResource] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4
�b��5�
͝��C�� # �f3��5� d � WDMClassesOfDriver AMLIEvalData1 C:\Windows\System32\drivers\en-US\ACPI.sys.mui[ACPIMOFResource] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �b��5�
͝��C�� . �f3��5� o � WDMClassesOfDriver AMLIEvalData1_TypeGroup1 C:\Windows\System32\drivers\en-US\ACPI.sys.mui[ACPIMOFResource] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ^�b��5�
͝��C�z " -e3 �5� W � WDMClassesOfDriver PortClsEvent C:\Windows\System32\Drivers\portcls.SYS[PortclsMof] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/pl\}�
͝��C�� ��
�S}� ] � WDMClassesOfDriver WMIEvent C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/pl\}�
͝��C�� $ ��
�S}� c � WDMClassesOfDriver MS_WmiInternal C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ͣn�^��
͝��C�v J.3�� S � WDMClassesOfDriver WMIEvent C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 Σn�^��
͝��C�| $ J.3�� Y � WDMClassesOfDriver MS_WmiInternal C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 9 A B 5 3 8 0 6 E 8 8 6 6 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0 �n�^�� ͝��C�l �2��2�� K � WMIBinaryMofResource C:\Windows\System32\drivers\monitor.sys[MonitorWMI] is.sys.mui[MofResourceName] 9 A B 5 3 8 0 6 E 8 8 6 6 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0 �n�^�� ͝��C�l �2��2�� K � WMIBinaryMofResource C:\Windows\System32\drivers\monitor.sys[MonitorWMI] [MofResourceName] 9 A B 5 3 8 0 6 E 8 8 6 6 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0 �n�^�� ͝��C�l �2��2�� K � WMIBinaryMofResource C:\Windows\System32\drivers\monitor.sys[MonitorWMI] \Windows\system32\kernelbase.dll[MofResourceName] ame] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 Σn�^��
͝��C�| $ J.3�� Y � WDMClassesOfDriver MS_WmiInternal C:\Windows\system32\kernelbase.dll[MofResourceName] �:Ͼlu�U + 6 � �� � " , : = J
N [ � � 2 > { � � � D O � � � � UU������������������������������������������ � MSFT_SmbClientCertificateMapping smbwmiv2 ClassVersion 7 Description 69 DisplayName
� � � �� string Flags A
� � � � � �� � �� uint32 ValueMap 0 1 2 Values & * . 18 67 65 IssuerName '
� s � �� � �� string MappingStatus $
� � � �� uint32 Namespace '
� � � �� � �� string RenewalChain
� < � �� string StoreName '
� � � �� � �� string Subject
� � � �� string Thumbprint '
� � �� � �� string Type 6
� Z b l w � �� uint32 ValueMap t 0 Values � 61 � L � � 4 7 x � AddClientCertificateMapping 7 ��D �� implemented static W WIN-F6NF7R6I6PJ ROOT\Microsoft\Windows\Smb ���� � ��
" �� � d z � D * � � � � H � j � UU��������������������������������� � __PARAMETERS abstract Namespace string
� 5 In
� 5 \ �� ID )
� � \ ��� string IssuerName string
� � In
� � �� ID )
� { ��@ string Subject string
� � In
� � � �� ID )
� . � ��� string Thumbprint string
� T In
� T { �� ID )
� � { ��� string DisplayName string
� In
� 2 �� ID )
� � 2 ��` string StoreName string
� � In
� � � �� ID )
� P � �� string Type uint32
� p In
� p � �� ID )
� � ��� uint32 Flags uint32
� ! In
� ! H �� ID )
� � H ��v uint32 __ �= WIN-F6NF7R6I6PJ ROOT\Microsoft\Windows\Smb ���� � �� �� * � ~ � ��������� � __PARAMETERS abstract
CreatedMapping object
� : Out
� : a �� MSFT_SmbClientCertificateMapping EmbeddedInstance
)
� : a ��� � ID
6
� C a ��� � � object:MSFT_SmbClientCertificateMapping ReturnValue uint32
� � uint32 out
� � � �� __ � SetClientCertificateMapping ��, �� implemented static � WIN-F6NF7R6I6PJ ROOT\Microsoft\Windows\Smb ���� � �� �� ` � D * � K � � � U���������������������� � __PARAMETERS abstract Namespace string
� 5 In
� 5 \ �� ID )
� � \ ��� string IssuerName string
� � In
� � �� ID )
� { ��@ string Thumbprint string
� � In
� � � �� ID )
� 1 � ��� string StoreName string
� V In
� V } �� ID )
� � } ��� string Flags uint32
� In
� . �� ID )
� � . ��\ uint32 __ �= WIN-F6NF7R6I6PJ ROOT\Microsoft\Windows\Smb ���� � �� �� * � ~ � ��������� � __PARAMETERS abstract
CreatedMapping object
� : Out
� : a �� MSFT_SmbClientCertificateMapping EmbeddedInstance
)
� : a ��� � ID
6
� C a ��� � � object:MSFT_SmbClientCertificateMapping ReturnValue uint32
� � uint32 out
� � � �� __ � � }� խ � C I M _ L o g i c a l E l e m e n t �ȝ��C� @ CIM_LogicalElement ) �� ' - U b � M a �
� � > D � � U c � � P f � � � � WUU������������������������������������������������������������% � CIM_SoftwareElement abstract Locale UUID {8502C561-5FBB-11D2-AAC1-006008C78BC7} BuildNumber ( 6
� � � ��� @ � � string Maxlen Mappingstrings � MIF.DMTF|Software Component Information|002.4 CodeSet
0 )
� = � ��E @ string Maxlen IdentificationCode 4 6
� � � ��� @ � � string Maxlen Mappingstrings � MIF.DMTF|Software Component Information|002.7 LanguageEdition 8 6
� Q � ��Y a q string Maxlen Mappingstrings y MIF.DMTF|Software Component Information|002.6 Manufacturer
$ 6
� � � ��
string Maxlen Mappingstrings " MIF.DMTF|ComponentID|001.1 Name @ A
� � � �� � ��� � � string maxlen override Name OtherTargetOS 6
� � �� @ + string Maxlen ModelCorrespondence CIM_OperatingSystem.OtherTypeDescription SerialNumber , 6
� � � ��� @ � � string Maxlen Mappingstrings � MIF.DMTF|ComponentID|001.4 SoftwareElementID 4
� @ � �� � ��H string maxlen SoftwareElementState '
� � � �� � �� uint16 TargetOperatingSystem A
� � �� � �� ! X m uint16 Mappingstrings ) MIF.DMTF|Software Component Information|002.5 ModelCorrespondence CIM_OperatingSystem.OSType Version A
� � � �� � ��� @ � string Maxlen Mappingstrings MIF.DMTF|ComponentID|001.3 � C I M _ S o f t w a r e E l e m e n t �ȝ��C�� C CIM_SoftwareElement ) �� # ) Q _ � x � ������������������������������������������������������������������ � CIM_BIOSElement abstract Locale UUID {8502C562-5FBB-11D2-AAC1-006008C78BC7} Manufacturer @
$ 6
� � � ��� � � � string Mappingstrings � MIF.DMTF|System BIOS|001.2 Override Manufacturer PrimaryBIOS < )
� ; � ��D T boolean MappingStrings \ MIF.DMTF|System BIOS|001.9 Version @ 6
� � � ��� � string Mappingstrings � MIF.DMTF|System BIOS|001.3 Override Version � C I M _ L o g i c a l E l e m e n t �ȝ��C� 8 CIM_LogicalElement ) �� ! I V � � � � : D v � � � � �WU�����������������������������������������������������7 � CIM_Job Abstract Locale UUID {8502C564-5FBB-11D2-AAC1-006008C78BC7} ElapsedTime e
� � � �� datetime JobStatus
(
� � � �� string Notify
� � � �� string Owner
� 2 � �� string Priority
� n � �� uint32 StartTime e $
� � � �� datetime TimeSubmitted e ,
� � � �� datetime UntilTime e 0
� - � �� datetime � C I M _ L o g i c a l E l e m e n t �ȝ��C� � CIM_LogicalElement ) �� ' - U h � � r z J W � � � � f y � � � � � � H ^ � � � � . A � � [ c � � � � # 7 i � � � �
WUUUU��������������������������������������������������������������������������������������������������������������������������������������~
� CIM_OperatingSystem Abstract Locale UUID {8502C565-5FBB-11D2-AAC1-006008C78BC7} CreationClassName 4
� � � �� � ��� string CIM_Key MaxLen CSCreationClassName A
� ' / ; a �� � ��j string Propagated CIM_ComputerSystem.CreationClassName CIM_Key MaxLen CSName A
� � � � � �� � ��� string Propagated CIM_ComputerSystem.Name CIM_Key MaxLen CurrentTimeZone H
� B � �� sint16 Distributed
� � � �� boolean FreePhysicalMemory "
� � � �� uint64 FreeSpaceInPagingFiles R )
� � ��' 7 uint64 MappingStrings ? MIF.DMTF|System Memory Settings|001.4 FreeVirtualMemory
*
� � � �� uint64 LastBootUpTime e Z
� � � �� datetime LocalDateTime e D )
� 5 � ��? O datetime MappingStrings [ � MIB.IETF|HOST-RESOURCES-MIB.hrSystemDate MIF.DMTF|General Information|001.6 MaxNumberOfProcesses ^ )
� � � � �� uint32 MappingStrings MIB.IETF|HOST-RESOURCES-MIB.hrSystemMaxProcesses MaxProcessMemorySize 2
� � � �� uint64 Name @ )
� � � ��� � string Override Name NumberOfLicensedUsers b
� & � �� uint32 NumberOfProcesses f )
� x � � � �� uint32 MappingStrings � MIB.IETF|HOST-RESOURCES-MIB.hrSystemProcesses NumberOfUsers j )
�
% � �� uint32 MappingStrings - MIB.IETF|HOST-RESOURCES-MIB.hrSystemNumUsers OSType : )
� � � ��� � uint16 ModelCorrespondence � CIM_OperatingSystem.OtherTypeDescription OtherTypeDescription
< 6
� C � ��K @ S h string MaxLen ModelCorrespondence p CIM_OperatingSystem.OSType SizeStoredInPagingFiles J )
� � � ��� � uint64 MappingStrings � MIF.DMTF|System Memory Settings|001.3 TotalSwapSpaceSize n
� a � �� uint64 TotalVirtualMemorySize v
� � � �� uint64 TotalVisibleMemorySize ~
� � � �� uint64 Version @ )
� =
� ��E
U
string MappingStrings ]
MIF.DMTF|Operating System|001.3 X � � � � � Reboot y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � Shutdown y ae442007200009F ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � W i n 3 2 _ P n P D e v i c e P r o p e r t y �ɝ��C�� ! Win32_PnPDeviceProperty % ��������������������������W � Win32_PnPDevicePropertyUint64 Data
� O � �� Uint64 � � # 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � \ b � MSFT_CliProperty Name The Name property defines the label by which the object is known. Name � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � ( � � MSFT_CliProperty OtherIdentifyingInfo OtherIdentifyingInfo captures additional data, beyond asset tag information, that could be used to identify a physical element. One example is bar code data associated with an element that also has an asset tag. OtherIdentifyingInfo 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � � � MSFT_CliProperty PartNumber The part number assigned by the organization responsible for producing or manufacturing the physical element. PartNumber � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ( � MSFT_CliQualifier MaxLen # 256 J 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � ~ � � MSFT_CliProperty PoweredOn Boolean indicating that the physical element is powered on (TRUE), or is currently off (FALSE). PoweredOn = 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � s | � MSFT_CliProperty Product The Product property indicates the base board part number defined by the manufacturer. Product � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier l � � � � MSFT_CliProperty Removable A physical package is removable if it is designed to be taken in and out of the physical container in which it is normally found, without impairing the function of the overall packaging. Removable m 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier 3 � � � � MSFT_CliProperty Replaceable A physical package is replaceable if it is possible to replace (FRU or upgrade) the element with a physically different one. Replaceable j 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier 0 � + � � � MSFT_CliProperty RequirementsDescription A free-form string describing the way(s) in which this card is physically unique from other cards. RequirementsDescription r 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier 8 � ) � � � MSFT_CliProperty RequiresDaughterBoard Boolean indicating that at least one daughterboard or auxiliary card is required in order to function properly. RequiresDaughterBoard � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � g u � � MSFT_CliProperty SerialNumber A manufacturer-allocated number used to identify the physicalelement. SerialNumber } � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 64 ~ 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier D Q V y � MSFT_CliProperty SKU The stock keeping unit number for this physical element. SKU ^ � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 64 � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier i � � � � MSFT_CliProperty SlotLayout SlotLayout is a free-form string that describes the slot positioning, typical usage, restrictions, individual slot spacing or any other pertinent information for the slots on a card. SlotLayout 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier E � ' � � � MSFT_CliProperty SpecialRequirements Boolean indicating that this card is physically unique from other cards of the same type and therefore requires a special slot. SpecialRequirements � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � h p � � MSFT_CliProperty Status The Status property is a string indicating the current status of the object. Status � � . � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 10 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap A E L V _ j t ~ OK Error Degraded Unknown Pred Fail Starting Stopping Service � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values ? C J T ] h r | OK Error Degraded Unknown Pred Fail Starting Stopping Service � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier X [ ` � � MSFT_CliProperty Tag The Tag property uniquely identifies the base board of the system. Tag h � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ( � MSFT_CliQualifier MaxLen # 256 � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier T U ^ � � MSFT_CliProperty Version A string indicating the version of the physical element. Version f � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 64 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � I Q � MSFT_CliProperty Weight The weight of the physical package in pounds. Weight 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � G N � MSFT_CliProperty Width The width of the physical package in inches. Width �&�d� � �cF�2
f �5�� � ��*�N l �r� ` �M`� o �#�ĉ c ( X e S q l P k g _ b r o k e r _ t r a n s m i t t e r _ s e r v i c e _ s e n d �Q��7 �J W 2 XeSqlPkg_broker_transmitter_service_send * ) � ��! , : F � � B Q � � % o z � � c s � � , v � � R c � � \ h � � X i WUUU������������������������������������������������������������������������������������ � broker_transmitter_service_send EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid asb_id % )
� / 7 � �� uint64 WmiDataId connection_id
F 6
� � � � ��� � object:guid WmiDataId Extension Guid database_id - )
�
� �� uint32 WmiDataId destination_id )
� \ d � �� uint64 WmiDataId dialog_id
B 6
� � � � ��� � object:guid WmiDataId Extension Guid FragmentId 6
� 7 ? J W � �� uint32 WmiDataId Description FragmentId initiator_flag $ )
� � � � �� sint8 WmiDataId is_sequenced
A )
�
� �� sint8 WmiDataId message_fragment_number = )
� c k � �� sint32 WmiDataId message_reference_address
1 4
� � �
� ��� �� object WmiDataId Pointer message_sequence_number 5 )
� ? G � �� uint64 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� , 4 ? L � �� uint32 WmiDataId Description SequenceNumber service_id )
� � � � �� uint64 WmiDataId to_broker_instance N C
� � ��* = M U string WmiDataId StringTermination NullTerminated Format w to_service_name J C
� � � � ��� � � � string WmiDataId StringTermination NullTerminated Format w � X e S q l P k g �Q��7 �> XeSqlPkg
C � ��- : ^ d � � � � c����� � XeSqlPkg_broker_transmitter_dialog_register Description Broker transmitter dialog register Guid {19C2F627-7211-40b3-BD08-453B3DAF00C8} locale MS\0x409 DisplayName broker_transmitter_dialog_register �+ X e S q l P k g _ b r o k e r _ t r a n s m i t t e r _ d i a l o g _ r e g i s t e r �Q��7 �H , 5 XeSqlPkg_broker_transmitter_dialog_register - ) � ��$ / = I � � k w � � @ Q � � ( � � � WU������������������������������������������a � broker_transmitter_dialog_register EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid dialog_id
% 6
� B O � ��Z e object:guid WmiDataId Extension Guid FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId initiator_flag )
� . 5 � �� sint8 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength result ! )
�
� �� sint32 WmiDataId SequenceNumber 6
� l t � � �� uint32 WmiDataId Description SequenceNumber service_id )
� � � � �� uint64 WmiDataId session_address
4
� E M � ��X �� object WmiDataId Pointer � X e S q l P k g �Q��7 �D XeSqlPkg
C � ��/ < b h � � � � c����� � XeSqlPkg_broker_transmitter_dialog_unregister Description Broker transmitter dialog unregister Guid {1AC2F627-7211-40b3-BD08-453B3DAF00C8} locale MS\0x409 DisplayName broker_transmitter_dialog_unregister �- X e S q l P k g _ b r o k e r _ t r a n s m i t t e r _ d i a l o g _ u n r e g i s t e r �Q��7 �� ( 7 XeSqlPkg_broker_transmitter_dialog_unregister / ) � ��& 1 ? K � m y � � B S � � L X � � WU�������������������������������������� � broker_transmitter_dialog_unregister EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid dialog_id
! 6
� D Q � ��\ g object:guid WmiDataId Extension Guid FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId initiator_flag )
� 0 7 � �� sint8 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� $ / < � �� uint32 WmiDataId Description SequenceNumber service_id )
� � � � �� uint64 WmiDataId session_address
4
� � � � �� �� object WmiDataId Pointer � X e S q l P k g �Q��7 �G XeSqlPkg
C � ��0 = d j � � � � c����� � XeSqlPkg_broker_transmitter_service_reclassify Description Broker transmitter service reclassify Guid {1BC2F627-7211-40b3-BD08-453B3DAF00C8} locale MS\0x409 DisplayName broker_transmitter_service_reclassify �. X e S q l P k g _ b r o k e r _ t r a n s m i t t e r _ s e r v i c e _ r e c l a s s i f y �Q��7 �� & 8 XeSqlPkg_broker_transmitter_service_reclassify 0 ) � ��' 2 @ L � r � � | � � � x � WU������������������������������������ � broker_transmitter_service_reclassify EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid FragmentId 6
� F N Y f � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� L T _ l � �� uint32 WmiDataId Description SequenceNumber service_id )
� � � � �� uint64 WmiDataId to_broker_instance C
� 7 ? � ��J ] m u string WmiDataId StringTermination NullTerminated Format w to_service_name C
� � � � ��� string WmiDataId StringTermination NullTerminated Format w � w �9 A B 5 3 8 0 6 E 8 8 6 6 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0 �M�8P�� ͝��C�n ��S3Ku� M � WMIBinaryMofResource C:\Windows\system32\drivers\ndis.sys[MofResourceName] )
� �I �I ���I Q string R � SharedSignaturesPath string R �
� J In R �
� J CJ �� ID R � )
� �J CJ ��qJ R string S � SharedSignaturesPathUpdateAtScheduledTimeOnly boolean S �
� �J In S �
� �J K �� ID S � )
� �K K ��KK S boolean T � EnableLowCpuPriority boolean T �
� �K In T �
� �K �K �� ID T � )
� HL �K ��
L T boolean U � EnableFileHashComputation boolean U �
� ~L In U �
� ~L �L �� ID U � )
� M �L ���L U boolean V � MeteredConnectionUpdates boolean V �
� DM In V �
� DM lM �� ID V � )
� �M lM ���M V boolean W � AllowNetworkProtectionOnWinServer boolean W �
� N In W �
� N ;N �� ID W � )
� �N ;N ��iN W boolean X � DisableDatagramProcessing boolean X �
� �N In X �
� �N O �� ID X � )
� kO O ��0O X boolean Y � EnableConvertWarnToBlock boolean Y �
� �O In Y �
� �O �O �� ID Y � )
� 1P �O ���O Y boolean Z � DisableCpuThrottleOnIdleScans boolean Z �
� kP In Z �
� kP �P �� ID Z � )
� �P �P ���P Z boolean [ � EnableFullScanOnBatteryPower boolean [ �
� 5Q In [ �
� 5Q ]Q �� ID [ � )
� �Q ]Q ���Q [ boolean \ � ProxyPacUrl string \ �
� �Q In \ �
� �Q R �� ID \ � )
� ~R R ��CR \ string ] � ProxyServer string ] �
� �R In ] �
� �R �R �� ID ] � )
� 5S �R ���R ] string ^ � ProxyBypass string ^ �
� \S In ^ �
� \S �S �� ID ^ � )
� �S �S ���S ^ string _ � ForceUseProxyOnly boolean _ �
� T In _ �
� T AT �� ID _ � )
� �T AT ��oT _ boolean ` � DisableTlsParsing boolean ` �
� �T In ` �
� �T U �� ID ` � )
� iU U ��.U ` boolean a � DisableHttpParsing boolean a �
� �U In a �
� �U �U �� ID a � )
� )V �U ���U a boolean b � DisableDnsParsing boolean b �
� WV In b �
� WV V �� ID b � )
� �V V ���V b boolean c � DisableDnsOverTcpParsing boolean c �
� W In c �
� W EW �� ID c � )
� �W EW ��sW c boolean d DisableSshParsing boolean d
� �W In d
� �W X �� ID d )
� mX X ��2X d boolean e PlatformUpdatesChannel uint8 e
� �X In e
� �X �X �� Y Y Y Y Y Y 0 2 3 4 5 6 ValueMap e )
� �X �X ��"Y �X ID e 6
� �Y �X ��"Y �X cY e uint8 f EngineUpdatesChannel uint8 f
� �Y In f
� �Y Z �� JZ MZ PZ SZ VZ YZ 0 2 3 4 5 6 ValueMap f )
� �Y Z ��\Z .Z ID f 6
� �Z Z ��\Z .Z �Z f uint8 g DefinitionUpdatesChannel uint8 g
� [ In g
� [ >[ �� |[ [ �[ 0 4 5 ValueMap g )
� [ >[ ���[ l[ ID g 6
� \ >[ ���[ l[ �[ g uint8 h DisableGradualRelease boolean h
� >\ In h
� >\ f\ �� ID h )
� �\ f\ ���\ h boolean i AllowNetworkProtectionDownLevel boolean i
� ] In i
� ] 3] �� ID i )
� �] 3] ��a] i boolean j
AllowDatagramProcessingOnWinServer boolean j
� �] In j
� �] ^ �� ID j
)
� l^ ^ ��1^ j boolean k EnableDnsSinkhole boolean k
� �^ In k
� �^ �^ �� ID k )
� +_ �^ ���^ k boolean l DisableInboundConnectionFiltering boolean l
� i_ In l
� i_ �_ �� ID l )
� �_ �_ ���_ l boolean m DisableRdpParsing boolean m
� (` In m
� (` P` �� ID m )
� �` P` ��~` m boolean n DisableNetworkProtectionPerfTelemetry boolean n
� �` In n
� �` #a �� ID n )
� �a #a ��Qa n boolean o TrustLabelProtectionStatus uint32 o
� �a In o
� �a �a �� ID o )
� Sb �a ��b o uint32 p DisableFtpParsing boolean p
� �b In p
� �b �b �� ID p )
� c �b ���b p boolean q AllowSwitchToAsyncInspection boolean q
� Jc In q
� Jc rc �� ID q )
� �c rc ���c q boolean r ScanScheduleOffset uint32 r
�
d In r
�
d 1d �� ID r )
� �d 1d ��_d r uint32 s DisableTDTFeature boolean s
� �d In s
� �d �d �� ID s )
� Xe �d �� e s boolean t " DisableTamperProtection boolean t "
� �e In t "
� �e �e �� ID t " )
� f �e ���e t boolean u $ DisableSmtpParsing boolean u $
� Lf In u $
� Lf tf �� ID u $ )
� �f tf ���f u boolean v & DisableQuicParsing boolean v &
� g In v &
� g 4g �� ID v & )
� �g 4g ��bg v boolean w ( NetworkProtectionReputationMode uint32 w (
� �g In w (
� �g h �� ID w ( )
� ih h ��.h w uint32 x , IntelTDTEnabled boolean x ,
� �h In x ,
� �h �h �� ID x , )
� %i �h ���h x boolean y . AttackSurfaceReductionRules_RuleSpecificExclusions_Id string y .
� wi In y .
� wi � .� �֝��C�� � 6 � �� � ' 5 8 E 1 I Z � � � � 7 U � � � � 6 G � � � � ' ; y � � = \ � � � C R � � � � / H � � � � * 9 w � � � - j x � � T a � � �
E
S
�
�
�
�
/ @ } � � � 0 D � � � � 8
F
�
�
�
�
; x � � � ( < z � � � UUUUUUUUUUUU�������������������������������������������������������������������������������������������������������������������������������������������( � MSFT_SmbServerConfiguration smbwmiv2 ClassVersion 7 Description 34 AnnounceComment '
� � � �� � �� string AnnounceServer '
� � � �� � �� boolean AsynchronousCredits '
� / � �� � �� uint32 AuditClientCertificateAccess 0 � '
� � � �� � �� boolean AuditSmb1Access + | '
� � � �� � �� boolean AutoDisconnectTimeout
'
� . � �� � �� uint32 AutoShareServer '
� | � �� � �� boolean AutoShareWorkstation '
� � � �� � �� boolean CachedOpenLimit
'
� � �� � �� uint32 DisableCompression '
� p � �� � �� boolean DisableSmbEncryptionOnSecureConnection , ~ '
� � � �� � �� boolean DurableHandleV2TimeoutInSeconds '
� 5 � �� � �� uint32 EnableAuthenticateUserSharing
$ '
� � � �� � �� boolean EnableDownlevelTimewarp '
� � � �� � �� boolean EnableForcedLogoff & '
� : � �� � �� boolean EnableLeasing '
� � � �� � �� boolean EnableMultiChannel '
� � � �� � �� boolean EnableOplocks ( '
� & � �� � �� boolean EnableSecuritySignature * '
� } � �� � �� boolean EnableSMB1Protocol ^ '
� � � �� � �� boolean EnableSMB2Protocol ` '
� ! � �� � �� boolean EnableSMBQUIC . � '
� n � �� � �� boolean EnableStrictNameChecking '
� � � �� � �� boolean EncryptData ) x '
� � �� � �� boolean EncryptionCiphers / � '
� b � �� � �� string IrpStackSize . '
� � � �� � �� uint32 KeepAliveTime 2 '
� � � �� � �� uint32 MaxChannelPerSession 6 '
� L � �� � �� uint32 MaxMpxCount : '
� � � �� � �� uint32 MaxSessionPerConnection > '
� � � �� � �� uint32 MaxThreadsPerQueue B '
� =
� �� � �� uint32 MaxWorkItems F '
� �
� �� � �� uint32 NullSessionPipes J '
� �
� �� � �� string NullSessionShares N '
� ' � �� � �� string OplockBreakWait R '
� u � �� � �� uint32 PendingClientTimeoutInSeconds V '
� � � �� � �� uint32 RejectUnencryptedAccess * z '
� ' � �� � �� boolean RequestCompression Z '
� y � �� � �� boolean RequireSecuritySignature \ '
� � � �� � �� boolean RestrictNamedpipeAccessViaQuic - � '
� /
� �� � �� boolean ServerHidden , '
� {
� �� � �� boolean Smb2CreditsMax ! b '
� �
� �� � �� uint32 Smb2CreditsMin " f '
� � �� � �� uint32 SmbServerNameHardeningLevel # j '
� p � �� � �� uint32 TreatHostAsStableStorage $ n '
� � � �� � �� boolean ValidateAliasNotCircular % p '
� � �� � �� boolean ValidateShareScope & r '
� q � �� � �� boolean ValidateShareScopeNotAliased ' t '
� � � �� � �� boolean ValidateTargetName ( v '
� � �� � �� boolean �� A E b v � �F �J �J &K �� 8� � GetConfiguration , ��9 �� implemented static WIN-F6NF7R6I6PJ ROOT\Microsoft\Windows\Smb ���� � �� �� * � l � ��������� � __PARAMETERS abstract
Output object
� 2 Out
� 2 Y �� MSFT_SmbServerConfiguration EmbeddedInstance
)
� 2 Y ��� � ID
6
� 6 Y ��� � � object:MSFT_SmbServerConfiguration ReturnValue uint32
� � uint32 out
� � � �� __ � ResetConfiguration � ��� �� implemented static B WIN-F6NF7R6I6PJ ROOT\Microsoft\Windows\Smb ���� � ��A a ��+ * � � � � E � � 3 $ � X � � � B W � � c � Q � � ? � M
� = A � � �
� i Y � | � >
�
�
I � | � 6 � � G � } _ � � # u � �
� � K � ~ � D �
\ � � � T UUUUUUUUUU��������������������������������������������������������������������������������������s � __PARAMETERS abstract All boolean
� / In
� / W �� ID )
� � W ��� boolean AnnounceServer boolean
� � In
� � �� ID )
� | ��A boolean AsynchronousCredits boolean
� � In
� � � �� ID )
� = � �� boolean AutoShareServer boolean
� i In
� i � �� ID )
� � � ��� boolean AutoShareWorkstation boolean
� + In
� + S �� ID )
� � S ��� boolean
CachedOpenLimit boolean
� � In
� � �� ID
)
� y ��> boolean AnnounceComment boolean
� � In
� � � �� ID )
� 6 � ��� boolean EnableDownlevelTimewarp boolean
� j In
� j � �� ID )
� � � ��� boolean �Ț�` � Z>OS� � '�_x� � Aj�"+ � ����� �
C I M _ S A R u l e xR|�C�l CIM_SARule ) � ��� � � � � � g z � � C R � � s ~ � � �
�
� � ' 1 � � w � # + � � �����UUU����������������������������������������������������������������������������������������������������������������������# � MSFT_NetSARule Description Represents an IPsec Rule. Subtypes differentiate between Connection Security Rules (MSFT_NetConSecRule) and Main Mode Rules (MSFT_NetMainModeRule). AMENDMENT LOCALE MS_409 DisplayGroup L
� string Description The group that this rule belongs to. This field is based on the value of RuleGroup and changes to this field are ignored. DisplayName H
� � � � string Description The localized name of this rule. This field's value is based on the value of ElementName. Changes to this field are ignored. EnforcementStatus l +
� � � � 1 9 uint16 Description If this object is retrieved from the ActiveStore, describes the current enforcement status of the rule. Values � � � � � � �
+ E ` z � � � � < O ] m � � Invalid Full FirewallOffInProfile CategoryOff DisabledObject InactiveProfile LocalAddressResolutionEmpty RemoteAddressResolutionEmpty LocalPortResolutionEmpty RemotePortResolutionEmpty InterfaceResolutionEmpty ApplicationResolutionEmpty RemoteMachineEmpty RemoteUserEmpty LocalGlobalOpenPortsDisallowed LocalAuthorizedApplicationsDisallowed LocalFirewallRulesDisallowed LocalConsecRulesDisallowed NotTargetPlatform OptimizedOut LocalUserEmpty TransportMachinesEmpty TunnelMachinesEmpty TupleResolutionEmpty MainModeCryptoSet R
� � � string Description The InstanceID of the MainModeCryptoSet to use for Main Mode. Phase1AuthSet Z
� ~ � � string Description The InstanceID of the Phase1AuthenticationSet to use for Phase 1 auth. Phase2AuthSet ^
� + string Description The InstanceID of the Phase2AuthenticationSet to use for Phase 2 auth. Platforms @
� � � � string Description Specifies which platforms the rule is applicable on. If null, the rule applies to all platforms (the default). Each entry takes the form Major.Minor+, for instance 6.0, 6.1+, or 6.2. If + is specified, then it means that the rule applies to that version or greater. For instance, Windows Vista could be represented as 6 or 6.0, and Windows 7 or later would be represented as 6.1+. + may only be attached to the final item in the list. 6.0+ is not valid because it means the same thing as null (all platforms). PolicyStoreSource " r
�
string Description If this object is retrieved from the ActiveStore, with the TracePolicyStoreSource option set, contains the path to the PolicyStore where this rule originally came from. PolicyStoreSourceType ! p
�
uint16 Description If this object is retrieved from the ActiveStore, with the TracePolicyStoreSource option set, describes the type of PolicyStore where this rule originally came from. PrimaryStatus b +
� � � uint16 Description PrimaryStatus provides a high level status value, intended to align with Red-Yellow-Green type representation of status. It should be used in conjunction with DetailedStatus to provide high level and detailed health status of the ManagedElement and its subcomponents.
PrimaryStatus consists of one of the following values: Unknown, OK, Degraded or Error. "Unknown" indicates the implementation is in general capable of returning this property, but is unable to do so at this time.
"OK" indicates the ManagedElement is functioning normally.
"Degraded" indicates the ManagedElement is functioning below normal.
"Error" indicates the ManagedElement is in an Error condition.
Values � � � Unknown OK Degraded Error DMTF Reserved Vendor Reserved Profiles P +
� j r � � uint16 Description Which profiles this rule is active on. Values � � � � Any Public Private Domain QuickModeCryptoSet V
� ! ) 6 string Description The InstanceID of the QuickModeCryptoSet to use for Quick Mode. RuleGroup D
� � � � string Description The locale-independent name for the group that this rule belongs to. If this field is non-null, then Windows Defender Firewall with Advanced Security assumes that this rule belongs to a Windows component or an installed application, and some parts of the rule are protected (including but not limited to the Name, Description, Program, and Service). Status h
� W _ l string Description The detailed status of the rule, as a string. StatusCode d
� � � � uint32 Description The detailed status of the rule, as a numeric error code. � C I M _ P o l i c y A c t i o n I n P o l i c y R u l e xR|�C�< & CIM_PolicyActionInPolicyRule ) ' Y ��d l t � � � D S ����������� � MSFT_NetSAActionInSARule Description Links an IPsec rule to its auth and crypto sets. AMENDMENT LOCALE MS_409 ActionOrder @
� � � � uint16 Description This field is ignored. GroupComponent f@
� & 3 ref:CIM_SARule Description The IPsec rule. PartComponent f@
� � � ref:CIM_SAAction Description The auth/crypto sets. � M S F T _ N e t S A A c t i o n I n S A R u l e xR|�C�_ " MSFT_NetSAActionInSARule ) # ] ��h p x � � � H W ����������� � MSFT_NetSARuleEMAuth Description Relates an IPsec rule to its Phase 2 Authentication Set. AMENDMENT LOCALE MS_409 ActionOrder @
� � � � uint16 Description This field is ignored. GroupComponent f@
� * 7 ref:CIM_SARule Description The IPsec rule. PartComponent f@
� � � � ref:MSFT_NetIKEP2AuthSet Description The Phase 2 Authentication Set used by the rule. � M S F T _ N e t S A R u l e E M A u t h xR|�C�� MSFT_NetSARuleEMAuth ) * q ��| � � � � r � ���������� � MSFT_NetConSecRuleEMAuthSet Description Relates a connection security rule to its Phase 2 Authentication Set. AMENDMENT LOCALE MS_409 ActionOrder @
� � � � uint16 Description This field is ignored. GroupComponent f@
� . F S ref:MSFT_NetConSecRule Description The connection security rule. PartComponent f@
� � � � ref:MSFT_NetIKEP2AuthSet Description The Phase 2 Authentication Set used by the rule. �
C I M _ C o m p o n e n t xR|�C�� CIM_Component ) ( R ��] e m } � � ��������] � MSFT_NetPolicyRuleFilters Description Associates a policy rule to its filters. AMENDMENT LOCALE MS_409 GroupComponent f@
� � � � ref:CIM_PolicyRule Description The rule. PartComponent f@
� ) 6 ref:CIM_FilterEntryBase Description The filters associated with the rule. �le. �9 A B 5 3 8 0 6 E 8 8 6 6 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0 _JV�� ͝��C�l d�J�� K � WMIBinaryMofResource C:\Windows\System32\drivers\monitor.sys[MonitorWMI] ame] i �� ID y . )
� j �i ���i y string z 2 AttackSurfaceReductionRules_RuleSpecificExclusions string z 2
� Uj In z 2
� Uj |j �� ID z 2 )
� �j |j ���j z string { 6 OobeEnableRtpAndSigUpdate boolean { 6
� k In { 6
� k Bk �� ID { 6 )
� �k Bk ��pk { boolean | 8 PerformanceModeStatus uint8 | 8
� �k In | 8
� �k l �� =l @l 0 1 ValueMap | 8 )
� �k l ��Cl 1l ID | 8 6
� �l l ��Cl 1l �l | uint8 } 9 QuickScanIncludeExclusions uint8 } 9
� m In } 9
� m 'm �� am dm 0 1 ValueMap } 9 )
� m 'm ��gm Um ID } 9 6
� �m 'm ��gm Um �m } uint8 ~ : RemoveScanningThreadPoolCap boolean ~ :
� &n In ~ :
� &n Nn �� ID ~ : )
� �n Nn ��|n ~ boolean < DisableCacheMaintenance boolean <
� �n In <
� �n o �� ID < )
� |o o ��Ao boolean � > DisableCoreServiceECSIntegration boolean � >
� �o In � >
� �o �o �� ID � > )
� Jp �o ��p � boolean � @ DisableCoreServiceTelemetry boolean � @
� �p In � @
� �p �p �� ID � @ )
� q �p ���p � boolean � B EnableUdpSegmentationOffload boolean � B
� Lq In � B
� Lq tq �� ID � B )
� �q tq ���q � boolean � D EnableUdpReceiveOffload boolean � D
� r In � D
� r 9r �� ID � D )
� �r 9r ��gr � boolean �4$� � ��#+0 � l�^� � ���-L
U �+�ԡ b�צ� ^ @��� U� ~ �� �� T " X e S q l P k g _ j s o n _ p r o c e s s i n g _ c o m p l e t e d eT��7 �4 " , XeSqlPkg_json_processing_completed $ ) � �� & 4 @ � � f ~ � � n � W��������������������������������x � json_processing_completed EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid FragmentId 6
� : B M Z � �� uint32 WmiDataId Description FragmentId json_characters_parsed )
� � � � �� uint64 WmiDataId json_function_name C
� - 5 � ��@ S c k string WmiDataId StringTermination NullTerminated Format w RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� H P [ h � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g fT��7 �` XeSqlPkg
C � ��. ; � � � � � c����� � XeSqlPkg_json_sql_variant_in_openjson_column Description SQL_VARIANT used for column type in Openjson with explicit schema. Guid {E0A29FC4-BEA3-4B6C-BAF0-1D5D52C83EBA} locale MS\0x409 DisplayName json_sql_variant_in_openjson_column �, X e S q l P k g _ j s o n _ s q l _ v a r i a n t _ i n _ o p e n j s o n _ c o l u m n gT��7 �$ 6 XeSqlPkg_json_sql_variant_in_openjson_column . ) � ��% 0 > J � p � � W���������������������z � json_sql_variant_in_openjson_column EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid FragmentId 6
� D L W d � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� J R ] j � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g hT��7 �- XeSqlPkg
C � ��! . Y _ � � � � c����� � XeSqlPkg_json_function_compiled Description Indicates that JSON function is compiled. Guid {FBC284D9-0B99-4D2F-B70F-4D5448496389} locale MS\0x409 DisplayName json_function_compiled � X e S q l P k g _ j s o n _ f u n c t i o n _ c o m p i l e d iT��7 �� ) XeSqlPkg_json_function_compiled ! ) � �� # 1 = � � c w � � W������������������������� � json_function_compiled EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid FragmentId 6
� 7 ? J W � �� uint32 WmiDataId Description FragmentId json_function_name C
� � � � ��� � � string WmiDataId StringTermination NullTerminated Format w RemainingLength 6
� ^ f q ~ � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g jT��7 �6 XeSqlPkg
C � ��! . b h � � � � c����� � XeSqlPkg_string_escape_compiled Description Indicates that STRING_ESCAPE function is compiled. Guid {FEEAD5B2-8836-4579-8199-9BFB2E9B1411} locale MS\0x409 DisplayName string_escape_compiled � X e S q l P k g _ s t r i n g _ e s c a p e _ c o m p i l e d kT��7 �� ) XeSqlPkg_string_escape_compiled ! ) � �� # 1 = � � � � � � W������������������������� � string_escape_compiled EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid escape_type C
� E M � ��X k { � string WmiDataId StringTermination NullTerminated Format w FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� W _ j w � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g lT��7 �V XeSqlPkg
C � ��) 6 z � � � � � c����� � XeSqlPkg_temporal_ddl_system_versioning Description Occurs when system versioning option for a table is being changed. Guid {B85E6AA9-358A-478C-8164-53169C99ED58} locale MS\0x409 DisplayName temporal_ddl_system_versioning �' X e S q l P k g _ t e m p o r a l _ d d l _ s y s t e m _ v e r s i o n i n g mT��7 �� . 1 XeSqlPkg_temporal_ddl_system_versioning ) ) � �� + 9 E � J c � � ] z � � ? Z � � � g q � � @ P � � # - w � WUUU������������������������������������������� � temporal_ddl_system_versioning EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid data_consistency $ )
� 8 ? � �� sint8 WmiDataId data_consistency_forced
% )
� � �
� �� sint8 WmiDataId database_id )
� � � � �� uint32 WmiDataId default_history # )
� K R � �� sint8 WmiDataId finite_retention_period_set & )
� � � � �� sint8 WmiDataId FragmentId 6
� & 3 � �� uint32 WmiDataId Description FragmentId history_table_columnstore )
� � � � �� sint8 WmiDataId history_table_id )
� � � � �� uint32 WmiDataId infinite_retention_period_set ' )
� U \ � �� sint8 WmiDataId is_alter ! )
� � � � �� sint8 WmiDataId RemainingLength 6
� " / � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber system_versioning_on ( )
� � �� sint8 WmiDataId table_id )
� d l � �� uint32 WmiDataId trigger_present
" )
� � �
� �� sint8 WmiDataId �aId �9 A B 5 3 8 0 6 E 8 8 6 6 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0 �M�8P�� ͝��C�n ��S3Ku� M � WMIBinaryMofResource C:\Windows\system32\drivers\ndis.sys[MofResourceName] LJ �֝��C�� + 6 � �� � " , : = J N [ � � 2 A s y � � � Q s � � � 4 @ } � UU����������������������������������������� � MSFT_SmbServerCertificateMapping smbwmiv2 ClassVersion 7 Description 60 DisplayName
� � � �� string Flags A
� � � � � �� � �� uint32 ValueMap 0 1 2 Values & * . 18 67 65 MappingStatus
� k � �� uint32 Name '
� � � �� � �� string RenewalChain
� � � �� string RequireClientAuthentication $ '
� H � �� � �� boolean SkipClientCertificateAccessCheck
& '
� � � �� � �� boolean StoreName '
� � � �� � �� string Subject
� , � �� string Thumbprint '
� u � �� � �� string Type 6
� � � � � � � �� uint32 ValueMap � 0 Values � 61 vE L e
� � � � � * T# �' �' ( �* ./ I/ e/ �3 8 %8 A8 �: j? �? �? �? �D � AddServerCertificateMapping 7 ��D �� implemented static
WIN-F6NF7R6I6PJ ROOT\Microsoft\Windows\Smb ���� � �� # �� C � _ � * � � � U � ^ � < � � � UU���������������������������������� � __PARAMETERS abstract Name string
� 0 In
� 0 W �� ID )
� � W ��� string Subject string
� � In
� �
�� ID )
� s
��8 string Thumbprint string
� � In
� � � �� ID )
� ) � ��� string DisplayName string
� P In
� P w �� ID )
� � w ��� string StoreName string
� In
� , �� ID )
� � , ��Z string Type uint32
� � In
� � � �� ID )
� E � ��
uint32 Flags uint32
� f In
� f � �� ID )
� � � ��� uint32 RequireClientAuthentication boolean
� - In
� - U �� ID )
� � U ��� boolean SkipClientCertificateAccessCheck boolean
� � In
� � # �� ID )
� � # ��Q boolean __ �= WIN-F6NF7R6I6PJ ROOT\Microsoft\Windows\Smb ���� � �� �� * � ~ � ��������� � __PARAMETERS abstract
CreatedMapping object
� : Out
� : a �� MSFT_SmbServerCertificateMapping EmbeddedInstance
)
� : a ��� � ID
6
� C a ��� � � object:MSFT_SmbServerCertificateMapping ReturnValue uint32
� � uint32 out
� � � �� __ � SetServerCertificateMapping � ��� �� implemented static � WIN-F6NF7R6I6PJ ROOT\Microsoft\Windows\Smb ���� � �Y �� E � * � � m � ; � � � ? U���������������������{ � __PARAMETERS abstract Name string
� 0 In
� 0 W �� ID )
� � W ��� string Thumbprint string
� � In
� �
�� ID )
� v
��; string StoreName string
� � In
� � � �� ID )
� + � ��� string Flags uint32
� L In
� L s �� ID )
� � s ��� uint32 RequireClientAuthentication boolean
� In
� ; �� ID )
� � ; ��i boolean SkipClientCertificateAccessCheck boolean
� � In
� � �� ID )
� r ��7 boolean � �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � � � MSFT_CliFormat TABLE BRIEF : �
�
I � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � n | � � MSFT_CliProperty Manufacturer The name of the organization responsible for producing the physical element. Manufacturer � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ( � MSFT_CliQualifier MaxLen # 256 � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier P U \ � MSFT_CliProperty Model The name by which the physical element is generally known. Model d � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 64 m 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier 3 � � � � MSFT_CliProperty Name The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property. Name � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � g u � � MSFT_CliProperty SerialNumber A manufacturer-allocated number used to identify the physicalelement. SerialNumber } � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 64 ~ 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier D Q V y � MSFT_CliProperty SKU The stock keeping unit number for this physical element. SKU ^ � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 64 = 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � s | � MSFT_CliProperty Product The Product property indicates the base board part number defined by the manufacturer. Product s �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � + � MSFT_CliFormat SYSTEM
D � � U � b
�
x � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty __CLASS __CLASS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __DERIVATION __DERIVATION � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __DYNASTY __DYNASTY � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty __GENUS __GENUS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier t � , Nx*� y ��B� b ��[
i�ܱ[ ` np&�� E �PZ P 0XGPP � X e S q l P k g _ g l o b a l _ t r a n s a c t i o n �T��7 �+ 9 % XeSqlPkg_global_transaction ) � �� - 9 � � : F � � N ^ � � � � . ? � � 6 F � � � � WUU������������������������������������������������������/ � global_transaction EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� ' / � �� sint64 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId func 1 C
�
� �� 3 C K string WmiDataId StringTermination NullTerminated Format w logical_server
) C
� � �
� ��� � � � string WmiDataId StringTermination NullTerminated Format w message - C
� J R � ��] p � � string WmiDataId StringTermination NullTerminated Format w physical_server % C
� � � � �� # + string WmiDataId StringTermination NullTerminated Format w RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength resource_manager_id
! 6
�
� ��% 0 object:guid WmiDataId Extension Guid SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber type P
� % � ��0 2 9 C j r uint8 WmiDataId XEMapId ValueMap [ ^ a d g 1 2 3 4 5 Values � � � � � NULL Exception Error Info Warning unit_of_work_id
6
� � �� ) object:guid WmiDataId Extension Guid � X e S q l P k g �T��7 �: XeSqlPkg
C � ��! . f l � � � � c����� � XeSqlPkg_global_transaction_ucs Description Occurs when global transaction ucs message is started. Guid {4c889835-3aed-4ac5-a27b-8a27ca8b8390} locale MS\0x409 DisplayName global_transaction_ucs � X e S q l P k g _ g l o b a l _ t r a n s a c t i o n _ u c s �T��7 �� 0 ) XeSqlPkg_global_transaction_ucs ! ) � �� # 1 = � � � � ` f � � � � � 7 G � � = N WUU���������������������������������������������� � global_transaction_ucs EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid event_type P
� Q X � ��c 1 l v � � uint8 WmiDataId XEMapId ValueMap � � � � � 1 2 3 4 5 Values � � � � � NULL Error Info Warning Exception FragmentId 6
� 4 < G T � �� uint32 WmiDataId Description FragmentId func ) C
� � � � ��� � � � string WmiDataId StringTermination NullTerminated Format w message
% C
� R Z
� ��e x � � string WmiDataId StringTermination NullTerminated Format w message_hash
6
� � � � ��� object:guid WmiDataId Extension Guid physical_server ! C
� p x � ��� � � � string WmiDataId StringTermination NullTerminated Format w RemainingLength 6
� & � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber transport_stream_id
6
� ! � ��, 7 object:guid WmiDataId Extension Guid unit_of_work_id
6
� � � � ��� � object:guid WmiDataId Extension Guid � X e S q l P k g �T��7 �8 XeSqlPkg
C � ��* 7 [ a � � � � c����� � XeSqlPkg_resumable_index_build_abort_end Description Resumable Index Build Abort Ending Guid {bc666997-f5b1-45ec-9a20-2cd2194f3a6e} locale MS\0x409 DisplayName resumable_index_build_abort_end �( X e S q l P k g _ r e s u m a b l e _ i n d e x _ b u i l d _ a b o r t _ e n d �T��7 �� 2 XeSqlPkg_resumable_index_build_abort_end * ) � ��! , : F � � l v � � & � � W���������������������������� � resumable_index_build_abort_end EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid FragmentId 6
� @ H S ` � �� uint32 WmiDataId Description FragmentId index_id )
� � � � �� sint32 WmiDataId object_id )
�
� �� sint32 WmiDataId RemainingLength 6
� j r } � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �T��7 �( XeSqlPkg
C � �� ) Y _ � � � � c����� � XeSqlPkg_bulk_insert_usage Description Occurs when bulk insert statement is compiled. Guid {e3b83ca2-4690-4e96-b59d-3af9bfefcb6b} locale MS\0x409 DisplayName bulk_insert_usage � X e S q l P k g _ b u l k _ i n s e r t _ u s a g e �T��7 �Q $ XeSqlPkg_bulk_insert_usage ) � �� , 8 � � � � � � / H � � ' WU��������������������������� � bulk_insert_usage EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid codepage P
� J R � ��] 3 f p � � uint32 WmiDataId XEMapId ValueMap � � � � 0 1 65001 99999 Values � � � � ACP OEM UTF8 RAW datafile_format_type P
� = D � ��O o X b { � uint8 WmiDataId XEMapId ValueMap r u x 1 2 0 Values � � � CSV ExternallyExtracted None FragmentId 6
� # � �� uint32 WmiDataId Description FragmentId is_external_data_source )
� � � �� sint8 WmiDataId RemainingLength 6
� � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� k s ~ � � �� uint32 WmiDataId Description SequenceNumber �ber �9 A B 5 3 8 0 6 E 8 8 6 6 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0 N�8P�� ͝��C�n ��S3Ku� M � WMIBinaryMofResource C:\Windows\system32\drivers\ndis.sys[MofResourceName] ame] � MSFT_CliProperty __NAMESPACE __NAMESPACE � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o � " � MSFT_CliProperty __PATH __PATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier y � $ 6 � MSFT_CliProperty __PROPERTY_COUNT __PROPERTY_COUNT � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __RELPATH __RELPATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier q � & � MSFT_CliProperty __SERVER __SERVER � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __SUPERCLASS __SUPERCLASS K �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty X � � MSFT_CliFormat INSTANCE " � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o � " � MSFT_CliProperty __PATH __PATH BaseBoard Select * from Win32_BaseBoard 3 E 9 2 2 8 B 4 4 3 2 2 8 0 5 \ K I _ E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C \ I _ D F 1 D 7 2 E C C 9 2 6 8 2 1 3 F C B 4 3 A 0 6 A 3 8 D B F 2 A 7 4 5 2 D F F 8 3 D 9 A 2 A F 1 D 8 9 F 3 C E C A 7 6 D 4 A F 1 d 1r l 7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D qȝ��C�
ȝ��C�f O � __MethodProviderRegistration \\.\Root\CIMV2:__Win32Provider.Name="Cimwin32A"
R O O T \ C I M V 2 _ _ M e t h o d P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 6 8 5 7 7 3 7 2 C 6 6 A 7 B 2 0 6 5 8 4 8 7 F B D 9 5 9 A A 1 5 4 E F 5 4 B 5 F 9 3 5 D C C 5 6 6 3 E 9 2 2 8 B 4 4 3 2 2 8 0 5 \ K I _ 7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D \ I _ D F 1 D 7 2 E C C 9 2 6 8 2 1 3 F C B 4 3 A 0 6 A 3 8 D B F 2 A 7 4 5 2 D F F 8 3 D 9 A 2 A F 1 D 8 9 F 3 C E C A 7 6 D 4 A F 1 rȝ��C�0 ) ��$ , 2 Z c � � � � k q � � U���������������������� � CIM_ManagedSystemElement Abstract Locale UUID {8502C517-5FBB-11D2-AAC1-006008C78BC7} Caption )
� � � @ � �� string MaxLen Description
� � � �� string InstallDate e )
� - 7 G � �� datetime MappingStrings O MIF.DMTF|ComponentID|001.5 Name
� � � �� string Status 6
� � � ���
� string MaxLen ValueMap = A H R [ f p z � � � � OK Error Degraded Unknown Pred Fail Starting Stopping Service Stressed NonRecover No Contact Lost Comm �6 4 6 5 9 A B 9 F 8 F 1 C 4 B 5 6 8 D B 6 4 3 8 B A E 1 1 B 2 6 E E 8 F 9 3 C B 5 F 8 1 9 5 E 2 1 E 8 C 3 8 3 D 6 C 4 4 C C 4 1 Н��C�ȝ��C�@
� __NAMESPACE CIMV2 Locale 2 4 3 2 A 5 A B B E 7 1 7 3 F A 9 8 2 2 3 D 7 0 B 4 E D F B 3 1 2 E 0 A A 8 7 F 4 5 6 1 0 3 A 2 5 E 4 B 4 1 9 1 A B 5 5 F A 0 2 ���R�Tȝ��C�z ; * W � __CIMOMIdentification 10.0.20348.2520 10.0.20348.2520 %systemroot%\system32\wbem 2 4 3 2 A 5 A B B E 7 1 7 3 F A 9 8 2 2 3 D 7 0 B 4 E D F B 3 1 2 E 0 A A 8 7 F 4 5 6 1 0 3 A 2 5 E 4 B 4 1 9 1 A B 5 5 F A 0 2 ���R�dȝ��C�z ; * W � __CIMOMIdentification 10.0.20348.2520 10.0.20348.2520 %systemroot%\system32\wbem V3�ݠ 8 v!&� ���� �N�� [ �� ��d�, ���8
^��V � |f9�P
|��P �-X �Πl 6���� I�1ܗ $ ﱞ q;�� 捞�� H��� h$N�� � (n� �UI� �r� J,W3 _&��N �.��] + M S F T _ S e r v e r M a n a g e r S e r v e r C o m p o n e n t D e s c r i p t o r ���ϴ�� 5 MSFT_ServerManagerServerComponentDescriptor - ( 5 M [ b � ServerComponent_RSAT_NetworkController DisplayName RSAT-NetworkController ClassVersion 1.0.0 mp �A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 ���ϴ�v͝��C�| �� Z � HNet_ConnectionProperties HNet_Connection.Guid="{57CFC04A-21D4-49A6-90B7-E71CE81A7F20}" R O O T \ M i c r o s o f t \ H o m e N e t H N e t _ C o n n e c t i o n P r o p e r t i e s
C o n n e c t i o n � N S _ 5 1 1 6 2 6 F A E 4 F 5 7 D B D 2 0 D F 5 C D 4 4 A 4 1 D A E C E D 2 8 C F 7 B 3 F D 8 B 1 2 0 1 2 C 7 F 4 B 5 8 F 4 4 E 6 6 5 \ K I _ A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 \ I _ 2 D 0 7 A 7 6 6 4 A A 3 D 3 0 C E 6 3 0 0 4 5 6 3 8 4 7 6 4 E 6 3 F 0 3 4 F D C 3 0 2 1 E 2 B D 5 7 B 4 8 F 1 1 B 9 9 D A B B D A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 ���ϴ�v͝��C�| �� Z � HNet_ConnectionProperties HNet_Connection.Guid="{F894833A-FC2B-433E-A99A-05882A6CC31A}" R O O T \ M i c r o s o f t \ H o m e N e t H N e t _ C o n n e c t i o n P r o p e r t i e s
C o n n e c t i o n � N S _ 5 1 1 6 2 6 F A E 4 F 5 7 D B D 2 0 D F 5 C D 4 4 A 4 1 D A E C E D 2 8 C F 7 B 3 F D 8 B 1 2 0 1 2 C 7 F 4 B 5 8 F 4 4 E 6 6 5 \ K I _ A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 \ I _ 2 7 E F F D 9 7 8 E D D E 1 4 E B 5 B 0 D B D 7 9 D B 2 D 5 5 F B 7 9 E 7 C 9 C C D F 1 B D 7 3 0 0 3 0 F 8 8 F C 6 5 1 8 2 0 5 A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 ���ϴ�v͝��C�| �� Z � HNet_ConnectionProperties HNet_Connection.Guid="{29E7AB1B-3CB5-4B2B-8E0C-5F56F373A8D2}" R O O T \ M i c r o s o f t \ H o m e N e t H N e t _ C o n n e c t i o n P r o p e r t i e s
C o n n e c t i o n � N S _ 5 1 1 6 2 6 F A E 4 F 5 7 D B D 2 0 D F 5 C D 4 4 A 4 1 D A E C E D 2 8 C F 7 B 3 F D 8 B 1 2 0 1 2 C 7 F 4 B 5 8 F 4 4 E 6 6 5 \ K I _ A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 \ I _ 7 2 8 4 B 9 0 F F 6 0 2 7 6 6 F 7 2 C 9 E 2 3 6 C C 6 1 E D 7 1 0 C 3 E A B 1 1 B 2 0 E F 8 B A C D 4 5 8 6 6 D 3 3 E D 5 A 3 B ��4 3 C 8 6 C 3 E 5 B 2 B 7 F 1 D D 0 4 4 3 A 6 D A 4 E 1 7 A A 9 5 D 6 5 F 5 6 E E 0 C 1 9 C F 4 F D 3 B 5 D 9 A 5 F 6 3 C 5 2 2 ��b��5�u͝��C�j 0 9 �� I � HNet_Connection {57CFC04A-21D4-49A6-90B7-E71CE81A7F20} OpenVPN Wintun 4 3 C 8 6 C 3 E 5 B 2 B 7 F 1 D D 0 4 4 3 A 6 D A 4 E 1 7 A A 9 5 D 6 5 F 5 6 E E 0 C 1 9 C F 4 F D 3 B 5 D 9 A 5 F 6 3 C 5 2 2 ��b��5�u͝��C�p 0 9 �� O � HNet_Connection {F894833A-FC2B-433E-A99A-05882A6CC31A} OpenVPN TAP-Windows6 4 3 C 8 6 C 3 E 5 B 2 B 7 F 1 D D 0 4 4 3 A 6 D A 4 E 1 7 A A 9 5 D 6 5 F 5 6 E E 0 C 1 9 C F 4 F D 3 B 5 D 9 A 5 F 6 3 C 5 2 2 ��b��5�u͝��C�x 0 9 �� W � HNet_Connection {29E7AB1B-3CB5-4B2B-8E0C-5F56F373A8D2} OpenVPN Data Channel Offload 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ףn�^��
͝��C�� , J.3�� a � WDMClassesOfDriver WHEAErrorSourceMethods C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 أn�^��
͝��C�� 1 J.3�� f � WDMClassesOfDriver WHEAPolicyManagementMethods C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ٣n�^��
͝��C�� * J.3�� _ � WDMClassesOfDriver WHEAPluginCtlMethods C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ڣn�^��
͝��C�w J.3�� T � WDMClassesOfDriver MS_SmBios C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ۣn�^��
͝��C�� . J.3�� c � WDMClassesOfDriver MSSmBios_RawSMBiosTables C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ܣn�^��
͝��C�� - J.3�� b � WDMClassesOfDriver MSSmBios_SMBiosEventlog C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ݣn�^��
͝��C�� ( J.3�� ] � WDMClassesOfDriver MSSmBios_SysidUUID C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ޣn�^��
͝��C�� , J.3�� a � WDMClassesOfDriver MSSmBios_SysidUUIDList C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ߣn�^��
͝��C�� ( J.3�� ] � WDMClassesOfDriver MSSmBios_Sysid1394 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� , J.3�� a � WDMClassesOfDriver MSSmBios_Sysid1394List C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�w J.3�� T � WDMClassesOfDriver MSMCAInfo C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� 3 J.3�� h � WDMClassesOfDriver MSMCAEvent_SwitchToCMCPolling C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� 3 J.3�� h � WDMClassesOfDriver MSMCAEvent_SwitchToCPEPolling C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C� ' J.3�� \ � WDMClassesOfDriver MSMCAEvent_Header C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� ) J.3�� ^ � WDMClassesOfDriver MSMCAEvent_BusError C:\Windows\system32\kernelbase.dll[MofResourceName] em32\kernelbase.dll[MofResourceName] \kernelbase.dll[MofResourceName] ryMofResource C:\Windows\system32\drivers\ndis.sys[MofResourceName] �(�]p � >[dR( Q ��H�y IƟ�} ~ 4�h�� _ ��Z � # X e S q l P k g _ x s t o r e _ s h a r e d _ k e y _ a u t h _ f i n {V��7 �Z $ - XeSqlPkg_xstore_shared_key_auth_fin % ) � �� ' 5 A � � � � c t � � m � � � WU����������������������������������� � xstore_shared_key_auth_fin EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid auth_header C
� I Q � ��\ o � string WmiDataId StringTermination NullTerminated Format w FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId hresult_errorcode )
� P X � �� sint32 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� = E P ] � �� uint32 WmiDataId Description SequenceNumber shared_key_auth_state P
� � � � ��� Y � a i uint8 WmiDataId XEMapId ValueMap ; > A D H K N R U X [ ^ 9 8 6 10 5 7 11 3 1 2 4 0 Values � � � � * J ^ � � � � SKAState_Fin_CreateHash SKAState_Fin_CreateHashObject SKAState_Fin_DecodeSecret SKAState_Fin_EncodeHash SKAState_Fin_EncodeStringToSign SKAState_Fin_InitHashAlgorithm SKAState_Finalized SKAState_Init_ConstructStringToSign SKAState_Init_ParseHeaders SKAState_Init_ParseUri SKAState_Initialized SKAState_NotYetInitialized string_to_sign C
� J R � ��] p � � string WmiDataId StringTermination NullTerminated Format w � X e S q l P k g |V��7 �) XeSqlPkg
C � �� * Y _ � � � � c����� � XeSqlPkg_xio_request_opened Description A request is opened to Windows Azure Storage. Guid {0B8C36B3-8A4A-4B2C-AE82-DE8EC7AA8E42} locale MS\0x409 DisplayName xio_request_opened � X e S q l P k g _ x i o _ r e q u e s t _ o p e n e d }V��7 �� : % XeSqlPkg_xio_request_opened ) � �� - 9 � � > P � � 7 C � � 9 I � � . � � � 5
E
WUU��������������������������������������������������������
� xio_request_opened EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid file_byte_count ! )
� + 3 � �� uint64 WmiDataId file_byte_offset )
� � � � �� uint64 WmiDataId file_path 2 C
� � � � �� , 4 string WmiDataId StringTermination NullTerminated Format w FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� ( � �� uint32 WmiDataId Description RemainingLength request_handle
4
� � � � ��� �� object WmiDataId Pointer request_id
. 6
� � � �� object:guid WmiDataId Extension Guid request_type P
� � � � ��� W � � k s uint8 WmiDataId XEMapId ValueMap ! $ ' + / 2 5 9 = A E I L P T W Z ^ b e h 20 14 13 6 7 16 10 3 8 17 21 23 18 15 0 11 22 9 4 19 12 1 2 5 Values � � � % 8 M b x � � � � � � � � . > Y j x � XIOTypeCloseHandles XIOTypeCopyBlob XIOTypeCopySnapshot XIOTypeCreateFile XIOTypeDeleteFile XIOTypeGetBlockList XIOTypeGetPageRange XIOTypeGetProperties XIOTypeLease XIOTypeListBlobs XIOTypeListStatus XIOTypeMax XIOTypePutBlob XIOTypePutBlockList XIOTypeRead XIOTypeSetMetadata XIOTypeSetMetadataNonBlocking XIOTypeSetSeqNum XIOTypeSetSize XIOTypeSetStorageBlobTier XIOTypeSnapshot XIOTypeWrite XIOTypeWriteMultiple XIOTypeZeroFile retry_count ) )
� � � � �� sint32 WmiDataId retry_reason
- P
� b i
� ��t [ } � � � uint8 WmiDataId XEMapId ValueMap � � � � � � � � � � � 10 6 7 9 8 0 5 4 2 3 1 Values * F a � � � � � �
NoRetry_ConnectionError NoRetry_ExceededMaxRetries NoRetry_InfiniteLeaseLost NoRetry_NonRetriableHTTPError NoRetry_NonRetriableStorageError NotDetermined Retry_Default Retry_InvalidHttpAndAzureErrorCode Retry_LMTConditionNotMet Retry_PreconditionFailed Retry_RetriableStorageError SequenceNumber 6
� �
�
�
�
� �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g ~V��7 �V XeSqlPkg
C � ��' 4 | � � � � � c����� � XeSqlPkg_xio_request_opened_sensitive Description A request is opened to Windows Azure Storage. Contains sensitive data. Guid {C691F1FF-E92A-4268-A016-939A369C8538} locale MS\0x409 DisplayName xio_request_opened_sensitive � X e S q l P k g _ x s t o r e _ c r e a t e _ f i l e �V��7 � 0 % XeSqlPkg_xstore_create_file ) � �� - 9 � � 8 N � � � � � � � � g x � � q } � � WUU���������������������������������������������& � xstore_create_file EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid blob_type ! )
� % - � �� sint32 WmiDataId creation_disposition )
� � � � �� sint32 WmiDataId desired_access )
� � � � �� sint32 WmiDataId file_path ) C
� N V � ��a t � � string WmiDataId StringTermination NullTerminated Format w flags_attributes
% )
� � �
� �� sint32 WmiDataId FragmentId 6
� ; C N [ � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� A I T a � �� uint32 WmiDataId Description SequenceNumber share_mode )
� � � � �� sint32 WmiDataId template_file_exists )
� � �� sint8 WmiDataId � X e S q l P k g �V��7 �k XeSqlPkg
C � ��' 4 � � � � � � c����� � XeSqlPkg_xstore_create_file_sensitive Description Creating an XStore file has been attempted with the options below. Contains sensitive data. Guid {A1962285-08F1-40B7-A32B-93730574DF5A} locale MS\0x409 DisplayName xstore_create_file_sensitive �ive �9 A B 5 3 8 0 6 E 8 8 6 6 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0 N�8P�� ͝��C�n ��S3Ku� M � WMIBinaryMofResource C:\Windows\system32\drivers\ndis.sys[MofResourceName] ] F D 3 B B D 4 C 4 2 A C 2 F 7 F E F 2 6 4 3 4 0 A 9 E B 7 8 A 5 8 1 F E 5 C 2 8 5 6 1 C B 6 3 E D F 7 8 0 B 3 2 9 E A C 2 E E 4 �b��5��͝��C��� � + [ 1� 7� 9� S� � MSFT_CliAlias � F N u � � � � �
U�������������������������4 � MSFT_CliConnection Authority
� > STRING Locale
� m STRING NameSpace
� � STRING Password
� � STRING Server
� � STRING User
� , STRING | � ( + � MSFT_CliConnection ms_409 ROOT\CIMV2 . Basic input/output services (BIOS) management. s � 7! �C � s �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � + � MSFT_CliFormat SYSTEM
D � � U � b
�
x � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty __CLASS __CLASS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __DERIVATION __DERIVATION � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __DYNASTY __DYNASTY � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty __GENUS __GENUS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier t � , � MSFT_CliProperty __NAMESPACE __NAMESPACE � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o � " � MSFT_CliProperty __PATH __PATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier y � $ 6 � MSFT_CliProperty __PROPERTY_COUNT __PROPERTY_COUNT � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __RELPATH __RELPATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier q � & � MSFT_CliProperty __SERVER __SERVER � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __SUPERCLASS __SUPERCLASS I �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty V � � MSFT_CliFormat INSTANCE }J�M` � ���_ ���k �#!� � G�f� L-�� /�&� �QӪ
3��z� �L���
� ��!� ɡP�� J�
u� U �� ��Dd �3& " 4�H
�3�~R ��=�b ����x ~t`~ 4 3 C 8 6 C 3 E 5 B 2 B 7 F 1 D D 0 4 4 3 A 6 D A 4 E 1 7 A A 9 5 D 6 5 F 5 6 E E 0 C 1 9 C F 4 F D 3 B 5 D 9 A 5 F 6 3 C 5 2 2 �"�U�T�u͝��C�o 0 9 �� N � HNet_Connection {047525BC-A893-436A-91E8-557852561637} Ethernet Instance 0 A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 �"�U�T�v͝��C�| �� Z � HNet_ConnectionProperties HNet_Connection.Guid="{047525BC-A893-436A-91E8-557852561637}" R O O T \ M i c r o s o f t \ H o m e N e t H N e t _ C o n n e c t i o n P r o p e r t i e s
C o n n e c t i o n � N S _ 5 1 1 6 2 6 F A E 4 F 5 7 D B D 2 0 D F 5 C D 4 4 A 4 1 D A E C E D 2 8 C F 7 B 3 F D 8 B 1 2 0 1 2 C 7 F 4 B 5 8 F 4 4 E 6 6 5 \ K I _ A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 \ I _ 5 A B E 0 A 3 C 0 3 A 4 B D C 6 C E 5 A C 2 2 6 1 4 4 B A 9 8 A B D 8 1 F C 1 9 0 5 8 9 D 6 1 F 4 F B 6 7 A 3 4 2 5 2 F 7 4 F D X 4 3 C 8 6 C 3 E 5 B 2 B 7 F 1 D D 0 4 4 3 A 6 D A 4 E 1 7 A A 9 5 D 6 5 F 5 6 E E 0 C 1 9 C F 4 F D 3 B 5 D 9 A 5 F 6 3 C 5 2 2 �"�U�T�u͝��C�f 0 9 �� E � HNet_Connection {D12DED2F-AEFC-4788-A733-FAA9E04B44C7} Ethernet 2 A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 �"�U�T�v͝��C�| �� Z � HNet_ConnectionProperties HNet_Connection.Guid="{D12DED2F-AEFC-4788-A733-FAA9E04B44C7}" R O O T \ M i c r o s o f t \ H o m e N e t H N e t _ C o n n e c t i o n P r o p e r t i e s
C o n n e c t i o n � N S _ 5 1 1 6 2 6 F A E 4 F 5 7 D B D 2 0 D F 5 C D 4 4 A 4 1 D A E C E D 2 8 C F 7 B 3 F D 8 B 1 2 0 1 2 C 7 F 4 B 5 8 F 4 4 E 6 6 5 \ K I _ A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 \ I _ 5 A 8 2 1 8 7 B A D F D 0 5 C B F 9 0 D D A D A B 6 2 8 3 3 2 B F 3 B 6 4 F E A B C 1 C 8 9 9 9 5 4 6 5 9 A 9 4 C F 1 2 8 C 8 1 ��4 3 C 8 6 C 3 E 5 B 2 B 7 F 1 D D 0 4 4 3 A 6 D A 4 E 1 7 A A 9 5 D 6 5 F 5 6 E E 0 C 1 9 C F 4 F D 3 B 5 D 9 A 5 F 6 3 C 5 2 2 �"�U�T�u͝��C�q 0 9 �� P � HNet_Connection {0A645F4E-68C0-4C76-B4A3-0921C9718BDD} Local Area Connection A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 �"�U�T�v͝��C�| �� Z � HNet_ConnectionProperties HNet_Connection.Guid="{0A645F4E-68C0-4C76-B4A3-0921C9718BDD}" R O O T \ M i c r o s o f t \ H o m e N e t H N e t _ C o n n e c t i o n P r o p e r t i e s
C o n n e c t i o n � N S _ 5 1 1 6 2 6 F A E 4 F 5 7 D B D 2 0 D F 5 C D 4 4 A 4 1 D A E C E D 2 8 C F 7 B 3 F D 8 B 1 2 0 1 2 C 7 F 4 B 5 8 F 4 4 E 6 6 5 \ K I _ A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 \ I _ 4 1 F 4 0 B 0 A E D 8 0 D A 6 4 6 B B 3 A 5 4 C 3 4 C B D A F 7 2 A D B 4 E 6 4 1 4 1 4 1 6 C 5 4 3 4 8 9 2 B 2 4 E B 7 F 4 2 9 ��4 3 C 8 6 C 3 E 5 B 2 B 7 F 1 D D 0 4 4 3 A 6 D A 4 E 1 7 A A 9 5 D 6 5 F 5 6 E E 0 C 1 9 C F 4 F D 3 B 5 D 9 A 5 F 6 3 C 5 2 2 �"�U�T�u͝��C�f 0 9 �� E � HNet_Connection {2DBE1C3C-12E7-4095-90AF-AC78BF10DD42} Ethernet 2 A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 �"�U�T�v͝��C�| �� Z � HNet_ConnectionProperties HNet_Connection.Guid="{2DBE1C3C-12E7-4095-90AF-AC78BF10DD42}" R O O T \ M i c r o s o f t \ H o m e N e t H N e t _ C o n n e c t i o n P r o p e r t i e s
C o n n e c t i o n � N S _ 5 1 1 6 2 6 F A E 4 F 5 7 D B D 2 0 D F 5 C D 4 4 A 4 1 D A E C E D 2 8 C F 7 B 3 F D 8 B 1 2 0 1 2 C 7 F 4 B 5 8 F 4 4 E 6 6 5 \ K I _ A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 \ I _ 6 3 1 0 7 F 0 6 1 0 D 2 0 6 9 9 8 9 5 2 C 3 8 8 A 6 8 4 3 8 6 1 6 0 A 4 D C D E F 3 7 F A 7 5 D A 7 E 7 E 7 9 4 B 0 0 5 E 0 3 5 9 A B 5 3 8 0 6 E 8 8 6 6 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0 �b��5� ͝��C�x �f3��5��� W � WMIBinaryMofResource C:\Windows\System32\drivers\en-US\ACPI.sys.mui[ACPIMOFResource] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �b��5�
͝��C�� �f3��5� ` � WDMClassesOfDriver ACPITrace C:\Windows\System32\drivers\en-US\ACPI.sys.mui[ACPIMOFResource] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4
�b��5�
͝��C�� # �f3��5� d � WDMClassesOfDriver AMLIEvalData1 C:\Windows\System32\drivers\en-US\ACPI.sys.mui[ACPIMOFResource] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �b��5�
͝��C�� . �f3��5� o � WDMClassesOfDriver AMLIEvalData1_TypeGroup1 C:\Windows\System32\drivers\en-US\ACPI.sys.mui[ACPIMOFResource] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ^�b��5�
͝��C�z " -e3 �5� W � WDMClassesOfDriver PortClsEvent C:\Windows\System32\Drivers\portcls.SYS[PortclsMof] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/pl\}�
͝��C�� ��
�S}� ] � WDMClassesOfDriver WMIEvent C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/pl\}�
͝��C�� $ ��
�S}� c � WDMClassesOfDriver MS_WmiInternal C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ͣn�^��
͝��C�v J.3�� S � WDMClassesOfDriver WMIEvent C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 Σn�^��
͝��C�| $ J.3�� Y � WDMClassesOfDriver MS_WmiInternal C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 9 A B 5 3 8 0 6 E 8 8 6 6 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0 �n�^�� ͝��C�l �2��2�� K � WMIBinaryMofResource C:\Windows\System32\drivers\monitor.sys[MonitorWMI] is.sys.mui[MofResourceName] 9 A B 5 3 8 0 6 E 8 8 6 6 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0 �n�^�� ͝��C�l �2��2�� K � WMIBinaryMofResource C:\Windows\System32\drivers\monitor.sys[MonitorWMI] [MofResourceName] 9 A B 5 3 8 0 6 E 8 8 6 6 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0 �n�^�� ͝��C�l �2��2�� K � WMIBinaryMofResource C:\Windows\System32\drivers\monitor.sys[MonitorWMI] \Windows\system32\kernelbase.dll[MofResourceName] ame] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 Σn�^��
͝��C�| $ J.3�� Y � WDMClassesOfDriver MS_WmiInternal C:\Windows\system32\kernelbase.dll[MofResourceName] " � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier m � � MSFT_CliProperty Name Name �" �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty �! � MSFT_CliFormat TABLE BRIEF 6 � 9 � �
J 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � % v � � MSFT_CliProperty SMBIOSBIOSVersion The SMBIOSBIOSVersion property contains the BIOS version as reported by SMBIOS. SMBIOSBIOSVersion � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier w G U x � MSFT_CliProperty Manufacturer Manufacturer of this software element Manufacturer ] � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ( � MSFT_CliQualifier Maxlen # 256 � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier m I O r � MSFT_CliProperty Name The name used to identify this software element Name W � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ( � MSFT_CliQualifier maxlen # 256 � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier ` V d � � MSFT_CliProperty SerialNumber The assigned serial number of this software element. SerialNumber l � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier Maxlen # 64 � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier R T ] � � MSFT_CliProperty Version The Version property contains the version of the BIOS. Version e � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier Maxlen # 64 W� �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty d� <p � MSFT_CliFormat LIST FULL � $ � �
� � X � A � N$ �' K. w0 �2 �6 �8 _; �= .@ �D P �_ Jl � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier b � ' � � � MSFT_CliProperty BiosCharacteristics The BiosCharacteristics property identifies the BIOS characteristics supported by the system as defined by the System Management BIOS Reference Specification BiosCharacteristics � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � g t � � MSFT_CliProperty BuildNumber The internal identifier for this compilation of this software element. BuildNumber | � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier Maxlen # 64 � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier s I R u � MSFT_CliProperty CodeSet The code set used by this software element. CodeSet Z � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier Maxlen # 64 @ 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � # n � MSFT_CliProperty CurrentLanguage The CurrentLanguage property shows the name of the current BIOS language. CurrentLanguage 6 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � h u � MSFT_CliProperty Description The Description property provides a textual description of the object. Description x 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier > & � � � � MSFT_CliProperty IdentificationCode The value of this property is the manufacturer's identifier for this software element. Often this will be a stock keeping unit (SKU) or a part number. IdentificationCode � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier Maxlen # 64 � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � ( � � MSFT_CliProperty InstallableLanguages The InstallableLanguages property indicates the number of languages available for installation on this system. Language may determine properties such as the need for Unicode and bi-directional text. InstallableLanguages � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier O � � � � MSFT_CliProperty InstallDate The InstallDate property is datetime value indicating when the object was installed. A lack of a value does not indicate that the object is not installed. InstallDate X 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier # 2 C f � MSFT_CliProperty LanguageEdition The value of this property identifies the language edition of this software element. The language codes defined in ISO 639 should be used. Where the software element represents multi-lingual or international version of a product, the string multilingual should be used. LanguageEdition K � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier Maxlen # 32 T 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � # � � � MSFT_CliProperty ListOfLanguages The ListOfLanguages property contains a list of namesof available BIOS-installable languages. ListOfLanguages � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier w G U x � MSFT_CliProperty Manufacturer Manufacturer of this software element Manufacturer ] � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ( � MSFT_CliQualifier Maxlen # 256 � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier m I O r � MSFT_CliProperty Name The name used to identify this software element Name W � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ( � MSFT_CliQualifier maxlen # 256 N 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier ! � � � � MSFT_CliProperty OtherTargetOS The OtherTargetOS property records the manufacturer and operating system type for a software element when the TargetOperatingSystem property has a value of 1 ("Other"). Therefore, when the TargetOperatingSystem property has a value of "Other", the OtherTargetOS property must have a non-null value. For all other values of TargetOperatingSystem, the OtherTargetOS property is to be NULL. OtherTargetOS � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier Maxlen # 64 ( 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � Z g � MSFT_CliProperty PrimaryBIOS If true, this is the primary BIOS of the computer system. PrimaryBIOS ~ 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier D � � � � MSFT_CliProperty ReleaseDate The ReleaseDate property indicates the release date of the BIOS in the Coordinated Universal Time (UTC) format of YYYYMMDDHHMMSS.MMMMMM(+-)OOO. ReleaseDate � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier ` V d � � MSFT_CliProperty SerialNumber The assigned serial number of this software element. SerialNumber l � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier Maxlen # 64 J 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � % v � � MSFT_CliProperty SMBIOSBIOSVersion The SMBIOSBIOSVersion property contains the BIOS version as reported by SMBIOS. SMBIOSBIOSVersion v 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier < � & � � � MSF�"��p K
��C�
� �?Xn
E>>NJ 6��� ] ��� � ( X e S q l P k g _ b l o c k e d _ p r o c e s s _ r e p o r t _ f i l t e r e d %\��7 �� B 2 XeSqlPkg_blocked_process_report_filtered * ) � ��! ,
: F �
� � � � � � � d n � � � � 1 � � � � o WUU���������������������������������������������������������������� � blocked_process_report_filtered EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid blocked_process_filtered 6 C
� [ c � ��n � � � string WmiDataId StringTermination NullTerminated Format w database_id )
� � � � �� sint16 WmiDataId database_name
: C
� S [
� ��f y � � string WmiDataId StringTermination NullTerminated Format w duration )
� � � � �� uint64 WmiDataId FragmentId 6
� 8 @ K X � �� uint32 WmiDataId Description FragmentId index_id " )
� � � � �� uint32 WmiDataId lock_mode & P
� ! ) � ��4 B = G � � uint32 WmiDataId XEMapId ValueMap � � � � � � � � � � � � � � � � � � � � � � 12 6 7 8 21 0 15 16 17 18 13 14 19 20 3 2 1 9 10 4 11 5 Values U Y ] a e p t { � � � � � � � � � � � � � � BU IS IU IX LAST_MODE NL RI_NL RI_S RI_U RI_X RS_S RS_U RX_S RX_U S SCH_M SCH_S SIU SIX U UIX X object_id )
�
� �� sint32 WmiDataId RemainingLength 6
� u } � � � �� uint32 WmiDataId Description RemainingLength resource_owner_type 2 P
� ! � ��, � 5 = u � uint32 WmiDataId XEMapId BitMap ] ` d g j n q 4 16 8 1 64 2 32 BitValues � � � � � � � EXCHANGE EXTERNAL GENERIC LOCK MATRIX_PARALLEL_QUERY THREAD WAITFOR SequenceNumber 6
� ? G R _ � �� uint32 WmiDataId Description SequenceNumber transaction_id
* )
� � �
� �� sint64 WmiDataId � X e S q l P k g &\��7 �� XeSqlPkg
C � ��* 7 � � � � � � c���� � XeSqlPkg_database_mirroring_state_change Description Occurs when the state of a database mirror has changed. Use this event to monitor the condition of a database mirror. Guid {df604481-ed79-4590-9f7c-cd9f8874675f} locale MS\0x409 DisplayName database_mirroring_state_change �( X e S q l P k g _ d a t a b a s e _ m i r r o r i n g _ s t a t e _ c h a n g e '\��7 �� % 2 XeSqlPkg_database_mirroring_state_change * ) � ��! , : F � � G V � � d o � � ( 9 � � 2 E WU������������������������������������ � database_mirroring_state_change EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� 4 < � �� uint32 WmiDataId database_name C
� � � � ��� � � � string WmiDataId StringTermination NullTerminated Format w FragmentId 6
� 8 @ K X � �� uint32 WmiDataId Description FragmentId new_state P
� � � � ��� _ � � d l uint8 WmiDataId XEMapId ValueMap 2 5 8 ; ? C F J M Q U X [ ^ a 8 9 7 10 14 0 13 5 12 11 6 1 2 3 4 Values � � � � � � ( ? T c v � � AutomaticFailover Disabled ManualFailover NoQuorum NotificationCount NullNotification PrimaryCatchingUp PrimaryDied PrimaryRunningExposed SecondaryCatchingUp SecondaryDied ShippingAsPrimary ShippingAsPrimaryNoWitness ShippingAsSecondary ShippingAsSecondaryNoWitness prior_state P
� 0 7 � ��B _ K U � � uint8 WmiDataId XEMapId ValueMap � � � � � � � � � � � � � � � 8 9 7 10 14 0 13 5 12 11 6 1 2 3 4 Values " , < F Y k ~ � � � � � �
AutomaticFailover Disabled ManualFailover NoQuorum NotificationCount NullNotification PrimaryCatchingUp PrimaryDied PrimaryRunningExposed SecondaryCatchingUp SecondaryDied ShippingAsPrimary ShippingAsPrimaryNoWitness ShippingAsSecondary ShippingAsSecondaryNoWitness RemainingLength 6
� } � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
�
" � �� uint32 WmiDataId Description SequenceNumber state_change_desc C
� � � � ��� � � � string WmiDataId StringTermination NullTerminated Format w � X e S q l P k g (\��7 �� XeSqlPkg
C � ��1 >
; C M Z c����� � XeSqlPkg_progress_report_online_index_operation Description Occurs during an online index build process to indicate the progress of the build operation. Each stage of an online index build operation generates an event. Use this event to monitor online index builds. Guid {bfcb6b84-b925-4293-9da7-ebeb01d0cfad} locale MS\0x409 DisplayName progress_report_online_index_operation �) X e S q l P k g _ e x t e n t _ a c t i v a t i o n _ c a c h e _ o v e r f l o w O\��7 �� 3 XeSqlPkg_extent_activation_cache_overflow + ) � ��" - ; G � L d � � * ; � � W����������������������������4 � extent_activation_cache_overflow EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid cache_max_count )
� 9 A � �� uint32 WmiDataId current_overflow_count )
� � � � �� uint32 WmiDataId FragmentId 6
� � � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� $ � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g P\��7 �� XeSqlPkg
C � ��# 0 � � & 3 c����M � XeSqlPkg_queryvm_context_shipping Description Occurs immediately before QVM context is serialized and shipped, and immediately after it is received and deserialized. Use this to get a dump of shipped/received QVM context data. Guid {e98b6c20-9bbd-42e1-817b-b0dad3de3538} locale MS\0x409 DisplayName queryvm_context_shipping �ing �9 A B 5 3 8 0 6 E 8 8 6 6 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0
N�8P�� ͝��C�n ��S3Ku� M � WMIBinaryMofResource C:\Windows\system32\drivers\ndis.sys[MofResourceName] urceName] ] T_CliProperty SMBIOSMajorVersion The SMBIOSMajorVersion property contains the major SMBIOS version number. This property will be NULL if SMBIOS not found. SMBIOSMajorVersion v 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier < � & � � � MSFT_CliProperty SMBIOSMinorVersion The SMBIOSMinorVersion property contains the minor SMBIOS Version number. This property will be NULL if SMBIOS not found. SMBIOSMinorVersion Q 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � ! � � � MSFT_CliProperty SMBIOSPresent The SMBIOSPresent property indicates whether the SMBIOS is available on this computer system.. SMBIOSPresent � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier ` % � � � MSFT_CliProperty SoftwareElementID This is an identifier for this software element and is designed to be used in conjunction with other keys to create a unique representation of this CIM_SoftwareElement SoftwareElementID � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ( � MSFT_CliQualifier maxlen # 256 N 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier
( � � � MSFT_CliProperty SoftwareElementState The SoftwareElementState is defined in this model to identify various states of a software elements life cycle. - A software element in the deployable state describes the details necessary to successful distribute it and the details (conditions and actions) required to create a software element in the installable state (i.e., the next state). - A software element in the installable state describes the details necessary to successfully install it and the details (conditions and actions required to create a software element in the executable state (i.e., the next state). - A software element in the executable state describes the details necessary to successfully start it and the details (conditions and actions required to create a software element in the running state (i.e., the next state). - A software element in the running state describes the details necessary to monitor and operate on a start element. SoftwareElementState � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � ] � MSFT_CliQualifier Values / ; H T Deployable Installable Executable Running � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � * � MSFT_CliProperty Status The Status property is a string indicating the current status of the object. Various operational and non-operational statuses can be defined. Operational statuses are "OK", "Degraded" and "Pred Fail". "Pred Fail" indicates that an element may be functioning properly but predicting a failure in the near future. An example is a SMART-enabled hard drive. Non-operational statuses can also be specified. These are "Error", "Starting", "Stopping" and "Service". The latter, "Service", could apply during mirror-resilvering of a disk, reload of a user permissions list, or other administrative work. Not all such work is on-line, yet the managed element is neither "OK" nor in one of the other states. Status � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 10 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap A E L V _ j t ~ OK Error Degraded Unknown Pred Fail Starting Stopping Service � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values ? C J T ] h r | OK Error Degraded Unknown Pred Fail Starting Stopping Service ure. These should be in the form of property=setting Description )
� � � ��< � ID 6
� � � ��< � � string __ �� WIN-F6NF7R6I6PJ ROOT\cimv2\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � Uninstall �5 �5 87 @7 Description This method will uninstall the associated instance of Win32_Product. The method can return the following values:
0 - Success.
2147549445 - RPC Server Fault Error.
Other - For integer values other than those listed above, refer to the documentation on error codes returned by the Windows Installer API and the Win32 error codes. Values P7 Y7 q7 Success RPC Server Fault Error Other � WIN-F6NF7R6I6PJ ROOT\cimv2\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ �
� ! � �� string Registry
� ] � �� string Root * )
� � � � � �� sint16 ValueMap �������� �F D 1 C 1 D 4 1 4 B 7 1 B 5 0 8 2 C 2 6 6 A 6 5 0 E 3 1 E F 6 D 5 0 1 9 3 8 2 7 2 4 2 4 4 B 6 8 5 F 2 1 7 C 0 A A E 0 0 A 9 2 1 �؝��C�Cȝ��C�C ��& � __SystemSecurity RequiresEncryption C I M _ C o n t r o l l e r �tR|�C�� A CIM_Controller ) # Y ��d l z ����������������������������������������������������������������� � CIM_PCMCIAController Description Capabilities and management of a PCMCIA controller. AMENDMENT LOCALE Manufacturer 8
� � � � string Description The Manufacturer property indicates the name of the PCMCIA controller manufacturer.
Example: Acme � C I M _ S y s t e m R e s o u r c e �tR|�C�� CIM_SystemResource ) N ��Y a o H [ � � A I � � E P � � ' UU������������������������E � CIM_IRQ Description The CIM_IRQ class represents an Intel architecture IRQ AMENDMENT LOCALE Availability +
� � � � � � uint16 Description Availability of the IRQ. Values � � ( Other Unknown Available In Use/Not Available In Use and Available/Shareable CreationClassName
� � � � string Description CreationClassName indicates the name of the class or the subclass used in the creation of an instance. When used with the other key properties of this class, this property allows all instances of this class and its subclasses to be uniquely identified. CSCreationClassName
� � � � string Description CSCreationClassName contains the scoping computer system's creation class name. CSName
� u } � string Description CSName contains the scoping computer system's name. IRQNumber )
� � �� uint32 Description A part of the object's key value, IRQ Number. Shareable
� | � � boolean Description Boolean indicating whether the IRQ can be shared. TriggerLevel +
� ! � � uint16 Description IRQ trigger level indicating whether the interrupt is triggered by the hardware signal going high (value=4) or low (value=3). Also, "Other" (1) and "Unknown" (2) may be defined. Values � �
Other Unknown Active Low Active High TriggerType +
� ` h u uint16 Description IRQ trigger type indicating whether edge (value=4) or level triggered (value=3) interrupts occur. Also, "Other" (1) and "Unknown" (2) may be defined. Values ( / 8 ? Other Unknown Level Edge � C I M _ L o g i c a l E l e m e n t �tR|�C�~ CIM_LogicalElement ) ! �� $ � CIM_SystemResource Description The CIM_SystemResource class is an entity managed by BIOS and/or an operating system which is available for use by software and/or logical devices. Examples of Resources in the x86 environment are IRQs, DMA channels and memory mapped I/O. AMENDMENT LOCALE � C I M _ M a n a g e d S y s t e m E l e m e n t uR|�C�z " CIM_ManagedSystemElement �� ' � CIM_LogicalElement AMENDMENT LOCALE � juR|�C�h ) ' { ��� � � Q ` ���������
� RSOP_IEToolbarButtonLink Description An association between an IEAK policy setting and a custom browser toolbar button. AMENDMENT LOCALE policySetting f 6
� � � ���
4 A ref:RSOP_IEAKPolicySetting Description Reference to the RSOP_IEAKPolicySetting. DisplayName Policy Setting toolbarButton f 6
� � � ��� � � � ref:RSOP_IEToolbarButton Description Reference to the IE toolbar button. DisplayName Toolbar Button t �6 4 6 5 9 A B 9 F 8 F 1 C 4 B 5 6 8 D B 6 4 3 8 B A E 1 1 B 2 6 E E 8 F 9 3 C B 5 F 8 1 9 5 E 2 1 E 8 C 3 8 3 D 6 C 4 4 C C 4 1 ���$��ȝ��C�,
� __NAMESPACE ms_409 5 7 E 5 F 3 A D D 9 E 2 4 2 C 4 E 9 F 9 E D F 7 9 A A 9 7 F 7 9 E 7 9 1 1 C 5 A 8 B 9 0 2 E C 1 5 0 D 6 4 4 2 E 3 B 8 5 A 5 A A �I����ȝ��C�� �?����J �� 9 S � __Win32Provider {BE0A9830-2B8B-11d1-A949-0060181EBBAD} LocalSystemHost MSIProv E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C �I���� ȝ��C�| � �������� O � __InstanceProviderRegistration \\.\root\cimv2:__Win32Provider.Name="MSIProv"
R O O T \ c i m v 2 _ _ I n s t a n c e P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 6 8 5 7 7 3 7 2 C 6 6 A 7 B 2 0 6 5 8 4 8 7 F B D 9 5 9 A A 1 5 4 E F 5 4 B 5 F 9 3 5 D C C 5 6 6 3 E 9 2 2 8 B 4 4 3 2 2 8 0 5 \ K I _ E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C \ I _ 0 B 5 A C 8 3 F B 2 7 2 5 D 3 3 B 4 1 C F F 3 B 5 1 E F 3 3 4 6 7 B 9 6 0 F D 4 E 7 B 5 4 F 0 5 5 E D 5 8 0 C 6 4 C 0 8 6 2 7 0 7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D �I����
ȝ��C�d M � __MethodProviderRegistration \\.\root\cimv2:__Win32Provider.Name="MSIProv"
R O O T \ c i m v 2 _ _ M e t h o d P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 6 8 5 7 7 3 7 2 C 6 6 A 7 B 2 0 6 5 8 4 8 7 F B D 9 5 9 A A 1 5 4 E F 5 4 B 5 F 9 3 5 D C C 5 6 6 3 E 9 2 2 8 B 4 4 3 2 2 8 0 5 \ K I _ 7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D \ I _ 0 B 5 A C 8 3 F B 2 7 2 5 D 3 3 B 4 1 C F F 3 B 5 1 E F 3 3 4 6 7 B 9 6 0 F D 4 E 7 B 5 4 F 0 5 5 E D 5 8 0 C 6 4 C 0 8 6 2 7 0 h 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier . ) 3 � � MSFT_CliProperty TargetOperatingSystem The TargetOperatingSystem property allows the provider to specify the operating system environment. The value of this property does not ensure binary executable. Two other pieces of information are needed. First, the version of the OS needs to be specified using the OS version check. The second piece of information is the architecture the OS runs on. The combination of these constructs allows the provider to clearly identify the level of OS required for a particular software element. TargetOperatingSystem ; G � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values : ' - 4 B K Q V [ b h p w ~ � � � � � � � � � � � � � �
( 0 7 = D L ^ g p x � � � � � � � � � � � � � Unknown Other MACOS ATTUNIX DGUX DECNT Digital Unix OpenVMS HPUX AIX MVS OS400 OS/2 JavaVM MSDOS WIN3x WIN95 WIN98 WINNT WINCE NCR3000 NetWare OSF DC/OS Reliant UNIX SCO UnixWare SCO OpenServer Sequent IRIX Solaris SunOS U6000 ASERIES TandemNSK TandemNT BS2000 LINUX Lynx XENIX VM/ESA Interactive UNIX BSDUNIX FreeBSD NetBSD GNU Hurd OS9 MACH Kernel Inferno QNX EPOC IxWorks VxWorks MiNT BeOS HP MPE NextStep PalmPilot Rhapsody � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � � � MSFT_CliProperty Version The Version property contains the version of the BIOS. This string is created by the BIOS manufacturer. Version � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier Maxlen # 64 % �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty #$ � � MSFT_CliFormat TABLE STATUS 3 � � h � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � * � MSFT_CliProperty Status The Status property is a string indicating the current status of the object. Various operational and non-operational statuses can be defined. Operational statuses are "OK", "Degraded" and "Pred Fail". "Pred Fail" indicates that an element may be functioning properly but predicting a failure in the near future. An example is a SMART-enabled hard drive. Non-operational statuses can also be specified. These are "Error", "Starting", "Stopping" and "Service". The latter, "Service", could apply during mirror-resilvering of a disk, reload of a user permissions list, or other administrative work. Not all such work is on-line, yet the managed element is neither "OK" nor in one of the other states. Status � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 10 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap A E L V _ j t ~ OK Error Degraded Unknown Pred Fail Starting Stopping Service � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values ? C J T ] h r | OK Error Degraded Unknown Pred Fail Starting Stopping Service � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier m I O r � MSFT_CliProperty Name The name used to identify this software element Name W � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ( � MSFT_CliQualifier maxlen # 256 � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � q z � � MSFT_CliProperty Caption The Caption property is a short textual description (one-line string) of the object. Caption � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 64 � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier S � ! � � � MSFT_CliProperty SMBIOSPresent The SMBIOSPresent property indicates whether the SMBIOS is available on this computer system./nValues: TRUE or FALSE. If TRUE, SMBIOS is on this computer. SMBIOSPresent BIOS Select * from Win32_BIOS ��Ƿ� 7 ���y� � ��c�� ,
�ԙ� �
���R + H���} ] �ގ � ��C� s �?���
�ʝ��C� ) k ��v ~ � $ / u��������� � CIM_Dependency Description A generic association to establish dependency relationships between objects. AMENDMENT LOCALE Antecedent f
� � � � ref:CIM_ManagedSystemElement Description Antecedent represents the independent object in this association. Dependent f
� [ y � ref:CIM_ManagedSystemElement Description Dependent represents the object dependent on the Antecedent. ed � C I M _ L o g i c a l D e v i c e [tR|�C�� 2 CIM_LogicalDevice ) � ��� ��������������������������������������������������� � CIM_Sensor Description The CIM_Sensor class represents a hardware device capable of measuring the characteristics of some physical property - for example, the temperature or voltage characteristics of a unitary computersystem. AMENDMENT LOCALE � C I M _ M e d i a A c c e s s D e v i c e ztR|�C�� j CIM_MediaAccessDevice ) �� ����������������������������������������������������������������������������������������������������������# � CIM_CDROMDrive Description The CIM_CDROMDrive class represents a CD-ROM drive on the system.
<B>Note:</B> The name of the drive does not correspond to the logical drive letter assigned to device, which is the name of the logical storage device dependent on this drive. AMENDMENT LOCALE � C I M _ S e r v i c e �tR|�C�N CIM_Service
) $ � ��� ������������������������� � CIM_ClusteringService Description The CIM_ClusteringService class represents the functionality provided by a cluster. For example, failover functionality may be modeled as a service of a failover cluster. AMENDMENT LOCALE ! 4 � p { � a � � AddNode ' Description AddNode brings a new computer system into a cluster. The node to be added is specified as a parameter to the method. The return value should be 0 if the computer system is successfully added, 1 if the method is not supported and any other number if an error occurred. � a42c9160500003S ROOT\CIMV2\ms_409 ���� � �Z �� * � ����� � __PARAMETERS abstract f CS ref f
� . IN f
� . R �� ID f )
� � R ��� ref:CIM_ComputerSystem __ �� a42c9160500003S ROOT\CIMV2\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � EvictNode � � Description EvictNode removes a computer system from a cluster. The node to be evicted is specified as a parameter to the method. The return value should be 0 if the computer system is successfully evicted, 1 if the method is not supported and any other number if an error occurred. � a42c9160500003S ROOT\CIMV2\ms_409 ���� � �Z �� * � ����� � __PARAMETERS abstract f CS ref f
� . IN f
� . R �� ID f )
� � R ��� ref:CIM_ComputerSystem __ �� a42c9160500003S ROOT\CIMV2\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � C I M _ S e r v i c e A c c e s s P o i n t �tR|�C�� CIM_ServiceAccessPoint ) ` ��k ����������������������s � CIM_ClusteringSAP Description A representation of the access points of a clustering service. AMENDMENT LOCALE � C I M _ L o g i c a l E l e m e n t �tR|�C�� CIM_LogicalElement ) % � ��� � � . 4 W p � � E K U���������������������= � CIM_ServiceAccessPoint Description CIM_ServiceAccessPoint represents the ability to utilize or invoke a service. Access points represent that a service is made available to other entities for use. AMENDMENT LOCALE CreationClassName
� # 0 string Description CreationClassName indicates the name of the class or the subclass used in the creation of an instance. When used with the other key properties of this class, this property allows all instances of this class and its subclasses to be uniquely identified. Name )
� k s � � �� string Description The Name property uniquely identifies the service access point and provides an indication of the functionality that is managed. This functionality is described in more detail in the object's Description property. SystemCreationClassName
� � � � string Description The scoping system's creation class name. SystemName
� ) string Description The scoping system's name. Type +
� � � � � � uint32 BitValues � � � � � Write Read Redirected Net_Attached unknown Description The Type property indicates the type of SAP such as 'attached' or 'Redirected'. rv � uR|�C�� )
j ��u } � A J � � � � > J � � � � U������������������������F � RSOP_GPLink Description This class represents the links from a domain, OU, site or local scope to GPOs AMENDMENT LOCALE appliedOrder +
� � � � % 2 uint32 Description Overall Order of the Applied GPO Links found acrossall the applicable SOMs DisplayName Applied Order enabled +
� � � � � � boolean Description Indicates whether this link is enabled or disabled DisplayName Is Enabled GPO f 6
� / � ��= J v � ref:RSOP_GPO Description Reference to GPO associated with this link DisplayName GPO linkOrder +
� � � � % 2 uint32 Description Overall Order of the GPO Links found acrossall the applicable SOMs DisplayName Link Order noOverride +
� � � � � � boolean Description Indicates whether this link is enforced down the SOM hierarchy DisplayName Force SOM f 6
� 6 � ��D Q � � ref:RSOP_SOM Description Reference to the SOM or scope of management associated with this link DisplayName SOM somOrder 6
� � � ��
. ; uint32 Description Order of the GPO within the SOM DisplayName SOM Order � �vR|�C�[ �� & � Win32_Reliability AMENDMENT LOCALE � ���C�� ) $ 1 � ��� � � � Win32_ManagedSystemElementResource Description This association relates an MSI feature with an action used to register and/or publish the feature AMENDMENT LOCALE ms_409 � � �g]P x ��\� � �7� � ��.�9 R C I M _ S o f t w a r e F e a t u r e LtR|�C�b ! CIM_SoftwareFeature ) $ N ��Y a i s � � F T Q Z �W�������������������������������� � Win32_SoftwareFeature Description SoftwareFeatures and SoftwareElements: A 'SoftwareFeature' is a distinct subset of a Product, consisting of one or more 'SoftwareElements'. Each SoftwareElement is defined in a Win32_SoftwareElement instance, and the association between a feature and its SoftwareFeature(s) is defined in the Win32_SoftwareFeatureSoftwareElement Association. Any component can be 'shared' between two or more SoftwareFeatures. If two or more features reference the same component, that component will be selected for installation if any of these features are selected. AMENDMENT LOCALE ms_409 Accesses
� � � � uint16 Description Number of times this SoftwareFeature has been used Attributes
� ( 5 uint16 Description Remote execution option, one of irsEnum: ifrsFavorLocal = 0: Install components locally, if possible ifrsFavorSource = 1: Install components to run from the source CD/Server, if possible ifrsFollowParent = 2: Follow the remote execution option of the parent feature InstallState +
� � � � � � sint16 Description The installed state of the software feature. Values � . : B I Bad Configuration Invalid Argument Unknown Package Advertised Absent Local Source LastUse e
� � � � datetime Description Last time this SoftwareFeature was used �
� _ � � � $ �
� Reinstall ) 6 � � Description This method will reinstall the associated instance of Win32_SoftwareFeature using the specified reinstallation mode. The method can return the following values:
0 - Success.
2147549445 - RPC Server Fault Error.
Other - For integer values other than those listed above, refer to the documentation on error codes returned by the Windows Installer API and the Win32 error codes. Values � � � Success RPC Server Fault Error Other k WIN-F6NF7R6I6PJ ROOT\cimv2\ms_409 ���� � � �� * � ��D � __PARAMETERS abstract ReinstallMode uint16
� 9 in
� 9 ` �� Specifies the reinstall mode Description )
� 9 ` ��� �
) ; M X d q { � � FileMissing FileOlderVersion FileEqualVersion FileExact FileVerify FileReplace UserData MachineData Shortcut Package Values 6
� 9 ` ��� � � � ID C
� < ` ��� � � � � uint16 __ �� WIN-F6NF7R6I6PJ ROOT\cimv2\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � Configure � � Description This method will configure the associated instance of Win32_SoftwareFeature to the specified install state. The method can return the following values:
0 - Success.
2147549445 - RPC Server Fault Error.
Other - For integer values other than those listed above, refer to the documentation on error codes returned by the Windows Installer API and the Win32 error codes. Values � � � Success RPC Server Fault Error Other V WIN-F6NF7R6I6PJ ROOT\cimv2\ms_409 ���� � �� �� * ��_ � __PARAMETERS abstract InstallState uint16
� 8 in
� 8 _ �� � � � � � Default Advertise Local Absent Source Values )
� 8 _ ��� � ID 6
� W _ ��� � uint16 __ �� WIN-F6NF7R6I6PJ ROOT\cimv2\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � C I M _ S o f t w a r e E l e m e n t �tR|�C�� 8 CIM_SoftwareElement ) $ N ��Y a i u �������������������������������������������������������� � Win32_SoftwareElement Description SoftwareFeatures and SoftwareElements: A 'SoftwareFeature' is a distinct subset of a Product, consisting of one or more 'SoftwareElements'. Each SoftwareElement is defined in a Win32_SoftwareElement instance, and the association between a feature and its SoftwareFeature(s) is defined in the Win32_SoftwareFeatureSoftwareElement Association. Any component can be 'shared' between two or more SoftwareFeatures. If two or more features reference the same component, that component will be selected for installation if any of these features are selected. AMENDMENT LOCALE ms_409 Attributes ,
� � � � uint16 Description A bit map containing the remote execution options for the software element. InstallState 2 +
� J R _ � � sint16 Description The current installed state for the software element. values � � � � � � Not Used Bad Configuration Source Absent Error Absent Local Source Path
.
� : B O string Description The path to the installed software element. If the component is a registry key,the registry roots are represented numerically. For example, a registry path of "HKEY_CURRENT_USER\SOFTWARE\Microsoft" would be returned as "01:\SOFTWARE\Microsoft". The registry roots returned are defined as follows:RootReturned Value
HKEY_CLASSES_ROOT 00
HKEY_CURRENT_USER 01
HKEY_LOCAL_MACHINE 02
HKEY_USERS 03 � C I M _ S e r v i c e �tR|�C�� CIM_Service
) ' � �� ������������������������ � Win32_ApplicationService Description The Win32_ApplicationService class represents any installed or advertised components or applications available on the system. Instances of this class include all properly installed and instrumented executables. AMENDMENT LOCALE ms_409 � C I M _ S e r v i c e A c c e s s P o i n t �tR|�C� CIM_ServiceAccessPoint ) & � ��� � � � ��������������������������� � Win32_CommandLineAccess Description The Win32_CommandLineAccess class represents the command line interface to a service or application. The name of the access point is always the full command line text. AMENDMENT LOCALE ms_409 CommandLine
� # + 8 string Description The value of the Commandline property provides the string used to start the service. �ice. �_409 � __ �S 03 � __ �= WIN-F6NF7R6I6PJ ROOT\Microsoft\Windows\Smb ���� � �� �� * � ~ � ��������� � __PARAMETERS abstract
CreatedMapping object
� : Out
� : a �� MSFT_SmbServerCertificateMapping EmbeddedInstance
)
� : a ��� � ID
6
� C a ��� � � object:MSFT_SmbServerCertificateMapping ReturnValue uint32
� � uint32 out
� � � �� __ � GrantClientAccessToServer �� implemented & WIN-F6NF7R6I6PJ ROOT\Microsoft\Windows\Smb ���� � ��
�� � � I * � ������������? � __PARAMETERS abstract IdentifierType uint32
� : In
� : a �� ID )
� � a ��� uint32 Identifier string
� � In
� � �� ID )
� � ��E string Description string
� � In
� � � �� ID )
� 7 � ��� string __ �u WIN-F6NF7R6I6PJ ROOT\Microsoft\Windows\Smb ���� � � �� * � � �������� � __PARAMETERS abstract
Output object
� 2 Out
� 2 Y �� MSFT_SmbServerCertificateMappingAccessControlEntry EmbeddedInstance
)
� 2 Y ��� � ID
6
� M Y ��� � object:MSFT_SmbServerCertificateMappingAccessControlEntry ReturnValue uint32
� � uint32 out
� � � �� __ � RevokeClientAccessToServer �' �� implemented � WIN-F6NF7R6I6PJ ROOT\Microsoft\Windows\Smb ���� � �I �� � I * � ��������� � __PARAMETERS abstract IdentifierType uint32
� : In
� : a �� ID )
� � a ��� uint32 Identifier string
� � In
� � �� ID )
� � ��E string __ �u WIN-F6NF7R6I6PJ ROOT\Microsoft\Windows\Smb ���� � � �� * � � �������� � __PARAMETERS abstract
Output object
� 2 Out
� 2 Y �� MSFT_SmbServerCertificateMappingAccessControlEntry EmbeddedInstance
)
� 2 Y ��� � ID
6
� M Y ��� � object:MSFT_SmbServerCertificateMappingAccessControlEntry ReturnValue uint32
� � uint32 out
� � � �� __ � BlockClientAccessToServer X/ �� implemented & WIN-F6NF7R6I6PJ ROOT\Microsoft\Windows\Smb ���� � ��
�� � � I * � ������������? � __PARAMETERS abstract IdentifierType uint32
� : In
� : a �� ID )
� � a ��� uint32 Identifier string
� � In
� � �� ID )
� � ��E string Description string
� � In
� � � �� ID )
� 7 � ��� string __ �u WIN-F6NF7R6I6PJ ROOT\Microsoft\Windows\Smb ���� � � �� * � � �������� � __PARAMETERS abstract
Output object
� 2 Out
� 2 Y �� MSFT_SmbServerCertificateMappingAccessControlEntry EmbeddedInstance
)
� 2 Y ��� � ID
6
� M Y ��� � object:MSFT_SmbServerCertificateMappingAccessControlEntry ReturnValue uint32
� � uint32 out
� � � �� __ � UnblockClientAccessToServer 48 �� implemented � WIN-F6NF7R6I6PJ ROOT\Microsoft\Windows\Smb ���� � �I �� � I * � ��������� � __PARAMETERS abstract IdentifierType uint32
� : In
� : a �� ID )
� � a ��� uint32 Identifier string
� � In
� � �� ID )
� � ��E �SdҀ ���X� � I�#j� _ 0� � ���� a ��� � �Q�o� ' X e S o s P k g _ p l a c e _ h o l d e r _ f o r _ s p i n l o c k _ m a p s $_��7 �� 7 1 XeSosPkg_place_holder_for_spinlock_maps ) ) � �� + 9 E � � k | � u � r � = S WU������������������������������������������������������ � place_holder_for_spinlock_maps EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid FragmentId 6
� ? G R _ � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� E M X e � �� uint32 WmiDataId Description SequenceNumber sos_rw_spinlock P
� � � � ���
* 2 uint64 WmiDataId XEMapId ValueMap ! $ ' 3 1 2 0 Values F Z a i SOS_SYSTEM_RW_LAST RW_AR RW_GTL RW_TEST sos_spinlock P
� � � � ��� � � � uint64 WmiDataId XEMapId ValueMap : � � � � �
# ' * - 1 5 9 = A E I M Q T X \ ` c g k o s w { � � � � � � � � � � � � � � � � � � � 57 6 38 36 7 50 15 0 33 3 2 47 37 35 46 4 5 23 12 48 22 21 26 31 45 49 8 34 14 16 1 32 29 19 27 17 10 20 24 9 30 11 18 13 28 25 51 53 54 56 55 52 39 44 43 40 42 41 Values : � � � �
4 K _ w � � � � � � � � 3 N ^ t � � � � � � �
. G ^ m � � � � � � � �
(
2
G
b
�
�
�
�
�
& SOS_SYSTEM_LAST BLOCKER_ENUM DELAYED_PARTITIONED_STACK DISPATCHER_LIST DISPATCHER_QUEUE DRTL_MODULEINFOLIST GLOBAL_SCHEDULER_LIST GLOBAL_TRACE_FLAGS IO_RG_VOLUME_HASHTABLE LOG_RG_GOVERNOR MEM_MGR NONYIELD_ANALYSIS PARTITIONED_HEAP_FREE_LIST RESMANAGER RESQUEUE RG_TIMER SEQUENCED_OBJECT SOS_ABORT_TASK SOS_ACTIVEDESCRIPTOR SOS_BLOCKALLOCPARTIALLIST SOS_BLOCKDESCRIPTORBUCKET SOS_CACHESTORE SOS_CACHESTORE_CLOCK SOS_CLOCKALG_INTERNODE_SYNC SOS_DEBUG_HOOK SOS_DESCDATABUFFERLIST SOS_DISPATCHER SOS_LARGEPAGE_ALLOCATOR SOS_MINITHREAD SOS_NODE SOS_OBJECT_POOL SOS_OBJECT_STORE SOS_OOM_CHECK SOS_RESOURCE_CLERK_LIST SOS_RINGBUFFER_RECORD SOS_SCHEDULER SOS_SCHEDULER_TIMER SOS_SELIST_SIZED_SLOCK SOS_SUSPEND_QUEUE SOS_SYSTHREAD SOS_SYSTHREAD_DISPATCHER SOS_TASK SOS_TLIST SOS_VM_LOW SOS_WAIT_STATS SOS_WAITABLE_ADDRESS_HASHBUCKET TESTTEAM TESTTEAMEXPONENTIAL TESTTEAMEXPONENTIALTASTAS TESTTEAMREPORTINGOPTIONSCHECKCLOUDDB TESTTEAMREPORTINGOPTIONSCHECKUNUSED TESTTEAMTASTAS XE_BUFFER_MGR XE_DISPATCHER_QUEUE XE_NOTIFICATION_CALLBACK_LIST XE_SESSION_EVENT_MGR XE_SESSION_MGR XE_SESSION_TARGET_MGR sqlservr_rw_spinlock , P
� � � � ��� � � � � uint64 WmiDataId XEMapId ValueMap � 0 Values � SOS_CLIENT_RW_LAST sqlservr_spinlock $ P
� w � ��� � � G
O
uint64 WmiDataId XEMapId ValueMap � �
"
&
)
-
1
4
8
<
?
C
21 1 9 11 12 7 14 0 5 6 15 2 10 3 16 13 8 19 17 4 20 18 Values �
�
�
�
�
�
* 3 C S Z a v { � � � � � SOS_CLIENT_LAST ASYNCSTATSLIST CACHEOBJ_DBG CLR_HOSTTASK CLR_SPIN_LOCK COM_INIT CONNECTION_MANAGER CONNECTS EXT_CACHE FT_INIT HOT_NODE_CACHE HTTP_CONNCACHE IOREQ MUTEX SESSION_SEC_CONTEXT SNI SOAPSESSIONS SOS_PHYS_PAGE_CACHE SOS_RW SRVPROC STACK_HASHER XE_SESSION_STORAGE �
E v e n t T r a c e %_��7 �� EventTrace 6 � �� 0 6 ^ f p � XEvent_Package0 Description XEvent Package 0 Guid {60aa9fbf-673b-4553-b7ed-71dca7f5e972} locale MS\0x409 X � X E v e n t _ P a c k a g e 0 &_��7 �) XEvent_Package0 C � ��! . O U } � � � � � XEvent_Package0_XferEventParent Description XEvent_Package0_XferEventParent Guid {b1c5b348-099d-4f62-845f-c1573bac72ac} locale MS\0x409 DisplayName Activity Id Transfer Event ag � X E v e n t _ P a c k a g e 0 _ X f e r E v e n t P a r e n t '_��7 �n ) XEvent_Package0_XferEventParent ! ) � �� ( C N Z � � � � 1 E U�������������������������� � XEvent_Package0_XferEvent Description XEvent_Package0_XferEvent EventType ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid FragmentId 6
� T \ g t � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� Z b m z � �� uint32 WmiDataId Description SequenceNumber XferActivityId
C
� � � � �� + object:guid WmiDataId Description XferActivityId Extension Guid XferSequenceNumber 6
� � � � � � �� uint32 WmiDataId Description XferSequenceNumber � X E v e n t _ P a c k a g e 0 (_��7 �+ XEvent_Package0 C � ��% 2 W ] � � � � � � XEvent_Package0_FragmentEventParent Description XEvent_Package0_FragmentEventParent Guid {9fbd558c-9713-439c-bccd-68d631b6a135} locale MS\0x409 DisplayName Large Event Fragment t_ �# X E v e n t _ P a c k a g e 0 _ F r a g m e n t E v e n t P a r e n t )_��7 �. - XEvent_Package0_FragmentEventParent % ) � �� , K V b � � U����������������� � XEvent_Package0_FragmentEvent Description XEvent_Package0_FragmentEvent EventType ActivityId
N
� � � � � � �� � ��� object:guid WmiDataId Description ActivityId ActivityID Extension Guid FragmentId 6
� \ d o | � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� b j u � � �� uint32 WmiDataId Description SequenceNumber � R O O T \ c i m v 2 \ m d m \ d m m a p _ _ I n s t a n c e P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 0 6 3 4 B E A A A 6 D 4 7 E 6 3 7 1 9 9 9 A D 4 0 5 E 0 D D A F D A 3 B D A B 3 6 5 9 C 4 8 5 8 F 5 6 5 9 3 6 A 4 9 0 9 9 8 1 F \ K I _ E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C \ I _ 1 0 3 5 B 0 F 6 2 E A A E C C 9 C 9 8 4 E 7 8 3 4 D 0 A B 6 A 9 9 2 8 5 0 6 8 5 2 D 8 C 8 4 0 D 1 4 F 9 B A B 2 A A E 4 A 6 8 B lbase.dll.mui[MofResourceName] 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0 i ���� ͝��C�l Xѣ� D� K � WMIBinaryMofResource C:\Windows\System32\drivers\monitor.sys[MonitorWMI] \0x409 DisplayName disk_log_read_ignore � �k F D 3 B B D 4 C 4 2 A C 2 F 7 F E F 2 6 4 3 4 0 A 9 E B 7 8 A 5 8 1 F E 5 C 2 8 5 6 1 C B 6 3 E D F 7 8 0 B 3 2 9 E A C 2 E E 4 �b��5��͝��C�*k � + K �j �j �j �j � MSFT_CliAlias � F N u � � � � �
U�������������������������4 � MSFT_CliConnection Authority
� > STRING Locale
� m STRING NameSpace
� � STRING Password
� � STRING Server
� � STRING User
� , STRING | � ( + � MSFT_CliConnection ms_409 ROOT\CIMV2 . Boot configuration management. c � +! �1 �V s �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � + � MSFT_CliFormat SYSTEM
D � � U � b
�
x � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty __CLASS __CLASS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __DERIVATION __DERIVATION � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __DYNASTY __DYNASTY � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty __GENUS __GENUS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier t � , � MSFT_CliProperty __NAMESPACE __NAMESPACE � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o � " � MSFT_CliProperty __PATH __PATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier y � $ 6 � MSFT_CliProperty __PROPERTY_COUNT __PROPERTY_COUNT � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __RELPATH __RELPATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier q � & � MSFT_CliProperty __SERVER __SERVER � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __SUPERCLASS __SUPERCLASS M �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty Z ! � � MSFT_CliFormat TABLE INSTANCE ) � string __ �u WIN-F6NF7R6I6PJ ROOT\Microsoft\Windows\Smb ���� � � �� * � � �������� � __PARAMETERS abstract
Output object
� 2 Out
� 2 Y �� MSFT_SmbServerCertificateMappingAccessControlEntry EmbeddedInstance
)
� 2 Y ��� � ID
6
� M Y ��� � object:MSFT_SmbServerCertificateMappingAccessControlEntry ReturnValue uint32
� � uint32 out
� � � �� __ � GetAccessControlEntries �? �� implemented WIN-F6NF7R6I6PJ ROOT\Microsoft\Windows\Smb ���� � �� �� * Q � . ��������X � __PARAMETERS abstract
Output object
� 2 Out
� 2 Y �� Stream
'
� 2 Y ��� �� MSFT_SmbServerCertificateMappingAccessControlEntry EmbeddedInstance
4
� 2 Y ��� ��� � ID
A
� � Y ��� ��� � M object:MSFT_SmbServerCertificateMappingAccessControlEntry ReturnValue uint32
� ! uint32 out
� ! ) �� __ � �w}p � & g�E # C ��h �Є
� ��� �&�*� r��
���� �O� ��& k80D q��U % +���z % ��Sz� ��1�� K3�j� q��
� �7�4� γ� \��� ��֧ ���
B a s e S t a t u s ,L�9�� BaseStatus ) � �� � ' = E U � � � �
J V � � � � T� ������������������������ � MSFT_MpBehavioralNetworkBlockingRules ProtectionManagement locale BlockingAction
� � �� string Direction
� � � �� string FilterGUID '
� � �� � �� string IpAddress
� B � �� string LocalPorts
� � � �� string Protocol
� � � �� string RemotePorts
� � � �� string 7 R � � Remove " ��/ �� implemented static WIN-F6NF7R6I6PJ ROOT\Microsoft\Windows\Defender ���� � �� �� * � ����� � __PARAMETERS abstract FilterGUID string
� 6 In
� 6 ] �� ID )
� � ] ��� string __ �� WIN-F6NF7R6I6PJ ROOT\Microsoft\Windows\Defender ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/pl\}�
͝��C�� 1 ��
�S}� p � WDMClassesOfDriver WHEAPolicyManagementMethods C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/pl\}�
͝��C�� * ��
�S}� i � WDMClassesOfDriver WHEAPluginCtlMethods C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/pl\}�
͝��C�� ��
�S}� ^ � WDMClassesOfDriver MS_SmBios C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/pl\}�
͝��C�� . ��
�S}� m � WDMClassesOfDriver MSSmBios_RawSMBiosTables C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/pl\}�
͝��C�� - ��
�S}� l � WDMClassesOfDriver MSSmBios_SMBiosEventlog C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/pl\}�
͝��C�� ( ��
�S}� g � WDMClassesOfDriver MSSmBios_SysidUUID C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/pl\}�
͝��C�� , ��
�S}� k � WDMClassesOfDriver MSSmBios_SysidUUIDList C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/pl\}�
͝��C�� ( ��
�S}� g � WDMClassesOfDriver MSSmBios_Sysid1394 C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/pl\}�
͝��C�� , ��
�S}� k � WDMClassesOfDriver MSSmBios_Sysid1394List C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/pl\}�
͝��C�� ��
�S}� ^ � WDMClassesOfDriver MSMCAInfo C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/pl\}�
͝��C�� 3 ��
�S}� r � WDMClassesOfDriver MSMCAEvent_SwitchToCMCPolling C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/pl\}�
͝��C�� 3 ��
�S}� r � WDMClassesOfDriver MSMCAEvent_SwitchToCPEPolling C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/pl\}�
͝��C�� ' ��
�S}� f � WDMClassesOfDriver MSMCAEvent_Header C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/pl\}�
͝��C�� ) ��
�S}� h � WDMClassesOfDriver MSMCAEvent_BusError C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�x J.3�� U � WDMClassesOfDriver MSWmi_Guid C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ѣn�^��
͝��C� ' J.3�� \ � WDMClassesOfDriver MSWmi_PnPDeviceId C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ңn�^��
͝��C�� , J.3�� a � WDMClassesOfDriver MSWmi_PnPInstanceNames C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ӣn�^��
͝��C�� 0 J.3�� e � WDMClassesOfDriver MSWmi_GuidRegistrationInfo C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ԣn�^��
͝��C�x J.3�� U � WDMClassesOfDriver MSAcpiInfo C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 գn�^��
͝��C�r J.3�� O � WDMClassesOfDriver WHEA C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ֣n�^��
͝��C�� / J.3�� d � WDMClassesOfDriver WHEAErrorInjectionMethods C:\Windows\system32\kernelbase.dll[MofResourceName] ] A 5 4 8 6 5 F 4 3*pl\}�
͝��C�x �\>�S}� U � WDMClassesOfDriver MSAcpiInfo C:\Windows\system32\kernelbase.dll[MofResourceName] me] lbase.dll.mui[MofResourceName] Resource] 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier m � � MSFT_CliProperty Name Name � �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � � � MSFT_CliFormat Status ( � � � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier m � � MSFT_CliProperty Name Name � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier } K V y � MSFT_CliProperty SettingID The identifier by which the object is known. SettingID ^ � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ( � MSFT_CliQualifier MaxLen # 256 I 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � % u � � MSFT_CliProperty ConfigurationPath The ConfigurationPath property indicates the path to the configuration files. ConfigurationPath % �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty ,$ � � MSFT_CliFormat LIST FULL @ � � W K
� k V 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � ! � � � MSFT_CliProperty BootDirectory The BootDirectory property indicates the path to the system files required for booting the system. BootDirectory I 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � % u � � MSFT_CliProperty ConfigurationPath The ConfigurationPath property indicates the path to the configuration files. ConfigurationPath 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � E R � MSFT_CliProperty Description A textual description of the object. Description H 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � | � � MSFT_CliProperty LastDrive The LastDrive property indicates the last drive letter to which a physical drive is assigned. LastDrive � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � � � MSFT_CliProperty Name The Name property indicates the name of the boot configuration. It is an identifier for the boot configuration. Name � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ( � MSFT_CliQualifier MaxLen # 256 EnableLeasing boolean
� % In
� % M �� ID )
� � M ��{ boolean EnableMultiChannel boolean
� � In
� �
�� ID )
� v
��;
boolean
EnableStrictNameChecking boolean
� � In
� � � �� ID
)
� < � �� boolean DisableCompression boolean
� k In
� k � �� ID )
� � � ��� boolean DurableHandleV2TimeoutInSeconds boolean
� 8 In
� 8 ` �� ID )
� � ` ���
boolean
EnableOplocks boolean
� � In
� �
�� ID
)
� �
��I
boolean ServerHidden boolean
� �
In
� �
�
�� ID )
� > �
�� boolean IrpStackSize boolean
� g In
� g � �� ID )
� � � ��� boolean KeepAliveTime boolean
� " In
� " J �� ID )
� � J ��x boolean " MaxChannelPerSession boolean "
� � In "
� �
�� ID " )
� u
��:
boolean $ MaxMpxCount boolean $
� �
In $
� �
�
�� ID $ )
� . �
���
boolean & MaxSessionPerConnection boolean &
� b In &
� b � �� ID & )
� � � ��� boolean ( MaxThreadsPerQueue boolean (
� " In (
� " J �� ID ( )
� � J ��x boolean * MaxWorkItems boolean *
� � In *
� � �� ID * )
� m ��2 boolean , NullSessionShares boolean ,
� � In ,
� � � �� ID , )
� , � ��� boolean . OplockBreakWait boolean .
� X In .
� X � �� ID . )
� � � ��� boolean 0 PendingClientTimeoutInSeconds boolean 0
� # In 0
� # K �� ID 0 )
� � K ��y boolean 2 EnableSMB2Protocol boolean 2
� � In 2
� � �� ID 2 )
� t ��9 boolean 4 Smb2CreditsMax boolean 4
� � In 4
� � � �� ID 4 )
� 0 � ��� boolean 6 Smb2CreditsMin boolean 6
� [ In 6
� [ � �� ID 6 )
� � � ��� boolean 8 SmbServerNameHardeningLevel boolean 8
� $ In 8
� $ L �� ID 8 )
� � L ��z boolean : TreatHostAsStableStorage boolean :
� � In :
� � �� ID : )
� { ��@ boolean < ValidateAliasNotCircular boolean <
� � In <
� � � �� ID < )
� A � �� boolean > ValidateShareScope boolean >
� p In >
� p � �� ID > )
� � ��� boolean @ ValidateShareScopeNotAliased boolean @
� : In @
� : b �� ID @ )
� � b ��� ! boolean ! B ValidateTargetName boolean ! B
� � In ! B
� � " �� ID ! B )
� � " ��P " boolean " D EncryptData boolean " D
� � In " D
� � � �� ID " D )
� D � �� # boolean # F RejectUnencryptedAccess boolean # F
� x In # F
� x � �� ID # F )
� � ��� $ boolean $ H AuditSmb1Access boolean $ H
� 5 In $ H
� 5 ] �� ID $ H )
� � ] ��� % boolean % J DisableSmbEncryptionOnSecureConnection boolean % J
� In % J
� 1 �� ID % J )
� � 1 ��_ & boolean & L RequestCompression boolean & L
� � In & L
� � � �� ID & L )
� Z � �� ' boolean ' N RestrictNamedpipeAccessViaQuic boolean ' N
� � In ' N
� � � �� ID ' N )
� & � ��� ( boolean ( P EnableSMBQUIC boolean ( P
� P In ( P
� P x �� ID ( P )
� � x ��� ) boolean ) R EncryptionCiphers boolean ) R
� In ) R
� 7 �� ID ) R )
� � 7 ��e * boolean * T AuditClientCertificateAccess boolean * T
� � In * T
� � �� ID * T )
� j ��/ + boolean __ � WIN-F6NF7R6I6PJ ROOT\Microsoft\Windows\Smb ���� � �� �� * � l � ��������� � __PARAMETERS abstract
Output object
� 2 Out
� 2 Y �� MSFT_SmbServerConfiguration EmbeddedInstance
)
� 2 Y ��� � ID
6
� 6 Y ��� � � object:MSFT_SmbServerConfiguration ReturnValue uint32
� � uint32 out
� � � �� __ � SetConfiguration K �� K �� implemented static �K WIN-F6NF7R6I6PJ ROOT\Microsoft\Windows\Smb ���� � � K � ��1 � I * � � T 9$ �$ d � � � b � $ � a � !! �! ! � � e
�
�
% _ � � w � 2 � U � � �" *# � N � M |# �# �
i � " � � H � \ � � � = � � K � ~ � � = � �! o" � _
� > � � I � � � J �
\ � & � UUUUUUUUUUUU��������������������������������������������������������������������������������������������������������������������������������������������$ � __PARAMETERS abstract AnnounceServer boolean
� : In
� : b �� ID )
� � b ��� boolean AsynchronousCredits uint32
� � In
� � " �� ID )
� � " ��P uint32 AutoShareServer boolean
� � In
� � � �� ID )
� G � �� boolean AutoShareWorkstation boolean
� x In
� x � �� ID )
� � ��� boolean
CachedOpenLimit uint32
� 5 In
� 5 \ �� ID
)
� � \ ��� uint32 AnnounceComment string
� � In
� � �� ID )
� � ��E string EnableDownlevelTimewarp boolean
� � In
� � � �� ID )
� D � �� boolean EnableLeasing boolean
� n In
� n � �� ID )
� � � ��� boolean EnableMultiChannel boolean
� . In
� . V �� ID )
� � V ��� boolean EnableStrictNameChecking boolean
� � In
� � �� ID )
� � ��J boolean
AutoDisconnectTimeout uint32
� � In
� � � �� ID
)
� G � ��
uint32 DisableCompression boolean
� u In
� u � �� ID )
� � ��� boolean DurableHandleV2TimeoutInSeconds uint32
� B In
� B i �� ID )
� � i ��� uint32
$ EnableAuthenticateUserSharing boolean
$
�
In
$
�
3
�� ID
$ )
� �
3
��a
boolean & EnableForcedLogoff boolean &
� �
In &
� �
�
�� ID & )
� \ �
��! boolean ( EnableOplocks boolean (
� � In (
� � � �� ID ( )
� � ��� boolean * EnableSecuritySignature boolean *
� K In *
� K s �� ID * )
� � s ��� boolean , ServerHidden boolean ,
�
In ,
�
-
�� ID , )
� �
-
��[
boolean . IrpStackSize uint32 .
� �
In .
� �
�
�� ID . )
� O �
�� uint32 2 KeepAliveTime uint32 2
� x In 2
� x � �� ID 2 )
� � ��� uint32 6 MaxChannelPerSession uint32 6
� 8 In 6
� 8 _ �� ID 6 )
� � _ ��� uint32 : MaxMpxCount uint32 :
� � In :
� � �� ID : )
� ��D uint32 > MaxSessionPerConnection uint32 >
� � In >
� � � �� ID > )
� B � �� uint32 B MaxThreadsPerQueue uint32 B
� p In B
� p � �� ID B )
� � ��� uint32 F MaxWorkItems uint32 F
� ( In F
� ( O �� ID F )
� � O ��} uint32 J NullSessionPipes string J
� � In J
� � �� ID J )
� t ��9 string N NullSessionShares string N
� � In N
� � � �� ID N )
� 1 � ��� string R OplockBreakWait uint32 R
� \ In R
� \ � �� ID R )
� � � ��� uint32 V PendingClientTimeoutInSeconds uint32 V
� % In V
� % L �� ID V )
� � L ��z uint32 Z RequestCompression boolean Z
� � In Z
� � �� ID Z )
� t ��9 boolean \ RequireSecuritySignature boolean \
� � In \
� � � �� ID \ )
� : � ��� boolean ^ EnableSMB1Protocol boolean ^
� i In ^
� i � �� ID ^ )
� � � ��� boolean ` EnableSMB2Protocol boolean `
� ) In `
� ) Q �� ID ` )
� � Q �� boolean ! b Smb2CreditsMax uint32 ! b
� � In ! b
� � �� ID ! b )
� u ��: ! uint32 " f Smb2CreditsMin uint32 " f
� � In " f
� � � �� ID " f )
� / � ��� " uint32 # j SmbServerNameHardeningLevel uint32 # j
� f In # j
� f � �� ID # j )
� � � ��� # uint32 $ n TreatHostAsStableStorage boolean $ n
� * In $ n
� * R �� ID $ n )
� � R ��� $ boolean % p ValidateAliasNotCircular boolean % p
� � In % p
� � �� ID % p )
� � ��F % boolean & r ValidateShareScope boolean & r
� � In & r
� � � �� ID & r )
� A � �� & boolean ' t ValidateShareScopeNotAliased boolean ' t
� z In ' t
� z � �� ID ' t )
� � ��� ' boolean ( v ValidateTargetName boolean ( v
� : In ( v
� : b �� ID ( v )
� � b ��� ( boolean ) x EncryptData boolean ) x
� � In ) x
� � �� ID ) x )
� � ��I ) boolean * z RejectUnencryptedAccess boolean * z
� � In * z
� � � �� ID * z )
� I � �� * boolean + | AuditSmb1Access boolean + |
� u In + |
� u � �� ID + | )
� ! � ��� + boolean , ~ DisableSmbEncryptionOnSecureConnection boolean , ~
� I! In , ~
� I! q! �� ID , ~ )
� �! q! ���! , boolean - � RestrictNamedpipeAccessViaQuic boolean - �
� " In - �
� " =" �� ID - � )
� �" =" ��k" - boolean . � EnableSMBQUIC boolean . �
� �" In . �
� �" �" �� ID . � )
� a# �" ��&# . boolean / � EncryptionCiphers string / �
� �# In / �
� �# �# �� ID / � )
� $ �# ���# / string 0 � AuditClientCertificateAccess boolean 0 �
� W$ In 0 �
� W$ $ �� ID 0 � )
� �$ $ ���$ 0 boolean __ �� WIN-F6NF7R6I6PJ ROOT\Microsoft\Windows\Smb ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � �� *` � n
d � �3:D� t ��ю � �&�4� N Zٝ��C�� � ) , � �� � R 9 c | � � . k y � � V g � � � @ U � � � = S � � � � ' 6 s � � � ! E � � � � , @ } � � � . G � � � � 7 L � � � � <
\
�
�
\ z � � * g r � � �
=
G
y
�
�
�
8 M � � � E o � � 7 t � � � ) A ~ � � � K � � � � < U UUUUUUUUUUUUUU�������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������� � MDM_Policy_Config01_Browser02 InPartition 8 F local-system local-user DMWmiBridgeProv AllowAddressBarDropdown '
� � � �� � �� sint32 AllowAutofill '
� � � �� � �� sint32 AllowConfigurationUpdateForBooksLibrary '
� c � �� � �� sint32 AllowCookies '
� � � �� � �� sint32 AllowDeveloperTools '
� � �� � �� sint32 AllowDoNotTrack '
� N � �� � �� sint32 AllowExtensions '
� � � �� � �� sint32 AllowFlash $ '
� � � �� � �� sint32 AllowFlashClickToRun
( '
� 8 � �� � �� sint32 AllowFullScreenMode , '
� � � �� � �� sint32 AllowInPrivate 0 '
� � � �� � �� sint32 AllowMicrosoftCompatibilityList
4 '
� 5 � �� � �� sint32 AllowPasswordManager 8 '
� � � �� � �� sint32 AllowPopups < '
� � � �� � �� sint32 AllowPrelaunch @ '
� � �� � �� sint32 AllowPrinting D '
� k � �� � �� sint32 AllowSavingHistory H '
� � � �� � �� sint32 AllowSearchEngineCustomization L '
� � �� � �� sint32 AllowSearchSuggestionsinAddressBar P '
� z � �� � �� sint32 AllowSideloadingOfExtensions T '
� � � �� � �� sint32 AllowSmartScreen X '
� $ � �� � �� sint32 AllowTabPreloading \ '
� u � �� � �� sint32 AllowWebContentOnNewTabPage ` '
� � � �� � �� sint32 AlwaysEnableBooksLibrary d '
� & � �� � �� sint32 ClearBrowsingDataOnExit h '
� | � �� � �� sint32 ConfigureAdditionalSearchEngines l '
� � � �� � �� string ConfigureFavoritesBar p '
� / � �� � �� sint32 ConfigureHomeButton t '
� � � �� � �� sint32 ConfigureKioskMode x '
� � � �� � �� sint32 ConfigureKioskResetAfterIdleTimeout | '
� 4
� �� � �� sint32 ConfigureOpenMicrosoftEdgeWith � '
� �
� �� � �� sint32 ConfigureTelemetryForMicrosoft365Analytics ! � '
� �
� �� � �� sint32 DisableLockdownOfStartPages " � '
� T � �� � �� sint32 EnableExtendedBooksTelemetry # � '
� � � �� � �� sint32 EnterpriseModeSiteList $ � '
� � �� � �� string EnterpriseSiteListServiceUrl % � '
� _ � �� � �� string HomePages & � '
� � � �� � �� string InstanceID
� � � �� string LockdownFavorites ' � '
� 5
� �� � �� sint32 ParentID
� q
� �� string PreventAccessToAboutFlagsInMicrosoftEdge ( � '
� �
� �� � �� sint32 PreventCertErrorOverrides ) � '
� 0 � �� � �� sint32 PreventFirstRunPage * � '
� � � �� � �� sint32 PreventLiveTileDataCollection + � '
� � � �� � �� sint32 PreventSmartScreenPromptOverride , � '
� = � �� � �� sint32 PreventSmartScreenPromptOverrideForFiles - � '
� � � �� � �� sint32 PreventTurningOffRequiredExtensions . � '
� � �� � �� string PreventUsingLocalHostIPAddressForWebRTC / � '
� l � �� � �� sint32 ProvisionFavorites 0 � '
� � � �� � �� string SendIntranetTraffictoInternetExplorer 1 � '
� ! � �� � �� sint32 SetDefaultSearchEngine 2 � '
� v � �� � �� string SetHomeButtonURL 3 � '
� � � �� � �� string SetNewTabPageURL 4 � '
� � �� � �� string ShowMessageWhenOpeningSitesInInternetExplorer 5 � '
� � � �� � �� sint32 SyncFavoritesBetweenIEAndMicrosoftEdge 6 � '
� � � �� � �� sint32 UnlockHomeButton 7 � '
� 4 � �� � �� sint32 UseSharedFolderForBooks 8 � '
� � � �� � �� sint32 � [ٝ��C�}
) + � �� � A R _ � � � � U������������ � MDM_Policy_Config01_Camera02 InPartition 3 local-system DMWmiBridgeProv AllowCamera '
� � � �� � �� sint32 InstanceID
� � � �� string ParentID
� � �� string a0 � \ٝ��C�\ ) - � �� � C T ` � � � V � � � 2 < n � U����������������������������� � MDM_Policy_Config01_Cellular02 InPartition 5 local-system DMWmiBridgeProv InstanceID
� � � �� string LetAppsAccessCellularData '
� � � �� � �� sint32 LetAppsAccessCellularData_ForceAllowTheseApps '
� N � �� � �� string LetAppsAccessCellularData_ForceDenyTheseApps '
� � � �� � �� string LetAppsAccessCellularData_UserInControlOfTheseApps '
� * � �� � �� string ParentID
� f � �� string ShowAppCellularAccessUI '
� � � �� � �� string � hٝ��C�� ) . ; � �� � Q b � � K � � � � U��������������������� � MDM_Policy_Config01_DeviceHealthMonitoring02 InPartition C local-system DMWmiBridgeProv AllowDeviceHealthMonitoring '
� � � �� � �� sint32 ConfigDeviceHealthMonitoringScope '
� � �� � �� string ConfigDeviceHealthMonitoringUploadDestination '
� � � �� � �� string InstanceID
� � � �� string ParentID
� � � �� string �5 7 E 5 F 3 A D D 9 E 2 4 2 C 4 E 9 F 9 E D F 7 9 A A 9 7 F 7 9 E 7 9 1 1 C 5 A 8 B 9 0 2 E C 1 5 0 D 6 4 4 2 E 3 B 8 5 A 5 A A g�)�-�ȝ��C�� �����J @ 9 \ � __Win32Provider {e17a999c-97f7-4213-bf6f-de08e9d7ecf5} LocalSystemHost DMWmiBridgeProv1 a 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier ' � $ � � � MSFT_CliProperty ScratchDirectory The ScratchDirectory property indicates the directory where temporary files can reside during boot time. ScratchDirectory � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier } K V y � MSFT_CliProperty SettingID The identifier by which the object is known. SettingID ^ � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ( � MSFT_CliQualifier MaxLen # 256 G 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier
� ! w � � MSFT_CliProperty TempDirectory The TempDirectory property indicates the directory where temporary files are stored. TempDirectory � �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty �
� MSFT_CliFormat TABLE BRIEF 2 � " � V 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � ! � � � MSFT_CliProperty BootDirectory The BootDirectory property indicates the path to the system files required for booting the system. BootDirectory � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier X Z ` � � MSFT_CliProperty Name The Name property indicates the name of the boot configuration. Name h � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ( � MSFT_CliQualifier MaxLen # 256 � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier } K V y � MSFT_CliProperty SettingID The identifier by which the object is known. SettingID ^ � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ( � MSFT_CliQualifier MaxLen # 256 0 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � : C f � MSFT_CliProperty Caption A short textual description. Caption K � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 64 BootConfig Select * from Win32_BootConfiguration i|�p � �[�" G ���i �=� z � <��� ] �
K` � S Q L T r a c e E v e n t 1 7 6 xP��7 �z � SQLTraceEvent176 6 � �� % Q \ k n 5 F � � 7 E � � � 1 @ � � 5 ? � � f x / : � � � � + � � �
�
X d � � � � P
[
�
�
� � } � � � � � . < UUUUUUU��������������������������������������������������������������������������������������������������������������������������������� � SQLTraceEvent176_TYPE0 Description Audit Server Object Management Event Type0 EventType EventTypeName 0 ApplicationName P
� � � � � , � �� string WmiDataId Description ApplicationName format w StringTermination Counted ClientProcessID 6
� � � � � � �� sint32 WmiDataId Description ClientProcessID DatabaseID 6
� + � �� sint32 WmiDataId Description DatabaseID DatabaseName L P
� � � � � � � � � � �� string WmiDataId Description DatabaseName format w StringTermination Counted DBUserName T P
� b j u � � � � � � �� string WmiDataId Description DBUserName format w StringTermination Counted EventClass
< 6
�
% � �� sint32 WmiDataId Description EventClass EventSequence p 6
� � � � � � �� sint64 WmiDataId Description EventSequence EventSubClass 4 6
� & � �� sint32 WmiDataId Description EventSubClass HostName P
� � � � � � � � � � �� string WmiDataId Description HostName format w StringTermination Counted IsSystem x 6
� < D O \ � �� sint32 WmiDataId Description IsSystem LinkedServerName \ P
� � � � � & � �� string WmiDataId Description LinkedServerName format w StringTermination Counted LoginName $ P
� � � � � � � � � � �� string WmiDataId Description LoginName format w StringTermination Counted LoginSid X P
� R Z e r | � � � � �� string WmiDataId Description LoginSid format c StringTermination Counted NestLevel D 6
� � � � �� sint32 WmiDataId Description NestLevel NTDomainName P
� � � � � � � � � � �� string WmiDataId Description NTDomainName format w StringTermination Counted NTUserName P
� H
P
[
h
t
|
�
� �� string WmiDataId Description NTUserName format w StringTermination Counted ObjectName H P
�
% 1 9 < O � �� string WmiDataId Description ObjectName format w StringTermination Counted ObjectType @ 6
� � � � � � �� sint32 WmiDataId Description ObjectType OwnerName P P
� = E P ] h p s � � �� string WmiDataId Description OwnerName format w StringTermination Counted ProviderName ` P
� �
)
1
4
G
� �� string WmiDataId Description ProviderName format w StringTermination Counted RequestID d 6
� �
�
�
�
� �� sint32 WmiDataId Description RequestID SessionLoginName | P
� : B M Z l t w � � �� string WmiDataId Description SessionLoginName format w StringTermination Counted SPID ( 6
� � �
� � � �� sint32 WmiDataId Description SPID StartTime
, 6
� R Z e r � �� uint64 WmiDataId Description StartTime Success 8 6
� � �
� � � �� sint32 WmiDataId Description Success TextData P
� [ c n { � � � � � �� string WmiDataId Description TextData format w StringTermination Counted TransactionID 6
� � � �� sint64 WmiDataId Description TransactionID XactSequence h 6
� � � � � � �� sint64 WmiDataId Description XactSequence � M S S Q L S E R V E R T r a c e yP��7 � MSSQLSERVERTrace 6 � �� H N t � � � SQLTraceEvent177 Description Audit Server Principal Management Event Guid 84e993e6-00b1-4d70-97ef-3824ed2c4e93 DisplayName Audit Server Principal Management Event pt � M S S Q L S E R V E R T r a c e �P��7 �� MSSQLSERVERTrace 6 � �� - 3 Y f t � SQLTraceEvent202 Description QN: Dynamics Guid 84e993e6-00ca-4d70-97ef-3824ed2c4e93 DisplayName QN: Dynamics � �7 X e S q l P k g _ b r o k e r _ t r a n s m i s s i o n _ l a z y f l u s h e r _ p r o c e s s i n g _ e n d eQ��7 � A XeSqlPkg_broker_transmission_lazyflusher_processing_end 9 ) � ��0 ; I U � { � � � \ l � � W����������������������������6 � broker_transmission_lazyflusher_processing_end EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid FragmentId 6
� O W b o � �� uint32 WmiDataId Description FragmentId objects_flushed )
� � � � �� uint32 WmiDataId RemainingLength 6
� + 3 > K � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber sleep_time )
� # + � �� uint32 WmiDataId � X e S q l P k g fQ��7 �5 XeSqlPkg
C � ��* 7 X ^ � � � � c����� � XeSqlPkg_broker_transmission_timer_armed Description Broker transmission timer armed Guid {37DE02F2-53F8-4fca-A7DE-42E73553790C} locale MS\0x409 DisplayName broker_transmission_timer_armed � X e S q l P k g ~R��7 �` XeSqlPkg
C � ��0 = } � � � � � c����� � XeSqlPkg_full_update_instead_of_partial_update Description Occurs when a DML operation that is intended to overwrite only part of a large column value is forced to rewrite the entire value. This happens if the table's heap or clustered index is being built online. Use this event to identify DML workloads that are running more slowly as a result of building an index online. Guid {e8497c9a-731c-4ea8-b9d0-1360b2d400b7} locale MS\0x409 DisplayName full_update_instead_of_partial_update �ate �9 A B 5 3 8 0 6 E 8 8 6 6 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0 �M�8P�� ͝��C�x :�� (D� W � WMIBinaryMofResource C:\Windows\system32\drivers\en-US\ndis.sys.mui[MofResourceName] �\ F D 3 B B D 4 C 4 2 A C 2 F 7 F E F 2 6 4 3 4 0 A 9 E B 7 8 A 5 8 1 F E 5 C 2 8 5 6 1 C B 6 3 E D F 7 8 0 B 3 2 9 E A C 2 E E 4 �b��5��͝��C�
\ � + ? �[ �[ �[ �[� MSFT_CliAlias � F N u � � � � �
U�������������������������4 � MSFT_CliConnection Authority
� > STRING Locale
� m STRING NameSpace
� � STRING Password
� � STRING Server
� � STRING User
� , STRING | � ( + � MSFT_CliConnection ms_409 ROOT\CIMV2 . CD-ROM management. [ � �! �N �4 BJ s �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � + � MSFT_CliFormat SYSTEM
D � � U � b
�
x � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty __CLASS __CLASS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __DERIVATION __DERIVATION � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __DYNASTY __DYNASTY � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty __GENUS __GENUS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier t � , � MSFT_CliProperty __NAMESPACE __NAMESPACE � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o � " � MSFT_CliProperty __PATH __PATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier y � $ 6 � MSFT_CliProperty __PROPERTY_COUNT __PROPERTY_COUNT � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __RELPATH __RELPATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier q � & � MSFT_CliProperty __SERVER __SERVER � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __SUPERCLASS __SUPERCLASS � �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � ! R � MSFT_CliFormat TABLE INSTANCE ) % 9 ���hp � ��Z�k G 븎ײ ��(� � Z��� � �ۆ�+ � S Q L T r a c e E v e n t 1 8 9 �P��7 �� � SQLTraceEvent189 6 � �� % G R a d u + 8 � � f w � � h v ) 3 � � # � � � � D R � � < G � � �
.
�
�
� � ! � �
�
�
I O � � 3 = � � n t UUUUUUU�������������������������������������������������������������������������������������������������������������������������������������������������� � SQLTraceEvent189_TYPE0 Description Lock:Timeout (timeout > 0) Type0 EventType EventTypeName 0 ApplicationName $ P
� � � � � " � �� string WmiDataId Description ApplicationName format w StringTermination Counted BigintData1 h 6
� | � � � � �� sint64 WmiDataId Description BigintData1 BinaryData P
� & 3 ? G J ] � �� string WmiDataId Description BinaryData format c StringTermination Counted ClientProcessID 6
� � � � � � �� sint32 WmiDataId Description ClientProcessID DatabaseID 6
� < D O \ � �� sint32 WmiDataId Description DatabaseID DatabaseName T P
� � � � �
� �� string WmiDataId Description DatabaseName format w StringTermination Counted Duration 0 6
� w � � � �� sint64 WmiDataId Description Duration EndTime
@ 6
� � � � �� uint64 WmiDataId Description EndTime EventClass L 6
� g o z � � �� sint32 WmiDataId Description EventClass EventSequence ` 6
� � � � � �� sint64 WmiDataId Description EventSequence GroupID � 6
� b j u � � �� sint32 WmiDataId Description GroupID HostName P
� � � % ( ; � �� string WmiDataId Description HostName format w StringTermination Counted IntegerData2 p 6
� � � � � � �� sint32 WmiDataId Description IntegerData2 IsSystem � 6
� % 2 � �� sint32 WmiDataId Description IsSystem LoginName ( P
� � �
� � � � � � � �� string WmiDataId Description LoginName format w StringTermination Counted LoginSid X P
� _ g r � � � � � �� string WmiDataId Description LoginSid format c StringTermination Counted Mode P 6
� �
� �� sint32 WmiDataId Description Mode NTDomainName P
� �
�
�
�
�
�
�
�
� �� string WmiDataId Description NTDomainName format w StringTermination Counted NTUserName P
� K S ^ k w � � � �� string WmiDataId Description NTUserName format w StringTermination Counted ObjectID H 6
� � � � � �� sint32 WmiDataId Description ObjectID ObjectID2 t 6
� e m x � � �� sint64 WmiDataId Description ObjectID2 OwnerID � 6
� � � � � � �� sint32 WmiDataId Description OwnerID RequestID \ 6
� U
]
h
u
� �� sint32 WmiDataId Description RequestID SessionLoginName � P
� �
�
" * - @ � �� string WmiDataId Description SessionLoginName format w StringTermination Counted SPID
, 6
� � � � � � �� sint32 WmiDataId Description SPID StartTime 8 6
�
( � �� uint64 WmiDataId Description StartTime TextData P
� � � � � � � � � � �� string WmiDataId Description TextData format w StringTermination Counted TransactionID 6
� ? G R _ � �� sint64 WmiDataId Description TransactionID Type | 6
� � � � � � �� sint32 WmiDataId Description Type � M S S Q L S E R V E R T r a c e �P��7 � MSSQLSERVERTrace 6 � �� H N t � � � SQLTraceEvent190 Description Progress Report: Online Index Operation Guid 84e993e6-00be-4d70-97ef-3824ed2c4e93 DisplayName Progress Report: Online Index Operation pt � M S S Q L S E R V E R T r a c e �P��7 �� MSSQLSERVERTrace 6 � �� 3 9 _ l � � SQLTraceEvent198 Description XQuery Static Type Guid 84e993e6-00c6-4d70-97ef-3824ed2c4e93 DisplayName XQuery Static Type Tr �8 X e S q l P k g _ b r o k e r _ t r a n s m i s s i o n _ o b j e c t _ w o r k t a b l e _ l o a d _ b e g i n mQ��7 �M 0 B XeSqlPkg_broker_transmission_object_worktable_load_begin : ) � ��1 < J V R _ � � ! - � � � | � WU����������������������������������������������U � broker_transmission_object_worktable_load_begin EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid asb_id )
� ? G � �� uint64 WmiDataId database_id )
� � � � �� uint32 WmiDataId dialog_id
) 6
� � � �� object:guid WmiDataId Extension Guid FragmentId 6
� q y � � � �� uint32 WmiDataId Description FragmentId initiator_flag )
� � � � �� sint8 WmiDataId RemainingLength 6
� K S ^ k � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber unique_id ! )
� B J � �� uint64 WmiDataId � X e S q l P k g nQ��7 �_ XeSqlPkg
C � ��8 E t z � � � � c����� � XeSqlPkg_broker_transmission_object_worktable_load_end Description Broker transmission object worktable load end Guid {FF994DCD-70EF-44fb-99F4-A0A40E846385} locale MS\0x409 DisplayName broker_transmission_object_worktable_load_end � X e S q l P k g S��7 �� XeSqlPkg
C � ��5 B � � � � � c����- � XeSqlPkg_fulltext_reorganize_phase1_source_fragment Description Reports a fragment that has been selected as a source fragment by one of the Phase1 background merge work items. Guid {6BBCD5D3-C158-4393-9A7A-C6D803263129} locale MS\0x409 DisplayName fulltext_reorganize_phase1_source_fragment �ent �9 A B 5 3 8 0 6 E 8 8 6 6 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0 �M�8P�� ͝��C�n ��S3Ku� M � WMIBinaryMofResource C:\Windows\system32\drivers\ndis.sys[MofResourceName] E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � ] d � MSFT_CliProperty Drive The Drive property indicates the drive letter of the CD ROM drive. Drive - �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty , �! � MSFT_CliFormat TABLE STATUS ? � �
Q � w J 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier M [ = � MSFT_CliProperty Availability The availability and status of the device. Availability g � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap e h k n q t w z } � � � � � � � � 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 0 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � \ � MSFT_CliQualifier Values c j s � � � � � � � � � � # 9 F Other Unknown Running/Full Power Warning In Test Not Applicable Power Off Off Line Off Duty Degraded Not Installed Install Error Power Save - Unknown Power Save - Low Power Mode Power Save - Standby Power Cycle Power Save - Warning % 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � ] d � MSFT_CliProperty Drive The Drive property indicates the drive letter of the CD ROM drive. Drive ` 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier & � � � � MSFT_CliProperty ErrorCleared ErrorCleared is a boolean property indicating that the error reported in LastErrorCode property is now cleared. ErrorCleared 3 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � e r � MSFT_CliProperty MediaLoaded The MediaLoaded property indicates whether a CD-ROM is in the drive. MediaLoaded 5 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � ! e t � MSFT_CliProperty NeedsCleaning Boolean indicating that the media access device needs cleaning. /n NeedsCleaning � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � i q � � MSFT_CliProperty Status The Status property is a string indicating the current status of the object. Status � � / � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 10 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap A E L V _ j t ~ OK Error Degraded Unknown Pred Fail Starting Stopping Service � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values ? C J T ] h r | OK Error Degraded Unknown Pred Fail Starting Stopping Service
9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � + � � MSFT_CliProperty StatusInfo StatusInfo is a string indicating whether the logical device is in an enabled (value = 3), disabled (value = 4) or some other (1) or unknown (2) state. If this property does not apply to the logical device, the value, 5 ("Not Applicable"), should be used. StatusInfo 7 T � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING k D � MSFT_CliQualifier ValueMap 5 8 ; > A 1 2 3 4 5 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � f � MSFT_CliQualifier Values 3 : C L V Other Unknown Enabled Disabled Not Applicable 0� �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty =� $� � MSFT_CliFormat LIST FULL - � " - � " I% �' �) , J. s0 �2 /5 �7 Q: �< �> (A �C �E 4H iJ �L O PQ �U zX �Z �\ _ �a �c �o �r �t ,w �y �{ �} � � � đ �� �� J 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier M [ = � MSFT_CliProperty Availability The availability and status of the device. Availability g � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap e h k n q t w z } � � � � � � � � 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 0 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � \ � MSFT_CliQualifier Values c j s � � � � � � � � � � # 9 F Other Unknown Running/Full Power Warning In Test Not Applicable Power Off Off Line Off Duty Degraded Not Installed Install Error Power Save - Unknown Power Save - Low Power Mode Power Save - Standby Power Cycle Power Save - Warning 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � L Z � � MSFT_CliProperty Capabilities Capabilities of the media access device. Capabilities b ^ � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values
G P W j y � � � � � Unknown Other Sequential Access Random Access Supports Writing Encryption Compression Supports Removable Media Manual Cleaning Automatic Cleaning � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier Y � * � � � MSFT_CliProperty CapabilityDescriptions An array of free-form strings providing more detailed explanations for any of the access device features indicated in the Capabilities array. CapabilityDescriptions Z 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � % � � � MSFT_CliProperty CompressionMethod A free form string indicating the algorithm or tool used by the device to support compression. CompressionMethod # 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � * [ s � � MSFT_CliProperty ConfigManagerErrorCode Indicates the Configuration Manager error code. ConfigManagerErrorCode { 9 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values � � � � � / u � � 0 K ` � � l � � ) � � F � � � 0 ` � This device is working properly. This device is not configured correctly. Windows cannot load the driver for this device. The driver for this device might be corrupted, or your system may be running low on memory or other resources. This device is not working properly. One of its drivers or your registry might be corrupted. The driver for this device needs a resource that Windows cannot manage. The boot configuration for this device conflicts with other devices. Cannot filter. The driver loader for the device is missing. This device is not working properly because the controlling firmware is reporting the resources for the device incorrectly. This device cannot start. This device failed. This device cannot find enough free resources that it can use. Windows cannot verify this device's resources. This device cannot work properly until you restart your computer. This device is not working properly because there is probably a re-enumeration problem. Windows cannot identify all the resources this device uses. This device is asking for an unknown resource type. Reinstall the drivers for this device. Your registry might be corrupted. System failure: Try changing the driver for this device. If that does not work, see your hardware documentation.Windows is removing this device. This device is disabled. System failure: Try changing the driver for this device. If that doesn't work, see your hardware documentation. This device is not present, is not working properly, or does not have all its drivers installed. Windows is still setting up this device. Windows is still setting up this device. This device does not have valid log configuration. The drivers for this device are not installed. This device is disabled because the firmware of the device did not give it the required resources. This device is using an Interrupt Request (IRQ) resource that another device is using. This device is not working properly because Windows cannot load the drivers required for this device. J 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � + p � � MSFT_CliProperty ConfigManagerUserConfig Indicates whether the device is using a user-defined configuration. ConfigManagerUserConfig 9 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � $ T f � MSFT_CliProperty DefaultBlockSize Default block size, in bytes, for this device. DefaultBlockSize 6 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � h u � MSFT_CliProperty Description The Description property provides a textual description of the object. Description 8 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � m w � MSFT_CliProperty DeviceID The DeviceID property contains a string to uniquely identify this CD-ROM drive. DeviceID % 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � ] d � MSFT_CliProperty Drive The Drive property indicates the drive letter of the CD ROM drive. Drive T 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � " � � � MSFT_CliProperty DriveIntegrity The DriveIntegrity property indicates whether files can be accurately read from the CD device. DriveIntegrity ` 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier & � � � � MSFT_CliProperty ErrorCleared ErrorCleared is a boolean property indicating that the error reported in LastErrorCode property is now cleared. ErrorCleared � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier q � $ � � � MSFT_CliProperty ErrorDescription ErrorDescription is a free-form string supplying more information about the error recorded in LastErrorCode property, and information on any corrective actions that may be taken. ErrorDescription o 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier 5 � $ � � � MSFT_CliProperty ErrorMethodology ErrorMethodology is a free-form string describing the type of error detection and correction supported by this device. ErrorMethodology ? 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � # m ~ � MSFT_CliProperty FileSystemFlags The FileSystemFlags property is deprecated in favor of FileSystemFlagsEx FileSystemFlags \ 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier " � % � � � MSFT_CliProperty FileSystemFlagsEx The FileSystemFlagsEx property indicates the file system flags associated with the CD-ROM drive. FileSystemFlagsEx 0 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � k o � MSFT_CliProperty Id The Id property indicates the driver letter uniquely identifying this CD-ROM drive. Id � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier O � � � � MSFT_CliProperty InstallDate The InstallDate property is datetime value indicating when the object was installed. A lack of a value does not indicate that the object is not installed. InstallDate = 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � ! m | � MSFT_CliProperty LastErrorCode LastErrorCode captures the last error code reported by the logical device. LastErrorCode : 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � k y � MSFT_CliProperty Manufacturer The Manufacturer property indicates the manufacturer of the CD-ROM drive. Manufacturer 1 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � b p � MSFT_CliProperty MaxBlockSize Maximum block size, in bytes, for media accessed by this device. MaxBlockSize | 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier B � * � � � MSFT_CliProperty MaximumComponentLength The MaximumComponentLength property indicates the maximum length of a filename component supported by the CD-ROM drive. MaximumComponentLength , 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � ] k � MSFT_CliProperty MaxMediaSize Maximum size, in Kbytes, of media supported by this device. MaxMediaSize 3 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � e r � MSFT_CliProperty MediaLoaded The MediaLoaded property indicates whether a CD-ROM is in the drive. MediaLoaded � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier h � � C � MSFT_CliProperty MediaType The MediaType property indicates the type of media used or accessed by this device. In this class, the value will always be "CD-ROM". MediaType � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � i � MSFT_CliQualifier Values / > P a Random Access Supports Writing Removable Media CD-ROM � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier F �� , � � MSFT_CliProperty MfrAssignedRevisionLevel The MfrAssignedRevisionLevel property indicates the manufacturer assigned firmware revision level of the CDROM drive./n MfrAssignedRevisionLevel 1 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � b p � MSFT_CliProperty MinBlockSize Minimum block size, in bytes, for media accessed by this device. MinBlockSize # 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � \ b � MSFT_CliProperty Name The Name property defines the label by which the object is known. Name 5 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � ! e t � MSFT_CliProperty NeedsCleaning Boolean indicating that the media access device needs cleaning. /n NeedsCleaning � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier X � * � � � MSFT_CliProperty NumberOfMediaSupported When the media access device supports multiple individual media, this property defines the maximum number which can be supported or inserted. NumberOfMediaSupported - 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � _ l � MSFT_CliProperty PNPDeviceID Indicates the Plug and Play device ID of the logical device. PNPDeviceID � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier �
/ � � S � MSFT_CliProperty PowerManagementCapabilities Indicates the specific power-related capabilities of the logical device. The array values, 0="Unknown", 1="Not Supported" and 2="Disabled" are self-explanatory. The value, 3="Enabled" indicates that the power management features are currently enabled but the exact feature set is unknown or the information is unavailable. "Power Saving Modes Entered Automatically" (4) describes that a device can change its power state based on usage or other criteria. "Power State Settable" (5) indicates that the SetPowerState method is supported. "Power Cycling Supported" (6) indicates that the SetPowerState method can be invoked with the PowerState input variable set to 5 ("Power Cycle"). "Timed Power On Supported" (7) indicates that the SetPowerState method can be invoked with the PowerState input variable set to 5 ("Power Cycle") and the Time parameter set to a specific date and time, or interval, for power-on. PowerManagementCapabilities � k � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values ? H W a j � � � Unknown Not Supported Disabled Enabled Power Saving Modes Entered Automatically Power State Settable Power Cycling Supported Timed Power On Supported � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � , 2 � MSFT_CliProperty PowerManagementSupported Indicates that the device can be power managed - i.e. can be put into suspend mode, etc. This boolean does not indicate that power management features are currently enabled, only that the logical device is capable of power management. PowerManagementSupported H 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � ! x � � MSFT_CliProperty RevisionLevel The RevisionLevel property indicates the firmware revision level of the CD-ROM drive. RevisionLevel - 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � c l � MSFT_CliProperty SCSIBus The SCSIBus property indicates the SCSI bus number for the disk drive. SCSIBus U 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � # � � � MSFT_CliProperty SCSILogicalUnit The SCSILogicalUnit property indicates the SCSI logical unit number (LUN) of the disk drive. SCSILogicalUnit 0 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � e o � MSFT_CliProperty SCSIPort The SCSIPort property indicates the SCSI port number of the disk drive. SCSIPort < 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � m { � MSFT_CliProperty SCSITargetId The SCSITargetId property indicates the SCSI ID number of the CD-ROM drive. SCSITargetId 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � Q W � MSFT_CliProperty Size The Size property indicates the size of the disk drive. Size � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � i q � � MSFT_CliProperty Status The Status property is a string indicating the current status of the object. Status � � / � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 10 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap A E L V _ j t ~ OK Error Degraded Unknown Pred Fail Starting Stopping Service � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values ? C J T ] h r | OK Error Degraded Unknown Pred Fail Starting Stopping Service
9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � + � � MSFT_CliProperty StatusInfo StatusInfo is a string indicating whether the logical device is in an enabled (value = 3), disabled (value = 4) or some other (1) or unknown (2) state. If this property does not apply to the logical device, the value, 5 ("Not Applicable"), should be used. StatusInfo 7 T � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING k D � MSFT_CliQualifier ValueMap 5 8 ; > A 1 2 3 4 5 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � f � MSFT_CliQualifier Values 3 : C L V Other Unknown Enabled Disabled Not Applicable � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier s � * � MSFT_CliProperty SystemName SystemName � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � � � MSFT_CliProperty TransferRate The TransferRate property indicates the CD-ROM drive's transfer rate. A value of -1 indicates that the rate could not be determined. This could potentially happen, for example, if the CD is not in the drive. TransferRate 3 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � f r � MSFT_CliProperty VolumeName The VolumeName property indicates the volume name of the CD-ROM drive. VolumeName a 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier ' � & � � � MSFT_CliProperty VolumeSerialNumber The VolumeSerialNumber property indicates the volume serial number of the media in the CD-ROM drive. VolumeSerialNumber
� O In
� O v �� ID
)
� � v ���
uint32 ! RemoteEncryptionProtectionAggressiveness uint8 !
� #
In !
� #
I
�� �
�
�
0 1 2 ValueMap ! )
� #
I
���
w
ID ! 6
� I
���
w
�
uint8 " RemoteEncryptionProtectionExclusions string "
� X In "
� X �� ID " )
� � ��� string
& BruteForceProtectionConfiguredState uint8
&
� ' In
&
� ' M �� � � � � 0 1 2 4 ValueMap
& )
� ' M ��� { ID
& 6
� $
M ��� { �
uint8 ' BruteForceProtectionMaxBlockTime uint32 '
� _
In '
� _
�
�� ID ' )
� �
�
���
uint32 + BruteForceProtectionAggressiveness uint8 +
� - In +
� - S �� � � � 0 1 2 ValueMap + )
� - S ��� � ID + 6
� # S ��� � � uint8 , BruteForceProtectionExclusions string ,
� \ In ,
� \ � �� ID , )
� � � ��� string 0 BruteForceProtectionLocalNetworkBlocking boolean 0
� 0 In 0
� 0 X �� ID 0 )
� � X ��� boolean 2 BruteForceProtectionSkipLearningPeriod boolean 2
� In 2
� , �� ID 2 )
� � , ��Z boolean 4 ReportingAdditionalActionTimeOut uint32 4
� � In 4
� � � �� ID 4 )
� b � ��' uint32 8 ReportingCriticalFailureTimeOut uint32 8
� � In 8
� � � �� ID 8 )
� - � ��� uint32 < ReportingNonCriticalTimeOut uint32 <
� d In <
� d � �� ID < )
� � � ��� uint32 @ ServiceHealthReportInterval uint32 @
� + In @
� + R �� ID @ )
� � R ��� uint32 D ReportDynamicSignatureDroppedEvent boolean D
� � In D
� � ! �� ID D )
� � ! ��O boolean F ScanAvgCPULoadFactor uint8 F
� � In F
� � � �� ID F )
� J � �� uint8 G CheckForSignaturesBeforeRunningScan boolean G
� � In G
� � � �� ID G )
� � ��� boolean I ScanPurgeItemsAfterDelay uint32 I
� N In I
� N u �� ID I )
� � u ��� uint32 M ScanOnlyIfIdleEnabled boolean M
� In M
� 7 �� ID M )
� � 7 ��e boolean O ScanParameters uint8 O
� � In O
� � � �� + . 1 2 ValueMap O )
� � � ��1 ID O 6
� � � ��1 r uint8 P ScanScheduleDay uint8 P
� � In P
� �
�� ` c f i l o r u x 0 1 2 3 4 5 6 7 8 ValueMap P )
� �
��{ 8 ID P 6
�
��{ 8 � uint8 e Q ScanScheduleQuickScanTime datetime e Q
� 8 In e Q
� 8 a �� ID e Q )
� � a ��� datetime e U ScanScheduleTime datetime e U
� � In e U
� � ! �� ID e U )
� � ! ��O datetime Y ThrottleForScheduledScanOnly boolean Y
� � In Y
� � � �� ID Y )
� U � �� boolean ! [ SignatureFirstAuGracePeriod uint32 ! [
� � In ! [
� � � �� ID ! [ )
� � ��� ! uint32 " _ SignatureAuGracePeriod uint32 " _
� O In " _
� O v �� ID " _ )
� � v ��� " uint32 # c SignatureDefinitionUpdateFileSharesSources string # c
� % In # c
� % L �� ID # c )
� � L ��z # string $ g SignatureDisableUpdateOnStartupWithoutEngine boolean $ g
� � In $ g
� � % �� ID $ g )
� � % ��S $ boolean % i SignatureFallbackOrder string % i
� � In % i
� � � �� ID % i )
� Q! � ��! % string & m SignatureScheduleDay uint8 & m
� �! In & m
� �! �! �� �! " " " " " " " " 0 1 2 3 4 5 6 7 8 ValueMap & m )
� �! �! ��" �! ID & m 6
� �" �! ��" �! Y" & uint8 e ' n SignatureScheduleTime datetime e ' n
� �" In e ' n
� �" �" �� ID e ' n )
� c# �" ��(# ' datetime ( r SignatureUpdateCatchupInterval uint32 ( r
� �# In ( r
� �# �# �� ID ( r )
� /$ �# ���# ( uint32 ) v SignatureBlobFileSharesSources string ) v
� i$ In ) v
� i$ �$ �� ID ) v )
� �$ �$ ���$ ) string * z SignatureUpdateInterval uint32 * z
� ,% In * z
� ,% S% �� ID * z )
� �% S% ���% * uint32 + ~ SignatureBlobUpdateInterval uint32 + ~
� �% In + ~
� �% & �� ID + ~ )
� �& & ��H& + uint32 , � MAPSReporting uint8 , �
� �& In , �
� �& �& �� ' ' ' 0 1 2 ValueMap , � )
� �& �& ��' ' ID , � 6
� �' �& ��' ' Z' , uint8 - � SubmitSamplesConsent uint8 - �
� �' In - �
� �' �' �� 9( <( ?( B( 0 1 2 3 ValueMap - � )
� �' �' ��E( %( ID - � 6
� �( �' ��E( %( �( - uint8 . � DisablePrivacyMode boolean . �
� �( In . �
� �( #) �� ID . � Y �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty f b
� MSFT_CliFormat TABLE BRIEF 2 � � + � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier N R [ ~ � MSFT_CliProperty Caption The Caption property is a short textual description.. Caption c � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 64 % 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � ] d � MSFT_CliProperty Drive The Drive property indicates the drive letter of the CD ROM drive. Drive @ 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � q � MSFT_CliProperty Manufacturer The Manufacturer property indicates the manufacturer of the Win32 CD-ROM drive. Manufacturer 3 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRI)
� �) #) ��Q) . boolean / � RandomizeScheduleTaskTimes boolean / �
� �) In / �
� �) �) �� ID / � )
� T* �) ��* / boolean 0 � SchedulerRandomizationTime uint32 0 �
� �* In 0 �
� �* �* �� ID 0 � )
� + �* ���* 0 uint32 1 � DisableBehaviorMonitoring boolean 1 �
� P+ In 1 �
� P+ x+ �� ID 1 � )
� �+ x+ ���+ 1 boolean 2 � DisableIntrusionPreventionSystem boolean 2 �
� , In 2 �
� , F, �� ID 2 � )
� �, F, ��t, 2 boolean 3 � DisableIOAVProtection boolean 3 �
� �, In 3 �
� �, - �� ID 3 � )
� r- - ��7- 3 boolean 4 � DisableRealtimeMonitoring boolean 4 �
� �- In 4 �
� �- �- �� ID 4 � )
� 9. �- ���- 4 boolean 5 � DisableScriptScanning boolean 5 �
� k. In 5 �
� k. �. �� ID 5 � )
� �. �. ���. 5 boolean 6 � DisableArchiveScanning boolean 6 �
� // In 6 �
� // W/ �� ID 6 � )
� �/ W/ ���/ 6 boolean 7 � DisableCatchupFullScan boolean 7 �
� �/ In 7 �
� �/ 0 �� ID 7 � )
� �0 0 ��I0 7 boolean 8 � DisableCatchupQuickScan boolean 8 �
� �0 In 8 �
� �0 �0 �� ID 8 � )
� I1 �0 ��1 8 boolean 9 � DisableEmailScanning boolean 9 �
� z1 In 9 �
� z1 �1 �� ID 9 � )
� 2 �1 ���1 9 boolean : � DisableRemovableDriveScanning boolean : �
� E2 In : �
� E2 m2 �� ID : � )
� �2 m2 ���2 : boolean ; � DisableRestorePoint boolean ; �
� 3 In ; �
� 3 .3 �� ID ; � )
� �3 .3 ��\3 ; boolean < � DisableScanningMappedNetworkDrivesForFullScan boolean < �
� �3 In < �
� �3 4 �� ID < � )
� r4 4 ��74 < boolean = � DisableScanningNetworkFiles boolean = �
� �4 In = �
� �4 �4 �� ID = � )
� ;5 �4 �� 5 = boolean > � ApplyDisableNetworkScanningToIOAV boolean > �
� y5 In > �
� y5 �5 �� ID > � )
�
6 �5 ���5 > boolean ? � UILockdown boolean ? �
� 16 In ? �
� 16 Y6 �� ID ? � )
� �6 Y6 ���6 ? boolean @ � ThreatIDDefaultAction_Ids sint64 @ �
� �6 In @ �
� �6 7 �� ID @ � )
� �7 7 ��M7 @ sint64 A � ThreatIDDefaultAction_Actions uint8 A �
� �7 In A �
� �7 �7 �� 58 88 ;8 >8 A8 D8 G8 1 2 3 6 8 9 10 ValueMap A � )
� �7 �7 ��K8 8 ID A � 6
� �8 �7 ��K8 8 �8 A uint8 B � UnknownThreatDefaultAction uint8 B �
� 9 In B �
� 9 /9 �� }9 �9 �9 �9 �9 �9 �9 1 2 3 6 8 9 10 ValueMap B � )
� 9 /9 ���9 ]9 ID B � 6
� : /9 ���9 ]9 �9 B uint8 C � LowThreatDefaultAction uint8 C �
� M: In C �
� M: s: �� �: �: �: �: �: �: �: 1 2 3 6 8 9 10 ValueMap C � )
� M: s: ���: �: ID C � 6
� `; s: ���: �: ; C uint8 D � ModerateThreatDefaultAction uint8 D �
� �; In D �
� �; �; ��
<
< < < < < < 1 2 3 6 8 9 10 ValueMap D � )
� �; �; �� < �; ID D � 6
� �< �; �� < �; a< D uint8 E � HighThreatDefaultAction uint8 E �
� �< In E �
� �< = �� O= R= U= X= [= ^= a= 1 2 3 6 8 9 10 ValueMap E � )
� �< = ��e= /= ID E � 6
� �= = ��e= /= �= E uint8 F � SevereThreatDefaultAction uint8 F �
� "> In F �
� "> H> �� �> �> �> �> �> �> �> 1 2 3 6 8 9 10 ValueMap F � )
� "> H> ���> v> ID F � 6
� 5? H> ���> v> �> F uint8 G � PUAProtection uint8 G �
� ]? In G �
� ]? �? �� �? �? �? 0 1 2 ValueMap G � )
� ]? �? ���? �? ID G � 6
� S@ �? ���? �? @ G uint8 H � DisableBlockAtFirstSeen boolean H �
� �@ In H �
� �@ �@ �� ID H � )
� A �@ ���@ H boolean I � CloudBlockLevel uint8 I �
� BA In I �
� BA hA �� �A �A �A �A �A 0 1 2 4 6 ValueMap I � )
� BA hA ���A �A ID I � 6
� FB hA ���A �A �A I uint8 J � CloudExtendedTimeout uint32 J �
� uB In J �
� uB �B �� ID J � )
� C �B ���B J uint32 K � EnableNetworkProtection uint8 K �
� 8C In K �
� 8C ^C �� �C �C �C 0 1 2 ValueMap K � )
� 8C ^C ���C �C ID K � 6
� .D ^C ���C �C �C K uint8 L � EnableControlledFolderAccess uint8 L �
� eD In L �
� eD �D �� �D �D �D �D �D 0 1 2 3 4 ValueMap L � )
� eD �D ���D �D ID L � 6
� iE �D ���D �D !E L uint8 M � AttackSurfaceReductionOnlyExclusions string M �
� �E In M �
� �E �E �� ID M � )
� 8F �E ���E M string N � AttackSurfaceReductionRules_Ids string N �
� sF In N �
� sF �F �� ID N � )
� G �F ���F N string O � AttackSurfaceReductionRules_Actions uint8 O �
� BG In O �
� BG hG �� �G �G �G �G �G 0 1 2 5 6 ValueMap O � )
� BG hG ���G �G ID O � 6
� FH hG ���G �G �G O uint8 P � ControlledFolderAccessAllowedApplications string P �
� �H In P �
� �H �H �� ID P � )
� I �H ���H P string Q � ControlledFolderAccessProtectedFolders stringNG Qualifiers
� � object:MSFT_CliQualifier � � f r � MSFT_CliProperty VolumeName The VolumeName property indicates the volume name of the CD-ROM drive. VolumeName [ �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty h \ � MSFT_CliFormat TABLE SCSI 5 ^ � � % 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � ] d � MSFT_CliProperty Drive The Drive property indicates the drive letter of the CD ROM drive. Drive - 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � c l � MSFT_CliProperty SCSIBus The SCSIBus property indicates the SCSI bus number for the disk drive. SCSIBus U 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � # � � � MSFT_CliProperty SCSILogicalUnit The SCSILogicalUnit property indicates the SCSI logical unit number (LUN) of the disk drive. SCSILogicalUnit 0 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � e o � MSFT_CliProperty SCSIPort The SCSIPort property indicates the SCSI port number of the disk drive. SCSIPort < 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � m { � MSFT_CliProperty SCSITargetId The SCSITargetId property indicates the SCSI ID number of the CD-ROM drive. SCSITargetId CDROM Where Drive='#' Select * from Win32_CDROMDrive ressed NonRecover No Contact Lost Comm �6 4 6 5 9 A B 9 F 8 F 1 C 4 B 5 6 8 D B 6 4 3 8 B A E 1 1 B 2 6 E E 8 F 9 3 C B 5 F 8 1 9 5 E 2 1 E 8 C 3 8 3 D 6 C 4 4 C C 4 1 Н��C�ȝ��C�@
� __NAMESPACE CIMV2 Locale 2 4 3 2 A 5 A B B E 7 1 7 3 F A 9 8 2 2 3 D 7 0 B 4 E D F B 3 1 2 E 0 A A 8 7 F 4 5 6 1 0 3 A 2 5 E 4 B 4 1 9 1 A B 5 5 F A 0 2 ���R�Tȝ��C�z ; * W � __CIMOMIdentification 10.0.20348.2520 10.0.20348.2520 %systemroot%\system32\wbem 2 4 3 2 A 5 A B B E 7 1 7 3 F A 9 8 2 2 3 D 7 0 B 4 E D F B 3 1 2 E 0 A A 8 7 F 4 5 6 1 0 3 A 2 5 E 4 B 4 1 9 1 A B 5 5 F A 0 2 ���R�dȝ��C�z ; * W � __CIMOMIdentification 10.0.20348.2520 10.0.20348.2520 %systemroot%\system32\wbem ���� � ��v�& ` �m � �Aw6
� � �
� � �t" � ��wE� � ����� ��~�� Jڝ��C�n ) � �� � 2 D P � � � � O \ � � U�������������������� � MDM_eUICCs_01 InPartition $ local-system DMWmiBridgeProv1 Identifier '
� � � �� � string InstanceID
� � � �� string IsActive '
�
� �� � boolean ParentID
� G � �� string PPR1Allowed '
� � � �� � boolean PPR1AlreadySet '
� � � �� � boolean � Kڝ��C�q
) # � �� � 9 K W � � � � U������������
� MDM_eUICCs_Actions02 InPartition + local-system DMWmiBridgeProv1 InstanceID
� � � �� string ParentID
� � � �� string Status '
� � �� � sint32 � ar n 7 8 � � ResetToFactoryStateMethod * �� implemented � ae442007200009F ROOT\cimv2\mdm\dmmap ���� � �� �� * � ����� � __PARAMETERS abstract param string
� 1 In
� 1 X �� ID )
� � X ��� string __ �� ae442007200009F ROOT\cimv2\mdm\dmmap ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � Lڝ��C�y ) $ � �� � : L X � � � � U���������� � MDM_eUICCs_Policies02 InPartition , local-system DMWmiBridgeProv1 InstanceID
� � � �� string LocalUIEnabled '
� � � �� � �� boolean ParentID
� � �� string rt � Mڝ��C�k ! ) ' � �� � = O \ � � � � , i s � � � � 3 ? | � UU�������������������������������� � MDM_eUICCs_Profiles02_01 InPartition / local-system DMWmiBridgeProv1 ErrorDetail '
� � � �� � sint32 InstanceID
� � � �� string IsEnabled '
� � �� � �� boolean MatchingID '
� a � �� � �� string ParentID
� � � �� string PPR1Set '
� � � �� � boolean PPR2Set '
� * � �� � boolean ServerName '
� t � �� � �� string State '
� � � �� � sint32 � Nڝ��C�p
) $ � �� � : L X � � � � U������������ � MDM_Firewall_Action04 InPartition , local-system DMWmiBridgeProv1 InstanceID
� � � �� string ParentID
� � � �� string Type '
� � �� � �� sint32 Pa � Oڝ��C�s ) ! � �� � 7 I S � � � � $ a k � � U�������������������������� � MDM_Firewall_App04 InPartition ) local-system DMWmiBridgeProv1 FilePath '
� � � �� � �� string Fqbn '
� � � �� � �� string InstanceID
� � �� string PackageFamilyName '
� Y � �� � �� string ParentID
� � � �� string ServiceName '
� � � �� � �� string � Pڝ��C�� ( ) + � �� � A S o � � \ r � � ^ r � � J � � � � 3 ? q { � � UUU�������������������������������������� � MDM_Firewall_DomainProfile02 InPartition 3 local-system DMWmiBridgeProv1 AllowLocalIpsecPolicyMerge
'
� � � �� � �� boolean AllowLocalPolicyMerge '
� � � �� � �� boolean AuthAppsAllowUserPrefMerge '
� S � �� � �� boolean DefaultInboundAction '
� � � �� � �� sint32 DefaultOutboundAction '
� � � �� � �� sint32 DisableInboundNotifications '
� U � �� � �� boolean DisableStealthMode
'
� � � �� � �� boolean DisableStealthModeIpsecSecuredPacketExemption
" '
� � �� � �� boolean DisableUnicastResponsesToMulticastBroadcast '
� � �� � �� boolean EnableFirewall '
� � � �� � �� boolean GlobalPortsAllowUserPrefMerge '
� * � �� � �� boolean InstanceID
� i � �� string ParentID
� � � �� string Shielded '
� � � �� � �� boolean �7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D ���C�
ȝ��C�s \ � __MethodProviderRegistration \\.\root\InventoryLogging:__Win32Provider.Name="silprovider" Qڝ��C�� K ) ! . � �� � D V c � � � � 5 > | � � � $ V f � � � B ^ � � � � ' d n � � � D V � � UUUU����������������������������������������������������������������������� � MDM_Firewall_FirewallRules02_01 InPartition 6 local-system DMWmiBridgeProv1 Description '
� � � �� � �� string Direction
& '
� � � �� � �� string EdgeTraversal . '
� , � �� � �� boolean Enabled '
� s � �� � �� boolean FriendlyName 8 '
� � � �� � �� boolean IcmpTypesAndCodes : '
� � �� � �� sint32 InstanceID
� N � �� string InterfaceTypes * '
� � � �� � �� string LocalAddressRanges '
� � � �� � �� string LocalPortRanges '
� : � �� � �� string LocalUserAuthorizationList
0 '
� � � �� � �� string Name B '
� � � �� � �� string ParentID
� � �� string PolicyAppId 4 '
� \ � �� � �� string Profiles " '
� � � �� � �� sint32 Protocol '
� � � �� � �� sint32 RemoteAddressRanges '
� < � �� � �� string RemotePortRanges '
� � � �� � �� string Status > '
� � � �� � sint32 � �IT+� 8 �k�( � �@}y$
� ���� + LC^C � <�Y� � =5��[ � x!� L �+[ � ��l M u'Wua o��<g ���E� � "|��> $ M S F T _ N e t S e t t i n g D a t a ٝ��C�� = MSFT_NetSettingData C
2 @ G � �� � O
W _ � � � > ` � � � � + 2 � � � f � � � = T � � �UUU���������������������������������������������������������� � MSFT_NetNat UMLPackagePath CIM::Core::Settings ClassVersion 1.0.0 locale netnat Active 3
� � � �� uint8 ExternalIPInterfaceAddressPrefix '
� � � �� � �� string IcmpQueryTimeout '
� 6 � �� � �� uint32 InternalIPInterfaceAddressPrefix 4 '
� � � �� � �� string InternalRoutingDomainId '
� � � �� � �� string Name
� # � �� string Store )
� i q { � �� uint32 ValueMap � � 0 1 TcpEstablishedConnectionTimeout $ '
� � � �� � �� uint32 TcpFilteringBehavior , 4
� C J T � �� � �� uint8 ValueMap ` c 0 1 TcpTransientConnectionTimeout
( '
� � � �� � �� uint32 UdpFilteringBehavior - 4
� ! + � �� � �� uint8 ValueMap 7 : 0 1 UdpIdleSessionTimeout
. '
� � � �� � �� uint32 UdpInboundRefresh 2 '
� � � �� � �� uint8 � M S F T _ N e t S e t t i n g D a t a
ٝ��C�� $ MSFT_NetSettingData C , A O V � �� � ^ f n � � � � , 5 g p � � �U����������������������������������� � MSFT_NetNatExternalAddress UMLPackagePath CIM::Core::Settings ClassVersion 1.0.0 locale netnat Active
� � � �� uint8 ExternalAddressID
� � � �� uint32 IPAddress '
� $ � �� � �� string NatName
� _ � �� string PortEnd '
� � � �� � �� uint16 PortStart '
� � � �� � �� uint16 � M S F T _ N e t S e t t i n g D a t a ٝ��C�y MSFT_NetSettingData C # 8 F M � �� � U ] � ����������������������� � MSFT_NetNatGlobal UMLPackagePath CIM::Core::Settings ClassVersion 1.0.0 locale netnat InterRoutingDomainHairpinningMode 4
� � � � � �� � �� uint32 ValueMap � � 0 1 � M S F T _ N e t S e t t i n g D a t a ٝ��C�� < MSFT_NetSettingData C $ 9 G N � �� � V ^ l � � � 9 P � � � � / a z � � � ; D v � �UUU��������������������������������������������������������� � MSFT_NetNatSession UMLPackagePath CIM::Core::Settings ClassVersion 1.0.0 locale netnat CreationTime e 4
� � � �� datetime ExternalDestinationAddress
"
� � � �� string ExternalDestinationPort &
� 1 � �� uint16 ExternalSourceAddress
� z � �� string ExternalSourcePort
� � � �� uint16 InternalDestinationAddress
� � �� string InternalDestinationPort
� Y � �� uint16 InternalRoutingDomainId
,
� � � �� string InternalSourceAddress
� � � �� string InternalSourcePort
� 3 � �� uint16 NatName 0
� n � �� string Protocol ( )
� � � � � �� uint32 ValueMap � � 6 17 � M S F T _ N e t S e t t i n g D a t a
ٝ��C�c 5 MSFT_NetSettingData C * ? M T � �� � \
d l � � � � 8 K � � � � ) 2 d n � � & 7 �UU��������������������������������������������������i � MSFT_NetNatStaticMapping UMLPackagePath CIM::Core::Settings ClassVersion 1.0.0 locale netnat Active
0
� � � �� uint8 ExternalIPAddress '
� � � �� � �� string ExternalPort $ '
� 0 � �� � �� uint16 InternalIPAddress
& '
� � � �� � �� string InternalPort * '
� � � �� � �� uint16 InternalRoutingDomainId , '
� ! � �� � �� string NatName
� \ � �� string Protocol )
� � � � � �� uint32 ValueMap � � 6 17 RemoteExternalIPAddressPrefix '
� � �� � �� string StaticMappingID
� a � �� uint32 �F D 1 C 1 D 4 1 4 B 7 1 B 5 0 8 2 C 2 6 6 A 6 5 0 E 3 1 E F 6 D 5 0 1 9 3 8 2 7 2 4 2 4 4 B 6 8 5 F 2 1 7 C 0 A A E 0 0 A 9 2 1 ٝ��C�Cȝ��C�$ � __SystemSecurity F D 1 C 1 D 4 1 4 B 7 1 B 5 0 8 2 C 2 6 6 A 6 5 0 E 3 1 E F 6 D 5 0 1 9 3 8 2 7 2 4 2 4 4 B 6 8 5 F 2 1 7 C 0 A A E 0 0 A 9 2 1 ٝ��C�Cȝ��C�$ � __SystemSecurity 4 1 C 5 3 E 6 D B 1 A C F 2 4 5 3 C E F D 4 1 3 9 8 1 9 8 E 6 1 3 F 1 0 D F F 4 7 7 0 9 E C A B 1 D 7 F 0 3 7 7 5 6 A C 8 C E 7 ���C�ȝ��C�� � � __thisNAMESPACE � �p � \ ? 6 4 6 5 9 A B 9 F 8 F 1 C 4 B 5 6 8 D B 6 4 3 8 B A E 1 1 B 2 6 E E 8 F 9 3 C B 5 F 8 1 9 5 E 2 1 E 8 C 3 8 3 D 6 C 4 4 C C 4 1 cxR|�C�ȝ��C�)
� __NAMESPACE mdm 5 7 E 5 F 3 A D D 9 E 2 4 2 C 4 E 9 F 9 E D F 7 9 A A 9 7 F 7 9 E 7 9 1 1 C 5 A 8 B 9 0 2 E C 1 5 0 D 6 4 4 2 E 3 B 8 5 A 5 A A b�)�-�ȝ��C�� �����J @ 9 [ � __Win32Provider {0e9847b3-13e8-44e6-9659-2b60a140a573} LocalSystemHost DMWmiBridgeProv 7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D c�)�-�
ȝ��C�v _ � __MethodProviderRegistration \\.\root\cimv2\mdm\dmmap:__Win32Provider.Name="DMWmiBridgeProv" R O O T \ c i m v 2 \ m d m \ d m m a p _ _ M e t h o d P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 0 6 3 4 B E A A A 6 D 4 7 E 6 3 7 1 9 9 9 A D 4 0 5 E 0 D D A F D A 3 B D A B 3 6 5 9 C 4 8 5 8 F 5 6 5 9 3 6 A 4 9 0 9 9 8 1 F \ K I _ 7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D \ I _ 1 0 3 5 B 0 F 6 2 E A A E C C 9 C 9 8 4 E 7 8 3 4 D 0 A B 6 A 9 9 2 8 5 0 6 8 5 2 D 8 C 8 4 0 D 1 4 F 9 B A B 2 A A E 4 A 6 8 B 3 7 1 9 6 4 6 5 9 A B 9 F 8 F 1 C 4 B 5 6 8 D B 6 4 3 8 B A E 1 1 B 2 6 E E 8 F 9 3 C B 5 F 8 1 9 5 E 2 1 E 8 C 3 8 3 D 6 C 4 4 C C 4 1 e�)�-�ȝ��C�+
� __NAMESPACE dmmap 4 1 C 5 3 E 6 D B 1 A C F 2 4 5 3 C E F D 4 1 3 9 8 1 9 8 E 6 1 3 F 1 0 D F F 4 7 7 0 9 E C A B 1 D 7 F 0 3 7 7 5 6 A C 8 C E 7 f�)�-�ȝ��C�� } � __thisNAMESPACE h �H X 4 ? ?
� __NAMESPACE mdm �b F D 3 B B D 4 C 4 2 A C 2 F 7 F E F 2 6 4 3 4 0 A 9 E B 7 8 A 5 8 1 F E 5 C 2 8 5 6 1 C B 6 3 E D F 7 8 0 B 3 2 9 E A C 2 E E 4 �b��5��͝��C�Qb + H , . R b� MSFT_CliAlias � F N u � � � � �
U�������������������������4 � MSFT_CliConnection Authority
� > STRING Locale
� m STRING NameSpace
� � STRING Password
� � STRING Server
� � STRING User
� , STRING | � ( + � MSFT_CliConnection ms_409 ROOT\CIMV2 . Computer system management. h �� � < �9 = ą � �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty '� ZI � MSFT_CliFormat TABLE STATUS O
( � � " �+ 90 U7 G � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier y ' � � M � MSFT_CliProperty AdminPasswordStatus The AdminPasswordStatus property identifies the system-wide hardware security settings for Administrator Password Status. AdminPasswordStatus � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � \ � MSFT_CliQualifier Values / 9 B S Disabled Enabled Not Implemented Unknown 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � � MSFT_CliProperty BootupState The BootupState property specifies how the system was started. Fail-safe boot (also called SafeBoot) bypasses the user's startup files. /nConstraints: Must have a value. BootupState � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � e � MSFT_CliQualifier Values + 8 H Normal boot Fail-safe boot Fail-safe with network boot 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � & o � = � MSFT_CliProperty ChassisBootupState The ChassisBootupState property indicates the enclosure's bootup state. ChassisBootupState � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING k K � MSFT_CliQualifier ValueMap 9 < ? B E H 1 2 3 4 5 6 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � q � MSFT_CliQualifier Values 7 > G M V ` Other Unknown Safe Warning Critical Non-recoverable � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � * � � Q � MSFT_CliProperty KeyboardPasswordStatus The KeyboardPasswordStatus property identifies the system-wide hardware security settings for Keyboard Password Status. KeyboardPasswordStatus � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � \ � MSFT_CliQualifier Values / 9 B S Disabled Enabled Not Implemented Unknown � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier { ) � � N � MSFT_CliProperty PowerOnPasswordStatus The PowerOnPasswordStatus property identifies the system-wide hardware security settings for Power On Password Status. PowerOnPasswordStatus � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � \ � MSFT_CliQualifier Values / 9 B S Disabled Enabled Not Implemented Unknown o 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qual��t� �
��P_ �Rl�t � <oc7 � n�R� ! _\�22 H %Нz � ���v ןE֎ - �ǟ.� �֝��C�� 6 � �� � * 8 ; H L \ � � � � ( U����������������e � MSFT_SmbMultichannelConstraint smbwmiv2 ClassVersion 7 Description 52 InterfaceAlias
� � � �� string InterfaceGuid '
� � � �� � �� string InterfaceIndex
� � �� uint32 ServerName '
� ] � �� � �� string � A q � � CreateConstraint , ��9 �� implemented static , ae442007200009F ROOT\Microsoft\Windows\Smb ���� � ��
�� � � I * � ������������B � __PARAMETERS abstract ServerName string
� 6 In
� 6 ] �� ID )
� � ] ��� string InterfaceIndex uint32
� � In
� � �� ID )
� � ��E uint32 InterfaceAlias string
� � In
� � � �� ID )
� : � ��� string __ �% ae442007200009F ROOT\Microsoft\Windows\Smb ���� � �� �� * � r � ��������� � __PARAMETERS abstract
Output object
� 2 Out
� 2 Y �� MSFT_SmbMultichannelConstraint EmbeddedInstance
)
� 2 Y ��� � ID
6
� 9 Y ��� � � object:MSFT_SmbMultichannelConstraint ReturnValue uint32
� � uint32 out
� � � �� __ � �֝��C�, > 6 � �� � * . ; ? S � � � �
! T _ � � � � H U � � � � F N � � UUU�����������������������������������������������������������/ � MSFT_SmbOpenFile smbwmiv2 ClassVersion 30 Description 33 ClientComputerName $
� } � �� string ClientUserName (
� � � �� string ClusterNodeName
� � �� string ContinuouslyAvailable 4
� K � �� boolean Encrypted 6
� � � �� boolean FileId '
� � � �� � �� uint64 Locks
0
� � �� uint32 Path
� @ � �� string Permissions ,
� � �� uint32 ScopeName
� � � �� string SessionId
� � � �� uint64 ShareRelativePath
� > � �� string Signed
8
� x � �� boolean SmbInstance 6
� � � � � �� uint32 ValueMap � � � 0 1 2 3 Values # ' + 9 10 56 57 � ( , � � ForceClose �� implemented � ae442007200009F ROOT\Microsoft\Windows\Smb ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � �֝��C�� ! / 2 ? B U � � � � � � � U���������������������6 � MSFT_SmbShareAccessControlEntry ClassVersion 7 Description 8 AccessControlType 6
� � � � � � � �� uint32 ValueMap � � 0 1 Values � � 1 2 AccessRight 6
� ( 0 : Z b � �� uint32 ValueMap N Q T W 0 1 2 3 Values v y | 3 4 5 6 AccountName
� � � �� string Name
� � � �� string ScopeName
� . � �� string ap � �֝��C�� A �� � �� � & 0 > A N R ] � � U��������O � MSFT_SmbShareChangeEvent Indication smbwmiv2 ClassVersion 7 Description 50 EventType +
� � � � � � uint32 ValueMap � � � 0 1 2 Values � � � 47 48 49 Share
� . @ object:MSFT_SmbShare EmbeddedInstance MSFT_SmbShare ve �
M S S A M T r a c e �ם��C�� MSSAMTrace C � �� - 3 [ h w � � SamDeleteUser Description SAM Delete User Guid {c2a0e094-a178-4372-b4fe-a33e48c3585c} DisplayName SamDeleteUser locale MS\0x409 �5 7 E 5 F 3 A D D 9 E 2 4 2 C 4 E 9 F 9 E D F 7 9 A A 9 7 F 7 9 E 7 9 1 1 C 5 A 8 B 9 0 2 E C 1 5 0 D 6 4 4 2 E 3 B 8 5 A 5 A A ������ȝ��C�� �����M @ 9 V � __Win32Provider {227C5B36-F148-4B4B-AEC1-943E394D9885} NetworkServiceHost wfascim 7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D ������
ȝ��C�l U � __MethodProviderRegistration \\.\root\standardcimv2:__Win32Provider.Name="wfascim" R O O T \ s t a n d a r d c i m v 2 _ _ M e t h o d P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ B 5 E C 8 A D F 9 6 E 5 E 6 0 6 4 A D 9 E B 0 B 1 3 7 0 F D B D 6 6 4 E 0 B 0 E 7 8 0 2 B 6 A 2 A 5 7 9 6 B 5 F A F 2 2 A F E E \ K I _ 7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D \ I _ 1 3 7 7 0 F B 2 9 B 5 3 5 A 9 7 6 A B D F 1 4 1 7 1 4 A D A 9 1 9 F C 9 C 5 1 E F C 3 7 E D B 5 C 1 E 9 5 5 A C E 5 6 B E 9 D B ݮ�~ E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C ������ ȝ��C�� � ��������W p � __InstanceProviderRegistration \\.\root\standardcimv2:__Win32Provider.Name="wfascim" _ WQL:UnarySelect R O O T \ s t a n d a r d c i m v 2 _ _ I n s t a n c e P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ B 5 E C 8 A D F 9 6 E 5 E 6 0 6 4 A D 9 E B 0 B 1 3 7 0 F D B D 6 6 4 E 0 B 0 E 7 8 0 2 B 6 A 2 A 5 7 9 6 B 5 F A F 2 2 A F E E \ K I _ E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C \ I _ 1 3 7 7 0 F B 2 9 B 5 3 5 A 9 7 6 A B D F 1 4 1 7 1 4 A D A 9 1 9 F C 9 C 5 1 E F C 3 7 E D B 5 C 1 E 9 5 5 A C E 5 6 B E 9 D B ~ �e��� @ �Ӹ� ( ֯�� D Z,�L > ��Z� � ˺�D � �R�� � [Xwlk g ���� � & R O O T \ M i c r o s o f t \ W i n d o w s \ M a n a g e m e n t T o o l s _ _ M e t h o d P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 0 7 4 8 1 6 2 0 A D D 7 6 F 7 8 A 6 1 0 2 D D C 5 A F C 2 D 9 B 1 C 2 B 1 F D F 0 3 B 3 F 6 3 6 2 1 8 B 8 A E 8 2 6 1 4 2 7 1 7 \ K I _ 7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D \ I _ 6 5 7 4 7 E 1 C F A A 2 2 9 0 7 7 E E A 4 A C 6 E 1 1 7 D 2 E 5 7 0 6 2 6 F 8 7 6 E 7 A 1 D 7 8 D 8 0 1 F F E 4 2 8 2 F 1 6 4 F E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C �ڝ��C� ȝ��C�� � �������� k � __InstanceProviderRegistration \\.\root\Microsoft\Windows\ManagementTools:__Win32Provider.Name="regprov" & R O O T \ M i c r o s o f t \ W i n d o w s \ M a n a g e m e n t T o o l s _ _ I n s t a n c e P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 0 7 4 8 1 6 2 0 A D D 7 6 F 7 8 A 6 1 0 2 D D C 5 A F C 2 D 9 B 1 C 2 B 1 F D F 0 3 B 3 F 6 3 6 2 1 8 B 8 A E 8 2 6 1 4 2 7 1 7 \ K I _ E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C \ I _ 6 5 7 4 7 E 1 C F A A 2 2 9 0 7 7 E E A 4 A C 6 E 1 1 7 D 2 E 5 7 0 6 2 6 F 8 7 6 E 7 A 1 D 7 8 D 8 0 1 F F E 4 2 8 2 F 1 6 4 F C I M _ M a n a g e d E l e m e n t �ڝ��C� CIM_ManagedElement ) ' @ ��J R X ����������������������� � MSFT_MTRegistryObject UMLPackagePath CIM::Core::CoreElements Abstract locale Name
� � � �� string � &՝��C�� ) �� . G O X � � � � � U����������������/ � CIM_ManagedElement Abstract UMLPackagePath CIM::Core::CoreElements locale Caption
� � � @ string MaxLen Description
� � string ElementName
� � string InstanceID
� ' string � C I M _ P r o t o c o l E n d p o i n t ;��C�P � CIM_ProtocolEndpoint C ( < J Q � �� � Y c u � � U f � � 1 � �
� � � s � � > T � � U l �������UUU���������������������������������������������� ���� �������� ������������������������������������������������������������� � MSFT_NetBaseIPProtocol UMLPackagePath CIM::Core::Service ClassVersion 1.0.0 locale nettcpip AddressMaskReply ) | 4
� � � �� � ��� � uint8 ValueMap � � 0 1 DeadGatewayDetection * } 4
� 2 � �� � ��9 C uint8 ValueMap O R 0 1 DefaultHopLimit Z '
� � � �� � �� uint32 DhcpMediaSense " o 4
� � � �� � ��� uint8 ValueMap 1 0 GroupForwardedFragments ' z 4
� s � �� � ��z � uint8 ValueMap � � 0 1 IcmpRedirects j 4
� � � �� � ��� � uint8 ValueMap 0 1 MediaSenseEventLog # p 4
� ` � �� � ��g q uint8 ValueMap } � 1 0 MldLevel $ q 4
� � � �� � ��� � uint32 ValueMap � � � 0 1 2 MldVersion % u 4
� H � �� � ��P Z uint32 ValueMap j m p 2 3 4 MulticastForwarding & y 4
� � � �� � ��� � uint8 ValueMap � � 0 1 NeighborCacheLimit ^ '
� 6 � �� � �� uint32 RandomizeIdentifiers ( { 4
� � � �� � ��� � uint8 ValueMap � � 0 1 ReassemblyLimit f '
� � � �� � �� uint32 RouteCacheLimit b '
� M � �� � �� uint32 SourceRoutingBehavior ! k 4
� � � �� � ��� � uint32 ValueMap � � � 0 1 2 � M S F T _ N e t S e t t i n g D a t a <��C�Y " MSFT_NetSettingData C % : H O � �� � W a y � � � � / @ �U��������������������������������� � MSFT_NetCompartment UMLPackagePath CIM::Core::Settings ClassVersion 1.0.0 locale nettcpip CompartmentDescription
� � � �� string CompartmentGuid
� � � �� string CompartmentId
� ' � �� uint32 CompartmentType )
� w � �� � uint32 ValueMap � � � 0 1 2 � M S F T _ S t o r a g e D e p a r t u r e E v e n t ���C� % $ MSFT_StorageDepartureEvent ) + 8 � �� � � �������������������������������������� � WSP_ReplicationGroupStorageDepartureEvent Description Storage departure events are used whenever a storage object is removed or deleted. wsp_sr � C I M _ M a n a g e d E l e m e n t '՝��C�� 2 CIM_ManagedElement ) * C ��M
U j � � � � � � � �
2 E � � � � � �UU������������������������������������������������ � CIM_ManagedSystemElement UMLPackagePath CIM::Core::CoreElements Abstract locale CommunicationStatus
&
� � � � uint16 ValueMap � � � � � � � 0 1 2 3 4 .. 0x8000.. DetailedStatus ( +
� . 6 @ � � uint16 ValueMap d g j m p s v z 0 1 2 3 4 5 .. 0x8000.. ModelCorrespondence � � CIM_EnabledLogicalElement.PrimaryStatus CIM_ManagedSystemElement.HealthState HealthState $
� - 5 ? uint16 ValueMap c f i m q u y } 0 5 10 15 20 25 30 .. InstallDate e
� � datetime Name
� � � string MaxLen OperatingStatus * +
� C K U � uint16 ValueMap � � � � � � � � � � � � � � � � � � � 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 .. 0x8000.. ModelCorrespondence
CIM_EnabledLogicalElement.EnabledState OperationalStatus 8
� � � � E P Y n uint16 ValueMap � � � �
# ' + / 3 7 ; 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 .. 0x8000.. ArrayType Indexed ModelCorrespondence v CIM_ManagedSystemElement.StatusDescriptions PrimaryStatus
, +
� � � � 3 H uint16 ValueMap " % ) 0 1 2 3 .. 0x8000.. ModelCorrespondence T } CIM_ManagedSystemElement.DetailedStatus CIM_ManagedSystemElement.HealthState Status 8
� � � 9 C �
string Deprecated
CIM_ManagedSystemElement.OperationalStatus ValueMap
{ � � � � � � � � � � � OK Error Degraded Unknown Pred Fail Starting Stopping Service Stressed NonRecover No Contact Lost Comm Stopped MaxLen StatusDescriptions +
� L T _ h } string ArrayType Indexed ModelCorrespondence � CIM_ManagedSystemElement.OperationalStatus � � CIM_ManagedSystemElement.OperationalStatus � 9<� � ͘ (h � B�q. � B�^|� ��?] �j�B ��f& � C I M _ D e v i c e S A P I m p l e m e n t a t i o n 6��C�� % CIM_DeviceSAPImplementation ) , @ ��M U a � � U�������� � CIM_PortImplementsEndpoint UMLPackagePath CIM::Device::Ports Association locale Antecedent f@
� � � � ref:CIM_LogicalPort Override Antecedent Dependent f@
� � ref:CIM_ProtocolEndpoint Override Dependent rr � C I M _ S e r v i c e A c c e s s P o i n t 9��C�� f CIM_ServiceAccessPoint . B J Y ^ j � � z � ' ��������������������������������������������������� ���� �������� ���������������������� ����� � CIM_RemoteServiceAccessPoint UMLPackagePath CIM::Core::Service locale AccessContext X +
� � � � % uint16 ValueMap
� � � � � � � � � � � � 0 1 2 3 4 5 6 7 8 9 10 .. 32768..65535 ModelCorrespondence - CIM_RemoteServiceAccessPoint.OtherAccessContext AccessInfo N
� � � � string ModelCorrespondence � CIM_RemoteServiceAccessPoint.InfoFormat InfoFormat R +
� ) 1 ; $ 9 uint16 ValueMap � � � � � � � � � � � � � � � � � � � � � �
1 2 3 4 5 6 7 8 9 10 11 12 13 100 101 102 103 104 200 201 202 203 204 205 206 .. 32768..65535 ModelCorrespondence A CIM_RemoteServiceAccessPoint.OtherInfoFormatDescription OtherAccessContext Z
� � � � string ModelCorrespondence � CIM_RemoteServiceAccessPoint.AccessContext OtherInfoFormatDescription T
� S [ p string ModelCorrespondence x CIM_RemoteServiceAccessPoint.InfoFormat � C I M _ D e p e n d e n c y :��C�� CIM_Dependency ) ' = ��J R ^ � � U��������. � CIM_RouteUsesEndpoint UMLPackagePath CIM::Network::Routes Association locale Antecedent f@ +
� � � � � ref:CIM_ProtocolEndpoint Override Antecedent Max Dependent f@
� # ref:CIM_NextHopRoute Override Dependent ou � M S F T _ N e t B a s e I P P r o t o c o l D��C�� � MSFT_NetBaseIPProtocol C & : H O � �� � W a q � � Q c � � � ����������U����������������������������������������������� ���� �������� ������������������������������������������������������������������������������������u � MSFT_NetIPv6Protocol UMLPackagePath CIM::Core::Service ClassVersion 1.0.0 locale nettcpip MaxDadAttempts , � '
� � � �� � �� uint32 MaxPreferredLifetime e . � '
� � � �� � �� datetime MaxRandomTime e 0 � '
� G � �� � �� datetime MaxValidLifetime e - � '
� � � �� � �� datetime RegenerateTime e / � '
� � � �� � �� datetime UseTemporaryAddresses + ~ 4
� J � �� � ��R \ uint32 ValueMap l o r 0 1 2 � R O O T \ c i m v 2 \ m d m _ _ M e t h o d P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 3 9 0 E B 4 5 D 3 2 F 6 8 9 2 8 2 4 0 8 A D A 5 2 0 C E 6 3 9 3 A 4 1 E C 4 6 1 8 E E 2 0 4 A A 0 F B C 3 2 C F 2 D 7 4 6 9 E 3 \ K I _ 7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D \ I _ 6 1 8 B E 3 4 8 A 4 7 7 5 3 A 2 4 0 9 C 5 6 D 8 B A 1 5 B 8 2 4 F E 8 6 4 B A E 4 B 7 A E C 8 D 5 7 6 1 6 9 1 B 8 7 2 6 3 4 2 6 a s E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C {��C� ȝ��C�� � �������� V � __InstanceProviderRegistration \\.\root\cimv2\mdm:__Win32Provider.Name="MDMAppProv" -՝��C�� 8 4 �� ��" 2 @ H W � � R _ � � � � � � . � � O g � � K Y � � $ �
m
�
UU�������������������������������������� �������������
� CIM_Error Indication Exception UMLPackagePath CIM::Interop locale CIMStatusCode
, +
� � � � � � uint32 ValueMap ! $ ' * - 0 3 6 9 = A E I M Q U Y ] a e i m q u y } � � � 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 .. ModelCorrespondence � CIM_Error.CIMStatusCodeDescription CIMStatusCodeDescription 0
� 1 string ModelCorrespondence 9 CIM_Error.CIMStatusCode ErrorSource
"
� � � � string ModelCorrespondence � CIM_Error.ErrorSourceFormat ErrorSourceFormat & +
� ! + L a uint16 ValueMap ? B E H 0 1 2 .. ModelCorrespondence m � CIM_Error.ErrorSource CIM_Error.OtherErrorSourceFormat ErrorType +
� � � � V k uint16 ValueMap 0 3 6 9 < ? B E H K N R 0 1 2 3 4 5 6 7 8 9 10 .. ModelCorrespondence s CIM_Error.OtherErrorType Message
� � � � string ModelCorrespondence � CIM_Error.MessageID CIM_Error.MessageArguments MessageArguments
� Z b w string ModelCorrespondence � � CIM_Error.MessageID CIM_Error.Message MessageID
)
� � � ��� string Required ModelCorrespondence 3 CIM_Error.Message CIM_Error.MessageArguments OtherErrorSourceFormat (
� � � � string ModelCorrespondence � CIM_Error.ErrorSourceFormat OtherErrorType
� . string ModelCorrespondence 6 CIM_Error.ErrorType OwningEntity
� x string PerceivedSeverity
� � � � uint16 ValueMap � � � 0 1 2 3 4 5 6 7 .. ProbableCause +
� ] e o � � uint16 ValueMap � �
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
! % ) - 1 5 9 = A E I M Q U Y ] a e i m q u y } � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � " ' , 1 6 ; @ E J O T Y ^ c h m r w | � � � � � � � � 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 .. ModelCorrespondence � CIM_Error.ProbableCauseDescription ProbableCauseDescription
� /
7
L
string ModelCorrespondence T
CIM_Error.ProbableCause RecommendedActions
� �
string �int.InfoFormat � �# C I M _ P o l i c y R u l e 1ם��C�T � CIM_PolicyRule C & � �� � 3 < J Q & Y a � � ( 4 � � ( ; � � _ m � � � � Q ^ � � - @ 8 K � � 8 J r � � � < G n { � � D T � �
�
�
�
�
� � � � T s � � � � +
=
�
�
�
* C � � UUTUUUUUU������������������������������� ���������������� ���� �� ��������������������������������������������������������������0 � MSFT_NetFirewallRule UMLPackagePath CIM::Policy wfascim ClassVersion 1.0.0 locale Action X
� � � � uint16 ValueMap � � � 2 3 4 Caption @ 6
�
@ � �� string MaxLen Override Caption CommonName @ )
� k s } � �� string Override CommonName ConditionListType @
0 6
� � � � � �� uint16 ValueMap 0 1 2 Override ConditionListType CreationClassName @ ( 6
� � � � � �� string MaxLen Override CreationClassName Description @
� � � � string Override Description Direction V
� ; C M uint16 ValueMap Y \ 1 2 DisplayGroup L
� � � �� string DisplayName H
� � � �� string EdgeTraversalPolicy P
� ' 1 uint16 ValueMap E H K N 0 1 2 3 ElementName @
� � � � string Override ElementName Enabled @ 6
� � � $ � �� uint16 ValueMap 1 2 Override Enabled EnforcementStatus d
� l t ~ uint16 ValueMap � � � � � � � � � � $ ( , 0 4 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 ExecutionStrategy @ < 6
� � � � � � � �� uint16 ValueMap � � � 1 2 3 Override ExecutionStrategy InstanceID @ )
� " , � �� string Override InstanceID LocalOnlyMapping B
� i boolean LooseSourceMapping @
� � boolean Mandatory @ 8 )
� � � � �� boolean Override Mandatory Owner # n
� 4 string Platforms R
� f string PolicyAppId % v
� � string PolicyDecisionStrategy @ 6
� � " , � �� uint16 ValueMap 1 2 Override PolicyDecisionStrategy PolicyKeywords ` )
� � � � � �� string Override PolicyKeywords PolicyRoles ` )
� � �
� �� string Override PolicyRoles PolicyRuleName @ , 6
� d
l
t
~
� �� string MaxLen Override PolicyRuleName PolicyStoreSource " j
� �
string PolicyStoreSourceType ! h
� �
uint16 PrimaryStatus Z
� A I S uint16 ValueMap o r u x { 0 1 2 3 .. 0x8000.. Priority @ 6 )
� � � � � �� uint16 Override Priority Profiles >
� $ . uint16 ValueMap B E J O 0 0x4 0x2 0x1 RemoteDynamicKeywordAddresses $ r
� � string RuleGroup D
� � string RuleUsage @ 2 )
�
� �� string Override RuleUsage SequencedActions @ : 6
� �
�
�
�
�
� �� uint16 ValueMap �
�
�
1 2 3 Override SequencedActions Status `
� �
string StatusCode \
� " uint32 SystemCreationClassName @ 6
� � � � � � �� string MaxLen Override SystemCreationClassName SystemName @
$ 6
�
$ � �� string MaxLen Override SystemName T $ ( � � � � [ c � 2 R � �
� � Enable �� implemented � WIN-F6NF7R6I6PJ ROOT\standardcimv2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � Disable � �� implemented � WIN-F6NF7R6I6PJ ROOT\standardcimv2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � Rename r �� implemented WIN-F6NF7R6I6PJ ROOT\standardcimv2 ���� � �� �� * � ����� � __PARAMETERS abstract NewName string
� 3 In
� 3 Z �� ID )
� � Z ��� string __ �� WIN-F6NF7R6I6PJ ROOT\standardcimv2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � CloneObject % �� implemented WIN-F6NF7R6I6PJ ROOT\standardcimv2 ���� � ��
�� � � * � � F ������������> � __PARAMETERS abstract NewName string
� 3 In
� 3 Z �� ID )
� � Z ��� string NewPolicyStore string
� � In
� � �� ID )
� } ��B string NewGPOSession string
� � In
� � � �� ID )
� 6 � ��� string __ �� WIN-F6NF7R6I6PJ ROOT\standardcimv2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � EnumerateFull
��
�� implemented static � WIN-F6NF7R6I6PJ ROOT\standardcimv2 ���� � �X �� * ; � � ��������( � __PARAMETERS abstract
Dependents object
� 6 Stream
� 6 ] �� Out
'
� 6 ] ��� �� CIM_ManagedSystemElement EmbeddedInstance
4
� 6 ] ��� ��� � ID
A
� � ] ��� ��� � 7 object:CIM_ManagedSystemElement ReturnValue uint32
� � uint32 out
� � � �� __ �� � + ��� 8��ok�|o�
|
_ ;
�
Ca� ���]�Wciu �J� � fR��
� ���%
� D �CI_41C53E6DB1ACF2453CEFD41398198E613F10DFF47709ECAB1D7F037756AC8CE7 NS_B5EC8ADF96E5E6064AD9EB0B1370FDBD664E0B0E7802B6A2A5796B5FAF22AFEE CD_F71CEDE68D110C46E631A74BD74BB02467459B066EB8F2E32432A8044C4EFD32.1381.1194636849.213 IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1380.4281939189.368 CI_57E5F3ADD9E242C4E9F9EDF79AA97F79E7911C5A8B902EC150D6442E3B85A5AA IL_0DCED9E1ACE5BCB5BD4659B22A968ACD211DAD28DD1F7F8E29338776357B1C20.1335.1860889157.329 CI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD IL_53AF8608C104F86655F42A8871E5F73225A8D681F66B8151B7C200C46C518C50.1336.183040057.253 CI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C IL_53AF8608C104F86655F42A8871E5F73225A8D681F66B8151B7C200C46C518C50.1376.3048142759.302 IL_2493B293FAE24B9DB6F542A76F6954F10DD366AAEC07782F39E87A24408C09BC.1394.1377725727.329 IL_7D726A53C2E109A7102AA0733AF15E0ABEDDFCEA169FD750AACBD377D8D29F56.1394.4251753050.253 CI_0899307408A32040A6DA19C0B1EC2745A3D604BAA9DFFE8EE4B75C3D91E16109 IL_7D726A53C2E109A7102AA0733AF15E0ABEDDFCEA169FD750AACBD377D8D29F56.1394.1000892939.305 IL_7D726A53C2E109A7102AA0733AF15E0ABEDDFCEA169FD750AACBD377D8D29F56.1394.1233076880.277 IL_F8B808D7A9252DEF065341C8B8313C296ECB08839CCF4A94507BC66DA5D3F382.1396.4244829382.329 IL_19E57369527D4B1D06F7B62EA4740710580A7EE3221F927586AA3C452A7CD5DA.1396.2160430151.253 IL_19E57369527D4B1D06F7B62EA4740710580A7EE3221F927586AA3C452A7CD5DA.1105.804701554.277 IL_952652DF528E210BA7D893A981FC3647340447B0622F76B4DEC06CFB4BBB51E2.1410.1234893268.332 IL_C18626E27D5153E5E65B72B574D4E2FD4416299A7B7135AC8C51438B7D94212E.1410.1809995816.258 IL_C18626E27D5153E5E65B72B574D4E2FD4416299A7B7135AC8C51438B7D94212E.1367.411778654.307 CD_FD4F4D3C59F149D4ECD4F84E3818809F406BCF7E122C03BCFA93C04C2B2F4607.1413.589973217.2940 CD_F9AF1E0E64A5F88E91652C8C44C8A5E0B35B46F211646049A589ADDFD182AD4B.1420.66014984.744 IL_01C76FA468673A0EA1B9609DBFD73E5A3BD638B19A8136374B3D41724E88832E.1452.7346238.339 IL_DBCD4213014601A293AABE7F4277D0A7FEC9623E379CDC7AA6A9EE60BBE340D3.1452.308621945.266 IL_DBCD4213014601A293AABE7F4277D0A7FEC9623E379CDC7AA6A9EE60BBE340D3.1452.2593861179.315 IL_11DC9B6A513916A4D323430E59B223090625B5769C0F700CDF56011654E2084D.1453.3296466713.336 IL_B3CCF51DA7E2E82EF4B967050224C72E8B5296498ACE167E310066C0B48C98F4.1453.412674135.260 IL_B3CCF51DA7E2E82EF4B967050224C72E8B5296498ACE167E310066C0B48C98F4.1453.718273497.309 IL_83845EF2309B741720FF4657440410FD82D34CBF99EA931930FB6ACC3DA7DA92.1456.4004546556.334 IL_FDFF3C9B0664E0FAF284BFA12AE8B9782E6E99E4BAEA05AB7851730AFE40F092.1456.1583338448.258 IL_FDFF3C9B0664E0FAF284BFA12AE8B9782E6E99E4BAEA05AB7851730AFE40F092.1381.441227506.307 IL_13770FB29B535A976ABDF141714ADA919FC9C51EFC37EDB5C1E955ACE56BE9DB.1572.874630654.252 IL_13770FB29B535A976ABDF141714ADA919FC9C51EFC37EDB5C1E955ACE56BE9DB.1572.1958558888.301 CD_FD4E702E602A432E7AB9CE0A91059DB9571223DB712493258C6527C16FC78E38.1383.1484579144.874 CD_FAE2ECC09FED2EB4B7A4EC8980CE634E75CF805CEDF86064A82170B68F9B5074.1383.2800220111.357 CD_FBE6F235041E0E3AE3541BE5BCDC297FFC96D908B951996F32623E2BBA30BD16.1565.244504713.979 CD_FA21EBCF6E5D32820AD55E9B2F2B94C75A7711947B6C3050C8DBA3A61357B1E9.1569.3383805475.244 CD_F9577C2F184B32F74981B6FE74A751DF70B09D37A1C0992592B3A2A75D5D48AB.1581.2986114336.2467 IL_B9EA4E4294BFAD4BF680A19D237326A3AB39882D24932A1112CF7A54CF8BA248.1609.4054195678.328 IL_2AED356462B2786C0E1FA1993CF981AE917D300D3F467D583FB4D81ECCFDFFA0.1414.1710848068.278 IL_E6EA3F9ABAB0F7F735ABB83D47A0BDA517A98F36F7D197BB63E64B363D115BDE.1629.1637266834.332 IL_2C3390DA0D8113E7B067C5F12CC8E1742CA924FE4948190A81257D1A9CF5BDEB.1629.1401708552.256 IL_2C3390DA0D8113E7B067C5F12CC8E1742CA924FE4948190A81257D1A9CF5BDEB.1629.2990471804.280 IL_5C130E57046B54A46D0932CB167A1C04FCF28B235244D73715DA96D155A8179B.1743.2686611583.327 IL_5E1D7125050B2CC85C55D9E8691DD0FE1973FE018C5E5F168814E739F6D15078.1743.423444378.275 IL_9999CE7BE2F7DFF5A650789A4ECB638EE8010B0E955DAF1D73AC5808D527D79C.1834.2786658215.333 IL_F5E021D5620DF76DB11A714354730BFDB3845D5ACC1D57EAF3889D51C85AA6FB.1427.3605456391.257 IL_F5E021D5620DF76DB11A714354730BFDB3845D5ACC1D57EAF3889D51C85AA6FB.1816.1771567077.281 IL_D5FAA70AF9F9BAE40FA47833C07D0CC366DB83E0973CD8E9E5C121D4195039B0.1456.2841926761.329 IL_3FB1CC987258F8087BD78386B8DDA093F7A2030F966FAF6199D43EFA0F6275CC.1456.2904520344.253 IL_3FB1CC987258F8087BD78386B8DDA093F7A2030F966FAF6199D43EFA0F6275CC.1456.1020630158.302 CD_FA52CB5E7D6BA7133233B22EA252FFA4A8C664E7F86ACC00B362A212DA58071C.1839.338165854.1567 CD_FD962A7CCACAB88D552FB4EA114CD68ED5194A98AC098089803CCB7DCC90E78C.1847.403463280.512 IL_48470CE86E49C23DA181F2E7738F61C8EB4E4B1D716A16F59BD2BEACE63CBB20.1881.1655706082.327 IL_30485B836AA5A6FD10A8644930D90B38AA35B211E21BF4839647DE43EFA8F751.1881.3062190868.275 IL_050953C58E97660582926667045FD157390A1B7EE9E1CDFCB3DD57BDA1E5B26D.2064.1974030381.333 IL_7E6A00AAB8467A7129258A087A168DE70442F1968001FDE8C28653B84A0C1849.2064.3823417284.257 IL_7E6A00AAB8467A7129258A087A168DE70442F1968001FDE8C28653B84A0C1849.2064.1544250319.281 CI_64659AB9F8F1C4B568DB6438BAE11B26EE8F93CB5F8195E21E8C383D6C44CC41 IL_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.2168.3346044834.188 IL_752BF18DDD5A926AECB492CF5F791DAA2495FFD9675699FBDF61554FC1FE5AB6.1572.850615391.328 864647387B5B4CB924FA06A5416 R_D916D4BE44BE6B03E2126E7308417D188AFACB2B602CF21C6B06A3D6A4DB852B R_34C7F02584835C9F53DA8B610B74BCACB61B9E0BCE6D8A239F117F5D7E99EE2B R_8BA1D21E61960B29D0AFE87B07C528E316D314C9CDB4E6E4157971C5502F0ED5 B012F0BFA851DE8E60A.316.3628980226.297 NS_3D98EC37D63EBFB9210DB658120A818078461369A71EFFA3DDE47412F528D55E I_88DF7CABF5BD1981831821654FEAF820A29780F13EEE1AF86755DD96BDDE9FDF.1017.1635285725.329 KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C I_DF1D72ECC9268213FCB43A06A38DBF2A7452DFF83D9A2AF1D89F3CECA76D4AF1.11.3465618677.295 CR_FBD11BA7DCC0C416362AC2A1F8EEFD82230A37B2505B7C99363ED198FE2F89CA R_CE7115C334FCF4CAF18779B5DCE6EE49094B2697F81975FFC890786B7C5BEB22 CD_403C7DAFD38411FBB7FFA51AD2D0CC5E3462A61D34EA60E279877DCCDC222D62.39.3518326436.452 NS_3D3E81DCD26451B69577998483A82363FD54E34563AA1BC6E73E4A2DC2212802 CD_9C256CE37E6F9177BC0EC95344373747E0112D20D664373933986EE480BE67C9.294.2927355688.1751 IL_6952BC8C6187412BA6F7CAEE56328B9DCA8AFF615B18BF7135EB8A91F51729F6.1022.10946060.268 CR_81CBCA9C0215B59E860943652530299E5FB0DE537CE83929081B409741C1FE81 R_97C7D526C4DBEB7083476F235A5653C31F00C78AFD98652230E17D721E353ADD CD_27CF2379D55C0D9FB04788B37F03791666FBE227F5B5256A959C5EECD8D8ABE2.288.1.14602 CD_805206C561285684F42D728C26661B4F548F5E54321B06170E013CB108084182.65.1665163772.660 CR_199CFC4A1FC7A648AECC1FFEF43CFCD6FD4BBDB0667CA99257540823E6C76661 C_AD65270397043F902D9F90C1B5BD4DFD9541ED0218BD51B3C4F8E8DBE71A2624 CD_35B1B65B914DF07FAC7860C3407AEAACB382311D5C7C7979B2E9A007C56D4FA3.130.678399164.893 I_9E8B26DC09F8BC8981ED0BE484716F2638BD5B08766978ADCDE0FC3354AE393C.1053.3817994873.347 ��J� � ��8zX
p ׯc� Z �JE�" � J^�� � ��Y p �h�� z G��,C �,�Q � U�- � YvR|�C�� 6 % 2 � ��� � � � � � , � � U���������������� � CIM_ManagedElement Version 2.19.0 Description ManagedElement is an abstract class that provides a common superclass (or top of the inheritance tree) for the non-association classes in the CIM Schema. AMENDMENT LOCALE MS_409 Caption
� % 2 string Description The Caption property is a short textual description (one- line string) of the object. Description
� � � � string Description The Description property provides a textual description of the object. ElementName
� X ` m string Description A user-friendly name for the object. This property allows each instance to define a user-friendly name in addition to its key properties, identity data, and description information.
Note that the Name property of ManagedSystemElement is also defined as a user-friendly name. But, it is often subclassed to be a Key. It is not reasonable that the same property can convey both identity and a user-friendly name, without inconsistencies. Where Name exists and is not a Key (such as for instances of LogicalDevice), the same information can be present in both the Name and ElementName properties. Note that if there is an associated instance of CIM_EnabledLogicalElementCapabilities, restrictions on this properties may exist as defined in ElementNameMask and MaxElementNameLen properties defined in that class. InstanceID
� � � � string Description InstanceID is an optional property that may be used to opaquely and uniquely identify an instance of this class within the scope of the instantiating Namespace. Various subclasses of this class may override this property to make it required, or a key. Such subclasses may also modify the preferred algorithms for ensuring uniqueness that are defined below.
To ensure uniqueness within the NameSpace, the value of InstanceID should be constructed using the following "preferred" algorithm:
<OrgID>:<LocalID>
Where <OrgID> and <LocalID> are separated by a colon (:), and where <OrgID> must include a copyrighted, trademarked, or otherwise unique name that is owned by the business entity that is creating or defining the InstanceID or that is a registered ID assigned to the business entity by a recognized global authority. (This requirement is similar to the <Schema Name>_<Class Name> structure of Schema class names.) In addition, to ensure uniqueness, <OrgID> must not contain a colon (:). When using this algorithm, the first colon to appear in InstanceID must appear between <OrgID> and <LocalID>.
<LocalID> is chosen by the business entity and should not be reused to identify different underlying (real-world) elements. If not null and the above "preferred" algorithm is not used, the defining entity must assure that the resulting InstanceID is not reused across any InstanceIDs produced by this or other providers for the NameSpace of this instance.
If not set to null for DMTF-defined instances, the "preferred" algorithm must be used with the <OrgID> set to CIM. qu � C I M _ M a n a g e d E l e m e n t ZvR|�C�4 CIM_ManagedElement ) � ��� � � � ? W � � ���������������������������� � PS_Module Description ManagedElement is an abstract class that provides a common superclass (or top of the inheritance tree) for the non-association classes in the CIM Schema. AMENDMENT LOCALE MS_409 InstanceID @ )
� & � �� string Description Full Path of the module moduleManifestFileData
� � � � uint8 Description Module Manifest data ModuleName
� � � � string Description Name of the module moduleType +
� T \ i ~ � uint16 Description Type of the module. Values � � Other CIM � C I M _ M a n a g e d E l e m e n t [vR|�C� CIM_ManagedElement ) � ��� � � � A K � � ��������������������������� � PS_ModuleFile Description ManagedElement is an abstract class that provides a common superclass (or top of the inheritance tree) for the non-association classes in the CIM Schema. AMENDMENT LOCALE MS_409 FileData
� uint8 Description File data represented as byte array FileName
� w � string Description File name of the file represented by this instance. InstanceID @ )
� � �� string Description Within the scope of the instantiating Namespace, InstanceID opaquely and uniquely identifies an instance of this class. � C I M _ D e p e n d e n c y \vR|�C�O CIM_Dependency ) $ � ��� � � � C N ���������� � PS_ModuleToModuleFile Description CIM_Dependency is a generic association used to establish dependency relationships between ManagedElements. AMENDMENT LOCALE MS_409 Antecedent f@
� � � ref:PS_Module Description Antecedent represents the independent object in this association. Dependent f@
� z � � ref:PS_ModuleFile Description Dependent represents the object that is dependent on the Antecedent. �F D 1 C 1 D 4 1 4 B 7 1 B 5 0 8 2 C 2 6 6 A 6 5 0 E 3 1 E F 6 D 5 0 1 9 3 8 2 7 2 4 2 4 4 B 6 8 5 F 2 1 7 C 0 A A E 0 0 A 9 2 1 ^vR|�C�Cȝ��C�$ � __SystemSecurity 4 1 C 5 3 E 6 D B 1 A C F 2 4 5 3 C E F D 4 1 3 9 8 1 9 8 E 6 1 3 F 1 0 D F F 4 7 7 0 9 E C A B 1 D 7 F 0 3 7 7 5 6 A C 8 C E 7 `vR|�C�ȝ��C�� � � __thisNAMESPACE � �� � � ?
M s f t _ M i S t r e a m �vR|�C�H Msft_MiStream ) � ��� � � � E Y � ����������� � Msft_MiCompare Description Compares the current output of a stream identified by the given ID with the previous output of the input stream and suppress the current output if it's identical. AMENDMENT LOCALE MS_409 Input
� % 2 object:Msft_MiStream Description The input stream. OnlyUpdateSnapshot
� � � � boolean Description Whether to only update the last known snapshot or also suppress the output based on that snapshot. SuppressionHint
� < ^ k object:Msft_MiCompareSuppression Description The Msft_MiCompareSuppression instance to produce if the output of the input stream was suppressed. io � �vR|�C�� ) ( u ��� � � � + 6 ���������� � Msft_MiCompareSuppression Description Output instance produced when the input of the output stream is suppressed. AMENDMENT LOCALE MS_409 SuppressionSignal
� � � � object Description The embedded object that signals an output suppression by the stream. Timestamp e
� b l y datetime Description Timestamp output was suppressed. � D D L _ S E C U R I T Y _ P O L I C Y _ E V E N T S iN��7 �� < $ DDL_SECURITY_POLICY_EVENTS ������������������������������������������������������������ � ALTER_SECURITY_POLICY �6 4 6 5 9 A B 9 F 8 F 1 C 4 B 5 6 8 D B 6 4 3 8 B A E 1 1 B 2 6 E E 8 F 9 3 C B 5 F 8 1 9 5 E 2 1 E 8 C 3 8 3 D 6 C 4 4 C C 4 1 ������ȝ��C�,
� __NAMESPACE MS_409 �3 C I M _ S e r v i c e A c c e s s P o i n t xR|�C��3 a CIM_ServiceAccessPoint 6 # � � � ��� � � � n | � � � k
~
t � � � �, �, 1 +1 ����U�������������������������������������������������������������������������������������������2 � CIM_ProtocolEndpoint Description A communication point from which data can be sent or received. ProtocolEndpoints link system or computer interfaces to LogicalNetworks. Version 2.15.0 AMENDMENT LOCALE MS_409 Description @
� & string Description The Description property provides a textual description of the object. EnabledState @ . +
� � � � � � uint16 Description EnabledState is an integer enumeration that indicates the enabled and disabled states of an element. It can also indicate the transitions between these requested states. For example, shutting down (value=4) and starting (value=10) are transient states between enabled and disabled. The following text briefly summarizes the various enabled and disabled states:
Enabled (2) indicates that the element is or could be executing commands, will process any queued commands, and queues new requests.
Disabled (3) indicates that the element will not execute commands and will drop any new requests.
Shutting Down (4) indicates that the element is in the process of going to a Disabled state.
Not Applicable (5) indicates the element does not support being enabled or disabled.
Enabled but Offline (6) indicates that the element might be completing commands, and will drop any new requests.
Test (7) indicates that the element is in a test state.
Deferred (8) indicates that the element might be completing commands, but will queue any new requests.
Quiesce (9) indicates that the element is enabled but in a restricted mode.
Starting (10) indicates that the element is in the process of going to an Enabled state. New requests are queued. Values
� � � � % : C M V ` o Unknown Other Enabled Disabled Shutting Down Not Applicable Enabled but Offline In Test Deferred Quiesce Starting DMTF Reserved Vendor Reserved Name @
� � � � string Description A string that identifies this ProtocolEndpoint with either a port or an interface on a device. To ensure uniqueness, the Name property should be prepended or appended with information from the Type or OtherTypeDescription properties. The method selected is described in the NameFormat property of this class. NameFormat N
� 5 = J string Description NameFormat contains the naming heuristic that is selected to ensure that the value of the Name property is unique. For example, you might choose to prepend the name of the port or interface with the Type of ProtocolEndpoint (for example, IPv4) of this instance followed by an underscore. OperationalStatus ` +
� �
�
�
uint16 Description Indicates the current statuses of the element. Various operational statuses are defined. Many of the enumeration\'s values are self-explanatory. However, a few are not and are described here in more detail.
"Stressed" indicates that the element is functioning, but needs attention. Examples of "Stressed" states are overload, overheated, and so on.
"Predictive Failure" indicates that an element is functioning nominally but predicting a failure in the near future.
"In Service" describes an element being configured, maintained, cleaned, or otherwise administered.
"No Contact" indicates that the monitoring system has knowledge of this element, but has never been able to establish communications with it.
"Lost Communication" indicates that the ManagedSystem Element is known to exist and has been contacted successfully in the past, but is currently unreachable.
"Stopped" and "Aborted" are similar, although the former implies a clean and orderly stop, while the latter implies an abrupt stop where the state and configuration of the element might need to be updated.
"Dormant" indicates that the element is inactive or quiesced.
"Supporting Entity in Error" indicates that this element might be "OK" but that another element, on which it is dependent, is in error. An example is a network service or endpoint that cannot function due to lower-layer networking problems.
"Completed" indicates that the element has completed its operation. This value should be combined with either OK, Error, or Degraded so that a client can tell if the complete operation Completed with OK (passed), Completed with Error (failed), or Completed with Degraded (the operation finished, but it did not complete OK or did not report an error).
"Power Mode" indicates that the element has additional power model information contained in the Associated PowerManagementService association.
OperationalStatus replaces the Status property on ManagedSystemElement to provide a consistent approach to enumerations, to address implementation needs for an array property, and to provide a migration path from today\'s environment to the future. This change was not made earlier because it required the deprecated qualifier. Due to the widespread use of the existing Status property in management applications, it is strongly recommended that providers or instrumentation provide both the Status and OperationalStatus properties. Further, the first value of OperationalStatus should contain the primary status for the element. When instrumented, Status (because it is single-valued) should also provide the primary status of the element. Values l u | � � � � � � � � � � � ! = H T c Unknown Other OK Degraded Stressed Predictive Failure Error Non-Recoverable Error Starting Stopping Stopped In Service No Contact Lost Communication Aborted Dormant Supporting Entity in Error Completed Power Mode DMTF Reserved Vendor Reserved OtherTypeDescription V
� � � � string Description A string that describes the type of ProtocolEndpoint when the Type property of this class (or any of its subclasses) is set to 1 (Other). This property should be set to null when the Type property is any value other than 1. ProtocolIFType T +
� � �
� � uint16 Description ProtocolIFType is an enumeration that is synchronized with the IANA ifType MIB. The ifType MIB is maintained at the URL, http://www.iana.org/assignments/ianaiftype-mib. Also, additional values defined by the DMTF are included. The property is used to categorize and classify instances of the ProtocolEndpoint class. Note that if the ProtocolIFType is set to 1 (Other), then the type information should be provided in the OtherTypeDescription string property. Values �
" , 9 K ^ s � � � � � � � � � � � � ( - @ E U [ a h m r � � � � � � � � � � � �
* 4 ? ] v � � � � � � ! %! +! 1! 7! D! Q! W! p! y! �! �! �! �! �! �! �! �! " " $" 0" 5" <" N" ^" y" �" �" �" �" �" �" # # # # %# .# J# i# �# �# �# �# �# �# �# �# �# $ $ $$ 1$ N$ T$ f$ l$ s$ y$ �$ �$ �$ �$ �$ �$ �$ % % *% 2% :% U% g% �% �% �% �% �% �% �% �% �% & & /& C& U& b& o& t& �& �& �& �& �& �& �& ' ' 1' H' ^' p' }' �' �' �' �' �' �' �' (
( 0( 7( B( M( S( s( �( �( �( �( ) 8) P) [) f) {) �) �) �) �) �) �) �) * * * $* 9* J* Y* p* x* �* �* �* �* �* �* �* �* + + + 3+ J+ S+ X+ f+ w+ }+ �+ �+ �+ �+ �+ �+ �+ �+ �+ �+ �+ �+ �+ , ,
, , , $, -, 6, ;, A, G, O, U, Z, `, h, m, u, {, �, �, �, �, Unknown Other Regular 1822 HDH 1822 DDN X.25 RFC877 X.25 Ethernet CSMA/CD ISO 802.3 CSMA/CD ISO 802.4 Token Bus ISO 802.5 Token Ring ISO 802.6 MAN StarLAN Proteon 10Mbit Proteon 80Mbit HyperChannel FDDI LAP-B SDLC DS1 E1 Basic ISDN Primary ISDN Proprietary Point-to-Point Serial PPP Software Loopback EON Ethernet 3Mbit NSIP SLIP Ultra DS3 SIP Frame Relay RS-232 Parallel ARCNet ARCNet Plus ATM MIO X.25 SONET X.25 PLE ISO 802.211c LocalTalk SMDS DXI Frame Relay Service V.35 HSSI HIPPI Modem AAL5 SONET Path SONET VT SMDS ICIP Proprietary Virtual/Internal Proprietary Multiplexor IEEE 802.12 Fibre Channel HIPPI Interface Frame Relay Interconnect ATM Emulated LAN for 802.3 ATM Emulated LAN for 802.5 ATM Emulated Circuit Fast Ethernet (100BaseT) ISDN V.11 V.36 G703 at 64K G703 at 2Mb QLLC Fast Ethernet 100BaseFX Channel IEEE 802.11 IBM 260/370 OEMI Channel ESCON Data Link Switching ISDN S/T Interface ISDN U Interface LAP-D IP Switch Remote Source Route Bridging ATM Logical DS0 DS0 Bundle BSC Async Combat Net Radio ISO 802.5r DTR Ext Pos Loc Report System AppleTalk Remote Access Protocol Proprietary Connectionless ITU X.29 Host PAD ITU X.3 Terminal PAD Frame Relay MPI ITU X.213 ADSL RADSL SDSL VDSL ISO 802.5 CRFP Myrinet Voice Receive and Transmit Voice Foreign Exchange Office Voice Foreign Exchange Service Voice Encapsulation Voice over IP ATM DXI ATM FUNI ATM IMA PPP Multilink Bundle IP over CDLC IP over CLAW Stack to Stack Virtual IP Address MPC IP over ATM ISO 802.5j Fibre Token Ring TDLC Gigabit Ethernet HDLC LAP-F V.37 X.25 MLP X.25 Hunt Group Transp HDLC Interleave Channel FAST Channel IP (for APPN HPR in IP Networks) CATV MAC Layer CATV Downstream CATV Upstream Avalon 12MPP Switch Tunnel Coffee Circuit Emulation Service ATM SubInterface Layer 2 VLAN using 802.1Q Layer 3 VLAN using IP Layer 3 VLAN using IPX Digital Power Line Multimedia Mail over IP DTM DCN IP Forwarding MSDSL IEEE 1394 IF-GSN/HIPPI-6400 DVB-RCC MAC Layer DVB-RCC Downstream DVB-RCC Upstream ATM Virtual MPLS Tunnel SRP Voice over ATM Voice over Frame Relay ISDL Composite Link SS7 Signaling Link Proprietary P2P Wireless Frame Forward RFC1483 Multiprotocol over ATM USB IEEE 802.3ad Link Aggregate BGP Policy Accounting FRF .16 Multilink FR H.323 Gatekeeper H.323 Proxy MPLS Multi-Frequency Signaling Link HDSL-2 S-HDSL DS1 Facility Data Link Packet over SONET/SDH DVB-ASI Input DVB-ASI Output Power Line Non Facility Associated Signaling TR008 GR303 RDT GR303 IDT ISUP Proprietary Wireless MAC Layer Proprietary Wireless Downstream Proprietary Wireless Upstream HIPERLAN Type 2 Proprietary Broadband Wireless Access Point to Mulipoint SONET Overhead Channel Digital Wrapper Overhead Channel ATM Adaptation Layer 2 Radio MAC ATM Radio Inter Machine Trunk MVL DSL Long Read DSL Frame Relay DLCI Endpoint ATM VCI Endpoint Optical Channel Optical Transport Proprietary ATM Voice over Cable Infiniband TE Link Q.2931 Virtual Trunk Group SIP Trunk Group SIP Signaling CATV Upstream Channel Econet FSAN 155Mb PON FSAN 622Mb PON Transparent Bridge Line Group Voice E&M Feature Group Voice FGD EANA Voice DID MPEG Transport 6To4 GTP Paradyne EtherLoop 1 Paradyne EtherLoop 2 Optical Channel Group HomePNA GFP ciscoISLvlan actelisMetaLOOP Fcip IANA Reserved IPv4 IPv6 IPv4/v6 IPX DECnet SNA CONP CLNP VINES XNS ISDN B Channel Endpoint ISDN D Channel Endpoint BGP OSPF UDP TCP 802.11a 802.11b 802.11g 802.11h NFS CIFS DAFS WebDAV HTTP FTP NDMP Telnet SSH SM CLP SMTP LDAP RDP HTTPS DMTF Reserved Vendor Reserved ProtocolType R +
� �, �, - �/ �/ uint16 Description Note: This property is deprecated in lieu of the ProtocolIFType enumeration. This deprecation was done to have better alignment between the IF-MIB of the IETF and this CIM class.
Deprecated description: ProtocolType is an enumeration that provides information to categorize and classify different instances of this class. For most instances, information in this enumeration and the definition of the subclass overlap. However, there are several cases where a specific subclass of ProtocolEndpoint is not required (for example, there is no Fibre Channel subclass of ProtocolEndpoint). Therefore, this property is needed to define the type of Endpoint. Values 0 0 "0 (0 .0 30 >0 F0 K0 Q0 W0 ^0 c0 h0 u0 0 �0 �0 �0 �0 �0 �0 �0 �0 �0 1
1 1 Unknown Other IPv4 IPv6 IPX AppleTalk DECnet SNA CONP CLNP VINES XNS ATM Frame Relay Ethernet TokenRing FDDI Infiniband Fibre Channel ISDN BRI Endpoint ISDN B Channel Endpoint ISDN D Channel Endpoint IPv4/v6 BGP OSPF MPLS UDP TCP TimeOfLastStateChange e@ 8
� W1 a1 n1 datetime Description The date or time when the EnabledState of the element last changed. If the state of the element has not changed and this property is populated, then it must be set to a 0 interval value. If a state change was requested, but rejected or not yet processed, the property must not be updated. ��s, to address implementation needs for an array property, and to provide a migration path from today\'s environment to the future. This change was not made earlier because it required the deprecated qualifier. Due to the widespread use of the existing Status property in management applications, it is strongly recommended that providers or instrumentation provide both the Status and OperationalStatus properties. Further, the first value of OperationalStatus should contain the primary status for the element. When instrumented, Status (because it is single-valued) should also provide the primary status of the element. Values l u | � � � � � � � � � � � ! = H T c Unknown Other OK Degraded Stressed Predictive Failure Error Non-Recoverable Error Starting Stopping Stopped In Service No Contact Lost Communication Aborted Dormant Supporting Entity in Error Completed Power Mode DMTF Reserved Vendor Reserved OtherTypeDescription V
� � � � string Description A string that describes the type of ProtocolEndpoint when the Type property of this class (or any of its subclasses) is set to 1 (Other). This property should be set to null when the Type property is any value other than 1. ProtocolIFType T +
� � �
� � uint16 Description ProtocolIFType is an enumeration that is synchronized with the IANA ifType MIB. The ifType MIB is maintained at the URL, http://www.iana.org/assignments/ianaiftype-mib. Also, additional values defined by the DMTF are included. The property is used to categorize and classify instances of the ProtocolEndpoint class. Note that if the ProtocolIFType is set to 1 (Other), then the type information should be provided in the OtherTypeDescription string property. Values �
" , 9 K ^ s � � � � � � � � � � � � ( - @ E U [ a h m r � � � � � � � � � � � �
* 4 ? ] v � � � � � � ! %! +! 1! 7! D! Q! W! p! y! �! �! �! �! �! �! �! �! " " $" 0" 5" <" N" ^" y" �" �" �" �" �" �" # # # # %# .# J# i# �# �# �# �# �# �# �# �# �# $ $ $$ 1$ N$ T$ f$ l$ s$ y$ �$ �$ �$ �$ �$ �$ �$ % % *% 2% :% U% g% �% �% �% �% �% �% �% �% �% & & /& C& U& b& o& t& �& �& �& �& �& �& �& ' ' 1' H' ^' p' }' �' �' �' �' �' �' �' (
( 0( 7( B( M( S( s( �( �( �( �( ) 8) P) [) f) {) �) �) �) �) �) �) �) * * * $* 9* J* Y* p* x* �* �* �* �* �* �* �* �* + + + 3+ J+ S+ X+ f+ w+ }+ �+ �+ �+ �+ �+ �+ �+ �+ �+ �+ �+ �+ �+ , ,
, , , $, -, 6, ;, A, G, O, U, Z, `, h, m, u, {, �, �, �, �, Unknown Other Regular 1822 HDH 1822 DDN X.25 RFC877 X.25 Ethernet CSMA/CD ISO 802.3 CSMA/CD ISO 802.4 Token Bus ISO 802.5 Token Ring ISO 802.6 �5 C I M _ P o l i c y R u l e ,xR|�C��" � CIM_PolicyRule ) # Q ��\ d & l t 6 ? � � < O � � t � > I � � � � � � � ! � � % 8 � � x
�
? S " | � � � @ M � � a q � � 0 @ � � � � � � # | � 6 U � � � � � � . : � � E Q UUUUUUUUU���������������������������������������������������������������������������������������������������������������������������� � MSFT_NetFirewallRule Description Represents a Windows Defender firewall rule. AMENDMENT LOCALE MS_409 Action X +
� � � � uint16 Description Specifies the action to take on traffic that matches this rule. Values " / Allow AllowBypass Block Caption @
� k s � string Description The Caption property is a short textual description (one- line string) of the object. CommonName @
� $ string Description This field is ignored. ConditionListType @
0 +
� � � � � � uint16 Description This field is ignored. Values � � � Unconditional Rule DNF CNF CreationClassName @ (
� * 2 ? string Description Reserved for internal use by the WMI provider only. Description @
� � � � string Description A brief description of the rule. May be an indirect string. If it is an indirect string, then it may not be overwritten. Direction V +
� � � � � � uint16 Description Specifies which direction of traffic to match with this rule. Values � � Inbound Outbound DisplayGroup L
� 7 ? L string Description The group that this rule belongs to. This field is based on the value of RuleGroup and changes to this field are ignored. DisplayName H
� string Description The localized name of this rule. This field's value is based on the value of ElementName. Changes to this field are ignored. EdgeTraversalPolicy P +
� � � � = E uint16 Description Specifies how this firewall rule will handle edge traversal cases. Values Y ` g v Block Allow Defer to User Defer to App ElementName @
� � � � string Description The locale-independent name of the rule. May be an indirect string. Enabled @ +
� Z b o � � uint16 Description Indicates whether this rule is administratively enabled or disabled. Values � � Enabled Disabled EnforcementStatus d +
� ( 0 = � � uint16 Description If this object is retrieved from the ActiveStore, describes the current enforcement status of the rule. Values
!
7
D
T
e
�
�
�
�
�
0 P w � � � � � � Invalid Full FirewallOffInProfile CategoryOff DisabledObject InactiveProfile LocalAddressResolutionEmpty RemoteAddressResolutionEmpty LocalPortResolutionEmpty RemotePortResolutionEmpty InterfaceResolutionEmpty ApplicationResolutionEmpty RemoteMachineEmpty RemoteUserEmpty LocalGlobalOpenPortsDisallowed LocalAuthorizedApplicationsDisallowed LocalFirewallRulesDisallowed LocalConsecRulesDisallowed NotTargetPlatform OptimizedOut LocalUserEmpty TransportMachinesEmpty TunnelMachinesEmpty TupleResolutionEmpty ExecutionStrategy @ < +
� q y � � � uint16 Description This field is ignored. Values � � � Do Until Success Do All Do Until Failure InstanceID @
�
"
/
string Description A string that uniquely identifies this instance within the PolicyStore. LocalOnlyMapping B
� �
�
�
boolean Description Whether to group UDP packets into conversations based only upon the local address and port. Applies only to UDP. LooseSourceMapping @
� � � boolean Description Whether to group UDP packets into conversations based upon the local address, local port, and remote port. Applies only to UDP. Mandatory @ 8
� N W d boolean Description This field is ignored. Owner # n
� � � � string Description The owner of the firewall rule, as a SID. Platforms R
� & . ; string Description Specifies which platforms the rule is applicable on. If null, the rule applies to all platforms (the default). Each entry takes the form Major.Minor+, for instance 6.0, 6.1+, or 6.2. If + is specified, then it means that the rule applies to that version or greater. For instance, Windows Vista could be represented as 6 or 6.0, and Windows 7 or later would be represented as 6.1+. + may only be attached to the final item in the list. 6.0+ is not valid because it means the same thing as null (all platforms). PolicyAppId % v
� y � � string Description Policy App Id corresponding for this rule. PolicyDecisionStrategy @ +
� 8 @ uint16 Description This field is ignored. Values L \ First Matching All PolicyKeywords `
� � � � string Description This field is ignored. PolicyRoles `
� string Description This field is ignored. PolicyRuleName @ ,
� l t � string Description Reserved for internal use by the WMI provider only. PolicyStoreSource " j
� � �
string Description If this object is retrieved from the ActiveStore, with the TracePolicyStoreSource option set, contains the path to the PolicyStore where this rule originally came from. PolicyStoreSourceType ! h
� � � uint16 Description If this object is retrieved from the ActiveStore, with the TracePolicyStoreSource option set, describes the type of PolicyStore where this rule originally came from. PrimaryStatus Z +
� � � � uint16 Description PrimaryStatus provides a high level status value, intended to align with Red-Yellow-Green type representation of status. It should be used in conjunction with DetailedStatus to provide high level and detailed health status of the ManagedElement and its subcomponents.
PrimaryStatus consists of one of the following values: Unknown, OK, Degraded or Error. "Unknown" indicates the implementation is in general capable of returning this property, but is unable to do so at this time.
"OK" indicates the ManagedElement is functioning normally.
"Degraded" indicates the ManagedElement is functioning below normal.
"Error" indicates the ManagedElement is in an Error condition.
Values � � � � � Unknown OK Degraded Error DMTF Reserved Vendor Reserved Priority @ 6
� O W d uint16 Description This field is ignored. Profiles > +
� � � � � uint16 Description Which profiles this rule is active on. Values % . Any Public Private Domain RemoteDynamicKeywordAddresses $ r
� � � � string Description List of dynamic keyword address IDs to corresponding to the remote addresses for this rule. RuleGroup D
� * 2 ? string Description The locale-independent name for the group that this rule belongs to. If this field is non-null, then Windows Defender Firewall with Advanced Security assumes that this rule belongs to a Windows component or an installed application, and some parts of the rule are protected (including but not limited to the Name, Description, Program, and Service). RuleUsage @ 2
� � � � string Description This field is ignored. SequencedActions @ : +
� N V c { � uint16 Description This field is ignored. Values � � � Mandatory Recommended Dont Care Status `
� � � � string Description The detailed status of the rule, as a string. StatusCode \
� f n { uint32 Description The detailed status of the rule, as a numeric error code. SystemCreationClassName @
� � string Description Reserved for internal use by the WMI provider only. SystemName @
$
� } � � string Description Reserved for internal use by the WMI provider only. � 9 = � � � � � � F S � m
� , 0 h � Enable & Description Enable this rule. � WIN-F6NF7R6I6PJ ROOT\standardcimv2\MS_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � Disable � � Description Disable this rule. � WIN-F6NF7R6I6PJ ROOT\standardcimv2\MS_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � Rename � � Description Rename this rule. � WIN-F6NF7R6I6PJ ROOT\standardcimv2\MS_409 ���� � �� �� * � ����8 � __PARAMETERS abstract NewName string
� 3 In
� 3 Z �� The new name for the rule. Description )
� 3 Z ��� � ID 6
� 0 Z ��� � � string __ �� WIN-F6NF7R6I6PJ ROOT\standardcimv2\MS_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � CloneObject d q Description Copy this rule. � WIN-F6NF7R6I6PJ ROOT\standardcimv2\MS_409 ���� � ��
�� y G * � J ������������� � __PARAMETERS abstract NewName string
� 3 In
� 3 Z �� The new name for the rule. Description )
� 3 Z ��� � ID 6
� 0 Z ��� � � string NewPolicyStore string
� Z In
� Z � �� The new policy store for the rule. Description )
� Z � ��� � ID 6
� _ � ��� � string NewGPOSession string
� � In
� � � �� The new GPOSession for the rule. Description )
� � � ��� � ID 6
� � � ��� � C string __ �� WIN-F6NF7R6I6PJ ROOT\standardcimv2\MS_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � EnumerateFull & Description Desc 4 WIN-F6NF7R6I6PJ ROOT\standardcimv2\MS_409 ���� � �� �� * � � ; ��������e � __PARAMETERS abstract
Dependents object
� 6 Out
� 6 ] �� ID
)
� � ] ��� object:CIM_ManagedSystemElement ReturnValue uint32
� . uint32 out
� . 6 �� __ � ifiers
� � object:MSFT_CliQualifier 5 $ � � [ � MSFT_CliProperty PowerSupplyState The PowerSupplyState identifies the state of the enclosure's power supply (or supplies) when last booted. PowerSupplyState � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING k K � MSFT_CliQualifier ValueMap 9 < ? B E H 1 2 3 4 5 6 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � q � MSFT_CliQualifier Values 7 > G M V ` Other Unknown Safe Warning Critical Non-recoverable s 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier 9 � � � MSFT_CliProperty PowerState Indicates the current power state of the computer system and its associated operating system. Regarding the power saving states, these are defined as follows: Value 4 (Unknown) indicates that the system is known to be in a power save mode, but its exact status in this mode is unknown; 2 (Low Power Mode) indicates that the system is in a power save state but still functioning, and may exhibit degraded performance; 3 (Standby) describes that the system is not functioning but could be brought to full power 'quickly'; and value 7 (Warning) indicates that the computerSystem is in a warning state, though also in a power save mode. PowerState � p � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values ? H T q � � � � Unknown Full Power Power Save - Low Power Mode Power Save - Standby Power Save - Unknown Power Cycle Power Off Power Save - Warning � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier q ) � � I � MSFT_CliProperty FrontPanelResetStatus The FrontPanelResetStatus property identifies the hardware security settings for the reset button on the machine. FrontPanelResetStatus � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � \ � MSFT_CliQualifier Values / 9 B S Disabled Enabled Not Implemented Unknown 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � v � > � MSFT_CliProperty ThermalState The ThermalState property identifies the enclosure's thermal state when last booted. ThermalState � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING k K � MSFT_CliQualifier ValueMap 9 < ? B E H 1 2 3 4 5 6 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � q � MSFT_CliQualifier Values 7 > G M V ` Other Unknown Safe Warning Critical Non-recoverable � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � * � MSFT_CliProperty Status The Status property is a string indicating the current status of the object. Various operational and non-operational statuses can be defined. Operational statuses are "OK", "Degraded" and "Pred Fail". "Pred Fail" indicates that an element may be functioning properly but predicting a failure in the near future. An example is a SMART-enabled hard drive. Non-operational statuses can also be specified. These are "Error", "Starting", "Stopping" and "Service". The latter, "Service", could apply during mirror-resilvering of a disk, reload of a user permissions list, or other administrative work. Not all such work is on-line, yet the managed element is neither "OK" nor in one of the other states. Status � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 10 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap A E L V _ j t ~ OK Error Degraded Unknown Pred Fail Starting Stopping Service � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values ? C J T ] h r | OK Error Degraded Unknown Pred Fail Starting Stopping Service A 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � z � � MSFT_CliProperty Name The inherited Name property serves as key of a CIM_System instance in an enterprise environment. Name Q �
� \I In Q �
� \I �I �� ID Q � )
� �I �I ���I Q string R � SharedSignaturesPath string R �
� J In R �
� J CJ �� ID R � )
� �J CJ ��qJ R string S � SharedSignaturesPathUpdateAtScheduledTimeOnly boolean S �
� �J In S �
� �J K �� ID S � )
� �K K ��KK S boolean T � EnableLowCpuPriority boolean T �
� �K In T �
� �K �K �� ID T � )
� HL �K ��
L T boolean U � EnableFileHashComputation boolean U �
� ~L In U �
� ~L �L �� ID U � )
� M �L ���L U boolean V � MeteredConnectionUpdates boolean V �
� DM In V �
� DM lM �� ID V � )
� �M lM ���M V boolean W � AllowNetworkProtectionOnWinServer boolean W �
� N In W �
� N ;N �� ID W � )
� �N ;N ��iN W boolean X � DisableDatagramProcessing boolean X �
� �N In X �
� �N O �� ID X � )
� kO O ��0O X boolean Y � EnableConvertWarnToBlock boolean Y �
� �O In Y �
� �O �O �� ID Y � )
� 1P �O ���O Y boolean Z � DisableCpuThrottleOnIdleScans boolean Z �
� kP In Z �
� kP �P �� ID Z � )
� �P �P ���P Z boolean [ � EnableFullScanOnBatteryPower boolean [ �
� 5Q In [ �
� 5Q ]Q �� ID [ � )
� �Q ]Q ���Q [ boolean \ � ProxyPacUrl string \ �
� �Q In \ �
� �Q R �� ID \ � )
� ~R R ��CR \ string ] � ProxyServer string ] �
� �R In ] �
� �R �R �� ID ] � )
� 5S �R ���R ] string ^ � ProxyBypass string ^ �
� \S In ^ �
� \S �S �� ID ^ � )
� �S �S ���S ^ string _ � ForceUseProxyOnly boolean _ �
� T In _ �
� T AT �� ID _ � )
� �T AT ��oT _ boolean ` � DisableTlsParsing boolean ` �
� �T In ` �
� �T U �� ID ` � )
� iU U ��.U ` boolean a � DisableHttpParsing boolean a �
� �U In a �
� �U �U �� ID a � )
� )V �U ���U a boolean b � DisableDnsParsing boolean b �
� WV In b �
� WV V �� ID b � )
� �V V ���V b boolean c � DisableDnsOverTcpParsing boolean c �
� W In c �
� W EW �� ID c � )
� �W EW ��sW c boolean d DisableSshParsing boolean d
� �W In d
� �W X �� ID d )
� mX X ��2X d boolean e PlatformUpdatesChannel uint8 e
� �X In e
� �X �X �� Y Y Y Y Y Y 0 2 3 4 5 6 ValueMap e )
� �X �X ��"Y �X ID e 6
� �Y �X ��"Y �X cY e uint8 f EngineUpdatesChannel uint8 f
� �Y In f
� �Y Z �� JZ MZ PZ SZ VZ YZ 0 2 3 4 5 6 ValueMap f )
� �Y Z ��\Z .Z ID f 6
� �Z Z ��\Z .Z �Z f uint8 g DefinitionUpdatesChannel uint8 g
� [ In g
� [ >[ �� |[ [ �[ 0 4 5 ValueMap g )
� [ >[ ���[ l[ ID g 6
� \ >[ ���[ l[ �[ g uint8 h DisableGradualRelease boolean h
� >\ In h
� >\ f\ �� ID h )
� �\ f\ ���\ h boolean i AllowNetworkProtectionDownLevel boolean i
� ] In i
� ] 3] �� ID i )
� �] 3] ��a] i boolean j
AllowDatagramProcessingOnWinServer boolean j
� �] In j
� �] ^ �� ID j
)
� l^ ^ ��1^ j boolean k EnableDnsSinkhole boolean k
� �^ In k
� �^ �^ �� ID k )
� +_ �^ ���^ k boolean l DisableInboundConnectionFiltering boolean l
� i_ In l
� i_ �_ �� ID l )
� �_ �_ ���_ l boolean m DisableRdpParsing boolean m
� (` In m
� (` P` �� ID m )
� �` P` ��~` m boolean n DisableNetworkProtectionPerfTelemetry boolean n
� �` In n
� �` #a �� ID n )
� �a #a ��Qa n boolean o TrustLabelProtectionStatus uint32 o
� �a In o
� �a �a �� ID o )
� Sb �a ��b o uint32 p DisableFtpParsing boolean p
� �b In p
� �b �b �� ID p )
� c �b ���b p boolean q AllowSwitchToAsyncInspection boolean q
� Jc In q
� Jc rc �� ID q )
� �c rc ���c q boolean r ScanScheduleOffset uint32 r
�
d In r
�
d 1d �� ID r )
� �d 1d ��_d r uint32 s DisableTDTFeature boolean s
� �d In s
� �d �d �� ID s )
� Xe �d �� e s boolean t " DisableTamperProtection boolean t "
� �e In t "
� �e �e �� ID t " )
� f �e ���e t boolean u $ DisableSmtpParsing boolean u $
� Lf In u $
� Lf tf �� ID u $ )
� �f tf ���f u boolean v & DisableQuicParsing boolean v &
� g In v &
� g 4g �� ID v & )
� �g 4g ��bg v boolean w ( NetworkProtectionReputationMode uint32 w (
� �g In w (
� �g h �� ID w ( )
� ih h ��.h w uint32 x , IntelTDTEnabled boolean x ,
� �h In x ,
� �h �h �� ID x , )
� %i �h ���h x boolean y . AttackSurfaceReductionRules_RuleSpecificExclusions_Id string y .
� wi In y .
� wi �i �� ID y . )
� j �i ���i y string z 2 AttackSurfaceReductionRules_RuleSpecificExclusions string z 2
� Uj In z 2
� Uj |j �� ID z 2 )
� �j |j ���j z string { 6 OobeEnableRtpAndSigUpdate boolean { 6
� k In { 6
� k Bk �� ID { 6 )
� �k Bk ��pk { boolean | 8 PerformanceModeStatus uint8 | 8
� �k In | 8
� �k l �� =l @l 0 1 ValueMap | 8 )
� �k l ��Cl 1l ID | 8 6
� �l l ��Cl 1l �l | uint8 } 9 QuickScanIncludeExclusions uint8 } 9
� m In } 9
� m 'm �� am dm 0 1 ValueMap } 9 )
� m 'm ��gm Um ID } 9 6
� �m 'm ��gm Um �m } uint8 ~ : RemoveScanningThreadPoolCap boolean ~ :
� &n In ~ :
� &n Nn �� ID ~ : )
� �n Nn ��|n ~ boolean < DisableCacheMaintenance boolean <
� �n In <
� �n o �� ID < )
� |o o ��Ao boolean � > DisableCoreServiceECSIntegration boolean � >
� �o In � >
� �o �o �� ID � > )
� Jp �o ��p � boolean � @ DisableCoreServiceTelemetry boolean � @
� �p In � @
� �p �p �� ID � @ )
� q �p ���p � boolean � B EnableUdpSegmentationOffload boolean � B
� Lq In � B
� Lq tq �� ID � B )
� �q tq ���q � boolean � D EnableUdpReceiveOffload boolean � D
� r In � D
� r 9r �� ID � D )
� �r 9r ��gr � boolean � F EnableEcsConfiguration boolean � F
� �r In � F
� �r �r �� ID � F )
� fs �r ��+s � boolean � H Force boolean � H
� �s In � H
� �s �s �� ID � H )
� t �s ���s � boolean ���u� � ��s*/ � ;��:� �M�H� % N&Ӎ� �Cz� I �H�H ݻ"L \ C I M _ C h e c k jН��C�u % CIM_Check ) - � ��� � � � p w �������������������������������������� � Win32_EnvironmentSpecification Description Instances of this class contain information about any environment variables that may need to be registered for their associated products installation. AMENDMENT LOCALE ms_409 Environment
� ! . string Description Token name for the environment specification within its package. Value
� � � � string Description The value for this environment as a formatted string. � C I M _ C h e c k k��C�f - CIM_Check ) � ��� � � � � � M [ ��U������������������������������������������� � Win32_ReserveCost Description This optional class allows the author to 'reserve' a specified amount of disk space in any directory, depending on the installation state of a component. Reserving cost in this way could be useful for authors who want to ensure that a minimum amount of disk space will be available after the installation is completed. For example, this disk space might be reserved for user documents, or for application files (such as index files) that are created only after the application is launched following installation. The ReserveCost class also allows custom actions to specify an approximate cost for any files, registry entries, or other items, that the custom action might install. AMENDMENT LOCALE ms_409 ReserveFolder
� ' 4 string Description The name of the directory (as a path, reference to a directory specification or reference to a property) where the space is reserved. ReserveKey
� � � string Description A unique key identifying this reserve cost item within its product. ReserveLocal
"
� � � � uint32 Description The number of bytes of disk space reserved if the associated software element is installed to run locally. ReserveSource &
� C K X uint32 Description The number of bytes of disk space reserved if the associated software element is installed to run from source. � C I M _ C h e c k l��C�� ) CIM_Check ) , � ��� � � � ! ' � � ����������������������������������������I � Win32_ODBCDriverSpecification Description This class represents any ODBC drivers that are to be installed as part of a particular product. AMENDMENT LOCALE ms_409 Driver
� � � � string Description Token name for the driver within its package. File
� S [ h string Description The FileID of the Win32_FileSpecification representing this driver. SetupFile
"
� � � � string Description The FileID of the Win32_FileSpecification representing this drivers setup dll. � C I M _ C h e c k m��C�� ) CIM_Check ) # 0 � ��� � � � I T � � ����������������������������������������i � Win32_ODBCTranslatorSpecification Description Instances of this class represent any ODBC Translators that are included as part of a products installation. AMENDMENT LOCALE ms_409 File
� � � string Description The FileID of the Win32_FileSpecification representing this translator. SetupFile
"
� � � � string Description The FileID of the Win32_FileSpecification representing this translators setup dll. Translator
� ! ) 6 string Description Token name for the translator within its package. � C I M _ C h e c k n��C�� ) CIM_Check ) # 0 � ��� � � � 1 D � � ����������������������������������������Z � Win32_ODBCDataSourceSpecification Description This class specifies any Data Sources (DSNs) that need to be registered as part of an installation. AMENDMENT LOCALE ms_409 DataSource
� � � � string Description Token name for the data source within its package. DriverDescription
� p x � string Description The associated ODBC driver name. Registration
"
� � � � string Description The type of registration for this data source.
) indicates per machine,
1 indicates per user. � C I M _ F i l e A c t i o n s��C� 4 CIM_FileAction ) # � ��� � � � � � � � � 8 D ��U�������������������������������������������������[ � Win32_MoveFileAction Description The MoveFiles action allows the author to locate files that already exist on the user's machine, and move or copy those files to a new location. AMENDMENT LOCALE ms_409 DestFolder &
� string Description The name of a win32_Property whose value resolves to the full path to the destination directory. DestName
� � � � string Description This property contains the name to be given to the original file after it is moved or copied. If this field is blank, then the destination file is given the same name as the source file. FileKey
,
� � � � string Description A unique key identifying this move file action within its product. Options *
� I Q ^ uint16 Description Integer value specifying the operating mode. ) indicates a copy, 1 indicates a move. SourceFolder
"
� � � string Description This property contains the name of a Win32_Property having a value that resolves to the full path to the source directory. If the SourceName property is left blank, then the property named in the SourceFolder property is assumed to contain the full path to the source file itself (including the file name). SourceName
� p x � string Description This property contains the name of the source files to be moved or copied.
This property may be left blank. See the description of the SourceFolder property. This field may contain wildcard characters (* and ?). �
C I M _ A c t i o n x��C�� ' CIM_Action ) & � ��� � � � j t � � ��������������������������������������G � Win32_TypeLibraryAction Description The RegisterTypeLibraries action registers type libraries with the system. The action works on each file referenced which is triggered to be installed. AMENDMENT LOCALE ms_409 Cost
� ! uint32 Description The cost associated with the registration of the type library in bytes. Language
� � � � uint16 Description The language of the type library. LibID
� string Description The GUID that identifies the library. �
C I M _ A c t i o n y��C�0 # CIM_Action ) ( � ��� � � � ������������������������������������ � Win32_SelfRegModuleAction Description The SelfRegModules action processes all the modules in the SelfReg to register the modules, if installed. AMENDMENT LOCALE ms_409 Cost
� � � � uint16 Description The value to be deleted. File
� A I V string Description The FileID of a Win32_FileSpecification associated with this selfreg module action. � �� �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � �� � MSFT_CliFormat LIST FULL 5 � � j R � � 2 ; ' &* �, ,/ f1 �3 &: Y? D �F 2I �K ~P �R EU �W �Y �f �i 0m �o /r u 7� 7� � g� ڙ W� �� =� Ħ K� �� I� ؽ 9� �� �� �� �� [� �� `� � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier y ' � � M � MSFT_CliProperty AdminPasswordStatus The AdminPasswordStatus property identifies the system-wide hardware security settings for Administrator Password Status. AdminPasswordStatus � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � \ � MSFT_CliQualifier Values / 9 B S Disabled Enabled Not Implemented Unknown � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � , � � � MSFT_CliProperty AutomaticResetBootOption The AutomaticResetBootOption property determines whether the automatic reset boot option is enabled. /nValues: TRUE or FALSE. If TRUE, the automatic reset boot option is enabled. AutomaticResetBootOption � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � , # � MSFT_CliProperty AutomaticResetCapability The AutomaticResetCapability property determines whether the automatic reset is enabled. This capability is available on Windows NT but not on Windows 95./nValues: TRUE or FALSE. If TRUE, the automatic reset is enabled. AutomaticResetCapability � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier G % � � 9 � MSFT_CliProperty BootOptionOnLimit Boot Option on Limit. Identifies the system action to be taken when the Reset Limit is reached. BootOptionOnLimit � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � l � MSFT_CliQualifier Values / 9 K ] Reserved Operating system System utilities Do not reboot � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � ( � � d � MSFT_CliProperty BootOptionOnWatchDog The BootOptionOnWatchDog Property indicates the type of re-boot action to be taken after the time on the watchdog timer has elapsed. BootOptionOnWatchDog � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � l � MSFT_CliQualifier Values / 9 K ] Reserved Operating system System utilities Do not reboot | 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier B � $ � � � MSFT_CliProperty BootROMSupported The BootROMSupported property determines whether a boot ROM is supported ./nValues: TRUE or FALSE. If TRUE, a boot ROM is supported. BootROMSupported 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � � MSFT_CliProperty BootupState The BootupState property specifies how the system was started. Fail-safe boot (also called SafeBoot) bypasses the user's startup files. /nConstraints: Must have a value. BootupState � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � e � MSFT_CliQualifier Values + 8 H Normal boot Fail-safe boot Fail-safe with network boot � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � q z � � MSFT_CliProperty Caption The Caption property is a short textual description (one-line string) of the object. Caption � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 64 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � & o � = � MSFT_CliProperty ChassisBootupState The ChassisBootupState property indicates the enclosure's bootup state. ChassisBootupState � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING k K � MSFT_CliQualifier ValueMap 9 < ? B E H 1 2 3 4 5 6 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � q � MSFT_CliQualifier Values 7 > G M V ` Other Unknown Safe Warning Critical Non-recoverable 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � % 0 C � MSFT_CliProperty CreationClassName The CreationClassName property indicates the name of the class or the subclass used in the creation of an instance. When used with the other key properties of this class, this property allows all instances of this class and its subclasses to be uniquely identified. CreationClassName x 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier > � # � � � MSFT_CliProperty CurrentTimeZone The CurrentTimeZone property indicates the amount of time the unitary computer system is offset from Coordinated Universal Time. CurrentTimeZone � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier L � $ � � � MSFT_CliProperty DaylightInEffect The DaylightInEffect property specifies if the daylight savings mode is on. /nValues: TRUE or FALSE. If TRUE, daylight savings is in effect. DaylightInEffect 6 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � h u � MSFT_CliProperty Description The Description property provides a textual description of the object. Description 8 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � o w � MSFT_CliProperty Domain The Domain property indicates the name of the domain to which the computer belongs. Domain � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier F 2 > � � MSFT_CliProperty DomainRole The DomainRole property indicates the role this computer plays within its assigned domain-workgroup. The domain-workgroup is a collection of computers on the same network. For example, the DomainRole property may show this computer is a "Member Workstation" (value of [1]). DomainRole F I � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values 7 O c v � � Standalone Workstation Member Workstation Standalone Server Member Server Backup Domain Controller Primary Domain Controller / 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � - , n � MSFT_CliProperty EnableDaylightSavingsTime The EnableDaylightSavingsTime property indicates whether Daylight Savings Time is recognized on this machine. FALSE - time does not move an hour ahead or behind in the year. NULL - the status of DST is unknown on this system EnableDaylightSavingsTime 8 T � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING j - � MSFT_CliQualifier CIMTYPE $ boolean � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING h ( � MSFT_CliQualifier write " True � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier q ) � � I � MSFT_CliProperty FrontPanelResetStatus The FrontPanelResetStatus property identifies the hardware security settings for the reset button on the machine. FrontPanelResetStatus � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � \ � MSFT_CliQualifier Values / 9 B S Disabled Enabled Not Implemented Unknown � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier [ � % � � � MSFT_CliProperty InfraredSupported The InfraredSupported property determines whether an infrared (IR) port exists on the computer system./nValues: TRUE or FALSE. If TRUE, an IR port exists. InfraredSupported � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier S � # � � � MSFT_CliProperty InitialLoadInfo This object contains the data needed to find either the initial load device (its key) or the boot service to request the operating system to start up. InitialLoadInfo � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier O � � � � MSFT_CliProperty InstallDate The InstallDate property is datetime value indicating when the object was installed. A lack of a value does not indicate that the object is not installed. InstallDate � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � * � � Q � MSFT_CliProperty KeyboardPasswordStatus The KeyboardPasswordStatus property identifies the system-wide hardware security settings for Keyboard Password Status. KeyboardPasswordStatus � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � \ � MSFT_CliQualifier Values / 9 B S Disabled Enabled Not Implemented Unknown u 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier ; � � � � MSFT_CliProperty LastLoadInfo The array entry of the InitialLoadInfo property, that holds the data corresponding to booting the currently loaded operating system. LastLoadInfo J 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � { � � MSFT_CliProperty Manufacturer The Manufacturer property indicates the name of the computer manufacturer./nExample: Acme Manufacturer [ 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifi er ! � � � � MSFT_CliProperty Model The Model property indicates the product name of the computer given by the manufacturer./nConstraints: Must have a value Model A 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � z � � MSFT_CliProperty Name The inherited Name property serves as key of a CIM_System instance in an enterprise environment. Name
9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � � � MSFT_CliProperty NameFormat The CIM_ComputerSystem object and its derivatives are Top Level Objects of CIM. They provide the scope for numerous components. Having unique CIM_System keys is required. A heuristic is defined to create the CIM_ComputerSystem name to attempt to always generate the same name, independent of discovery protocol. This prevents inventory and management problems where the same asset or entity is discovered multiple times, but can not be resolved to a single object. Use of the heuristic is optional, but recommended. /n The NameFormat property identifies how the computer system name is generated, using a heuristic. The heuristic is outlined, in detail, in the CIM V2 Common Model specification. It assumes that the documented rules are traversed in order, to determine and assign a name. The NameFormat values list defines the precedence order for assigning the computer system name. Several rules do map to the same Value. /n Note that the CIM_ComputerSystem Name calculated using the heuristic is the system's key value. Other names can be assigned and used for the CIM_ComputerSystem, that better suit the business, using Aliases. NameFormat � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i � � MSFT_CliQualifier ValueMap Y ] c h m r w } � � � � � � IP Dial HID NWA HWA X25 ISDN IPX DCC ICD E.164 SNA OID/OSI Other � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING c � � MSFT_CliQualifier Values W [ a f k p u { � � � � � � IP Dial HID NWA HWA X25 ISDN IPX DCC ICD E.164 SNA OID/OSI Other � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier i � , � � � MSFT_CliProperty NetworkServerModeEnabled The NetworkServerModeEnabled property determines whether Network Server Mode is enabled./nValues: TRUE or FALSE. If TRUE, Network Server Mode is enabled. NetworkServerModeEnabled � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier T � & � � � MSFT_CliProperty NumberOfProcessors The NumberOfProcessors property indicates the number of processors currently available on the system. This is the number of processors whose status is "enabled" - versus simply the number of processors for the computer system. The former can be determined by enumerating the number of processor instances associated with the computer system object, using the Win32_ComputerSystemProcessor association. NumberOfProcessors � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � " � � � MSFT_CliProperty OEMStringArray This structure contains free form strings defined by the OEM. Examples of this are: Part Numbers for Reference Documents for the system, contact information for the manufacturer, etc. OEMStringArray K 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier �| � � MSFT_CliProperty PartOfDomain The PartOfDomain property indicates whether the computer is part of a domain or workgroup. PartOfDomain � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � # ) � MSFT_CliProperty PauseAfterReset The PauseAfterReset property identifies the time delay before the reboot is initiated. It is used after a system power cycle, system reset (local or remote), and automatic system reset. A value of -1 indicates that the pause value is unknown PauseAfterReset 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier �
/ � � o � MSFT_CliProperty PowerManagementCapabilities Indicates the specific power-related capabilities of a computer system and its associated running operating system. The values, 0="Unknown", 1="Not Supported", and 2="Disabled" are self-explanatory. The value, 3="Enabled" indicates that the power management features are currently enabled but the exact feature set is unknown or the information is unavailable. "Power Saving Modes Entered Automatically" (4) describes that a system can change its power state based on usage or other criteria. "Power State Settable" (5) indicates that the SetPowerState method is supported. "Power Cycling Supported" (6) indicates that the SetPowerState method can be invoked with the PowerState parameter set to 5 ("Power Cycle"). "Timed Power On Supported" (7) indicates that the SetPowerState method can be invoked with the PowerState parameter set to 5 ("Power Cycle") and the Time parameter set to a specific date and time, or interval, for power-on. PowerManagementCapabilities k � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values ? H W a j � � � Unknown Not Supported Disabled Enabled Power Saving Modes Entered Automatically Power State Settable Power Cycling Supported Timed Power On Supported � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � , ! ; � MSFT_CliProperty PowerManagementSupported Boolean indicating that the computer system, with its running operating system, support power management. This boolean does not indicate that power management features are currently enabled, only that the system is capable of power management. PowerManagementSupported � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier { ) � � N � MSFT_CliProperty PowerOnPasswordStatus The PowerOnPasswordStatus property identifies the system-wide hardware security settings for Power On Password Status. PowerOnPasswordStatus � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � \ � MSFT_CliQualifier Values / 9 B S Disabled Enabled Not Implemented Unknown s 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier 9 � � � MSFT_CliProperty PowerState Indicates the current power state of the computer system and its associated operating system. Regarding the power saving states, these are defined as follows: Value 4 (Unknown) indicates that the system is known to be in a power save mode, but its exact status in this mode is unknown; 2 (Low Power Mode) indicates that the system is in a power save state but still functioning, and may exhibit degraded performance; 3 (Standby) describes that the system is not functioning but could be brought to full power 'quickly'; and value 7 (Warning) indicates that the computerSystem is in a warning state, though also in a power save mode. PowerState � p � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values ? H T q � � � � Unknown Full Power Power Save - Low Power Mode Power Save - Standby Power Save - Unknown Power Cycle Power Off Power Save - Warning o 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier 5 $ � � [ � MSFT_CliProperty PowerSupplyState The PowerSupplyState identifies the state of the enclosure's power supply (or supplies) when last booted. PowerSupplyState � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING k K � MSFT_CliQualifier ValueMap 9 < ? B E H 1 2 3 4 5 6 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � q � MSFT_CliQualifier Values 7 __ �� WIN-F6NF7R6I6PJ ROOT\Microsoft\Windows\Defender ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � Remove Q� ��^� �� implemented static � WIN-F6NF7R6I6PJ ROOT\Microsoft\Windows\Defender ���� � ��� J ��� �\ Z] \ �\ bN �N Sb �b �5 6 �E qF �G rH �F <G �h i �g 6h ! � � X � " � S
�
� z �
�A fB �B 5C �H SI �I %J �Z �Z a/ �/ * � + �+ �@ AA @m �m %0 �0 �0 \1 n �n �n Jo �P 7Q 1O �O {W �W �V )W �1 2 �a b L[ �[ �U jV k^ �^ F, �, - �- �_ z` /) �) \e �e :_ �_ �- L. p2 �2 ;3 �3 �3 �4 �4 N5 �. / �d
e AX �X �c Jd =U �U �D �E �O lP �] ^ +q �q �L JM �Q R L �L �C TD fp �p �o p �Y 4Z � � � U d � �q Pr ~T �T = > �f Tg �: l; �& �' �M N �; �< f �f ei �i ,j �j Y rY �S ,T SR �R S sS �? o@ � X Ok l �) e* � u � � ) �
�
� � D � 3 � wl �l � w � H � g � � 9 " � � � \ � � c �c O � � �* -+ 0 � a> M? vJ �J 8K �K g � �$ �$ & �& + � � � O! � �! �" �" e# �# 1$ O% �% �' �( �7 �8 '7 �7 � L �` Ba o6 �6 79 $: UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU����������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������r � __PARAMETERS abstract DisableAutoExclusions boolean
� A In
� A i �� ID )
� � i ��� boolean ExclusionPath string
� � In
� � # �� ID )
� � # ��Q string ExclusionExtension string
� � In
� � � �� ID )
� J � �� string
ExclusionProcess string
� v In
� v � �� ID
)
� � ��� string ExclusionIpAddress string
� 4 In
� 4 [ �� ID )
� � [ ��� string QuarantinePurgeItemsAfterDelay boolean
� � In
� � & �� ID )
� � & ��T boolean RealTimeScanDirection boolean
� � In
� � � �� ' * - 0 1 2 ValueMap )
� � � ��0 ID 6
� � � ��0 q boolean RemediationScheduleDay boolean
� � In
� � �� j m p s v y | � 0 1 2 3 4 5 6 7 8 ValueMap )
� � ��� B ID 6
� ��� B � boolean RemediationScheduleTime boolean
� B In
� B j �� ID )
� � j ��� boolean RemoteEncryptionProtectionConfiguredState boolean
� In
� A �� � � � � 0 1 2 4 ValueMap )
� A ��� o ID 6
� A ��� o � boolean
RemoteEncryptionProtectionMaxBlockTime boolean
� [ In
� [ � �� ID
)
� � � ���
boolean RemoteEncryptionProtectionAggressiveness boolean
� 1
In
� 1
Y
�� �
�
�
0 1 2 ValueMap )
� 1
Y
���
�
ID 6
� ) Y
���
�
�
boolean RemoteEncryptionProtectionExclusions string
� j In
� j � �� ID )
� � � ��� string
$ BruteForceProtectionConfiguredState boolean
$
� 9 In
$
� 9 a �� � � � � 0 1 2 4 ValueMap
$ )
� 9 a ��� � ID
$ 6
� 8
a ��� � �
boolean & BruteForceProtectionMaxBlockTime boolean &
� u
In &
� u
�
�� ID & )
� �
���
boolean ( BruteForceProtectionAggressiveness boolean (
� E In (
� E m �� � � � 0 1 2 ValueMap ( )
� E m ��� � ID ( 6
� = m ��� � � boolean * BruteForceProtectionExclusions string *
� x In *
� x � �� ID * )
� � ��� string . BruteForceProtectionLocalNetworkBlocking boolean .
� L In .
� L t �� ID . )
� � t ��� boolean 0 BruteForceProtectionSkipLearningPeriod boolean 0
� In 0
� H �� ID 0 )
� � H ��v boolean 2 ReportingAdditionalActionTimeOut boolean 2
� � In 2
� � �� ID 2 )
� ��D boolean 4 ReportingCriticalFailureTimeOut boolean 4
� � In 4
� � � �� ID 4 )
� L � �� boolean 6 ReportingNonCriticalTimeOut boolean 6
� � In 6
� � � �� ID 6 )
� � ��� boolean 8 ServiceHealthReportInterval boolean 8
� M In 8
� M u �� ID 8 )
� � u ��� boolean : ReportDynamicSignatureDroppedEvent boolean :
� In :
� E �� ID : )
� � E ��s boolean < ScanAvgCPULoadFactor boolean <
� � In <
� � �� ID < )
� p ��5 boolean > CheckForSignaturesBeforeRunningScan boolean >
� � In >
� � � �� ID > )
� A � �� boolean @ ScanPurgeItemsAfterDelay boolean @
� v In @
� v � �� ID @ )
� � ��� boolean B ScanOnlyIfIdleEnabled boolean B
� 9 In B
� 9 a �� ID B )
� � a ��� boolean D ScanParameters boolean D
� � In D
� � �� W Z 1 2 ValueMap D )
� � ��] K ID D 6
� � ��] K � boolean F ScanScheduleDay boolean F
� In F
� : �� � � � � � � � � � 0 1 2 3 4 5 6 7 8 ValueMap F )
� : ��� h ID F 6
� 4 : ��� h � boolean H ScanScheduleQuickScanTime boolean H
� j In H
� j � �� ID H )
� � � ��� boolean J ScanScheduleTime boolean J
� ( In J
� ( P �� ID J )
� � P ��~ boolean L ThrottleForScheduledScanOnly boolean L
� � In L
� � �� ID L )
� � ��H boolean ! N SignatureFirstAuGracePeriod boolean ! N
� � In ! N
� � � �� ID ! N )
� L � �� ! boolean " P SignatureAuGracePeriod boolean " P
� In " P
� � �� ID " P )
� � ��� " boolean # R SignatureDefinitionUpdateFileSharesSources boolean # R
� W In # R
� W �� ID # R )
� � ��� # boolean $ T SignatureDisableUpdateOnStartupWithoutEngine boolean $ T
� 1 In $ T
� 1 Y �� ID $ T )
� � Y ��� $ boolean % V SignatureFallbackOrder boolean % V
� � In % V
� � ! �� ID % V )
� �! ! ��K! % boolean & X SignatureScheduleDay boolean & X
� �! In & X
� �! �! �� 5" 8" ;" >" A" D" G" J" M" 0 1 2 3 4 5 6 7 8 ValueMap & X )
� �! �! ��P"
" ID & X 6
� �" �! ��P"
" �" & boolean ' Z SignatureScheduleTime boolean ' Z
� # In ' Z
� # 3# �� ID ' Z )
� �# 3# ��a# ' boolean ( \ SignatureUpdateCatchupInterval boolean ( \
� �# In ( \
� �# �# �� ID ( \ )
� h$ �# ��-$ ( boolean ) ^ SignatureBlobFileSharesSources boolean ) ^
� �$ In ) ^
� �$ �$ �� ID ) ^ )
� 4% �$ ���$ ) boolean * ` SignatureUpdateInterval boolean * `
� h% In * `
� h% �% �� ID * ` )
� �% �% ���% * boolean + b SignatureBlobUpdateInterval boolean + b
� 1& In + b
� 1& Y& �� ID + b )
� �& Y& ���& + boolean , d MAPSReporting boolean , d
� �& In , d
� �& ' �� R' U' X' 0 1 2 ValueMap , d )
� �& ' ��[' B' ID , d 6
� �' ' ��[' B' �' , boolean - f SubmitSamplesConsent boolean - f
� ( In - f
� ( =( �� ( �( �( �( 0 1 2 3 ValueMap - f )
� ( =( ���( k( ID - f 6
� ) =( ���( k( �( - boolean . h DisablePrivacyMode boolean . h
� C) In . h
� C) k) �� ID . h )
� �) k) ���) . boolean / j RandomizeScheduleTaskTimes boolean / j
� * In / j
� * 3* �� ID / j )
� �* 3* ��a* / boolean 0 l SchedulerRandomizationTime boolean 0 l
� �* In 0 l
� �* �* �� ID 0 l )
� d+ �* ��)+ 0 boolean 1 n DisableBehaviorMonitoring boolean 1 n
� �+ In 1 n
� �+ �+ �� ID 1 n )
� +, �+ ���+ 1 boolean 2 p DisableIntrusionPreventionSystem boolean 2 p
� h, In 2 p
� h, �, �� ID 2 p )
� �, �, ���, 2 boolean 3 r DisableIOAVProtection boolean 3 r
� +- In 3 r
� +- S- �� ID 3 r )
� �- S- ���- 3 boolean 4 t DisableRealtimeMonitoring boolean 4 t
� �- In 4 t
� �- . �� ID 4 t )
� �. . ��H. 4 boolean 5 v DisableScriptScanning boolean 5 v
� �. In 5 v
� �. �. �� ID 5 v )
� F/ �. �� / 5 boolean 6 x DisableArchiveScanning boolean 6 x
� y/ In 6 x
� y/ �/ �� ID 6 x )
�
0 �/ ���/ 6 boolean 7 z DisableCatchupFullScan boolean 7 z
� =0 In 7 z
� =0 e0 �� ID 7 z )
� �0 e0 ���0 7 boolean 8 | DisableCatchupQuickScan boolean 8 |
� 1 In 8 |
� 1 *1 �� ID 8 | )
� �1 *1 ��X1 8 boolean 9 ~ DisableEmailScanning boolean 9 ~
� �1 In 9 ~
� �1 �1 �� ID 9 ~ )
� U2 �1 ��2 9 boolean : � DisableRemovableDriveScanning boolean : �
� �2 In : �
� �2 �2 �� ID : � )
� 3 �2 ���2 : boolean ; � DisableRestorePoint boolean ; �
� P3 In ; �
� P3 x3 �� ID ; � )
� �3 x3 ���3 ; boolean < � DisableScanningMappedNetworkDrivesForFullScan boolean < �
� +4 In < �
� +4 S4 �� ID < � )
� �4 S4 ���4 < boolean = � DisableScanningNetworkFiles boolean = �
� �4 In = �
� �4 5 �� ID = � )
� �5 5 ��J5 = boolean > � ApplyDisableNetworkScanningToIOAV boolean > �
� �5 In > �
� �5 �5 �� ID > � )
� T6 �5 ��6 > boolean ? � UILockdown boolean ? �
� {6 In ? �
� {6 �6 �� ID ? � )
� 7 �6 ���6 ? boolean @ � ThreatIDDefaultAction_Ids sint64 @ �
� B7 In @ �
� B7 i7 �� ID @ � )
� �7 i7 ���7 @ sint64 A � ThreatIDDefaultAction_Actions uint8 A �
� 8 In A �
� 8 18 �� 8 �8 �8 �8 �8 �8 �8 1 2 3 6 8 9 10 ValueMap A � )
� 8 18 ���8 _8 ID A � 6
� 9 18 ���8 _8 �8 A uint8 B � UnknownThreatDefaultAction boolean B �
� S9 In B �
� S9 {9 �� �9 �9 �9 �9 �9 �9 �9 1 2 3 6 8 9 10 ValueMap B � )
� S9 {9 ���9 �9 ID B � 6
� h: {9 ���9 �9 : B boolean C � LowThreatDefaultAction boolean C �
� �: In C �
� �: �: �� ; ; ; ; ; ; #; 1 2 3 6 8 9 10 ValueMap C � )
� �: �: ��'; �: ID C � 6
� �; �: ��'; �: h; C boolean D � ModerateThreatDefaultAction boolean D �
� �; In D �
� �; < �� ^< a< d< g< j< m< p< 1 2 3 6 8 9 10 ValueMap D � )
� �; < ��t< >< ID D � 6
� �< < ��t< >< �< D boolean E � HighThreatDefaultAction boolean E �
� 1= In E �
� 1= Y= �� �= �= �= �= �= �= �= 1 2 3 6 8 9 10 ValueMap E � )
� 1= Y= ���= �= ID E � 6
� F> Y= ���= �= �= E boolean F � SevereThreatDefaultAction boolean F �
� |> In F �
� |> �> �� �> �> �> �> �> ? ? 1 2 3 6 8 9 10 ValueMap F � )
� |> �> ��? �> ID F � 6
� �? �> ��? �> I? F boolean G � PUAProtection boolean G �
� �? In G �
� �? �? �� !@ $@ '@ 0 1 2 ValueMap G � )
� �? �? ��*@ @ ID G � 6
� �@ �? ��*@ @ k@ G boolean H � DisableBlockAtFirstSeen boolean H �
� �@ In H �
� �@ A �� ID H � )
� xA A ��=A H boolean I � CloudBlockLevel boolean I �
� �A In I �
� �A �A �� B B B B B 0 1 2 4 6 ValueMap I � )
� �A �A ��!B �A ID I � 6
� �B �A ��!B �A bB I boolean J � CloudExtendedTimeout boolean J �
� �B In J �
� �B C �� ID J � )
� lC C ��1C J boolean K � EnableNetworkProtection boolean K �
� �C In K �
� �C �C �� D D D 0 1 2 ValueMap K � )
� �C �C ��D �C ID K � 6
� �D �C ��D �C PD K boolean L � EnableControlledFolderAccess boolean L �
� �D In L �
� �D �D �� ?E BE EE HE KE 0 1 2 3 4 ValueMap L � )
� �D �D ��NE 'E ID L � 6
� �E �D ��NE 'E �E L boolean M � AttackSurfaceReductionOnlyExclusions string M �
� F In M �
� F ?F �� ID M � )
� �F ?F ��mF M string N � AttackSurfaceReductionRules_Ids string N �
� �F In N �
� �F
G �� ID N � )
� sG
G ��8G N string O � AttackSurfaceReductionRules_Actions uint8 O �
� �G In O �
� �G �G �� H !H $H 'H *H 0 1 2 5 6 ValueMap O � )
� �G �G ��-H H ID O � 6
� �H �G ��-H H nH O uint8 P � ControlledFolderAccessAllowedApplications string P �
� �H In P �
� �H !I �� ID P � )
� �I !I ��OI P string Q � ControlledFolderAccessProtectedFolders string Q �
� �I In Q �
� �I �I �� ID Q � )
� \J �I ��!J Q string R � SharedSignaturesPath boolean R �
� �J In R �
� �J �J �� ID R � )
� K �J ���J R boolean S � SharedSignaturesPathUpdateAtScheduledTimeOnly boolean S �
� gK In S �
� gK �K �� ID S � )
� �K �K ���K S boolean T � EnableLowCpuPriority boolean T �
� )L In T �
� )L QL �� ID T � )
� �L QL ��L T boolean U � EnableFileHashComputation boolean U �
� �L In U �
� �L M �� ID U � )
� �M M ��FM U boolean V � MeteredConnectionUpdates boolean V �
� �M In V �
� �M �M �� ID V � )
� GN �M �� N V boolean W � AllowNetworkProtectionOnWinServer boolean W �
� �N In W �
� �N �N �� ID W � )
� O �N ���N W boolean X � DisableDatagramProcessing boolean X �
� LO In X �
� LO tO �� ID X � )
� �O tO ���O X boolean Y � EnableConvertWarnToBlock boolean Y �
� P In Y �
� P :P �� ID Y � )
� �P :P ��hP Y boolean Z � DisableCpuThrottleOnIdleScans boolean Z �
� �P In Z �
� �P Q �� ID Z � )
� nQ Q ��3Q Z boolean [ � EnableFullScanOnBatteryPower boolean [ �
� �Q In [ �
� �Q �Q �� ID [ � )
� 8R �Q ���Q [ boolean \ � ProxyPacUrl boolean \ �
� `R In \ �
� `R �R �� ID \ � )
� �R �R ���R \ boolean ] � ProxyServer boolean ] �
� S In ] �
� S AS �� ID ] � )
� �S AS ��oS ] boolean ^ � ProxyBypass boolean ^ �
� �S In ^ �
� �S �S �� ID ^ � )
� cT �S ��(T ^ boolean _ � ForceUseProxyOnly boolean _ �
� �T In _ �
� �T �T �� ID _ � )
� "U �T ���T _ boolean ` � DisableTlsParsing boolean ` �
� PU In ` �
� PU xU �� ID ` � )
� �U xU ���U ` boolean a � DisableHttpParsing boolean a �
� V In a �
� V 8V �� ID a � )
� �V 8V ��fV a boolean b � DisableDnsParsing boolean b �
� �V In b �
� �V �V �� ID b � )
� `W �V ��%W b boolean c � DisableDnsOverTcpParsing boolean c �
� �W In c �
� �W �W �� ID c � )
� &X �W ���W c boolean d � DisableSshParsing boolean d �
� TX In d �
� TX |X �� ID d � )
� �X |X ���X d boolean e � PlatformUpdatesChannel boolean e �
� Y In e �
� Y @Y �� ID e � )
� �Y @Y ��nY e boolean f � EngineUpdatesChannel boolean f �
� �Y In f �
� �Y Z �� ID f � )
� kZ Z x+C�� P ��Zx� F �xk6 � Ѱ�x5
H a��@} ' �Z�f� k P�� �) 1�9�5 X e S o s P k g _ c l o c k _ h a n d _ r o u n d _��7 � K # XeSosPkg_clock_hand_round ) � �� + 7 � � ? K � � A U � � � U e � � F Z � � WUU������������������������������������������������������������������������ � clock_hand_round EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid entries_last_round
8 )
� , 4
� �� uint64 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� # 0 � �� uint32 WmiDataId Description RemainingLength removed_all_rounds )
� � � � �� uint64 WmiDataId removed_last_round ( )
� � � � �� uint64 WmiDataId rounds_count )
� B J � �� uint64 WmiDataId SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber stats_address
4
� * 2 � ��= �� object WmiDataId Pointer time_of_last_round @ )
� � � � �� uint64 WmiDataId updated_last_round 0 )
� � � � �� uint64 WmiDataId � X e S o s P k g _��7 � XeSosPkg
C � �� ' Q W � � � _����� � XeSosPkg_clock_hand_move Description Statistics of clock hand after one move. Guid {3D234CAB-7B2B-4D14-9A3E-A8C1F25204F1} locale MS\0x409 DisplayName clock_hand_move � X e S o s P k g _ c l o c k _ h a n d _ m o v e _��7 �� 3 " XeSosPkg_clock_hand_move ) � �� * 6 � � ; L � � � � m ~ � w � WU�������������������������������������������������� � clock_hand_move EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid entries_removed )
� ( 0 � �� uint64 WmiDataId entries_updated ( )
� � � � �� uint64 WmiDataId entries_visited )
� � � � �� uint64 WmiDataId FragmentId 6
� A I T a � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� G O Z g � �� uint32 WmiDataId Description SequenceNumber stats_address
4
� � � � ��� �� object WmiDataId Pointer � X e S o s P k g !_��7 � XeSosPkg
C � �� ( R X � � � � _����� � XeSosPkg_clock_hand_stats Description Statistics of clock hand after one tick. Guid {077C6EF6-58E5-4086-A91F-90CD75324870} locale MS\0x409 DisplayName clock_hand_stats � X e S o s P k g _ c l o c k _ h a n d _ s t a t s "_��7 ��
� # XeSosPkg_clock_hand_stats ) � �� + 7 � � : F � � > � � � K [ � � % � � � V d � � 2 A � � = I � � 9 M � � � WUUUU����������������������������������������������������������������������������������������������������������������������������S � clock_hand_stats EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid clock_hand_id )
� ' / � �� uint64 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId is_process_physical_memory_low q )
�
� �� sint8 WmiDataId is_process_virtual_memory_low r )
� u | � �� sint8 WmiDataId is_system_physical_memory_low p )
� � � � �� sint8 WmiDataId last_round_start X )
� 8 @ � �� uint64 WmiDataId last_tick_time
P )
� � �
� �� uint64 WmiDataId pool_physical_memory_indicator_mask h )
� � �� uint64 WmiDataId RemainingLength 6
� i q | � � �� uint32 WmiDataId Description RemainingLength removed_all_rounds 0 )
� � � � �� uint64 WmiDataId removed_last_round H )
� C K � �� uint64 WmiDataId rounds_count )
� � � � �� uint64 WmiDataId SequenceNumber 6
�
" � �� uint32 WmiDataId Description SequenceNumber store_address
4
� � � � ��� �� object WmiDataId Pointer store_name w C
� � � �� " 2 : string WmiDataId StringTermination NullTerminated Format w store_type s C
� � � � ��� � � � string WmiDataId StringTermination NullTerminated Format w time_of_last_round ` )
� & . � �� uint64 WmiDataId updated_last_round @ )
� � � � �� uint64 WmiDataId visited_all_rounds ( )
� � � � �� uint64 WmiDataId visited_last_round
8 )
� @ H
� �� uint64 WmiDataId � X e S o s P k g #_��7 �C XeSosPkg
C � ��) 6 g m � � � � _����� � XeSosPkg_place_holder_for_spinlock_maps Description Map showcasing various spinlock maps available. Guid {077a6EF6-58Ea-4086-A91F-9aCD7532487a} locale MS\0x409 DisplayName place_holder_for_spinlock_maps �7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D h�)�-�
ȝ��C�w ` � __MethodProviderRegistration \\.\root\cimv2\mdm\dmmap:__Win32Provider.Name="DMWmiBridgeProv1" E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C i�)�-� ȝ��C�� � �������� b � __InstanceProviderRegistration \\.\root\cimv2\mdm\dmmap:__Win32Provider.Name="DMWmiBridgeProv1" R O O T \ c i m v 2 \ m d m \ d m m a p _ _ I n s t a n c e P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 0 6 3 4 B E A A A 6 D 4 7 E 6 3 7 1 9 9 9 A D 4 0 5 E 0 D D A F D A 3 B D A B 3 6 5 9 C 4 8 5 8 F 5 6 5 9 3 6 A 4 9 0 9 9 8 1 F \ K I _ E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C \ I _ 0 2 E 3 B 8 C 8 2 4 F D 0 B 9 C 1 5 B 4 D 4 9 A B 8 4 C F 0 2 F A 3 8 E 0 2 C A F 6 9 9 D C 3 C B D C B B 2 D 7 9 F 3 0 2 5 D F QueryNicSwitchHardwareCapabilities C:\Windows\system32\kernelbase.dll[MofResourceName] C8981003CC080FE852D5AF14F1A379A2C0.3267.3052567418.1928 Sequence �e] s���� <
��Z� ̉�= � ^��� � ��2&� Q �N � ���� M |� � ��K�� `x�Y� \ g9�3 � oڝ��C�$ ) = J � �� � ` r � � � ' Y y � � C S U������������������������� � MDM_Win32CompatibilityAppraiser_UtcConfigurationDiagnosis02 InPartition R local-system DMWmiBridgeProv1 CommercialDataOptIn '
� � � �� � sint32 DiagTrackServiceRunning '
� � �� � boolean InstanceID
� Q � �� string InternetExplorerTelemetryOptIn '
� � � �� � sint32 MsaServiceEnabled '
� � � �� � boolean ParentID
� ; � �� string TelemetryOptIn '
� � � �� � sint32 � pڝ��C� ) = J � �� � ` r ~ � � A T U����������������� � MDM_Win32CompatibilityAppraiser_WerConfigurationDiagnosis02 InPartition R local-system DMWmiBridgeProv1 InstanceID
� � � �� string MostRestrictiveSetting '
� � � �� � sint32 ParentID
� 9 � �� string WerTelemetryOptIn '
� � � �� � sint32 M � qڝ��C��
) 9 F � �� � \ n z � � � � U������������: � MDM_Win32CompatibilityAppraiser_WindowsErrorReporting01 InPartition N local-system DMWmiBridgeProv1 InstanceID
� � � �� string ParentID
� � � �� string WerConnectionReport '
� 2 � �� � string ra � rڝ��C�� ) % 2 � �� � H Z f � � � � + 5 U����������������g � MDM_WindowsAdvancedThreatProtection InPartition : local-system DMWmiBridgeProv1 InstanceID
� � � �� string Offboarding '
� � � �� � �� string Onboarding '
� # � �� � �� string ParentID
� _ � �� string M � tڝ��C�9 ) 5 B � �� � X j w � � � ? K } � U���������������������� � MDM_WindowsAdvancedThreatProtection_DeviceTagging01 InPartition J local-system DMWmiBridgeProv1 Criticality '
� � � �� � �� sint32 Group '
� � � �� � �� string IdMethod '
� 7 � �� � �� sint32 InstanceID
� u � �� string ParentID
� � � �� string � uڝ��C�� ) 3 @ � �� � V h t � � � B I � � � � U����������������������� � MDM_WindowsAdvancedThreatProtection_HealthState01 InPartition H local-system DMWmiBridgeProv1 InstanceID
� � � �� string LastConnected e '
� � � �� � datetime OnboardingState '
� : � �� � sint32 OrgId '
� ~ � �� � string ParentID
� � � �� string SenseIsRunning '
� � �� � boolean � vڝ��C�K ) % 2 � �� � H Z � � � � 9 I � � U���������������������� � MDM_WindowsDefenderApplicationGuard InPartition : local-system DMWmiBridgeProv1 InstallWindowsDefenderApplicationGuard '
� � � �� � string InstanceID
� � � �� string ParentID
� 1 � �� string PlatformStatus '
� ~ � �� � sint32 Status '
� � � �� � sint32 � . J K � � InstallWindowsDefenderApplicationGuardMethod = �� implemented � ae442007200009F ROOT\cimv2\mdm\dmmap ���� � �� �� * � ����� � __PARAMETERS abstract param string
� 1 In
� 1 X �� ID )
� � X ��� string __ �� ae442007200009F ROOT\cimv2\mdm\dmmap ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � wڝ��C��
) - : � �� � P b y � � � � U������������0 � MDM_WindowsDefenderApplicationGuard_Audit01 InPartition B local-system DMWmiBridgeProv1 AuditApplicationGuard '
� � � �� � �� sint32 InstanceID
� � � �� string ParentID
� ( � �� string at � xڝ��C�� 3 ) 0 = � �� � S e � � � $ a � � � 4 q � � � O Y � � � � UUU������������������������������������������������( � MDM_WindowsDefenderApplicationGuard_Settings01 InPartition E local-system DMWmiBridgeProv1 AllowCameraMicrophoneRedirection , '
� � � �� � �� sint32 AllowPersistence '
� � �� � �� sint32 AllowVirtualGPU '
� Y � �� � �� sint32 AllowWindowsDefenderApplicationGuard '
� � � �� � �� sint32 BlockNonEnterpriseContent '
� � �� � �� sint32 CertificateThumbprints
( '
� i � �� � �� string ClipboardFileType '
� � � �� � �� sint32 ClipboardSettings '
� � �� � �� sint32 InstanceID
� G � �� string ParentID
� � � �� string PrintingSettings '
� � � �� � �� sint32 SaveFilesToHost $ '
� � �� � �� sint32 �5 7 E 5 F 3 A D D 9 E 2 4 2 C 4 E 9 F 9 E D F 7 9 A A 9 7 F 7 9 E 7 9 1 1 C 5 A 8 B 9 0 2 E C 1 5 0 D 6 4 4 2 E 3 B 8 5 A 5 A A yڝ��C�ȝ��C�� �����V @ 9 j � __Win32Provider {31B4248C-DE4C-408E-88EF-3B4C377E40C9} LocalSystemHost:MSFT_Deploy deploymentprovider sڝ��C�� ) 5 B � �� � X j w � � � 9 C u � � � U������������������������� � MDM_WindowsAdvancedThreatProtection_Configuration01 InPartition J local-system DMWmiBridgeProv1 AadDeviceId '
� � � �� � �� string GroupIds '
� � � �� � �� string InstanceID
� 1 � �� string ParentID
� m � �� string SampleSharing '
� � � �� � �� sint32 TelemetryReportingFrequency '
� � �� � �� sint32 � ��0Z f boolean g � DefinitionUpdatesChannel boolean g �
� �Z In g �
� �Z �Z �� ID g � )
� 1[ �Z ���Z g boolean h � DisableGradualRelease boolean h �
� c[ In h �
� c[ �[ �� ID h � )
� �[ �[ ���[ h boolean i � AllowNetworkProtectionDownLevel boolean i �
� 0\ In i �
� 0\ X\ �� ID i � )
� �\ X\ ���\ i boolean j � AllowDatagramProcessingOnWinServer boolean j �
� ] In j �
� ] (] �� ID j � )
� �] (] ��V] j boolean k � EnableDnsSinkhole boolean k �
� �] In k �
� �] �] �� ID k � )
� P^ �] ��^ k boolean l � DisableInboundConnectionFiltering boolean l �
� �^ In l �
� �^ �^ �� ID l � )
� _ �^ ���^ l boolean m � DisableRdpParsing boolean m �
� M_ In m �
� M_ u_ �� ID m � )
� �_ u_ ���_ m boolean n � DisableNetworkProtectionPerfTelemetry boolean n �
� ` In n �
� ` H` �� ID n � )
� �` H` ��v` n boolean o � TrustLabelProtectionStatus boolean o �
� �` In o �
� �` a �� ID o � )
� ya a ��>a o boolean p � DisableFtpParsing boolean p �
� �a In p �
� �a �a �� ID p � )
� 8b �a ���a p boolean q � AllowSwitchToAsyncInspection boolean q �
� qb In q �
� qb �b �� ID q � )
� c �b ���b q boolean r � ScanScheduleOffset boolean r �
� 1c In r �
� 1c Yc �� ID r � )
� �c Yc ���c r boolean s DisableTDTFeature boolean s
� �c In s
� �c d �� ID s )
� �d d ��Fd s boolean t DisableSmtpParsing boolean t
� �d In t
� �d �d �� ID t )
� Ae �d ��e t boolean u DisableQuicParsing boolean u
� pe In u
� pe �e �� ID u )
� f �e ���e u boolean v NetworkProtectionReputationMode boolean v
� =f In v
� =f ef �� ID v )
� �f ef ���f v boolean w IntelTDTEnabled boolean w
� �f In w
� �f "g �� ID w )
� �g "g ��Pg w boolean x
AttackSurfaceReductionRules_RuleSpecificExclusions_Id string x
� �g In x
� �g h �� ID x
)
� mh h ��2h x string y AttackSurfaceReductionRules_RuleSpecificExclusions string y
� �h In y
� �h �h �� ID y )
� Ki �h ��i y string z OobeEnableRtpAndSigUpdate boolean z
� �i In z
� �i �i �� ID z )
� j �i ���i z boolean { PerformanceModeStatus boolean {
� Cj In {
� Cj kj �� �j �j 0 1 ValueMap { )
� Cj kj ���j �j ID { 6
� 4k kj ���j �j �j { boolean | QuickScanIncludeExclusions boolean |
� kk In |
� kk �k �� �k �k 0 1 ValueMap | )
� kk �k ���k �k ID | 6
� \l �k ���k �k l | boolean } RemoveScanningThreadPoolCap boolean }
� �l In }
� �l �l �� ID } )
� %m �l ���l } boolean ~ DisableCacheMaintenance boolean ~
� Ym In ~
� Ym �m �� ID ~ )
� �m �m ���m ~ boolean DisableCoreServiceECSIntegration boolean
� 'n In
� 'n On �� ID )
� �n On ��}n boolean � DisableCoreServiceTelemetry boolean �
� �n In �
� �n o �� ID � )
� �o o ��Fo � boolean � EnableUdpSegmentationOffload boolean �
� �o In �
� �o �o �� ID � )
� Kp �o ��p � boolean � " EnableUdpReceiveOffload boolean � "
� p In � "
� p �p �� ID � " )
� q �p ���p � boolean � $ EnableEcsConfiguration boolean � $
� Cq In � $
� Cq kq �� ID � $ )
� �q kq ���q � boolean � & Force boolean � &
� �q In � &
� �q r �� ID � & )
� �r r ��Lr � boolean > G M V ` Other Unknown Safe Warning Critical Non-recoverable y 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier ? � ' � � � MSFT_CliProperty PrimaryOwnerContact A string that provides information on how the primary system owner can be reached (e.g. phone number, email address, ...). PrimaryOwnerContact 0 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � $ K ] � MSFT_CliProperty PrimaryOwnerName The name of the primary system owner. PrimaryOwnerName � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier t # Z k % � MSFT_CliProperty ResetCapability If enabled (value = 4), the unitary computer system can be reset via hardware (e.g. the power and reset buttons). If disabled (value = 3), hardware reset is not allowed. In addition to Enabled and Disabled, other values for the property are also defined - "Not Implemented" (5), "Other" (1) and "Unknown" (2). ResetCapability w � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING k D � MSFT_CliQualifier ValueMap 5 8 ; > A 1 2 3 4 5 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � g � MSFT_CliQualifier Values 3 : C M V Other Unknown Disabled Enabled Not Implemented � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier I � � � � MSFT_CliProperty ResetCount The ResetCount property indicates the number of automatic resets since the last intentional reset. A value of -1 indicates that the count is unknown. ResetCount � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier I � � � � MSFT_CliProperty ResetLimit The ResetLimit property indicates the number of consecutive time the system reset will be attempted. A value of -1 indicates that the limit is unknown ResetLimit : 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � r y � MSFT_CliProperty Roles A collection of strings that specify the roles this system plays in the IT-environment. Roles � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � * � MSFT_CliProperty Status The Status property is a string indicating the current status of the object. Various operational and non-operational statuses can be defined. Operational statuses are "OK", "Degraded" and "Pred Fail". "Pred Fail" indicates that an element may be functioning properly but predicting a failure in the near future. An example is a SMART-enabled hard drive. Non-operational statuses can also be specified. These are "Error", "Starting", "Stopping" and "Service". The latter, "Service", could apply during mirror-resilvering of a disk, reload of a user permissions list, or other administrative work. Not all such work is on-line, yet the managed element is neither "OK" nor in one of the other states. Status � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 10 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap A E L V _ j t ~ OK Error Degraded Unknown Pred Fail Starting Stopping Service � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values ? C J T ] h r | OK Error Degraded Unknown Pred Fail Starting Stopping Service {�]p ��E�| � �i|�y X �Ā� �u�J� �ȑ� M S F T _ N e t A d a p t e r S e t t i n g D a t a �wR|�C�� + $ MSFT_NetAdapterSettingData ) , S ��^ f n { � � � ������������������������������������������S � MSFT_NetAdapterUsoSettingData Description USO properties for a network adapter. AMENDMENT LOCALE MS_409 IPv4Enabled
� � � � boolean Description Indicates if USO is currently enabled for IPv4 TCP packets. IPv6Enabled "
� 3 < I boolean Description Indicates if USO is currently enabled for IPv6 TCP packets. UdpSegmentationOffloadHardwareCapabilities
$
� � % object:MSFT_NetAdapterUdpSegmentationOffloadCapabilities Description The USO current capabilities of the Adapter. � u K T � R � � Enable & Description Enables the UDP Segmentation Offload (USO) properties on the network adapter. � a42c9160500003S ROOT\standardcimv2\MS_409 ���� � �* �� * � � < ����| � __PARAMETERS abstract IPv4 boolean
� 0 In
� 0 X �� ID )
� � X ��� boolean IPv6 boolean
� � In
� �
�� ID )
� s
��8 boolean __ �B a42c9160500003S ROOT\standardcimv2\MS_409 ���� � �� �� * � B ��������l � __PARAMETERS abstract
cmdletOutput object
� 8 Out
� 8 _ �� ID
)
� � _ ��� object:MSFT_NetAdapterUsoSettingData ReturnValue uint32
� 5 uint32 out
� 5 = �� __ � Disable e r Description Disables the UDP Segmentation Offload (USO) properties on the network adapter. � a42c9160500003S ROOT\standardcimv2\MS_409 ���� � �* �� * � � < ����| � __PARAMETERS abstract IPv4 boolean
� 0 In
� 0 X �� ID )
� � X ��� boolean IPv6 boolean
� � In
� �
�� ID )
� s
��8 boolean __ �B a42c9160500003S ROOT\standardcimv2\MS_409 ���� � �� �� * � B ��������l � __PARAMETERS abstract
cmdletOutput object
� 8 Out
� 8 _ �� ID
)
� � _ ��� object:MSFT_NetAdapterUsoSettingData ReturnValue uint32
� 5 uint32 out
� 5 = �� __ �! M S F T _ N e t A d a p t e r E l e m e n t S e t t i n g D a t a �wR|�C�� + MSFT_NetAdapterElementSettingData # ) $ 1 k ��v ~ � � ����������������" � MSFT_NetAdapterVPortElementSetting Description Associates a network adapter with its virtual port data. AMENDMENT LOCALE MS_409 SettingData f@
� � � � ref:MSFT_NetAdapterVPortSettingData Description The VPort setting data for the network adapter. � M S F T _ N e t A d a p t e r S e t t i n g D a t a �wR|�C� Q $ MSFT_NetAdapterSettingData ) ! . V ��a i q } ( � � � � & � � � � ' 1 � � � � U a ��UU���������������������������������������������������������������������������� � MSFT_NetAdapterVPortSettingData Description Network adapter Virtual Port settings. AMENDMENT LOCALE MS_409 FilterList
H
� � � � object:MSFT_NetAdapter_VmqFilter Description An array of MAC address and VLAN ID pair filters set on the VPort. FunctionID ,
� T \ i uint16 Description The ID of the attached function. This could be the Vf or the PF ID. InterruptModeration
2 +
� � S ` uint32 Values ( 1 ; @ E M Unknown Adaptive Off Low Medium High Description The interrupt moderation for the VPort. NumFilters D
� � � � uint32 Description The number of MAC address and VLAN ID filters set on the queue. NumQueuePairs .
� R Z g uint32 Description The number of queue pairs. ProcessorAffinityMask :
� � � � uint64 Description A bitmap that specifies the CPU that the queue has affinity with. For example, setting bit 0 indicates CPU 0 is used, setting bit 1 indicates CPU 1 is used, and so on. ProcessorGroup B
� � � � uint16 Description The group number for the processors specified in ProcessorAffinityMask property. SwitchID
(
� ] e r uint32 Description The identifier of the switch. VPortID
� � � � uint32 Description The ID of the VPort. VPortName $
� ( 0 = string Description The name of the VPort. VPortState 6 +
� � � � � � uint32 Values � � � Unknown Activated DeActivated Description The state of the VPort. �! M S F T _ N e t A d a p t e r E l e m e n t S e t t i n g D a t a �wR|�C�� + MSFT_NetAdapterElementSettingData # ) " / � ��� � � � ����������������3 � MSFT_NetAdapterVmqElementSetting Description Associates a network adapter with its Virtual Machine Queue (VMQ) setting data. AMENDMENT LOCALE MS_409 SettingData f@
� � � ref:MSFT_NetAdapterVmqSettingData Description The VMQ setting data for the network adapter. �! M S F T _ N e t A d a p t e r E l e m e n t S e t t i n g D a t a �wR|�C�� + MSFT_NetAdapterElementSettingData # ) ' 4 { ��� � � � ����������������9 � MSFT_NetAdapterVmqQueueElementSetting Description Associates a network adapter with the setting data of its VMQ queues. AMENDMENT LOCALE MS_409 SettingData f@
� � � ref:MSFT_NetAdapterVmqQueueSettingData Description The VMQ Queue setting data for the network adapter. �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�x
��2�� U � WDMClassesOfDriver AcpiPct C:\Windows\System32\drivers\processr.sys[PROCESSORWMI] me] \�\7� uȡn� &s�@� � � �@ � �*� � � �9m�d T= 1{ R VRX�
C I M _ A c t i o n z��C�� ) CIM_Action ) + � ��� � � � � � ( . ����������������������������������������J � Win32_PublishComponentAction Description The PublishComponents action manages the advertisement of the components that may be faulted in by other products with the system. In the Advertise mode the action publishes the all components for which the corresponding feature is enabled. Else the action publishes components for which the corresponding feature is currently selected to be installed. AMENDMENT LOCALE ms_409 AppData
"
� � � � string Description A localizable text describing the qualified component of this instance. The string is commonly parsed by the application and can be displayed to the user. ComponentID
� � � � string Description The SoftwareElementID of the software element associated with this action. Qual
� Z b o string Description A text string that qualifies the value in the ComponentId property. A qualifier is used to distinguish multiple forms of the same software element, such as a software element that is implemented in multiple languages. �
C I M _ A c t i o n {��C�� % CIM_Action ) $ e ��p x � � - 3 �������������������������������������X � Win32_BindImageAction Description The BindImage action binds each executable that needs to be bound to the DLLs imported by it by computing the virtual address of each function that is imported from all DLLs. The computed virtual address is then saved in the importing image's Import Address Table (IAT). The action works on each file installed locally. AMENDMENT LOCALE ms_409 File
� � � � string Description The FileID of a Win32_FileSpecification for which this action applies (must be a valid binary file.) Path
� _ g t string Description A list of paths, separated by semicolons, that represent the paths to be searched to find the imported DLLs. The list is usually a list of Win32_Properties, with each Win32_Property.Name enclosed inside square brackets ([ ]). �
C I M _ A c t i o n |��C�p > CIM_Action ) ( �� ) � � �
w } � � f p � � > D ��UU����������������������������������������������������������� � Win32_ExtensionInfoAction Description The ExtensionInfoAction manages the registration of extension related information with the system. The action registers the extension servers for which the corresponding feature is currently selected to be uninstalled. AMENDMENT LOCALE ms_409 Argument 2
� U ] j string Description Value for the command arguments. Command
.
� � � � string Description The text displayed on the context menu. Extension &
� 6 > K string Description The extension associated with an instance. MIME 6
� � � � string Description The MIME type associated with this extension. ProgID
� ! ) 6 string Description The Program ID associated with this extension. ShellNew
� � � � string Description Parameters for shell execution. ShellNewValue
"
�
" string Description Value for shell execution. Verb *
� p x � string Description The verb for the command. � C I M _ C o p y F i l e A c t i o n }��C�Z + CIM_CopyFileAction ) ( ��* 2 : C ������������������������������������������� � Win32_DuplicateFileAction Description The DuplicateFileAction allows the author to make one or more duplicate copies of files installed by the InstallFiles executable action, either to a different directory than the original file, or to the same directory, but with a different name. AMENDMENT LOCALE ms_409 FileKey $
� o w � string Description A unique key identifying this duplicate file action within its product. � C I M _ R e m o v e F i l e A c t i o n ~��C�N 0 CIM_RemoveFileAction ) % � ��� � � � � � � � ��W���������������������������������������������� � Win32_RemoveFileAction Description The RemoveFiles action uninstalls files previously installed by the InstallFiles action. Each of these files is 'gated' by a link to an entry in the Component class; only those files whose components are resolved to the iisAbsent Action state, or the iisSource Action state IF the component is currently installed locally, will be removed. The RemoveFiles action can also remove specific author-specified files that weren't installed by the InstallFiles action. Each of these files is 'gated' by a link to an entry in the Component class; those files whose components are resolved to any 'active' Action state (i.e. not in the 'off', or NULL, state) will be removed (if the file exists in the specified directory, of course). This implies that removal of files will be attempted when the gating component is first installed, during a reinstall, and again when the gating component is removed. AMENDMENT LOCALE ms_409 DirProperty
"
� � � string Description The name of a Win32_Property whose value is assumed to resolve to the full path to the folder of the file to be removed. The property can be the name of a directory iproperty for a Win32_DirectorySpecification or any other property that represents a full path. FileKey &
� G O \ string Description A unique key identifying this remove file action within its product. FileName
� � � � string Description The property contains the name of the file to be removed. If this column is null, then the specified folder will be removed if it is empty. All of the files that match the wildcard will be removed from the specified directory. InstallMode *
�
uint16 Description A bit map that tells when this action will be preformed based on the following
Hexadecimal
Decimal
Description
0x001
1
Remove only when the associated component is being installed (msiInstallStateLocalor msiInstallStateSource).
0x002
2
Remove only when the associated component is being removed (msiInstallStateAbsent).
0x003
3
Remove in either of the above cases. � C I M _ C r e a t e D i r e c t o r y A c t i o n ��C�� ! # CIM_CreateDirectoryAction ) ' 0 ��; C ���������������������������������K � Win32_CreateFolderAction Description The CreateFolder action creates empty folders for components set to be installed locally. The removal of these folders is handled by the RemoveFolders action. When a folder is created (and didn't already exist), it is registered with the appropriate component id. AMENDMENT LOCALE ms_409 � C I M _ S e t t i n g ���C�$
CIM_Setting
) � ��� � ?������������� � Win32_MSIResource Description This abstract class represents any resources that are used by the MSI installer durring the course of an installation, patch or upgrade AMENDMENT LOCALE ms_409 � �Н��C�� ) * � ��� � � � Win32_SoftwareFeatureAction Description This association relates an MSI feature with an action used to register and/or publish the feature AMENDMENT LOCALE ms_409 � � �Hή�
�� ȝ�� "RL�� ٫z� ̋u�, �I��@ ��@T I+ Bn
3��� "�˛ W� �
*��� W���
p�ͭ� �=L XqU8 ǿ9�- ! ]��yN �2($S �yP�e �h2{ JQ�6 ��R
� (u4� ��� �FK� 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� 0 J.3�� e � WDMClassesOfDriver MSNdis_NetworkShortAddress C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4
�n�^��
͝��C�� - J.3�� b � WDMClassesOfDriver MSNdis_NetworkLinkSpeed C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� ) J.3�� ^ � WDMClassesOfDriver MSMCAEvent_TLBError C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� 5 J.3�� j � WDMClassesOfDriver MSMCAEvent_MemoryHierarchyError C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� ) J.3�� ^ � WDMClassesOfDriver MSMCAEvent_CPUError C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� , J.3�� a � WDMClassesOfDriver MSMCAEvent_MemoryError C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� , J.3�� a � WDMClassesOfDriver MSMCAEvent_PCIBusError C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� 2 J.3�� g � WDMClassesOfDriver MSMCAEvent_PCIComponentError C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� 1 J.3�� f � WDMClassesOfDriver MSMCAEvent_SystemEventError C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� , J.3�� a � WDMClassesOfDriver MSMCAEvent_SMBIOSError C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� 6 J.3�� k � WDMClassesOfDriver MSMCAEvent_PlatformSpecificError C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� - J.3�� b � WDMClassesOfDriver MSMCAEvent_InvalidError C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� 2 J.3�� g � WDMClassesOfDriver MSMCAEvent_MemoryPageRemoved C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�} % J.3�� Z � WDMClassesOfDriver MSMCAInfo_Entry C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� * J.3�� _ � WDMClassesOfDriver MSMCAInfo_RawMCAData C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� + J.3�� ` � WDMClassesOfDriver MSMCAInfo_RawCMCEvent C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� + J.3�� ` � WDMClassesOfDriver MSMCAInfo_RawMCAEvent C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� 9 J.3�� n � WDMClassesOfDriver MSMCAInfo_RawCorrectedPlatformEvent C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�u J.3�� R � WDMClassesOfDriver MSPower C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� * J.3�� _ � WDMClassesOfDriver MSPower_DeviceEnable C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� . J.3�� c � WDMClassesOfDriver MSPower_DeviceWakeEnable C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�t J.3�� Q � WDMClassesOfDriver MSNdis C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� + J.3�� ` � WDMClassesOfDriver MSNdis_NetworkAddress C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� - J.3�� b � WDMClassesOfDriver MSNdis_EnumerateAdapter C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� 1 J.3�� f � WDMClassesOfDriver MSNdis_NotifyAdapterRemoval C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� 1 J.3�� f � WDMClassesOfDriver MSNdis_NotifyAdapterArrival C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� , J.3�� a � WDMClassesOfDriver MSNdis_NdisEnumerateVc C:\Windows\system32\kernelbase.dll[MofResourceName] ame] 9 A B 5 3 8 0 6 E 8 8 6 6 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0 ��b��5� ͝��C�n N�X�5� M � WMIBinaryMofResource C:\Windows\system32\drivers\ndis.sys[MofResourceName] ame] e] }J�M` � ���_ ���k �#!� � G�f� L-�� /�&� �QӪ
3��z� �L���
� ��!� ɡP�� J�
u� U �� ��Dd �3& " 4�H
�3�~R ��=�b ����x ~t`~ 4 3 C 8 6 C 3 E 5 B 2 B 7 F 1 D D 0 4 4 3 A 6 D A 4 E 1 7 A A 9 5 D 6 5 F 5 6 E E 0 C 1 9 C F 4 F D 3 B 5 D 9 A 5 F 6 3 C 5 2 2 �"�U�T�u͝��C�o 0 9 �� N � HNet_Connection {047525BC-A893-436A-91E8-557852561637} Ethernet Instance 0 A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 �"�U�T�v͝��C�| �� Z � HNet_ConnectionProperties HNet_Connection.Guid="{047525BC-A893-436A-91E8-557852561637}" R O O T \ M i c r o s o f t \ H o m e N e t H N e t _ C o n n e c t i o n P r o p e r t i e s
C o n n e c t i o n � N S _ 5 1 1 6 2 6 F A E 4 F 5 7 D B D 2 0 D F 5 C D 4 4 A 4 1 D A E C E D 2 8 C F 7 B 3 F D 8 B 1 2 0 1 2 C 7 F 4 B 5 8 F 4 4 E 6 6 5 \ K I _ A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 \ I _ 5 A B E 0 A 3 C 0 3 A 4 B D C 6 C E 5 A C 2 2 6 1 4 4 B A 9 8 A B D 8 1 F C 1 9 0 5 8 9 D 6 1 F 4 F B 6 7 A 3 4 2 5 2 F 7 4 F D X 4 3 C 8 6 C 3 E 5 B 2 B 7 F 1 D D 0 4 4 3 A 6 D A 4 E 1 7 A A 9 5 D 6 5 F 5 6 E E 0 C 1 9 C F 4 F D 3 B 5 D 9 A 5 F 6 3 C 5 2 2 �"�U�T�u͝��C�f 0 9 �� E � HNet_Connection {D12DED2F-AEFC-4788-A733-FAA9E04B44C7} Ethernet 2 A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 �"�U�T�v͝��C�| �� Z � HNet_ConnectionProperties HNet_Connection.Guid="{D12DED2F-AEFC-4788-A733-FAA9E04B44C7}" R O O T \ M i c r o s o f t \ H o m e N e t H N e t _ C o n n e c t i o n P r o p e r t i e s
C o n n e c t i o n � N S _ 5 1 1 6 2 6 F A E 4 F 5 7 D B D 2 0 D F 5 C D 4 4 A 4 1 D A E C E D 2 8 C F 7 B 3 F D 8 B 1 2 0 1 2 C 7 F 4 B 5 8 F 4 4 E 6 6 5 \ K I _ A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 \ I _ 5 A 8 2 1 8 7 B A D F D 0 5 C B F 9 0 D D A D A B 6 2 8 3 3 2 B F 3 B 6 4 F E A B C 1 C 8 9 9 9 5 4 6 5 9 A 9 4 C F 1 2 8 C 8 1 ��4 3 C 8 6 C 3 E 5 B 2 B 7 F 1 D D 0 4 4 3 A 6 D A 4 E 1 7 A A 9 5 D 6 5 F 5 6 E E 0 C 1 9 C F 4 F D 3 B 5 D 9 A 5 F 6 3 C 5 2 2 �"�U�T�u͝��C�q 0 9 �� P � HNet_Connection {0A645F4E-68C0-4C76-B4A3-0921C9718BDD} Local Area Connection A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 �"�U�T�v͝��C�| �� Z � HNet_ConnectionProperties HNet_Connection.Guid="{0A645F4E-68C0-4C76-B4A3-0921C9718BDD}" R O O T \ M i c r o s o f t \ H o m e N e t H N e t _ C o n n e c t i o n P r o p e r t i e s
C o n n e c t i o n � N S _ 5 1 1 6 2 6 F A E 4 F 5 7 D B D 2 0 D F 5 C D 4 4 A 4 1 D A E C E D 2 8 C F 7 B 3 F D 8 B 1 2 0 1 2 C 7 F 4 B 5 8 F 4 4 E 6 6 5 \ K I _ A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 \ I _ 4 1 F 4 0 B 0 A E D 8 0 D A 6 4 6 B B 3 A 5 4 C 3 4 C B D A F 7 2 A D B 4 E 6 4 1 4 1 4 1 6 C 5 4 3 4 8 9 2 B 2 4 E B 7 F 4 2 9 ��4 3 C 8 6 C 3 E 5 B 2 B 7 F 1 D D 0 4 4 3 A 6 D A 4 E 1 7 A A 9 5 D 6 5 F 5 6 E E 0 C 1 9 C F 4 F D 3 B 5 D 9 A 5 F 6 3 C 5 2 2 �"�U�T�u͝��C�f 0 9 �� E � HNet_Connection {2DBE1C3C-12E7-4095-90AF-AC78BF10DD42} Ethernet 2 A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 �"�U�T�v͝��C�| �� Z � HNet_ConnectionProperties HNet_Connection.Guid="{2DBE1C3C-12E7-4095-90AF-AC78BF10DD42}" R O O T \ M i c r o s o f t \ H o m e N e t H N e t _ C o n n e c t i o n P r o p e r t i e s
C o n n e c t i o n � N S _ 5 1 1 6 2 6 F A E 4 F 5 7 D B D 2 0 D F 5 C D 4 4 A 4 1 D A E C E D 2 8 C F 7 B 3 F D 8 B 1 2 0 1 2 C 7 F 4 B 5 8 F 4 4 E 6 6 5 \ K I _ A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 \ I _ 6 3 1 0 7 F 0 6 1 0 D 2 0 6 9 9 8 9 5 2 C 3 8 8 A 6 8 4 3 8 6 1 6 0 A 4 D C D E F 3 7 F A 7 5 D A 7 E 7 E 7 9 4 B 0 0 5 E 0 3 5 9 A B 5 3 8 0 6 E 8 8 6 6 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0 �b��5� ͝��C�x �f3��5��� W � WMIBinaryMofResource C:\Windows\System32\drivers\en-US\ACPI.sys.mui[ACPIMOFResource] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �b��5�
͝��C�� �f3��5� ` � WDMClassesOfDriver ACPITrace C:\Windows\System32\drivers\en-US\ACPI.sys.mui[ACPIMOFResource] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4
�b��5�
͝��C�� # �f3��5� d � WDMClassesOfDriver AMLIEvalData1 C:\Windows\System32\drivers\en-US\ACPI.sys.mui[ACPIMOFResource] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �b��5�
͝��C�� . �f3��5� o � WDMClassesOfDriver AMLIEvalData1_TypeGroup1 C:\Windows\System32\drivers\en-US\ACPI.sys.mui[ACPIMOFResource] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ^�b��5�
͝��C�z " -e3 �5� W � WDMClassesOfDriver PortClsEvent C:\Windows\System32\Drivers\portcls.SYS[PortclsMof] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/pl\}�
͝��C�� ��
�S}� ] � WDMClassesOfDriver WMIEvent C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/pl\}�
͝��C�� $ ��
�S}� c � WDMClassesOfDriver MS_WmiInternal C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ͣn�^��
͝��C�v J.3�� S � WDMClassesOfDriver WMIEvent C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 Σn�^��
͝��C�| $ J.3�� Y � WDMClassesOfDriver MS_WmiInternal C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 9 A B 5 3 8 0 6 E 8 8 6 6 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0 ݦn�^�� ͝��C�l �2��2�� K � WMIBinaryMofResource C:\Windows\System32\drivers\monitor.sys[MonitorWMI] is.sys.mui[MofResourceName] 9 A B 5 3 8 0 6 E 8 8 6 6 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0 ݦn�^�� ͝��C�l �2��2�� K � WMIBinaryMofResource C:\Windows\System32\drivers\monitor.sys[MonitorWMI] [MofResourceName] 9 A B 5 3 8 0 6 E 8 8 6 6 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0 ݦn�^�� ͝��C�l �2��2�� K � WMIBinaryMofResource C:\Windows\System32\drivers\monitor.sys[MonitorWMI] \Windows\system32\kernelbase.dll[MofResourceName] ame] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 Σn�^��
͝��C�| $ J.3�� Y � WDMClassesOfDriver MS_WmiInternal C:\Windows\system32\kernelbase.dll[MofResourceName] __ �� WIN-F6NF7R6I6PJ ROOT\Microsoft\Windows\Defender ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � Add 2� ��?� �� implemented static & WIN-F6NF7R6I6PJ ROOT\Microsoft\Windows\Defender ���� � �� G �� + � � � � u P � o
�
� w
� � ^ � P ] � * � � �
) . � �
� � � UUUU�������������������������������������������������������������������i � __PARAMETERS abstract ExclusionPath string
� 9 In
� 9 ` �� ID )
� � ` ��� string ExclusionExtension string
� � In
� � �� ID )
� � ��L string ExclusionProcess string
� � In
� � � �� ID )
� C � �� string ExclusionIpAddress string
� q In
� q � �� ID )
� � ��� string ThreatIDDefaultAction_Ids sint64
� 6 In
� 6 ] �� ID )
� � ] ��� sint64 ThreatIDDefaultAction_Actions uint8
� � In
� � % �� s v y | � � 1 2 3 6 8 9 10 ValueMap )
� � % ��� S ID 6
� % ��� S � uint8 AttackSurfaceReductionOnlyExclusions string
� Q In
� Q x �� ID )
� � x ��� string AttackSurfaceReductionRules_Ids string
� In
� C �� ID )
� � C ��q string AttackSurfaceReductionRules_Actions uint8
� � In
� � �� W Z ] ` c 0 1 2 5 6 ValueMap )
� � ��f ? ID 6
� � ��f ? � uint8 $ ControlledFolderAccessAllowedApplications string $
� 3 In $
� 3 Z �� ID $ )
� � Z ��� string
( ControlledFolderAccessProtectedFolders string
(
� In
(
� , �� ID
( )
� � , ��Z
string , SharedSignaturesPath string ,
� � in ,
� � � �� ID , )
� U
� ��
string 0 AttackSurfaceReductionRules_RuleSpecificExclusions_Id string 0
� �
In 0
� �
�
�� ID 0 )
� 6 �
���
string
4 AttackSurfaceReductionRules_RuleSpecificExclusions string
4
� � In
4
� � � �� ID
4 )
� � ���
string 8 RemoteEncryptionProtectionExclusions string 8
� T In 8
� T { �� ID 8 )
� � { ��� string < BruteForceProtectionExclusions string <
�
In <
�
E
�� ID < )
� �
E
��s
string @ Force boolean @
� �
In @
� �
�
�� ID @ )
� ` �
��% boolean )��` �
R���) W �E� � ���R � I0�� u
C I M _ A c t i o n t��C��
E CIM_Action ) $ a ��l t
| � ( H O � � � � � � � � D L � � 9 C ��UU������������������������������������������������������������������ � Win32_ClassInfoAction Description The RegisterClassInfo action manages the registration of COM class information with the system. In the Advertise mode the action registers all COM classes for which the corresponding feature is enabled. Else the action registers COM classes for which the corresponding feature is currently selected to be installed. AMENDMENT LOCALE ms_409 AppID (
� � � � string Description Application ID containing DCOM information for the associated application (string GUID). Argument 0
� T \ i string Description This property is optional only when the Context property is set to the LocalServer or LocalServer32 server context. The text is registered as the argument against the OLE server and is used by OLE for invoking the server. CLSID
� { � � string Description The class identifier of a COM server Context 8
� � � string Description The server context for this server. This may be one of the following values: LocalServer, LocalServer32, InprocServer, InprocServer32 DefInprocHandler 4
� � � � string Description Default inproc handler. May be optionally provided only for Context = LocalServer or LocalServer32. A non-numeric value is treated as a system file that serves as the 32-bit InprocHandler (appearing as the InprocHandler32 value).
Value
Meaning
1 = default (system)
16-bit InprocHandler (appearing as the InprocHandler value)
2 = default (system)
32-bit InprocHandler (appearing as the InprocHandler32 value)
3 = default (system)
16-bit as well as 32-bit InprocHandlers FileTypeMask
,
� � string Description Contains information for the HKCR (this CLSID) key. If multiple patterns exist, they must be delimited by a semicolon, and numeric subkeys are generated: 0, 1, 2. Insertable &
� � � uint16 Description An indicator as to whether this object is insertable or not. ProgID
� x � � string Description The default Program ID associated with this Class ID. RemoteName <
� � string Description The name used remotely for the server. VIProgID
"
� o w � string Description The VI Program ID associated with this Class ID. �
C I M _ A c t i o n u��C�+ ) CIM_Action ) # q ��| � � � + 8 � � ����������������������������������������� � Win32_MIMEInfoAction Description The RegisterMIMEInfo action registers the MIME related registry information with the system. In the Advertise mode the action registers all MIME info for servers for which the corresponding feature is enabled. Else the action registers MIME info for servers for which the corresponding feature is currently selected to be installed. AMENDMENT LOCALE ms_409 CLSID
� � � � string Description This property contains the COM server CLSID that is associated with the MIME content. ContentType
� d l y string Description This column is an identifier for the MIME content. It is commonly written in the form of type/format. Extension
"
� , string Description This column contains the server extension that is to be associated with the MIME content, without the dot. �
C I M _ A c t i o n v��C�� % CIM_Action ) # � ��� � � � 9 D ������������������������������������� � Win32_FontInfoAction Description The RegisterFonts action registers installed fonts with the system. It maps the Font.FontTitle to the path of the font file installed. The RegisterFonts action is triggered when the Component to which the Font.File_ belongs is selected for install. This implies that fonts can be made private, shared or system by making the Components to which they belong so. AMENDMENT LOCALE ms_409 File
� � � � string Description The FileID of a Win32_FileSpecification that represents this fonts file. FontTitle
� p x � string Description Font name. For TrueType Fonts and TrueType Collections if NULL the installer registers the font after reading the correct font title from the font file. �
C I M _ A c t i o n w��C�� 6 CIM_Action ) # � ��� � � � c k 9 D � � $ 7 ? . 5 ��U��������������������������������������������������� � Win32_ShortcutAction Description The CreateShortcuts action manages the creation of shortcuts. In the Advertise mode, the action creates shortcuts to the key files of components of features that are enabled. Advertised shortcuts are those for which the Target property is the feature of the component and the directory of the shortcut is one of the Shell folders or below one. Advertised shortcuts are created with a Microsoft installer technology Descriptor as the target. Non-advertised shortcuts are those for which the Target column in the Shortcut class is a property or the directory of the shortcut is not one of the Shell folders or below one. Advertised shortcuts are created with a Microsoft installer technology Descriptor as the target. In the non-advertise mode (normal install) the action creates shortcuts to the key files of components of features that are selected for install as well as non-advertised shortcuts whose component is selected for install. AMENDMENT LOCALE ms_409 Arguments
� ( 5 string Description The command-line arguments for the shortcut. HotKey
� � � � uint16 Description The hotkey for the shortcut. It has the virtual-key code for the key in the low-order byte, and the modifier flags in the high-order byte. IconIndex
� p x � string Description The icon index for the shortcut. Shortcut &
� � � � string Description The name of the shortcut to be created. ShowCmd $ +
� ] e r � � uint16 Description The Show Command specifies the view state of the application window and is similar to the ShowWindow Windows function. Values # SW_SHOWNORMAL SW_SHOWMAXIMIZED SW_SHOWMINNOACTIVE Target
*
� k s � string Description The Shortcut target specifies the action to be taken when a shortcut is launched. This can reference a software feature or a file specification of directory specification. WkDir .
� a i v string Description The name of the Win32_Property that has the path of the working directory for the shortcut. � ���C�] ) � ��� � � � e o �������� � Win32_CheckCheck Description This association relates a MSI Check with any locational information it requires. The location is in the form of a file and/or directory specification. AMENDMENT LOCALE ms_409 Check f )
� � ��! . ref:CIM_Check Description The Check reference represents one side of the Check. Location f )
� � � ��� � ref:CIM_Check Description The Location reference represents the other side of the Check. � ^O�� } n<[} j ���� �^[� � |�X�� ��I�� � �p��� #�%�� � �?�v� H�e&� �6m�� � =��o < g�}� � �N�v uW/6| q C I M _ R e m o v e F i l e A c t i o n >��C�= 4 CIM_RemoveFileAction C & � �� � N W g ~ � � � � 4 A ��_�������������������������������������������������s � Win32_RemoveFileAction Locale UUID {AE565838-DB33-11d2-85FC-0000F8102E5F} MSIProv MappingStrings o Microsoft.MSI DirProperty &
� � � �� string FileKey *
� � � �� string FileName
"
� , � �� string InstallMode
.
� k � �� uint16 � C I M _ C r e a t e D i r e c t o r y A c t i o n ?��C� % # CIM_CreateDirectoryAction C " ( � �� � P Y i �������������������������������������� � Win32_CreateFolderAction Locale UUID {55A2DC30-DB32-11d2-85FC-0000F8102E5F} MSIProv MappingStrings q Microsoft.MSI � C I M _ S e t t i n g @��C��
CIM_Setting
6 ! I ��S c ������������z � Win32_MSIResource Locale UUID {CD7CA121-E3D2-11d2-8601-0000F8102E5F} Abstract MappingStrings k Microsoft.MSI � W i n 3 2 _ M S I R e s o u r c e A��C�� Win32_MSIResource C $ ; C I � q � �� z � � � ���������������������
� Win32_PatchPackage MappingStrings , Microsoft.MSI Locale UUID {14575942-E3E1-11d2-8601-0000F8102E5F} MSIProv PatchID '
� � � �� � �� string ProductCode '
� � �� � �� string � W i n 3 2 _ M S I R e s o u r c e B��C�� Win32_MSIResource C 7 ? E � �� � m v � � � �������������������������@ � Win32_Property MappingStrings ( Microsoft.MSI Locale UUID {CD7CA120-E3D2-11d2-8601-0000F8102E5F} MSIProv ProductCode '
� � � �� � �� string Property '
� � � �� � �� string Value
� 8 � �� string � W i n 3 2 _ M S I R e s o u r c e C��C�{ Win32_MSIResource C
4 < B � �� � j s � � � � 1 > { � U����������������������������� � Win32_Patch MappingStrings % Microsoft.MSI Locale UUID {7A9E24ED-E3D2-11d2-8601-0000F8102E5F} MSIProv Attributes
� � � �� uint16 File '
� � � �� � �� string PatchSize
� ) � �� uint32 ProductCode '
� s � �� � �� string Sequence '
� � � �� � �� sint16 � W i n 3 2 _ M S I R e s o u r c e D��C�� Win32_MSIResource C 5 = C � �� � k t z � � � � �������������������������9 � Win32_Binary MappingStrings & Microsoft.MSI Locale UUID {DB150AA8-E3D1-11d2-8601-0000F8102E5F} MSIProv Data
� � � �� string Name '
� � � �� � �� string ProductCode '
� 1 � �� � �� string � W i n 3 2 _ M S I R e s o u r c e E��C�� % Win32_MSIResource C & = E K � s � �� | � � � � � 3 9 k x � � U������������������������������������ � Win32_ServiceControl MappingStrings . Microsoft.MSI Locale UUID {E7D29B98-E3D1-11d2-8601-0000F8102E5F} MSIProv Arguments
� � � �� string Event
� � � �� string ID '
� + � �� � �� string Name
� c � �� string ProductCode '
� � � �� � �� string Wait
� � � �� uint16 � C I M _ S e t t i n g F��C�� CIM_Setting
C # � K � ��T d { � � � �������������������������A � Win32_ODBCAttribute Locale UUID {023763EC-E3D2-11d2-8601-0000F8102E5F} MSIProv MappingStrings l Microsoft.MSI Attribute '
� � � �� � �� string Driver '
� � �� � �� string Value
� 9 � �� string � C I M _ S e t t i n g G��C�� CIM_Setting
C # ) � Q � ��Z j � � � � �������������������������K � Win32_ODBCSourceAttribute Locale UUID {100985A4-E3D2-11d2-8601-0000F8102E5F} MSIProv MappingStrings r Microsoft.MSI Attribute '
� � � �� � �� string DataSource '
�
� �� � �� string Value
� C � �� string �# C I M _ S o f t w a r e F e a t u r e S o f t w a r e E l e m e n t s H��C�7 - CIM_SoftwareFeatureSoftwareElements % C ' / 5 � �� � ] f v � � # e��������� � Win32_SoftwareFeatureSoftwareElements Locale UUID {F3B44268-DB34-11d2-85FC-0000F8102E5F} MSIProv MappingStrings ~ Microsoft.MSI GroupComponent f@ 4
� � � �� � ��� ref:Win32_SoftwareFeature Override GroupComponent PartComponent f@ 4
� e � �� � ��� � ref:Win32_SoftwareElement Override PartComponent � C I M _ D e p e n d e n c y I��C� CIM_Dependency C % + � S � ��\ l � �
U�������� � Win32_SoftwareFeatureParent Locale UUID {E7CD451C-DB34-11d2-85FC-0000F8102E5F} MSIProv MappingStrings t Microsoft.MSI Antecedent f@ 4
� � � �� � ��� � ref:Win32_SoftwareFeature Override Antecedent Dependent f@ 4
� O � �� � ��j t ref:Win32_SoftwareFeature Override Dependent � J��C�� N $ * R �� � _ � ��h x � � � � ���������3 � Win32_SoftwareFeatureCheck Locale UUID {5016E228-DB34-11d2-85FC-0000F8102E5F} Association MSIProv MappingStrings � Microsoft.MSI Check f '
� � � �� � �� ref:CIM_Check Element f '
� � �� � �� ref:Win32_SoftwareFeature 00 � C I M _ S o f t w a r e E l e m e n t C h e c k s K��C�� # CIM_SoftwareElementChecks C $ * � R � ��[ k � � � � u����������& � Win32_SoftwareElementCheck Locale UUID {1E45DFA6-DB34-11d2-85FC-0000F8102E5F} MSIProv MappingStrings s Microsoft.MSI Check f@ '
� � � �� � �� ref:CIM_Check Element f@ '
� � �� � �� ref:Win32_SoftwareElement �" W i n 3 2 _ M a n a g e d S y s t e m E l e m e n t R e s o u r c e ���C� , Win32_ManagedSystemElementResource $ ) , � ��� � � � Win32_SoftwareElementResource Description This association relates an MSI feature with an action used to register and/or publish the feature AMENDMENT LOCALE ms_409 � __ �� WIN-F6NF7R6I6PJ ROOT\Microsoft\Windows\Defender ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � n t D e s c r i p t o r ���j��� 5 MSFT_ServerManagerServerComponentDescriptor - " ' 5 < � ServerComponent_RDC DisplayName RDC ClassVersion 0.0.0 mp �+ M S F T _ S e r v e r M a n a g e r S e r v e r C o m p o n e n t D e s c r i p t o r ���j��� 5 MSFT_ServerManagerServerComponentDescriptor - # ) 7 > � ServerComponent_WINS DisplayName WINS ClassVersion 8.0.0 mp �+ M S F T _ S e r v e r M a n a g e r S e r v e r C o m p o n e n t D e s c r i p t o r ���j��� 5 MSFT_ServerManagerServerComponentDescriptor - # ) 7 > � ServerComponent_CMAK DisplayName CMAK ClassVersion 1.0.0 mp �+ M S F T _ S e r v e r M a n a g e r S e r v e r C o m p o n e n t D e s c r i p t o r ���j��� 5 MSFT_ServerManagerServerComponentDescriptor - ) 6 O ] e � ServerComponent_Remote_Desktop_Services DisplayName Remote-Desktop-Services ClassVersion 10.0.0 po �+ M S F T _ S e r v e r M a n a g e r S e r v e r C o m p o n e n t D e s c r i p t o r ���j��� 5 MSFT_ServerManagerServerComponentDescriptor - ' 4 K Y ` � ServerComponent_RDS_Connection_Broker DisplayName RDS-Connection-Broker ClassVersion 0.0.0 mp �+ M S F T _ S e r v e r M a n a g e r S e r v e r C o m p o n e n t D e s c r i p t o r ���j��� 5 MSFT_ServerManagerServerComponentDescriptor - , ; I P � ServerComponent_RDS_RD_Server DisplayName RDS-RD-Server ClassVersion 0.0.0 mp �+ M S F T _ S e r v e r M a n a g e r S e r v e r C o m p o n e n t D e s c r i p t o r ���j��� 5 MSFT_ServerManagerServerComponentDescriptor - $ 1 E S Z � ServerComponent_RDS_Virtualization DisplayName RDS-Virtualization ClassVersion 0.0.0 mp �+ M S F T _ S e r v e r M a n a g e r S e r v e r C o m p o n e n t D e s c r i p t o r ���j��� 5 MSFT_ServerManagerServerComponentDescriptor - " ' 5 = � ServerComponent_Fax DisplayName Fax ClassVersion 10.0.0 po �+ M S F T _ S e r v e r M a n a g e r S e r v e r C o m p o n e n t D e s c r i p t o r ���j��� 5 MSFT_ServerManagerServerComponentDescriptor - # ) 7 ? � ServerComponent_NPAS DisplayName NPAS ClassVersion 10.0.0 po �+ M S F T _ S e r v e r M a n a g e r S e r v e r C o m p o n e n t D e s c r i p t o r ���j��� 5 MSFT_ServerManagerServerComponentDescriptor - ) 6 O ] d � ServerComponent_BitLocker_NetworkUnlock DisplayName BitLocker-NetworkUnlock ClassVersion 0.0.0 mp �+ M S F T _ S e r v e r M a n a g e r S e r v e r C o m p o n e n t D e s c r i p t o r ���j��� 5 MSFT_ServerManagerServerComponentDescriptor - % 2 G U \ � ServerComponent_FabricShieldedTools DisplayName FabricShieldedTools ClassVersion 0.0.0 mp �+ M S F T _ S e r v e r M a n a g e r S e r v e r C o m p o n e n t D e s c r i p t o r ���j��� 5 MSFT_ServerManagerServerComponentDescriptor - 2 ? a o v � ServerComponent_RSAT_Clustering_AutomationServer DisplayName RSAT-Clustering-AutomationServer ClassVersion 0.0.0 mp �+ M S F T _ S e r v e r M a n a g e r S e r v e r C o m p o n e n t D e s c r i p t o r ���j��� 5 MSFT_ServerManagerServerComponentDescriptor - . ; Y g n � ServerComponent_RSAT_Clustering_CmdInterface DisplayName RSAT-Clustering-CmdInterface ClassVersion 0.0.0 mp �+ M S F T _ S e r v e r M a n a g e r S e r v e r C o m p o n e n t D e s c r i p t o r ���j��� 5 MSFT_ServerManagerServerComponentDescriptor - ! . ? M T � ServerComponent_Storage_Replica DisplayName Storage-Replica ClassVersion 0.0.0 mp �+ M S F T _ S e r v e r M a n a g e r S e r v e r C o m p o n e n t D e s c r i p t o r ���j��� 5 MSFT_ServerManagerServerComponentDescriptor - + 9 G N � ServerComponent_FS_VSS_Agent DisplayName FS-VSS-Agent ClassVersion 0.0.0 mp �+ M S F T _ S e r v e r M a n a g e r S e r v e r C o m p o n e n t D e s c r i p t o r ���j��� 5 MSFT_ServerManagerServerComponentDescriptor - ' 4 K Y ` � ServerComponent_FS_iSCSITarget_Server DisplayName FS-iSCSITarget-Server ClassVersion 0.0.0 mp �+ M S F T _ S e r v e r M a n a g e r S e r v e r C o m p o n e n t D e s c r i p t o r ���j��� 5 MSFT_ServerManagerServerComponentDescriptor - , ; I P � ServerComponent_RDS_Licensing DisplayName RDS-Licensing ClassVersion 0.0.0 mp �+ M S F T _ S e r v e r M a n a g e r S e r v e r C o m p o n e n t D e s c r i p t o r !���j��� 5 MSFT_ServerManagerServerComponentDescriptor - # ) 7 > � ServerComponent_RSAT DisplayName RSAT ClassVersion 8.0.0 mp � D D L _ P R O C E D U R E _ E V E N T S �N��7 �� @ DDL_PROCEDURE_EVENTS ����������������������������������������������������������������D � ALTER_PROCEDURE Parameters
8
� < String �WMI] esourceName] @* o��C��/ p ) � �� � ) � 1 U } � � � / W z � � � x � � � R y � � u � � � 0 W � � � i � � � A p � � � V n � � � � 1 Y r � � � �
=
e
�
�
�
�
4 N v � � � � * A i } � � �
/
V
~
�
�
�
�
1 L t � � � � ' O l � � � � " J c � � � � H b � � � � H f � � � � ; T | � � � C W ~ � � � � ( ; c � � � 5 F n � � ^ x � � 0 Q x � � � ! 9 � � � � @ O � � � W s � � � � � b � � 7 _ � � � � 9 ` � � � � ( ? g w � � ! ! �! �! �! �! " )" R" n" �" �" �" �" g# }# �# �# �# $ :$ Z$ �$ �$ �$ �$ % F% n% �% �% �% �% & �& �& �& �& ' '' N' d' �' �' S( n( �( �( �( �( ) *) R) n) PUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUu�) �������������������� ��������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������) � MSFT_MpPreference ProtectionManagement locale AllowDatagramProcessingOnWinServer k
� t boolean AllowNetworkProtectionDownLevel j
� � boolean AllowNetworkProtectionOnWinServer X �
� boolean AllowSwitchToAsyncInspection s "
� N boolean ApplyDisableNetworkScanningToIOAV > �
� � boolean AttackSurfaceReductionOnlyExclusions M �
� � string AttackSurfaceReductionRules_Actions O �
� @ G Q uint8 ValueMap i l o r u 0 1 2 5 6 AttackSurfaceReductionRules_Ids N �
� � string AttackSurfaceReductionRules_RuleSpecificExclusions { 8
� string AttackSurfaceReductionRules_RuleSpecificExclusions_Id z 4
� q string BruteForceProtectionAggressiveness /
� � � � uint8 ValueMap � � � 0 1 2 BruteForceProtectionConfiguredState *
� D K U uint8 ValueMap i l o r 0 1 2 4 BruteForceProtectionExclusions 0
� � string BruteForceProtectionLocalNetworkBlocking 4
� boolean BruteForceProtectionMaxBlockTime +
� O uint32 BruteForceProtectionSkipLearningPeriod 6
� � boolean CheckForSignaturesBeforeRunningScan K
� � boolean CloudBlockLevel I �
� 1 8 B uint8 ValueMap Z ] ` c f 0 1 2 4 6 CloudExtendedTimeout J �
� � uint32 ComputerID '
� � � �� � �� string ControlledFolderAccessAllowedApplications P �
� 9 string ControlledFolderAccessDefaultProtectedFolders R �
� � string ControlledFolderAccessProtectedFolders Q �
� � string DefinitionUpdatesChannel h
� , 3 = uint8 ValueMap M P S 0 4 5 DisableArchiveScanning 6 �
� � boolean DisableAutoExclusions
� � boolean DisableBehaviorMonitoring 2 �
� boolean DisableBlockAtFirstSeen H �
� P boolean DisableCacheMaintenance ~ ?
� � boolean DisableCatchupFullScan 7 �
� � boolean DisableCatchupQuickScan 8 �
�
boolean DisableCoreServiceECSIntegration � D
� \
boolean DisableCoreServiceTelemetry � F
� �
boolean DisableCpuThrottleOnIdleScans [ �
� �
boolean DisableDatagramProcessing Y �
� + boolean DisableDnsOverTcpParsing d
� m boolean DisableDnsParsing c
� � boolean DisableEmailScanning 9 �
� � boolean DisableFtpParsing r
� ! boolean DisableGradualRelease i
� ` boolean DisableHttpParsing b
� � boolean DisableInboundConnectionFiltering m
� � boolean DisableIOAVProtection 3 �
� &
boolean DisableNetworkProtectionPerfTelemetry o
� u
boolean DisablePrivacyMode / �
� �
boolean DisableQuicParsing w ,
� �
boolean DisableRdpParsing n
� ( boolean DisableRealtimeMonitoring 4 �
� k boolean DisableRemovableDriveScanning : �
� � boolean DisableRestorePoint ; �
� � boolean DisableScanningMappedNetworkDrivesForFullScan < �
� F boolean DisableScanningNetworkFiles = �
� � boolean DisableScriptScanning 5 �
� � boolean DisableSmtpParsing v *
� boolean DisableSshParsing e
� A boolean DisableTamperProtection u (
� � boolean DisableTlsParsing a �
� � boolean EnableControlledFolderAccess L �
� ! uint8 ValueMap 9 < ? B E 0 1 2 3 4 EnableConvertWarnToBlock Z �
� � boolean EnableDnsSinkhole l
� � boolean EnableEcsConfiguration � L
� � boolean EnableFileHashComputation V �
� ? boolean EnableFullScanOnBatteryPower \ �
� � boolean EnableLowCpuPriority U �
� � boolean EnableNetworkProtection K �
� " uint8 ValueMap 2 5 8 0 1 2 EnableUdpReceiveOffload � J
� s boolean EnableUdpSegmentationOffload � H
� � boolean EngineUpdatesChannel g
� uint8 ValueMap 1 4 7 : = @ 0 2 3 4 5 6 ExclusionExtension
� v string ExclusionIpAddress
� � string ExclusionPath
� � string ExclusionProcess
� string ForceUseProxyOnly ` �
� Z boolean HideExclusionsFromLocalUsers q
� � boolean HighThreatDefaultAction E �
� � � � uint8 ValueMap " % ( + . 1 1 2 3 6 8 9 10 IntelTDTEnabled y 2
� e boolean LowThreatDefaultAction C �
� � � � uint8 ValueMap � � � � � � � 1 2 3 6 8 9 10 MAPSReporting - �
� 4 ; E uint8 ValueMap U X [ 0 1 2 MeteredConnectionUpdates W �
� � boolean ModerateThreatDefaultAction D �
� � � � uint8 ValueMap # & ) , 1 2 3 6 8 9 10 NetworkProtectionReputationMode x .
� p uint32 OobeEnableRtpAndSigUpdate | <
� � boolean PerformanceModeStatus } >
� � uint8 ValueMap 0 1 PlatformUpdatesChannel f
� e l v uint8 ValueMap � � � � � � 0 2 3 4 5 6 ProxyBypass _ �
� � string ProxyPacUrl ] � �� P� E �UK�% � d�Z�
P���(
�Ͷ(6 � 1���
� ,�>u = �%0� � ��sXr ���2� � ��ѷC w ΣNO� � boq�^ M
C I M _ A c t i o n 2��C� 0 CIM_Action C % � �� � M V f } � �� � � $ + ��W���������������������������������������������] � Win32_RemoveIniAction Locale UUID {B94A25A8-DB33-11d2-85FC-0000F8102E5F} MSIProv MappingStrings n Microsoft.MSI Action *
� � � �� uint16
"
� � � �� string Section
� � �� string Value &
� U � �� string � C I M _ F i l e A c t i o n 3��C�� 8 CIM_FileAction C $ � �� � L U e | � � � � � 1 : l z � � ��W����������������������������������������������������� � Win32_MoveFileAction Locale UUID {FF7DA3FC-DB32-11d2-85FC-0000F8102E5F} MSIProv MappingStrings m Microsoft.MSI DestFolder *
� � � �� string DestName
"
� � � �� string FileKey 0
� ) � �� string Options
.
� d � �� uint16 SourceFolder &
� � � �� string SourceName
� � � �� string �
C I M _ A c t i o n 4��C�� I CIM_Action C % � �� � M V f
} � � � � � + 4 f x � � � � ( 0 b n � � ��WU��������������������������������������������������������������������� � Win32_ClassInfoAction Locale UUID {38BA58F0-DB32-11d2-85FC-0000F8102E5F} MSIProv MappingStrings n Microsoft.MSI AppID
,
� � � �� string Argument 4
� � � �� string CLSID
� # � �� string Context <
� ^ � �� string DefInprocHandler 8
� � � �� string FileTypeMask 0
� � � �� string Insertable *
� � �� uint16 ProgID
"
� Z � �� string RemoteName @
� � � �� string VIProgID &
� � � �� string �
C I M _ A c t i o n 5��C�� - CIM_Action C $ � �� � L U e | � � � � � ��W������������������������������������������1 � Win32_MIMEInfoAction Locale UUID {F3F3A266-DB32-11d2-85FC-0000F8102E5F} MSIProv MappingStrings m Microsoft.MSI CLSID
"
� � � �� string ContentType
� � � �� string Extension &
� ) � �� string �
C I M _ A c t i o n 6��C�� ) CIM_Action C $ � �� � L U k p v � � ����������������������������������������� � Win32_FontInfoAction Locale UUID {C63BAA94-DB32-11d2-85FC-0000F8102E5F} MSIProv ImplementationSource MSI File
"
� � � �� string FontTitle
� � � �� string �
C I M _ A c t i o n 7��C�] : CIM_Action C $ � �� � L U e | � � � � � % + ] g � � > E ��WU������������������������������������������������������w � Win32_ShortcutAction Locale UUID {FAE1F7B6-DB33-11d2-85FC-0000F8102E5F} MSIProv MappingStrings m Microsoft.MSI Arguments
� � � �� string HotKey
"
� � � �� uint16 IconIndex $
� string Name @
� U � �� string Shortcut
*
� � � �� string ShowCmd ( )
� � � � � �� uint16 ValueMap � � 0 3 7 Target .
� 6 � �� string WkDir 2
� o � �� string �
C I M _ A c t i o n 8��C� + CIM_Action C ! ' � �� � O X h � � � ��W����������������������������������������b � Win32_TypeLibraryAction Locale UUID {5D06847A-DB34-11d2-85FC-0000F8102E5F} MSIProv MappingStrings p Microsoft.MSI Cost
'
� � � �� � �� uint32 Fixed Language '
� �� � �� uint16 Fixed LibID $ '
� S [ �� � �� string Fixed �
C I M _ A c t i o n 9��C�� ' CIM_Action C # ) � �� � Q Z j � � � � ��������������������������������������� � Win32_SelfRegModuleAction Locale UUID {DC7E5E90-DB33-11d2-85FC-0000F8102E5F} MSIProv MappingStrings r Microsoft.MSI Cost
� � � �� uint16 File
� � � �� string �
C I M _ A c t i o n :��C�� - CIM_Action C & , � �� � T ] m � � � � � ��W������������������������������������������6 � Win32_PublishComponentAction Locale UUID {990E7AE6-DB33-11d2-85FC-0000F8102E5F} MSIProv MappingStrings u Microsoft.MSI AppData &
� � � �� string ComponentID
� � � �� string Qual
"
� . � �� string �
C I M _ A c t i o n ;��C�� ) CIM_Action C % � �� � M V f } � � � ����������������������������������������� � Win32_BindImageAction Locale UUID {1D40FFD4-DB32-11d2-85FC-0000F8102E5F} MSIProv MappingStrings n Microsoft.MSI File
"
� � � �� string Path
� � � �� string �
C I M _ A c t i o n <��C�K C CIM_Action C # ) � �� � Q Z j � � � � � 5 ; m u � � � � $ * ��WU���������������������������������������������������������������\ � Win32_ExtensionInfoAction Locale UUID {9668DF4E-DB32-11d2-85FC-0000F8102E5F} MSIProv MappingStrings r Microsoft.MSI Argument 6
� � � �� string Command 2
� � � �� string Extension *
� - � �� string MIME :
� e � �� string ProgID
� � � �� string ShellNew
"
� � � �� string ShellNewValue &
� � �� string Verb
.
� T � �� string � C I M _ C o p y F i l e A c t i o n =��C�h 0 CIM_CopyFileAction C # ) � �� � Q Z j � � ������������������������������������������������� � Win32_DuplicateFileAction Locale UUID {785B1AD0-DB32-11d2-85FC-0000F8102E5F} MSIProv MappingStrings r Microsoft.MSI FileKey (
� � � �� string � C I M _ S o f t w a r e E l e m e n t A c t i o n s ���C� $ CIM_SoftwareElementActions ) * � ��� � � � Win32_SoftwareElementAction Description This association relates an MSI software element with an action that access the element. AMENDMENT LOCALE ms_409 � � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier Q � - � � � MSFT_CliProperty SupportContactDescription The SupportContactDescription property is an array that indicates the support contact information for the Win32 computer system. SupportContactDescription ] 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier # � & � � � MSFT_CliProperty SystemStartupDelay The SystemStartupDelay property indicates the time to delay before starting the operating system SystemStartupDelay � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier O � ( � � � MSFT_CliProperty SystemStartupOptions The SystemStartupOptions property array indicates the options for starting up the Win32 computer system./nConstraints: Must have a value SystemStartupOptions ) 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � ( R h � MSFT_CliProperty SystemStartupSetting The SystemStartupSetting property indicates the index of the default start profile. This value is 'calculated' so that it usually returns zero (0) because at write-time, the profile string is physically moved to the top of the list. (This is how Windows NT determines which value is the default.) SystemStartupSetting �
9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � � � MSFT_CliProperty SystemType The SystemType property indicates the type of system running on the Win32 computer./nConstraints: Must have a value SystemType � k � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap
I W f v � � � � � � X86-based PC MIPS-based PC Alpha-based PC Power PC SH-x PC StrongARM PC 64-bit Intel PC 64-bit Alpha PC Unknown X86-Nec98 PC e � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values
G U d t ~ � � � � � X86-based PC MIPS-based PC Alpha-based PC Power PC SH-x PC StrongARM PC 64-bit Intel PC 64-bit Alpha PC Unknown X86-Nec98 PC 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � v � > � MSFT_CliProperty ThermalState The ThermalState property identifies the enclosure's thermal state when last booted. ThermalState � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING k K � MSFT_CliQualifier ValueMap 9 < ? B E H 1 2 3 4 5 6 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � q � MSFT_CliQualifier Values 7 > G M V ` Other Unknown Safe Warning Critical Non-recoverable +���� � �t�� ��Q5� � �|�� �� < ���
r��$� w�͎� Yz�4 �{0 x�H ��^h u�?w 9�Վ % 9ٝ��C��
) + � �� � A R d � � � � ( 2 U������������d � MDM_EnterpriseAPN_Settings01 InPartition 3 local-system DMWmiBridgeProv AllowUserControl '
� � � �� � �� boolean HideView
'
� � � �� � �� boolean InstanceID
� � �� string ParentID
� \ � �� string MD � Dٝ��C��
) " / � �� � E V } � � � 5 D U������������� � MDM_PassportForWork_Biometrics01 InPartition 7 local-system DMWmiBridgeProv FacialFeaturesUseEnhancedAntiSpoofing
'
� � � �� � �� boolean InstanceID
� � � �� string ParentID
� - � �� string UseBiometrics '
� y � �� � �� boolean MD � Eٝ��C�� ) ' 4 � �� � J [ g � � � � U����������0 � MDM_PassportForWork_Device_Policies02 InPartition < local-system DMWmiBridgeProv InstanceID
� � � �� string ParentID
� � � �� string UseCertificateForOnPremAuth '
� ' � �� � �� boolean Po � Iڝ��C�� ) : G � �� � ] o z � � � � 1 F U����������������� � MDM_EnterpriseModernAppManagement_ReleaseManagement03_01 InPartition O local-system DMWmiBridgeProv1 ChannelId '
� � � �� � �� string InstanceID
� � � �� string ParentID
� ) � �� string ReleaseManagementId '
� { � �� � �� string M �$ R O O T \ M i c r o s o f t \ W i n d o w s \ S e r v e r M a n a g e r _ _ M e t h o d P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 7 E 7 4 6 D 8 C C 9 7 8 8 2 C B 8 8 D F 7 3 9 9 7 2 7 6 5 9 B 5 9 A 1 3 A 9 2 A B 8 4 0 C 9 F E 6 F 8 C 0 3 E 9 F B 5 D 5 5 D B \ K I _ 7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D \ I _ 7 E E 9 A 4 1 9 A 1 3 7 C B 9 0 4 1 9 D B 8 6 B 8 F 3 8 2 6 6 6 3 6 7 5 5 A 9 4 0 6 C F 4 1 C E 7 5 F A 4 0 6 C 6 7 D 2 C 2 5 F � :ٝ��C�H " ) 8 E � �� � [ m | � � � ? N � � � � Y g UU��������������������������������� � MDM_EnterpriseModernAppManagement_AppInstallation01_01 InPartition M local-system DMWmiBridgeProv1 HostedInstall '
� � � �� � string InstanceID
� � � �� string LastError '
� 7 � �� � sint32 LastErrorDesc '
� � � �� � string ParentID
� � � �� string ProgressStatus '
� � �� � sint32 Status '
� Q � �� � sint32 StoreInstall '
� � � �� � string � 0 1 � � � � q � StoreInstallMethod # �� implemented � WIN-F6NF7R6I6PJ ROOT\cimv2\mdm\dmmap ���� � �� �� * � ����� � __PARAMETERS abstract param string
� 1 In
� 1 X �� ID )
� � X ��� string __ �� WIN-F6NF7R6I6PJ ROOT\cimv2\mdm\dmmap ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � HostedInstallMethod � �� implemented � WIN-F6NF7R6I6PJ ROOT\cimv2\mdm\dmmap ���� � �� �� * � ����� � __PARAMETERS abstract param string
� 1 In
� 1 X �� ID )
� � X ��� string __ �� WIN-F6NF7R6I6PJ ROOT\cimv2\mdm\dmmap ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � <ٝ��C� ) 6 C � �� � Y k x � � � W a U����������������� � MDM_EnterpriseModernAppManagement_AppManagement01_02 InPartition K local-system DMWmiBridgeProv1 DoNotUpdate '
� � � �� � �� sint32 InstanceID
� � � �� string MaintainProcessorArchitectureOnUpdate '
� O � �� � �� sint32 ParentID
� � � �� string M �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� 1 J.3�� f � WDMClassesOfDriver MSNdis_NetworkDirectVersion C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� 5 J.3�� j � WDMClassesOfDriver MSNdis_NetworkDirectAdapterInfo C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� 0 J.3�� e � WDMClassesOfDriver MSNdis_NotifyFilterArrival C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� 8 J.3�� m � WDMClassesOfDriver MSNdis_DeviceWakeOnMagicPacketOnly C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C� ' J.3�� \ � WDMClassesOfDriver MSNdis_RSSEnabled C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� / J.3�� d � WDMClassesOfDriver MSNdis_NetworkDirectState C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� = J.3�� r � WDMClassesOfDriver MSNdis_NetworkDirectAdapterCapabilities C:\Windows\system32\kernelbase.dll[MofResourceName] .mui[MofResourceName] dll.mui[MofResourceName] ofResourceName] F � �ձ�� P p�P - ��/1= U��tI � 6N�) ���=5 � �!o3- ���5 ���A � �WT� � �T� � 5 7 E 5 F 3 A D D 9 E 2 4 2 C 4 E 9 F 9 E D F 7 9 A A 9 7 F 7 9 E 7 9 1 1 C 5 A 8 B 9 0 2 E C 1 5 0 D 6 4 4 2 E 3 B 8 5 A 5 A A �Н��C�ȝ��C�� ���M 9 ^ � __Win32Provider {734AC5AE-68E1-4fb5-B8DA-1D92F7FC6661} NetworkServiceHost WMIPingProvider E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C �Н��C� ȝ��C�� � �� ��W p � __InstanceProviderRegistration \\.\Root\CIMV2:__Win32Provider.Name="WMIPingProvider" _ WQL:UnarySelect
R O O T \ C I M V 2 _ _ I n s t a n c e P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 6 8 5 7 7 3 7 2 C 6 6 A 7 B 2 0 6 5 8 4 8 7 F B D 9 5 9 A A 1 5 4 E F 5 4 B 5 F 9 3 5 D C C 5 6 6 3 E 9 2 2 8 B 4 4 3 2 2 8 0 5 \ K I _ E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C \ I _ D 3 4 1 F C E F 2 D B 2 5 B 0 B D 9 A 4 2 0 2 4 7 A 5 5 8 A F 8 6 F F 8 8 3 E 9 F 4 A B 3 5 1 1 4 C 7 9 5 D 1 E E 7 7 C 1 0 4 7 __ ���C�� ` � �� � # , i u � � ! } � � � 5 B � � � V d � � � � 0 b o � � * 6 f o � � � 9 Y � � � � ! 0 @UUA����P � q ��������������������������������������m o ����s � Win32_PingStatus WMIPingProvider Address '
� a � �� � �� String BufferSize '
� � � �� � �� uint32 NoFragmentation '
� � � �� � �� boolean PrimaryAddressResolutionStatus V )
� X � ��` j uint32 ValueMap v y 0 .. ProtocolAddress N )
� � � ��� String MaxLen ProtocolAddressResolved R )
� % � ��- String MaxLen RecordRoute '
� w � �� � �� uint32 ReplyInconsistency 4
� � � �� boolean ReplySize 6
� � � �� uint32 ResolveAddressNames
& '
� M � �� � �� boolean ResponseTime ,
� � � �� uint32 ResponseTimeToLive
0
� � � �� uint32 RouteRecord :
� � �� String RouteRecordResolved >
� Z � �� String SourceRoute " '
� � � �� � �� String SourceRouteType 4
� � � �� � �� uint32 ValueMap ! $ ' 0 1 2 StatusCode ( )
� m � ��u uint32 ValueMap � � � � � � � ' . 5 < C J Q X _ 0 11001 11002 11003 11004 11005 11006 11007 11008 11009 11010 11011 11012 11013 11014 11015 11016 11017 11018 11032 11050 Timeout '
� � � �� � �� uint32 TimeStampRecord B
� � � �� uint32 TimeStampRecordAddress F
� 1 � �� string TimeStampRecordAddressResolved J
� � � �� string TimestampRoute '
� � � �� � �� uint32 TimeToLive '
� � �� � �� uint32 TypeofService '
� e � �� � �� uint32 �
R O O T \ C I M V 2 _ _ I n s t a n c e P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 6 8 5 7 7 3 7 2 C 6 6 A 7 B 2 0 6 5 8 4 8 7 F B D 9 5 9 A A 1 5 4 E F 5 4 B 5 F 9 3 5 D C C 5 6 6 3 E 9 2 2 8 B 4 4 3 2 2 8 0 5 \ K I _ E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C \ I _ 1 4 E 8 1 F E D 6 5 C A 2 5 6 A 2 9 1 5 5 2 D 7 3 6 8 0 7 6 B D F 0 8 6 E 6 5 B 0 7 9 8 6 8 D 3 3 E 5 0 C 9 7 9 9 C 9 0 9 A 9 8 � 7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D ���C�
ȝ��C�h Q � __MethodProviderRegistration \\.\Root\CIMV2:__Win32Provider.Name="DFSProvider"
R O O T \ C I M V 2 _ _ M e t h o d P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 6 8 5 7 7 3 7 2 C 6 6 A 7 B 2 0 6 5 8 4 8 7 F B D 9 5 9 A A 1 5 4 E F 5 4 B 5 F 9 3 5 D C C 5 6 6 3 E 9 2 2 8 B 4 4 3 2 2 8 0 5 \ K I _ 7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D \ I _ 1 4 E 8 1 F E D 6 5 C A 2 5 6 A 2 9 1 5 5 2 D 7 3 6 8 0 7 6 B D F 0 8 6 E 6 5 B 0 7 9 8 6 8 D 3 3 E 5 0 C 9 7 9 9 C 9 0 9 A 9 8 2 o c e
R O O T \ C I M V 2 _ _ I n s t a n c e P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 6 8 5 7 7 3 7 2 C 6 6 A 7 B 2 0 6 5 8 4 8 7 F B D 9 5 9 A A 1 5 4 E F 5 4 B 5 F 9 3 5 D C C 5 6 6 3 E 9 2 2 8 B 4 4 3 2 2 8 0 5 \ K I _ E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C \ I _ 5 3 D 7 5 5 7 2 F C E 9 5 F 8 0 C 9 1 5 6 1 D C 2 2 5 5 4 2 0 4 1 A 2 8 4 A 8 7 D 7 D 3 C 4 B C 2 4 7 C C B 4 A 9 8 8 D 1 1 E 5 ���C�� & | �� � �� � 0 8 > d ��t ~ � ��� � � �� � �
J W � �
[ i U�������������������������������������� � Win32_DiskQuota Association DskQuotaProvider Locale UUID B94560CA-41CC-4FB5-BD56-282329DA41DA SupportsCreate CreateBy PutInstance SupportsDelete DeleteBy DeleteInstance SupportsUpdate DiskSpaceUsed
� � � �� uint64 Limit '
� B � �� � �� uint64 QuotaVolume f '
� � � �� � �� ref:Win32_LogicalDisk Status )
� � � ��� � uint32 ValueMap
0 1 2 User f '
� H � �� � �� ref:Win32_Account WarningLimit '
� � � �� � �� uint64 � C I M _ I n s t a l l e d S o f t w a r e E l e m e n t ���C�� & CIM_InstalledSoftwareElement ) - � ��� � � � o w �������� � Win32_InstalledSoftwareElement Description The InstalledSoftwareElement association allows one to to identify the Computer System a particular Software element is installed on. AMENDMENT LOCALE ms_409 Software f@ )
� . ; � �� ref:Win32_SoftwareElement Description References the software element that is installed. System f@ )
� � � � � �� ref:CIM_ComputerSystem Description References the computer system hosting a particular software element. lo � C I M _ S e r v i c e A c c e s s B y S A P ���C�y CIM_ServiceAccessBySAP ) + � ��� � � � [ f u�������� � Win32_ApplicationCommandLine Description The ApplicationCommandLine association allows one to to identify connection between an application and it's command line access point. AMENDMENT LOCALE ms_409 Antecedent f@ )
� 1 > � �� ref:Win32_ApplicationService Description References the application. Dependent f@ )
� � � � � �� ref:Win32_CommandLineAccess Description references the commandline used to access the antecedent. � �x�� ��ay�
�74� � ����� � ��(�
-
��G � =g�u1
v�Q�6 <�NoT �rV;g H�A�z ���� ?ٝ��C�� ) 6 C � �� � Y j u � � � � , A U����������������~ � MDM_EnterpriseModernAppManagement_EffectiveRelease03 InPartition K local-system DMWmiBridgeProv ChannelId '
� � � �� � string InstanceID
� � � �� string ParentID
� $ � �� string ReleaseManagementId '
� v � �� � string M � @ٝ��C�� ) : G � �� � ] n y � � � � 0 E U����������������� � MDM_EnterpriseModernAppManagement_ReleaseManagement01_01 InPartition O local-system DMWmiBridgeProv ChannelId '
� � � �� � �� string InstanceID
� � � �� string ParentID
� ( � �� string ReleaseManagementId '
� z � �� � �� string M � Bٝ��C�� 1 ) $ � �� � : K X � � � N ] � � � � # @ } � � � � W _ � � UUU����������������������������������������������� � MDM_HealthAttestation InPartition , local-system DMWmiBridgeProv Certificate 2
� � � �� � �� � string Octetstring CorrelationID '
� � � �� � string CurrentProtocolVersion " '
� F � �� � sint32 ForceRetrieve '
� � � �� � �� boolean HASEndpoint '
� � � �� � �� string InstanceID
� � �� string MaxSupportedProtocolVersion * '
� u � �� � sint32 Nonce '
� � � �� � �� string ParentID
� � � �� string PreferredMaxProtocolVersion
& '
� O � �� � �� sint32 Status '
� � � �� � sint32 TpmReadyStatus '
� � � �� � sint32 � 0 4 � � VerifyHealthMethod # �� implemented � ae442007200009F ROOT\cimv2\mdm\dmmap ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � Cٝ��C�u ) " � �� � 8 I U � � � � U���������� � MDM_PassportForWork InPartition * local-system DMWmiBridgeProv InstanceID
� � �� string ParentID
� � � �� string UseBiometrics '
� � �� � �� boolean it �
M S L S A T r a c e Pܝ��C� MSLSATrace C � �� 7 = e r � � � � EnumTrustedDoms Description EnumerateTrustedDomains Guid {2306fe37-dbf6-11d2-9244-006008269001} DisplayName EnumTrustedDoms locale MS\0x409 � >ٝ��C�� ) 6 C � �� � Y k w � � � � $ U��������������a � MDM_EnterpriseModernAppManagement_AppSettingPolicy04 InPartition K local-system DMWmiBridgeProv1 InstanceID
� � � �� string IsVariableLeaf
� � boolean ParentID
� � �� string Value '
� Y � �� � �� string � Aٝ��C�H ) 6 C � �� � Y k w � � � B L ~ � U���������������������� � MDM_EnterpriseModernAppManagement_StoreLicenses02_01 InPartition K local-system DMWmiBridgeProv1 InstanceID
� � � �� string LicenseCategory '
� � � �� � string LicenseUsage '
� : � �� � string ParentID
� v � �� string RequesterID '
� � � �� � string � . / � Ent � � � u � AddLicenseMethod ! �� implemented � WIN-F6NF7R6I6PJ ROOT\cimv2\mdm\dmmap ���� � �� �� * � ����� � __PARAMETERS abstract param string
� 1 In
� 1 X �� ID )
� � X ��� string __ �� WIN-F6NF7R6I6PJ ROOT\cimv2\mdm\dmmap ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � GetLicenseFromStoreMethod � �� implemented � WIN-F6NF7R6I6PJ ROOT\cimv2\mdm\dmmap ���� � �� �� * � ����� � __PARAMETERS abstract param string
� 1 In
� 1 X �� ID )
� � X ��� string __ �� WIN-F6NF7R6I6PJ ROOT\cimv2\mdm\dmmap ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� 6 J.3�� k � WDMClassesOfDriver MSNdis_NetworkDirectCapabilities C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� + J.3�� ` � WDMClassesOfDriver MSNdis_HardwareStatus C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� + J.3�� ` � WDMClassesOfDriver MSNdis_MediaSupported C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4
�n�^��
͝��C� ' J.3�� \ � WDMClassesOfDriver MSNdis_MediaInUse C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� - J.3�� b � WDMClassesOfDriver MSNdis_MaximumLookahead C:\Windows\system32\kernelbase.dll[MofResourceName] rnelbase.dll[MofResourceName] Name] sourceName] ernelbase.dll.mui[MofResourceName] � _ 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier % � ' � � � MSFT_CliProperty TotalPhysicalMemory The TotalPhysicalMemory property indicates the total size of physical memory./nExample: 67108864 TotalPhysicalMemory h 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier . � � � � MSFT_CliProperty UserName The UserName property indicates the name of the currently-logged-on user./nConstraints: Must have a value. /nExample: johnsmith UserName � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier [
� � + � MSFT_CliProperty Workgroup The Workgroup property contains the name of the workgroup. This value is only valid if the PartOfDomain property is FALSE. Workgroup � � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING j , � MSFT_CliQualifier CIMTYPE $ string � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING q # 9 � MSFT_CliQualifier MappingStrings / 7 string � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING g ' � MSFT_CliQualifier read ! True � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING h ( � MSFT_CliQualifier write " True < 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o { � MSFT_CliProperty WakeUpType The WakeUpType property indicates the event that caused the system to power up. WakeUpType � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values C M T ] h t � � � Reserved Other Unknown APM Timer Modem Ring LAN Remote Power Switch PCI PME# AC Power Restored __ �� WIN-F6NF7R6I6PJ ROOT\Microsoft\Windows\Defender ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � Remove N� ��[� �� implemented static �� WIN-F6NF7R6I6PJ ROOT\Microsoft\Windows\Defender ���� � � � G ��� �\ Z] \ �\ bN �N Sb �b �5 6 �E qF �G rH �F <G �h i �g 6h ! � � X � " � S
�
� z �
�A fB �B 5C �H SI �I %J �Z �Z a/ �/ * � + �+ �@ AA @m �m %0 �0 �0 \1 n �n �n Jo �P 7Q 1O �O {W �W �V )W �1 2 �a b L[ �[ �U jV k^ �^ F, �, - �- �_ z` /) �) \e �e :_ �_ �- L. p2 �2 ;3 �3 �3 �4 �4 N5 �. / �d
e AX �X �c Jd =U �U �D �E �O lP �] ^ �L JM �Q R L �L �C TD fp �p �o p �Y 4Z � � � U d � +q �q ~T �T = > �f Tg �: l; �& �' �M N �; �< f �f ei �i ,j �j Y rY �S ,T SR �R S sS �? o@ � X Ok l �) e* � u � � ) �
�
� � D � 3 � wl �l � w � H �
� string ProxyServer ^ �
� 8 string PUAProtection G �
� { � � uint8 ValueMap � � � 0 1 2 QuarantinePurgeItemsAfterDelay
� � uint32 QuickScanIncludeExclusions A
� 4 ; E uint8 ValueMap Q T 0 1 RandomizeScheduleTaskTimes 0 �
� � boolean RealTimeScanDirection
� � � � uint8 ValueMap � 0 1 2 RemediationScheduleDay
� L S ] uint8 ValueMap � � � � � � � � � 0 1 2 3 4 5 6 7 8 RemediationScheduleTime e
� � datetime RemoteEncryptionProtectionAggressiveness %
� 8 ? I uint8 ValueMap Y \ _ 0 1 2 RemoteEncryptionProtectionConfiguredState
� � � � uint8 ValueMap � � � � 0 1 2 4 RemoteEncryptionProtectionExclusions
&
� / string RemoteEncryptionProtectionMaxBlockTime !
� ~ uint32 RemoveScanningThreadPoolCap � B
� � boolean ReportDynamicSignatureDroppedEvent H
� boolean ReportingAdditionalActionTimeOut 8
� X uint32 ReportingCriticalFailureTimeOut <
� � uint32 ReportingNonCriticalTimeOut @
� � uint32 ScanAvgCPULoadFactor J
� ! uint8 ScanOnlyIfIdleEnabled Q
� ^ boolean ScanParameters S
� � � � uint8 ValueMap � � 1 2 ScanPurgeItemsAfterDelay M
� � uint32 ScanScheduleDay T
� D! K! U! uint8 ValueMap }! �! �! �! �! �! �! �! �! 0 1 2 3 4 5 6 7 8 ScanScheduleOffset t $
� �! uint32 ScanScheduleQuickScanTime e U
�
" datetime ScanScheduleTime e Y
� H" datetime SchedulerRandomizationTime 1 �
� �" uint32 ServiceHealthReportInterval D
� �" uint32 SevereThreatDefaultAction F �
� # '# 1# uint8 ValueMap Q# T# W# Z# ]# `# c# 1 2 3 6 8 9 10 SharedSignaturesPath S �
� �# string SharedSignaturesPathUpdateAtScheduledTimeOnly T �
� �# boolean SignatureAuGracePeriod # c
� 2$ uint32 SignatureBlobFileSharesSources + ~
� y$ string SignatureBlobUpdateInterval , �
� �$ uint32 SignatureDefinitionUpdateFileSharesSources $ g
� % string SignatureDisableUpdateOnStartupWithoutEngine % k
� e% boolean SignatureFallbackOrder & m
� �% string SignatureFirstAuGracePeriod " _
� �% uint32 SignatureScheduleDay ' q
� 3& :& D& uint8 ValueMap l& o& r& u& x& {& ~& �& �& 0 1 2 3 4 5 6 7 8 SignatureScheduleTime e ( r
� �& datetime SignatureUpdateCatchupInterval ) v
� ' uint32 SignatureUpdateInterval * z
� F' uint32 SubmitSamplesConsent . �
� �' �' �' uint8 ValueMap �' �' �' �' 0 1 2 3 ThreatIDDefaultAction_Actions A �
� ( ( ( uint8 ValueMap =( @( C( F( I( L( O( 1 2 3 6 8 9 10 ThreatIDDefaultAction_Ids @ �
� �( sint64 ThrottleForScheduledScanOnly ! ]
� �( boolean TrustLabelProtectionStatus p
� ) uint32 UILockdown ? �
� I) boolean UnknownThreatDefaultAction B �
� �) �) �) uint8 ValueMap �) �) �) �) �) �) �) 1 2 3 6 8 9 10 o� 4 �� 7� ?� n� �� #� (� W� �� �� Set ��, �� implemented static i� WIN-F6NF7R6I6PJ ROOT\Microsoft\ProtectionManagement ���� � ��� l ��� �] 5^ �\ e] �M mN ,c �c V5 �5 �E F G H RF �F !j �j @i �i � � < � � =
�
� ^ c � 1A B _B �B _H �H 4I �I �Z �[ / �/ * � 5+ �+ l@ �@ �n Eo �/ M0 �0 1 �o p ep �p LP �P �N 4O W wW DV �V d1 �1 mb �b '\ �\ �U �U F_ �_ �+ x, �, ;- �` Ua �( U) �f fg ` �` �- . &2 �2 �2 `3 �3 ;4 �4 5 T. �. 8f �f �W 6X se �e �d !e �T 2U GD %E �O �O �^ �^ �r /s cL �L Q �Q �K L C �C �q kr .q �q �Y �Z � � � U d � �s �s T sT �< �= �h �h 5: ; �& ^' *M �M y; e< �g 2h �j tk �k �l �X gY OS �S �Q GR �R �R N? @ � W �l �m �) * � q � � � � �
� � 2 � ' � n �n � S � + | � G � � � i � v 4 � � � �c cd � � S o* �* � > �> J uJ �J OK 7 � I$ �$ �% L& � ~ � W � ! p � k! ]" �" ,# # �# % �% �' �( �7 �8 �6 Q7 � �a b %6 �6 �8 �9 UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU�������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������"t � __PARAMETERS abstract DisableAutoExclusions boolean
� A In
� A i �� ID )
� � i ��� boolean ExclusionPath string
� � In
� � # �� ID )
� � # ��Q string ExclusionExtension string
� � In
� � � �� ID )
� J � �� string
ExclusionProcess string
� v In
� v � �� ID
)
� � ��� string ExclusionIpAddress string
� 4 In
� 4 [ �� ID )
� � [ ��� string QuarantinePurgeItemsAfterDelay uint32
� � In
� � % �� ID )
� � % ��S uint32 RealTimeScanDirection uint8
� � In
� � � �� # & ) 0 1 2 ValueMap )
� � � ��, ID 6
� � � ��, m uint8 RemediationScheduleDay uint8
� � In
� � �� b e h k n q t w z 0 1 2 3 4 5 6 7 8 ValueMap )
� � ��} : ID 6
� ��} : � uint8 e RemediationScheduleTime datetime e
� 8 In e
� 8 a �� ID e )
� � a ��� datetime RemoteEncryptionProtectionConfiguredState uint8
� In
� 7 �� y | � 0 1 2 4 ValueMap )
� 7 ��� e ID 6
� 7 ��� e � uint8
RemoteEncryptionProtectionMaxBlockTime uint32
� O In
� O v �� ID
)
� � v ���
uint32 ! RemoteEncryptionProtectionAggressiveness uint8 !
� #
In !
� #
I
�� �
�
�
0 1 2 ValueMap ! )
� #
I
���
w
ID ! 6
� I
���
w
�
uint8 " RemoteEncryptionProtectionExclusions string "
� X In "
� X �� ID " )
� � ��� string
& BruteForceProtectionConfiguredState uint8
&
� ' In
&
� ' M �� � � � � 0 1 2 4 ValueMap
& )
� ' M ��� { ID
& 6
� $
M ��� { �
uint8 ' BruteForceProtectionMaxBlockTime uint32 '
� _
In '
� _
�
�� ID ' )
� �
�
���
uint32 + BruteForceProtectionAggressiveness uint8 +
� - In +
� - S �� � � � 0 1 2 ValueMap + )
� - S ��� � ID + 6
� # S ��� � � uint8 , BruteForceProtectionExclusions string ,
� \ In ,
� \ � �� ID , )
� � � ��� string 0 BruteForceProtectionLocalNetworkBlocking boolean 0
� 0 In 0
� 0 X �� ID 0 )
� � X ��� boolean 2 BruteForceProtectionSkipLearningPeriod boolean 2
� In 2
� , �� ID 2 )
� � , ��Z boolean 4 ReportingAdditionalActionTimeOut uint32 4
� � In 4
� � � �� ID 4 )
� b � ��' uint32 8 ReportingCriticalFailureTimeOut uint32 8
� � In 8
� � � �� ID 8 )
� - � ��� uint32 < ReportingNonCriticalTimeOut uint32 <
� d In <
� d � �� ID < )
� � � ��� uint32 @ ServiceHealthReportInterval uint32 @
� + In @
� + R �� ID @ )
� � R ��� uint32 D ReportDynamicSignatureDroppedEvent boolean D
� � In D
� � ! �� ID D )
� � ! ��O boolean F ScanAvgCPULoadFactor uint8 F
� � In F
� � � �� ID F )
� J � �� uint8 G CheckForSignaturesBeforeRunningScan boolean G
� � In G
� � � �� ID G )
� � ��� boolean I ScanPurgeItemsAfterDelay uint32 I
� N In I
� N u �� ID I )
� � u ��� uint32 M ScanOnlyIfIdleEnabled boolean M
� In M
� 7 �� ID M )
� � 7 ��e boolean O ScanParameters uint8 O
� � In O
� � � �� + . 1 2 ValueMap O )
� � � ��1 ID O 6
� � � ��1 r uint8 P ScanScheduleDay uint8 P
� � In P
� �
�� ` c f i l o r u x 0 1 2 3 4 5 6 7 8 ValueMap P )
� �
��{ 8 ID P 6
�
��{ 8 � uint8 e Q ScanScheduleQuickScanTime datetime e Q
� 8 In e Q
� 8 a �� ID e Q )
� � a ��� datetime e U ScanScheduleTime datetime e U
� � In e U
� � ! �� ID e U )
� � ! ��O datetime Y ThrottleForScheduledScanOnly boolean Y
� � In Y
� � � �� ID Y )
� U � �� boolean ! [ SignatureFirstAuGracePeriod uint32 ! [
� � In ! [
� � � �� ID ! [ )
� � ��� ! uint32 " _ SignatureAuGracePeriod uint32 " _
� O In " _
� O v �� ID " _ )
� � v ��� " uint32 # c SignatureDefinitionUpdateFileSharesSources string # c
� % In # c
� % L �� ID # c )
� � L ��z # string $ g SignatureDisableUpdateOnStartupWithoutEngine boolean $ g
� � In $ g
� � % �� ID $ g )
� � % ��S $ boolean % i SignatureFallbackOrder string % i
� � In % i
� � � �� ID % i )
� Q! � ��! % string & m SignatureScheduleDay uint8 & m
� �! In & m
� �! �! �� �! " " " " " " " " 0 1 2 3 4 5 6 7 8 ValueMap & m )
� �! �! ��" �! ID & m 6
� �" �! ��" �! Y" & uint8 e ' n SignatureScheduleTime datetime e ' n
� �" In e ' n
� �" �" �� ID e ' n )
� c# �" ��(# ' datetime ( r SignatureUpdateCatchupInterval uint32 ( r
� �# In ( r
� �# �# �� ID ( r )
� /$ �# ���# ( uint32 ) v SignatureBlobFileSharesSources string ) v
� i$ In ) v
� i$ �$ �� ID ) v )
� �$ �$ ���$ ) string * z SignatureUpdateInterval uint32 * z
� ,% In * z
� ,% S% �� ID * z )
� �% S% ���% * uint32 + ~ SignatureBlobUpdateInterval uint32 + ~
� �% In + ~
� �% & �� ID + ~ )
� �& & ��H& + uint32 , � MAPSReporting uint8 , �
� �& In , �
� �& �& �� ' ' ' 0 1 2 ValueMap , � )
� �& �& ��' ' ID , � 6
� �' �& ��' ' Z' , uint8 - � SubmitSamplesConsent uint8 - �
� �' In - �
� �' �' �� 9( <( ?( B( 0 1 2 3 ValueMap - � )
� �' �' ��E( %( ID - � 6
� �( �' ��E( %( �( - uint8 . � DisablePrivacyMode boolean . �
� �( In . �
� �( #) �� ID . � )
� �) #) ��Q) . boolean / � RandomizeScheduleTaskTimes boolean / �
� �) In / �
� �) �) �� ID / � )
� T* �) ��* / boolean 0 � SchedulerRandomizationTime uint32 0 �
� �* In 0 �
� �* �* �� ID 0 � )
� + �* ���* 0 uint32 1 � DisableBehaviorMonitoring boolean 1 �
� P+ In 1 �
� P+ x+ �� ID 1 � )
� �+ x+ ���+ 1 boolean 2 � DisableIntrusionPreventionSystem boolean 2 �
� , In 2 �
� , F, �� ID 2 � )
� �, F, ��t, 2 boolean 3 � DisableIOAVProtection boolean 3 �
� �, In 3 �
� �, - �� ID 3 � )
� r- - ��7- 3 boolean 4 � DisableRealtimeMonitoring boolean 4 �
� �- In 4 �
� �- �- �� ID 4 � )
� 9. �- ���- 4 boolean 5 � DisableScriptScanning boolean 5 �
� k. In 5 �
� k. �. �� ID 5 � )
� �. �. ���. 5 boolean 6 � DisableArchiveScanning boolean 6 �
� // In 6 �
� // W/ �� ID 6 � )
� �/ W/ ���/ 6 boolean 7 � DisableCatchupFullScan boolean 7 �
� �/ In 7 �
� �/ 0 �� ID 7 � )
� �0 0 ��I0 7 boolean 8 � DisableCatchupQuickScan boolean 8 �
� �0 In 8 �
� �0 �0 �� ID 8 � )
� I1 �0 ��1 8 boolean 9 � DisableEmailScanning boolean 9 �
� z1 In 9 �
� z1 �1 �� ID 9 � )
� 2 �1 ���1 9 boolean : � DisableRemovableDriveScanning boolean : �
� E2 In : �
� E2 m2 �� ID : � )
� �2 m2 ���2 : boolean ; � DisableRestorePoint boolean ; �
� 3 In ; �
� 3 .3 �� ID ; � )
� �3 .3 ��\3 ; boolean < � DisableScanningMappedNetworkDrivesForFullScan boolean < �
� �3 In < �
� �3 4 �� ID < � )
� r4 4 ��74 < boolean = � DisableScanningNetworkFiles boolean = �
� �4 In = �
� �4 �4 �� ID = � )
� ;5 �4 �� 5 = boolean > � ApplyDisableNetworkScanningToIOAV boolean > �
� y5 In > �
� y5 �5 �� ID > � )
�
6 �5 ���5 > boolean ? � UILockdown boolean ? �
� 16 In ? �
� 16 Y6 �� ID ? � )
� �6 Y6 ���6 ? boolean @ � ThreatIDDefaultAction_Ids sint64 @ �
� �6 In @ �
� �6 7 �� ID @ � )
� �7 7 ��M7 @ sint64 A � ThreatIDDefaultAction_Actions uint8 A �
� �7 In A �
� �7 �7 �� 58 88 ;8 >8 A8 D8 G8 1 2 3 6 8 9 10 ValueMap A � )
� �7 �7 ��K8 8 ID A � 6
� �8 �7 ��K8 8 �8 A uint8 B � UnknownThreatDefaultAction uint8 B �
� 9 In B �
� 9 /9 �� }9 �9 �9 �9 �9 �9 �9 1 2 3 6 8 9 10 ValueMap B � )
� 9 /9 ���9 ]9 ID B � 6
� : /9 ���9 ]9 �9 B uint8 C � LowThreatDefaultAction uint8 C �
� M: In C �
� M: s: �� �: �: �: �: �: �: �: 1 2 3 6 8 9 10 ValueMap C � )
� M: s: ���: �: ID C � 6
� `; s: ���: �: ; C uint8 D � ModerateThreatDefaultAction uint8 D �
� �; In D �
� �; �; ��
<
< < < < < < 1 2 3 6 8 9 10 ValueMap D � )
� �; �; �� < �; ID D � 6
� �< �; �� < �; a< D uint8 E � HighThreatDefaultAction uint8 E �
� �< In E �
� �< = �� O= R= U= X= [= ^= a= 1 2 3 6 8 9 10 ValueMap E � )
� �< = ��e= /= ID E � 6
� �= = ��e= /= �= E uint8 F � SevereThreatDefaultAction uint8 F �
� "> In F �
� "> H> �� �> �> �> �> �> �> �> 1 2 3 6 8 9 10 ValueMap F � )
� "> H> ���> v> ID F � 6
� 5? H> ���> v> �> F uint8 G � PUAProtection uint8 G �
� ]? In G �
� ]? �? �� �? �? �? 0 1 2 ValueMap G � )
� ]? �? ���? �? ID G � 6
� S@ �? ���? �? @ G uint8 H � DisableBlockAtFirstSeen boolean H �
� �@ In H �
� �@ �@ �� ID H � )
� A �@ ���@ H boolean I � CloudBlockLevel uint8 I �
� BA In I �
� BA hA �� �A �A �A �A �A 0 1 2 4 6 ValueMap I � )
� BA hA ���A �A ID I � 6
� FB hA ���A �A �A I uint8 J � CloudExtendedTimeout uint32 J �
� uB In J �
� uB �B �� ID J � )
� C �B ���B J uint32 K � EnableNetworkProtection uint8 K �
� 8C In K �
� 8C ^C �� �C �C �C 0 1 2 ValueMap K � )
� 8C ^C ���C �C ID K � 6
� .D ^C ���C �C �C K uint8 L � EnableControlledFolderAccess uint8 L �
� eD In L �
� eD �D �� �D �D �D �D �D 0 1 2 3 4 ValueMap L � )
� eD �D ���D �D ID L � 6
� iE �D ���D �D !E L uint8 M � AttackSurfaceReductionOnlyExclusions string M �
� �E In M �
� �E �E �� ID M � )
� 8F �E ���E M string N � AttackSurfaceReductionRules_Ids string N �
� sF In N �
� sF �F �� ID N � )
� G �F ���F N string O � AttackSurfaceReductionRules_Actions uint8 O �
� BG In O �
� BG hG �� �G �G �G �G �G 0 1 2 5 6 ValueMap O � )
� BG hG ���G �G ID O � 6
� FH hG ���G �G �G O uint8 P � ControlledFolderAccessAllowedApplications string P �
� �H In P �
� �H �H �� ID P � )
� I �H ���H P string Q � ControlledFolderAccessProtectedFolders string Q �
� \I In Q �
� \I �I �� ID Q � )
� �I �I ���I Q string R � SharedSignaturesPath string R �
� J In R �
� J CJ �� ID R � )
� �J CJ ��qJ R string S � SharedSignaturesPathUpdateAtScheduledTimeOnly boolean S �
� �J In S �
� �J K �� ID S � )
� �K K ��KK S boolean T � EnableLowCpuPriority boolean T �
� �K In T �
� �K �K �� ID T � )
� HL �K ��
L T boolean U � EnableFileHashComputation boolean U �
� ~L In U �
� ~L �L �� ID U � )
� M �L ���L U boolean V � MeteredConnectionUpdates boolean V �
� DM In V �
� DM lM �� ID V � )
� �M lM ���M V boolean W � AllowNetworkProtectionOnWinServer boolean W �
� N In W �
� N ;N �� ID W � )
� �N ;N ��iN W boolean X � DisableDatagramProcessing boolean X �
� �N In X �
� �N O �� ID X � )
� kO O ��0O X boolean Y � EnableConvertWarnToBlock boolean Y �
� �O In Y �
� �O �O �� ID Y � )
� 1P �O ���O Y boolean Z � DisableCpuThrottleOnIdleScans boolean Z �
� kP In Z �
� kP �P �� ID Z � )
� �P �P ���P Z boolean [ � EnableFullScanOnBatteryPower boolean [ �
� 5Q In [ �
� 5Q ]Q �� ID [ � )
� �Q ]Q ���Q [ boolean \ � ProxyPacUrl string \ �
� �Q In \ �
� �Q R �� ID \ � )
� ~R R ��CR \ string ] � ProxyServer string ] �
� �R In ] �
� �R �R �� ID ] � )
� 5S �R ���R ] string ^ � ProxyBypass string ^ �
� \S In ^ �
� \S �S �� ID ^ � )
� �S �S ���S ^ string _ � ForceUseProxyOnly boolean _ �
� T In _ �
� T AT �� ID _ � )
� �T AT ��oT _ boolean ` � DisableTlsParsing boolean ` �
� �T In ` �
� �T U �� ID ` � )
� iU U ��.U ` boolean a � DisableHttpParsing boolean a �
� �U In a �
� �U �U �� ID a � )
� )V �U ���U a boolean b � DisableDnsParsing boolean b �
� WV In b �
� WV V �� ID b � )
� �V V ���V b boolean c � DisableDnsOverTcpParsing boolean c �
� W In c �
� W EW �� ID c � )
� �W EW ��sW c boolean d DisableSshParsing boolean d
� �W In d
� �W X �� ID d )
� mX X ��2X d boolean e PlatformUpdatesChannel uint8 e
� �X In e
� �X �X �� Y Y Y Y Y Y 0 2 3 4 5 6 ValueMap e )
� �X �X ��"Y �X ID e 6
� �Y �X ��"Y �X cY e uint8 f EngineUpdatesChannel uint8 f
� �Y In f
� �Y Z �� JZ MZ PZ SZ VZ YZ 0 2 3 4 5 6 ValueMap f )
� �Y Z ��\Z .Z ID f 6
� �Z Z ��\Z .Z �Z f uint8 g DefinitionUpdatesChannel uint8 g
� [ In g
� [ >[ �� |[ [ �[ 0 4 5 ValueMap g )
� [ >[ ���[ l[ ID g 6
� \ >[ ���[ l[ �[ g uint8 h DisableGradualRelease boolean h
� >\ In h
� >\ f\ �� ID h )
� �\ f\ ���\ h boolean i AllowNetworkProtectionDownLevel boolean i
� ] In i
� ] 3] �� ID i )
� �] 3] ��a] i boolean j
AllowDatagramProcessingOnWinServer boolean j
� �] In j
� �] ^ �� ID j
)
� l^ ^ ��1^ j boolean k EnableDnsSinkhole boolean k
� �^ In k
� �^ �^ �� ID k )
� +_ �^ ���^ k boolean l DisableInboundConnectionFiltering boolean l
� i_ In l
� i_ �_ �� ID l )
� �_ �_ ���_ l boolean m DisableRdpParsing boolean m
� (` In m
� (` P` �� ID m )
� �` P` ��~` m boolean n DisableNetworkProtectionPerfTelemetry boolean n
� �` In n
� �` #a �� ID n )
� �a #a ��Qa n boolean o TrustLabelProtectionStatus uint32 o
� �a In o
� �a �a �� ID o )
� Sb �a ��b o uint32 p DisableFtpParsing boolean p
� �b In p
� �b �b �� ID p )
� c �b ���b p boolean q AllowSwitchToAsyncInspection boolean q
� Jc In q
� Jc rc �� ID q )
� �c rc ���c q boolean r ScanScheduleOffset uint32 r
�
d In r
�
d 1d �� ID r )
� �d 1d ��_d r uint32 s DisableTDTFeature boolean s
� �d In s
� �d �d �� ID s )
� Xe �d �� e s boolean t " DisableTamperProtection boolean t "
� �e In t "
� �e �e �� ID t " )
� f �e ���e t boolean u $ DisableSmtpParsing boolean u $
� Lf In u $
� Lf tf �� ID u $ )
� �f tf ���f u boolean v & DisableQuicParsing boolean v &
� g In v &
� g 4g �� ID v & )
� �g 4g ��bg v boolean w ( NetworkProtectionReputationMode uint32 w (
� �g In w (
� �g h �� ID w ( )
� ih h ��.h w uint32 x , IntelTDTEnabled boolean x ,
� �h In x ,
� �h �h �� ID x , )
� %i �h ���h x boolean y . AttackSurfaceReductionRules_Ru leSpecificExclusions_Id string y .
� wi In y .
� wi �i �� ID y . )
� j �i ���i y string z 2 AttackSurfaceReductionRules_RuleSpecificExclusions string z 2
� Uj In z 2
� Uj |j �� ID z 2 )
� �j |j ���j z string { 6 OobeEnableRtpAndSigUpdate boolean { 6
� k In { 6
� k Bk �� ID { 6 )
� �k Bk ��pk { boolean | 8 PerformanceModeStatus uint8 | 8
� �k In | 8
� �k l �� =l @l 0 1 ValueMap | 8 )
� �k l ��Cl 1l ID | 8 6
� �l l ��Cl 1l �l | uint8 } 9 QuickScanIncludeExclusions uint8 } 9
� m In } 9
� m 'm �� am dm 0 1 ValueMap } 9 )
� m 'm ��gm Um ID } 9 6
� �m 'm ��gm Um �m } uint8 ~ : RemoveScanningThreadPoolCap boolean ~ :
� &n In ~ :
� &n Nn �� ID ~ : )
� �n Nn ��|n ~ boolean < DisableCacheMaintenance boolean <
� �n In <
� �n o �� ID < )
� |o o ��Ao boolean � > DisableCoreServiceECSIntegration boolean � >
� �o In � >
� �o �o �� ID � > )
� Jp �o ��p � boolean � @ DisableCoreServiceTelemetry boolean � @
� �p In � @
� �p �p �� ID � @ )
� q �p ���p � boolean � B EnableUdpSegmentationOffload boolean � B
� Lq In � B
� Lq tq �� ID � B )
� �q tq ���q � boolean � D EnableUdpReceiveOffload boolean � D
� r In � D
� r 9r �� ID � D )
� �r 9r ��gr � boolean � F EnableEcsConfiguration boolean � F
� �r In � F
� �r �r �� ID � F )
� fs �r ��+s � boolean � H Force boolean � H
� �s In � H
� �s �s �� ID � H )
� t �s ���s � boolean __ �� WIN-F6NF7R6I6PJ ROOT\Microsoft\ProtectionManagement ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � Remove Y� ��f� �� implemented static � WIN-F6NF7R6I6PJ ROOT\Microsoft\ProtectionManagement ���� � ��� J ��� �\ Z] \ �\ bN �N Sb �b �5 6 �E qF �G rH �F <G �h i �g 6h ! � � X � " � S
�
� z �
�A fB �B 5C �H SI �I %J �Z �Z a/ �/ * � + �+ �@ AA @m �m %0 �0 �0 \1 n �n �n Jo �P 7Q 1O �O {W �W �V )W �1 2 �a b L[ �[ �U jV k^ �^ F, �, - �- �_ z` /) �) \e �e :_ �_ �- L. p2 �2 ;3 �3 �3 �4 �4 N5 �. / �d
e AX �X �c Jd =U �U �D �E �O lP �] ^ +q �q �L JM �Q R L �L �C TD fp �p �o p �Y 4Z � � � U d � �q Pr ~T �T = > �f Tg �: l; �& �' �M N �; �< f �f ei �i ,j �j Y rY �S ,T SR �R S sS �? o@ � X Ok l �) e* � u � � ) �
�
� � D � 3 � wl �l � w � H � g � � 9 " � � � \ � � c �c O � � �* -+ 0 � a> M? vJ �J 8K �K g � �$ �$ & �& + � � � O! � �! �" �" e# �# 1$ O% �% �' �( �7 �8 '7 �7 � L �` Ba o6 �6 79 $: UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU����������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������r � __PARAMETERS abstract DisableAutoExclusions boolean
� A In
� A i �� ID )
� � i ��� boolean ExclusionPath string
� � In
� � # �� ID )
� � # ��Q string ExclusionExtension string
� � In
� � � �� ID )
� J � �� string
ExclusionProcess string
� v In
� v � �� ID
)
� � ��� string ExclusionIpAddress string
� 4 In
� 4 [ �� ID )
� � [ ��� string QuarantinePurgeItemsAfterDelay boolean
� � In
� � & �� ID )
� � & ��T boolean RealTimeScanDirection boolean
� � In
� � � �� ' * - 0 1 2 ValueMap )
� � � ��0 ID 6
� � � ��0 q boolean RemediationScheduleDay boolean
� � In
� � �� j m p s v y | � 0 1 2 3 4 5 6 7 8 ValueMap )
� � ��� B ID 6
� ��� B � boolean RemediationScheduleTime boolean
� B In
� B j �� ID )
� � j ��� boolean RemoteEncryptionProtectionConfiguredState boolean
� In
� A �� � � � � 0 1 2 4 ValueMap )
� A ��� o ID 6
� A ��� o � boolean
RemoteEncryptionProtectionMaxBlockTime boolean
� [ In
� [ � �� ID
)
� � � ���
boolean RemoteEncryptionProtectionAggressiveness boolean
� 1
In
� 1
Y
�� �
�
�
0 1 2 ValueMap )
� 1
Y
���
�
ID 6
� ) Y
���
�
�
boolean RemoteEncryptionProtectionExclusions string
� j In
� j � �� ID )
� � � ��� string
$ BruteForceProtectionConfiguredState boolean
$
� 9 In
$
� 9 a �� � � � � 0 1 2 4 ValueMap
$ )
� 9 a ��� � ID
$ 6
� 8
a ��� � �
boolean & BruteForceProtectionMaxBlockTime boolean &
� u
In &
� u
�
�� ID & )
� �
���
boolean ( BruteForceProtectionAggressiveness boolean (
� E In (
� E m �� � � � 0 1 2 ValueMap ( )
� E m ��� � ID ( 6
� = m ��� � � boolean * BruteForceProtectionExclusions string *
� x In *
� x � �� ID * )
� � ��� string . BruteForceProtectionLocalNetworkBlocking boolean .
� L In .
� L t �� ID . )
� � t ��� boolean 0 BruteForceProtectionSkipLearningPeriod boolean 0
� In 0
� H �� ID 0 )
� � H ��v boolean 2 ReportingAdditionalActionTimeOut boolean 2
� � In 2
� � �� ID 2 )
� ��D boolean 4 ReportingCriticalFailureTimeOut boolean 4
� � In 4
� � � �� ID 4 )
� L � �� boolean 6 ReportingNonCriticalTimeOut boolean 6
� � In 6
� � � �� ID 6 )
� � ��� boolean 8 ServiceHealthReportInterval boolean 8
� M In 8
� M u �� ID 8 )
� � u ��� boolean : ReportDynamicSignatureDroppedEvent boolean :
� In :
� E �� ID : )
� � E ��s boolean < ScanAvgCPULoadFactor boolean <
� � In <
� � �� ID < )
� p ��5 boolean > CheckForSignaturesBeforeRunningScan boolean >
� � In >
� � � �� ID > )
� A � �� boolean @ ScanPurgeItemsAfterDelay boolean @
� v In @
� v � �� ID @ )
� � ��� boolean B ScanOnlyIfIdleEnabled boolean B
� 9 In B
� 9 a �� ID B )
� � a ��� boolean D ScanParameters boolean D
� � In D
� � �� W Z 1 2 ValueMap D )
� � ��] K ID D 6
� � ��] K � boolean F ScanScheduleDay boolean F
� In F � �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � �
� MSFT_CliFormat TABLE BRIEF : v � � 9 m 8 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � o w � MSFT_CliProperty Domain The Domain property indicates the name of the domain to which the computer belongs. Domain ; 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � l z � MSFT_CliProperty Manufacturer The Manufacturer property indicates the name of the computer manufacturer. Manufacturer ; 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � s z � MSFT_CliProperty Model The Model property indicates the product name of the computer given by the manufacturer. Model A 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � z � � MSFT_CliProperty Name The inherited Name property serves as key of a CIM_System instance in an enterprise environment. Name 0 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � $ K ] � MSFT_CliProperty PrimaryOwnerName The name of the primary system owner. PrimaryOwnerName _ 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier % � ' � � � MSFT_CliProperty TotalPhysicalMemory The TotalPhysicalMemory property indicates the total size of physical memory./nExample: 67108864 TotalPhysicalMemory s �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � o
� : �� � � � � � � � � � 0 1 2 3 4 5 6 7 8 ValueMap F )
� : ��� h ID F 6
� 4 : ��� h � boolean H ScanScheduleQuickScanTime boolean H
� j In H
� j � �� ID H )
� � � ��� boolean J ScanScheduleTime boolean J
� ( In J
� ( P �� ID J )
� � P ��~ boolean L ThrottleForScheduledScanOnly boolean L
� � In L
� � �� ID L )
� � ��H boolean ! N SignatureFirstAuGracePeriod boolean ! N
� � In ! N
� � � �� ID ! N )
� L � �� ! boolean " P SignatureAuGracePeriod boolean " P
� In " P
� � �� ID " P )
� � ��� " boolean # R SignatureDefinitionUpdateFileSharesSources boolean # R
� W In # R
� W �� ID # R )
� � ��� # boolean $ T SignatureDisableUpdateOnStartupWithoutEngine boolean $ T
� 1 In $ T
� 1 Y �� ID $ T )
� � Y ��� $ boolean % V SignatureFallbackOrder boolean % V
� � In % V
� � ! �� ID % V )
� �! ! ��K! % boolean & X SignatureScheduleDay boolean & X
� �! In & X
� �! �! �� 5" 8" ;" >" A" D" G" J" M" 0 1 2 3 4 5 6 7 8 ValueMap & X )
� �! �! ��P"
" ID & X 6
� �" �! ��P"
" �" & boolean ' Z SignatureScheduleTime boolean ' Z
� # In ' Z
� # 3# �� ID ' Z )
� �# 3# ��a# ' boolean ( \ SignatureUpdateCatchupInterval boolean ( \
� �# In ( \
� �# �# �� ID ( \ )
� h$ �# ��-$ ( boolean ) ^ SignatureBlobFileSharesSources boolean ) ^
� �$ In ) ^
� �$ �$ �� ID ) ^ )
� 4% �$ ���$ ) boolean * ` SignatureUpdateInterval boolean * `
� h% In * `
� h% �% �� ID * ` )
� �% �% ���% * boolean + b SignatureBlobUpdateInterval boolean + b
� 1& In + b
� 1& Y& �� ID + b )
� �& Y& ���& + boolean , d MAPSReporting boolean , d
� �& In , d
� �& ' �� R' U' X' 0 1 2 ValueMap , d )
� �& ' ��[' B' ID , d 6
� �' ' ��[' B' �' , boolean - f SubmitSamplesConsent boolean - f
� ( In - f
� ( =( �� ( �( �( �( 0 1 2 3 ValueMap - f )
� ( =( ���( k( ID - f 6
� ) =( ���( k( �( - boolean . h DisablePrivacyMode boolean . h
� C) In . h
� C) k) �� ID . h )
� �) k) ���) . boolean / j RandomizeScheduleTaskTimes boolean / j
� * In / j
� * 3* �� ID / j )
� �* 3* ��a* / boolean 0 l SchedulerRandomizationTime boolean 0 l
� �* In 0 l
� �* �* �� ID 0 l )
� d+ �* ��)+ 0 boolean 1 n DisableBehaviorMonitoring boolean 1 n
� �+ In 1 n
� �+ �+ �� ID 1 n )
� +, �+ ���+ 1 boolean 2 p DisableIntrusionPreventionSystem boolean 2 p
� h, In 2 p
� h, �, �� ID 2 p )
� �, �, ���, 2 boolean 3 r DisableIOAVProtection boolean 3 r
� +- In 3 r
� +- S- �� ID 3 r )
� �- S- ���- 3 boolean 4 t DisableRealtimeMonitoring boolean 4 t
� �- In 4 t
� �- . �� ID 4 t )
� �. . ��H. 4 boolean 5 v DisableScriptScanning boolean 5 v
� �. In 5 v
� �. �. �� ID 5 v )
� F/ �. �� / 5 boolean 6 x DisableArchiveScanning boolean 6 x
� y/ In 6 x
� y/ �/ �� ID 6 x )
�
0 �/ ���/ 6 boolean 7 z DisableCatchupFullScan boolean 7 z
� =0 In 7 z
� =0 e0 �� ID 7 z )
� �0 e0 ���0 7 boolean 8 | DisableCatchupQuickScan boolean 8 |
� 1 In 8 |
� 1 *1 �� ID 8 | )
� �1 *1 ��X1 8 boolean 9 ~ DisableEmailScanning boolean 9 ~
� �1 In 9 ~
� �1 �1 �� ID 9 ~ )
� U2 �1 ��2 9 boolean : � DisableRemovableDriveScanning boolean : �
� �2 In : �
� �2 �2 �� ID : � )
� 3 �2 ���2 : boolean ; � DisableRestorePoint boolean ; �
� P3 In ; �
� P3 x3 �� ID ; � )
� �3 x3 ���3 ; boolean < � DisableScanningMappedNetworkDrivesForFullScan boolean < �
� +4 In < �
� +4 S4 �� ID < � )
� �4 S4 ���4 < boolean = � DisableScanningNetworkFiles boolean = �
� �4 In = �
� �4 5 �� ID = � )
� �5 5 ��J5 = boolean > � ApplyDisableNetworkScanningToIOAV boolean > �
� �5 In > �
� �5 �5 �� ID > � )
� T6 �5 ��6 > boolean ? � UILockdown boolean ? �
� {6 In ? �
� {6 �6 �� ID ? � )
� 7 �6 ���6 ? boolean @ � ThreatIDDefaultAction_Ids sint64 @ �
� B7 In @ �
� B7 i7 �� ID @ � )
� �7 i7 ���7 @ sint64 A � ThreatIDDefaultAction_Actions uint8 A �
� 8 In A �
� 8 18 �� 8 �8 �8 �8 �8 �8 �8 1 2 3 6 8 9 10 ValueMap A � )
� 8 18 ���8 _8 ID A � 6
� 9 18 ���8 _8 �8 A uint8 B � UnknownThreatDefaultAction boolean B �
� S9 In B �
� S9 {9 �� �9 �9 �9 �9 �9 �9 �9 1 2 3 6 8 9 10 ValueMap B � )
� S9 {9 ���9 �9 ID B � 6
� h: {9 ���bject:MSFT_CliProperty � + � MSFT_CliFormat SYSTEM
D � � U � b
�
x � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty __CLASS __CLASS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __DERIVATION __DERIVATION � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __DYNASTY __DYNASTY � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty __GENUS __GENUS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier t � , � MSFT_CliProperty __NAMESPACE __NAMESPACE � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o � " � MSFT_CliProperty __PATH __PATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier y � $ 6 � MSFT_CliProperty __PROPERTY_COUNT __PROPERTY_COUNT � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __RELPATH __RELPATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier q � & � MSFT_CliProperty __SERVER __SERVER � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __SUPERCLASS __SUPERCLASS I �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty V � � MSFT_CliFormat INSTANCE " � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier m � � MSFT_CliProperty Name Name �H �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty �G <' � MSFT_CliFormat TABLE POWER : � � R � A 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � z � � MSFT_CliProperty Name The inherited Name property serves as key of a CIM_System instance in an enterprise environment. Name 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier �
/ � � o � MSFT_CliProperty PowerManagementCapabilities Indicates the specific power-related capabilities of a computer system and its associated running operating system. The values, 0="Unknown", 1="Not Supported", and 2="Disabled" are self-explanatory. The value, 3="Enabled" indicates that the power management features are currently enabled but the exact feature set is unknown or the information is unavailable. "Power Saving Modes Entered Automatically" (4) describes that a system can change its power state based on usage or other criteria. "Power State Settable" (5) indicates that the SetPowerState method is supported. "Power Cycling Supported" (6) indicates that the SetPowerState method can be invoked with the PowerState parameter set to 5 ("Power Cycle"). "Timed Power On Supported" (7) indicates that the SetPowerState method can be invoked with the PowerState parameter set to 5 ("Power Cycle") and the Time parameter set to a specific date and time, or interval, for power-on. PowerManagementCapabilities k � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values ? H W a j � � � Unknown Not Supported Disabled Enabled Power Saving Modes Entered Automatically Power State Settable Power Cycling Supported Timed Power On Supported � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � , ! ; � MSFT_CliProperty PowerManagementSupported Boolean indicating that the computer system, with its running operating system, support power management. This boolean does not indicate that power management features are currently enabled, only that the system is capable of power management. PowerManagementSupported � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier { ) � � N � MSFT_CliProperty PowerOnPasswordStatus The PowerOnPasswordStatus property identifies the system-wide hardware security settings for Power On Password Status. PowerOnPasswordStatus � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � \ � MSFT_CliQualifier Values / 9 B S Disabled Enabled Not Implemented Unknown s 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier 9 � � � MSFT_CliProperty PowerState Indicates the current power state of the computer system and its associated operating system. Regarding the power saving states, these are defined as follows: Value 4 (Unknown) indicates that the system is known to be in a power save mode, but its exact status in this mode is unknown; 2 (Low Power Mode) indicates that the system is in a power save state but still functioning, and may exhibit degraded performance; 3 (Standby) describes that the system is not functioning but could be brought to full power 'quickly'; and value 7 (Warning) indicates that the computerSystem is in a warning state, though also in a power save mode. PowerState � p � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values ? H T q � � � � Unknown Full Power Power Save - Low Power Mode Power Save - Standby Power Save - Unknown Power Cycle Power Off Power Save - Warning o 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier 5 $ � � [ � MSFT_CliProperty PowerSupplyState The PowerSupplyState identifies the state of the enclosure's power supply (or supplies) when last booted. PowerSupplyState � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING k K � MSFT_CliQualifier ValueMap 9 < ? B E H 1 2 3 4 5 6 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � q � MSFT_CliQualifier Values 7 > G M V ` Other Unknown Safe Warning Critical Non-recoverable 9 �9 : B boolean C � LowThreatDefaultAction boolean C �
� �: In C �
� �: �: �� ; ; ; ; ; ; #; 1 2 3 6 8 9 10 ValueMap C � )
� �: �: ��'; �: ID C � 6
� �; �: ��'; �: h; C boolean D � ModerateThreatDefaultAction boolean D �
� �; In D �
� �; < �� ^< a< d< g< j< m< p< 1 2 3 6 8 9 10 ValueMap D � )
� �; < ��t< >< ID D � 6
� �< < ��t< >< �< D boolean E � HighThreatDefaultAction boolean E �
� 1= In E �
� 1= Y= �� �= �= �= �= �= �= �= 1 2 3 6 8 9 10 ValueMap E � )
� 1= Y= ���= �= ID E � 6
� F> Y= ���= �= �= E boolean F � SevereThreatDefaultAction boolean F �
� |> In F �
� |> �> �� �> �> �> �> �> ? ? 1 2 3 6 8 9 10 ValueMap F � )
� |> �> ��? �> ID F � 6
� �? �> ��? �> I? F boolean G � PUAProtection boolean G �
� �? In G �
� �? �? �� !@ $@ '@ 0 1 2 ValueMap G � )
� �? �? ��*@ @ ID G � 6
� �@ �? ��*@ @ k@ G boolean H � DisableBlockAtFirstSeen boolean H �
� �@ In H �
� �@ A �� ID H � )
� xA A ��=A H boolean I � CloudBlockLevel boolean I �
� �A In I �
� �A �A �� B B B B B 0 1 2 4 6 ValueMap I � )
� �A �A ��!B �A ID I � 6
� �B �A ��!B �A bB I boolean J � CloudExtendedTimeout boolean J �
� �B In J �
� �B C �� ID J � )
� lC C ��1C J boolean K � EnableNetworkProtection boolean K �
� �C In K �
� �C �C �� D D D 0 1 2 ValueMap K � )
� �C �C ��D �C ID K � 6
� �D �C ��D �C PD K boolean L � EnableControlledFolderAccess boolean L �
� �D In L �
� �D �D �� ?E BE EE HE KE 0 1 2 3 4 ValueMap L � )
� �D �D ��NE 'E ID L � 6
� �E �D ��NE 'E �E L boolean M � AttackSurfaceReductionOnlyExclusions string M �
� F In M �
� F ?F �� ID M � )
� �F ?F ��mF M string N � AttackSurfaceReductionRules_Ids string N �
� �F In N �
� �F
G �� ID N � )
� sG
G ��8G N string O � AttackSurfaceReductionRules_Actions uint8 O �
� �G In O �
� �G �G �� H !H $H 'H *H 0 1 2 5 6 ValueMap O � )
� �G �G ��-H H ID O � 6
� �H �G ��-H H nH O uint8 P � ControlledFolderAccessAllowedApplications string P �
� �H In P �
� �H !I �� ID P � )
� �I !I ��OI P string Q � ControlledFolderAccessProtectedFolders string Q �
� �I In Q �
� �I �I �� ID Q � )
� \J �I ��!J Q string R � SharedSignaturesPath boolean R �
� �J In R �
� �J �J �� ID R � )
� K �J ���J R boolean S � SharedSignaturesPathUpdateAtScheduledTimeOnly boolean S �
� gK In S �
� gK �K �� ID S � )
� �K �K ���K S boolean T � EnableLowCpuPriority boolean T �
� )L In T �
� )L QL �� ID T � )
� �L QL ��L T boolean U � EnableFileHashComputation boolean U �
� �L In U �
� �L M �� ID U � )
� �M M ��FM U boolean V � MeteredConnectionUpdates boolean V �
� �M In V �
� �M �M �� ID V � )
� GN �M �� N V boolean W � AllowNetworkProtectionOnWinServer boolean W �
� �N In W �
� �N �N �� ID W � )
� O �N ���N W boolean X � DisableDatagramProcessing boolean X �
� LO In X �
� LO tO �� ID X � )
� �O tO ���O X boolean Y � EnableConvertWarnToBlock boolean Y �
� P In Y �
� P :P �� ID Y � )
� �P :P ��hP Y boolean Z � DisableCpuThrottleOnIdleScans boolean Z �
� �P In Z �
� �P Q �� ID Z � )
� nQ Q ��3Q Z boolean [ � EnableFullScanOnBatteryPower boolean [ �
� �Q In [ �
� �Q �Q �� ID [ � )
� 8R �Q ���Q [ boolean \ � ProxyPacUrl boolean \ �
� `R In \ �
� `R �R �� ID \ � )
� �R �R ���R \ boolean ] � ProxyServer boolean ] �
� S In ] �
� S AS �� ID ] � )
� �S AS ��oS ] boolean ^ � ProxyBypass boolean ^ �
� �S In ^ �
� �S �S �� ID ^ � )
� cT �S ��(T ^ boolean _ � ForceUseProxyOnly boolean _ �
� �T In _ �
� �T �T �� ID _ � )
� "U �T ���T _ boolean ` � DisableTlsParsing boolean ` �
� PU In ` �
� PU xU �� ID ` � )
� �U xU ���U ` boolean a � DisableHttpParsing boolean a �
� V In a �
� V 8V �� ID a � )
� �V 8V ��fV a boolean b � DisableDnsParsing boolean b �
� �V In b �
� �V �V �� ID b � )
� `W �V ��%W b boolean c � DisableDnsOverTcpParsing boolean c �
� �W In c �
� �W �W �� ID c � )
� &X �W ���W c boolean d � DisableSshParsing boolean d �
� TX In d �
� TX |X �� ID d � )
� �X |X ���X d boolean e � PlatformUpdatesChannel boolean e �
� Y In e �
� Y @Y �� ID e � )
� �Y @Y ��nY e boolean f � EngineUpdatesChannel boolean f �
� �Y In f �
� �Y Z �� ID f � )
� T� �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty a� DY � MSFT_CliFormat WRITEABLE ? � � P' �3 "C �M � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier d , # = v � MSFT_CliProperty AutomaticResetBootOption The AutomaticResetBootOption property determines whether the automatic reset boot option is enabled, i.e. whether the machine will try to reboot after a system failure./nValues: TRUE or FALSE. If TRUE, the automatic reset boot option is enabled. AutomaticResetBootOption Q m C \ � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING j - � MSFT_CliQualifier CIMTYPE $ boolean � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING $ # � � MSFT_CliQualifier MappingStrings / 8 boolean Win32Registry|HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl|AutoReboot � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING g ' � MSFT_CliQualifier read ! True � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING h ( � MSFT_CliQualifier write " True � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � # � � � � MSFT_CliProperty CurrentTimeZone The CurrentTimeZone property indicates the amount of time the unitary computer system is offset from Coordinated Universal Time. CurrentTimeZone � � � � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING j , � MSFT_CliQualifier CIMTYPE $ sint16 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � # l � MSFT_CliQualifier MappingStrings / 7 sint16 Win32API|Time Structures|TIME_ZONE_INFORMATION|Bias � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING g ' � MSFT_CliQualifier read ! True � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING h + � MSFT_CliQualifier Units " Minutes � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING h ( � MSFT_CliQualifier write " True / 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � - , n � MSFT_CliPropkZ Z ��0Z f boolean g � DefinitionUpdatesChannel boolean g �
� �Z In g �
� �Z �Z �� ID g � )
� 1[ �Z ���Z g boolean h � DisableGradualRelease boolean h �
� c[ In h �
� c[ �[ �� ID h � )
� �[ �[ ���[ h boolean i � AllowNetworkProtectionDownLevel boolean i �
� 0\ In i �
� 0\ X\ �� ID i � )
� �\ X\ ���\ i boolean j � AllowDatagramProcessingOnWinServer boolean j �
� ] In j �
� ] (] �� ID j � )
� �] (] ��V] j boolean k � EnableDnsSinkhole boolean k �
� �] In k �
� �] �] �� ID k � )
� P^ �] ��^ k boolean l � DisableInboundConnectionFiltering boolean l �
� �^ In l �
� �^ �^ �� ID l � )
� _ �^ ���^ l boolean m � DisableRdpParsing boolean m �
� M_ In m �
� M_ u_ �� ID m � )
� �_ u_ ���_ m boolean n � DisableNetworkProtectionPerfTelemetry boolean n �
� ` In n �
� ` H` �� ID n � )
� �` H` ��v` n boolean o � TrustLabelProtectionStatus boolean o �
� �` In o �
� �` a �� ID o � )
� ya a ��>a o boolean p � DisableFtpParsing boolean p �
� �a In p �
� �a �a �� ID p � )
� 8b �a ���a p boolean q � AllowSwitchToAsyncInspection boolean q �
� qb In q �
� qb �b �� ID q � )
� c �b ���b q boolean r � ScanScheduleOffset boolean r �
� 1c In r �
� 1c Yc �� ID r � )
� �c Yc ���c r boolean s DisableTDTFeature boolean s
� �c In s
� �c d �� ID s )
� �d d ��Fd s boolean t DisableSmtpParsing boolean t
� �d In t
� �d �d �� ID t )
� Ae �d ��e t boolean u DisableQuicParsing boolean u
� pe In u
� pe �e �� ID u )
� f �e ���e u boolean v NetworkProtectionReputationMode boolean v
� =f In v
� =f ef �� ID v )
� �f ef ���f v boolean w IntelTDTEnabled boolean w
� �f In w
� �f "g �� ID w )
� �g "g ��Pg w boolean x
AttackSurfaceReductionRules_RuleSpecificExclusions_Id string x
� �g In x
� �g h �� ID x
)
� mh h ��2h x string y AttackSurfaceReductionRules_RuleSpecificExclusions string y
� �h In y
� �h �h �� ID y )
� Ki �h ��i y string z OobeEnableRtpAndSigUpdate boolean z
� �i In z
� �i �i �� ID z )
� j �i ���i z boolean { PerformanceModeStatus boolean {
� Cj In {
� Cj kj �� �j �j 0 1 ValueMap { )
� Cj kj ���j �j ID { 6
� 4k kj ���j �j �j { boolean | QuickScanIncludeExclusions boolean |
� kk In |
� kk �k �� �k �k 0 1 ValueMap | )
� kk �k ���k �k ID | 6
� \l �k ���k �k l | boolean } RemoveScanningThreadPoolCap boolean }
� �l In }
� �l �l �� ID } )
� %m �l ���l } boolean ~ DisableCacheMaintenance boolean ~
� Ym In ~
� Ym �m �� ID ~ )
� �m �m ���m ~ boolean DisableCoreServiceECSIntegration boolean
� 'n In
� 'n On �� ID )
� �n On ��}n boolean � DisableCoreServiceTelemetry boolean �
� �n In �
� �n o �� ID � )
� �o o ��Fo � boolean � EnableUdpSegmentationOffload boolean �
� �o In �
� �o �o �� ID � )
� Kp �o ��p � boolean � " EnableUdpReceiveOffload boolean � "
� p In � "
� p �p �� ID � " )
� q �p ���p � boolean � $ EnableEcsConfiguration boolean � $
� Cq In � $
� Cq kq �� ID � $ )
� �q kq ���q � boolean � & Force boolean � &
� �q In � &
� �q r �� ID � & )
� �r r ��Lr � boolean erty EnableDaylightSavingsTime The EnableDaylightSavingsTime property indicates whether Daylight Savings Time is recognized on this machine. FALSE - time does not move an hour ahead or behind in the year. NULL - the status of DST is unknown on this system EnableDaylightSavingsTime 8 T � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING j - � MSFT_CliQualifier CIMTYPE $ boolean � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING h ( � MSFT_CliQualifier write " True E 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier
� � � MSFT_CliProperty Roles An array (bag) of strings that specify the roles this System plays in the IT-environment. Subclasses of System may override this property to define explicit Roles values. Alternately, a Working Group may describe the heuristics, conventions and guidelines for specifying Roles. For example, for an instance of a networking system, the Roles property might contain the string, 'Switch' or 'Bridge'. Roles � � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING j , � MSFT_CliQualifier CIMTYPE $ string � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING g ' � MSFT_CliQualifier read ! True � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING h ( � MSFT_CliQualifier write " True � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier ` & � � � � MSFT_CliProperty SystemStartupDelay The SystemStartupDelay property indicates the time to delay before starting the operating system SystemStartupDelay � � } � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING j , � MSFT_CliQualifier CIMTYPE $ uint16 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � # j � MSFT_CliQualifier MappingStrings / 7 uint16 Win32API|GetPrivateProfileInt|Boot Loader|timeout � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING g ' � MSFT_CliQualifier read ! True � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING h + � MSFT_CliQualifier units " Seconds � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING h ( � MSFT_CliQualifier write " True 0 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier �
( 1 G � MSFT_CliProperty SystemStartupOptions The SystemStartupOptions property array indicates the options for starting up the computer system./nConstraints: Must have a value./nNote: The SE_SYSTEM_ENVIRONMENT_NAME privilege is required on IA64bit machines. This privilege is not required for 32bit systems. SystemStartupOptions _ { * � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING j , � MSFT_CliQualifier CIMTYPE $ string � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRI 2�<Pp � � ؞/ � e���� � �)�)s 6 ���˩ � 2���� � I I S _ R e w r i t e _ T r a n s 6h�b �� IIS_Rewrite_Trans ] � �� ) E R u � � � � � � � } � I R � � _������������������������ � SetServerVariableFromCache DisplayName SetServerVariableFromCache Description Sets a server variable from cache EventType EventTypeName SET_SERVER_VARIABLE_FROM_CACHE EventLevel locale MS\0x409 ContextId
N
� 4 < G T ` k q �� � �� object WmiDataId Description Context ID extension Guid ActivityID Name P
� � � � . > F � �� string WmiDataId Description The server variable name StringTermination NullTerminated Format a Replace 6
� � � � � � �� boolean WmiDataId Description True if the server variable needs to be replaced or added Value P
� W _ j w � � � � � �� string WmiDataId Description The server variable value StringTermination NullTerminated Format w � I I S _ R e w r i t e _ T r a n s 6h�b �f IIS_Rewrite_Trans ] � �� ( C P r } � � � � � � y < E � � _������������������������ � SetRequestHeaderFromCache DisplayName SetRequestHeaderFromCache Description Sets a request header from cache EventType EventTypeName SET_REQUEST_HEADER_FROM_CACHE EventLevel locale MS\0x409 ContextId
N
� 0 8 C P \ g m �� � �� object WmiDataId Description Context ID extension Guid ActivityID Name P
� � � � � ! 1 9 � �� string WmiDataId Description The header name StringTermination NullTerminated Format a Replace 6
� � � � � � �� boolean WmiDataId Description True if the header needs to be replaced or added Value P
� A I T a s � � � � �� string WmiDataId Description The header value StringTermination NullTerminated Format a � I I S _ R e w r i t e _ T r a n s
6h�b �j IIS_Rewrite_Trans ] � �� ) E R u � � � � � � � } � @ I � � _������������������������ � SetResponseHeaderFromCache DisplayName SetResponseHeaderFromCache Description Sets a response header from cache EventType EventTypeName SET_RESPONSE_HEADER_FROM_CACHE EventLevel locale MS\0x409 ContextId
N
� 4 < G T ` k q �� � �� object WmiDataId Description Context ID extension Guid ActivityID Name P
� � � � % 5 = � �� string WmiDataId Description The header name StringTermination NullTerminated Format a Replace 6
� � � � � � �� boolean WmiDataId Description True if the header needs to be replaced or added Value P
� E M X e w � � � � �� string WmiDataId Description The header value StringTermination NullTerminated Format a � I I S _ R e w r i t e _ T r a n s 6h�b �� IIS_Rewrite_Trans ] � �� * G T t � � � � � � { � � � � _�������������������������5 � PreconditionEvaluationStart DisplayName PreconditionEvaluationStart Description Precondition evaluation starts EventType EventTypeName PRECONDITION_EVALUATION_START EventLevel locale MS\0x409 ContextId
N
� 2 : E R ^ i o �� � �� object WmiDataId Description Context ID extension Guid ActivityID LogicalGrouping j
� $ @ S � � � � � � � �� uint32 WmiDataId Description Logical condition grouping ValueDescriptions _ � Must match all conditions to succeed. Match any condition to succeed. ValueMap � � 0 1 Values � � MatchAll MatchAny ValueType index Name P
� a i t � � � � � � �� string WmiDataId Description The preconditon name StringTermination NullTerminated Format w PatternSyntax j
� L T _ l | � � � � � # . � �� uint32 WmiDataId Description Pattern Syntax ValueDescriptions � � � Regex Syntax Wildcard Syntax Exact Match ValueMap � � � 0 1 2 Values
Regex Wildcard ExactMatch ValueType index � I I S _ R e w r i t e _ T r a n s 6h�b �� IIS_Rewrite_Trans ] � �� ( C P n y � � � � � � s ~ _�������������� � PreconditionEvaluationEnd DisplayName PreconditionEvaluationEnd Description Precondition evaluation ends EventType EventTypeName PRECONDITION_EVALUATION_END EventLevel locale MS\0x409 ContextId
N
� * 2 = J V a g �� � �� object WmiDataId Description Context ID extension Guid ActivityID Succeeded 6
� � � � � � �� boolean WmiDataId Description True if the precondition evaluation succeeded � I I S _ R e w r i t e _ T r a n s
6h�b �� # IIS_Rewrite_Trans ] � �� % = J c n } � � � � � d s 9 @ � � ( 1 _U���������������������������������� � PreconditionEvaluation DisplayName PreconditionEvaluation Description Precondition evaluation EventType EventTypeName PRECONDITION_EVALUATION EventLevel locale MS\0x409 ContextId
N
� # . ; G R X �� � �� object WmiDataId Description Context ID extension Guid ActivityID ExpandedInput P
� � � � � . 6 � �� string WmiDataId Description The expanded input value StringTermination NullTerminated Format w Input P
� � � � � � � � � �� string WmiDataId Description The input value format StringTermination NullTerminated Format w MatchType j
� � � � � � � - 7 P X � � � �� uint32 WmiDataId Description The condition match type to evaluate ValueDescriptions � Pattern match. Is file condition. Is directory condition. ValueMap G J M 0 1 2 Values h q y Pattern IsFile IsDirectory ValueType index Negate 6
� � � � � �� boolean WmiDataId Description True if the match will be negated Pattern P
� � � � � � � � �� string WmiDataId Description The pattern to use if the match type is Pattern StringTermination NullTerminated Format w Succeeded 6
� ] f q ~ � �� boolean WmiDataId Description True if the condition evaluation succeeded �C:\Windows\system32\kernelbase.dll[MofResourceName] E65868511053C7856CA375F94BE.2669.2928240190.272 ndows\system32\kernelbase.dll[MofResourceName] NG QualifierValue
� o STRING � # l � MSFT_CliQualifier MappingStrings / 7 string Win32API|GetPrivateProfileSection|Operating Systems � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Privileges / 7 l string Win32API|GetPrivateProfileSection|Operating Systems SeSystemEnvironmentNamePrivilege � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING g ' � MSFT_CliQualifier read ! True � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING h ( � MSFT_CliQualifier write " True �
9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier K ( R h � � MSFT_CliProperty SystemStartupSetting The SystemStartupSetting property indicates the index of the default start profile. This value is 'calculated' so that it usually returns zero (0) because at write-time, the profile string is physically moved to the top of the list. (This is how Windows NT determines which value is the default.) SystemStartupSetting | � � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING j + � MSFT_CliQualifier CIMTYPE $ uint8 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING q # ; � MSFT_CliQualifier MappingStrings / 6 uint8 WMI � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING g ' � MSFT_CliQualifier read ! True � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING h ( � MSFT_CliQualifier write " True � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier [
� � + � MSFT_CliProperty Workgroup The Workgroup property contains the name of the workgroup. This value is only valid if the PartOfDomain property is FALSE. Workgroup � � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING j , � MSFT_CliQualifier CIMTYPE $ string � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING q # 9 � MSFT_CliQualifier MappingStrings / 7 string � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING g ' � MSFT_CliQualifier read ! True � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING h ( � MSFT_CliQualifier write " True 2eU�` � �-B � ^��% V���: /]TH
�֝��C�� 6 � �� � * 8 ; H L Z � � � � ! , ^ k � � � � U����������������������������% � MSFT_SmbServerNetworkInterface smbwmiv2 ClassVersion 7 Description 46 FriendlyName
� � � �� string InterfaceIndex '
� � � �� � �� uint32 IpAddress '
� � �� � �� string LinkSpeed
� V � �� uint64 RdmaCapable
� � � �� boolean RssCapable
� � � �� boolean ScopeName '
� � �� � �� string � �:Ͼlu�� 6 � �� � 4 > L O \ ` s � 4 @ r � U���������������������> � MSFT_SmbServerCertificateMappingAccessControlEntry smbwmiv2 ClassVersion 7 Description 76 AccessControlType 6
� � � � � � � �� uint32 ValueMap � � 0 1 Values � � 1 2 Description
� , � �� string Identifier
� j � �� string IdentifierType 6
� � � � � � � �� uint32 ValueMap � � 0 1 Values � 74 75 Name
� 6 � �� string �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �b��5�
͝��C�� ! �f3��5� b � WDMClassesOfDriver __namespace C:\Windows\System32\drivers\en-US\ACPI.sys.mui[ACPIMOFResource] W i n 3 2 _ M S I R e s o u r c e �Н��C�� Win32_MSIResource ) ! ��! ) 1 : � � ���������������������U � Win32_PatchPackage Description The PatchPackage class describes all patch packages that have been applied to this product. For each patch package, the unique identifier for the patch is provided along with information about the media image the on which the patch is located. AMENDMENT LOCALE ms_409 PatchID )
� q � ��y � string Description The unique identifier for a patch package. ProductCode )
� � � ��� string Description The product code for the product to which this patch package is applied. �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 Уn�^��
͝��C�� ( J.3�� ] � WDMClassesOfDriver MSWmi_ProviderInfo C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 9 A B 5 3 8 0 6 E 8 8 6 6 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0 Ҧn�^�� ͝��C�l �2��2�� K � WMIBinaryMofResource C:\Windows\System32\drivers\monitor.sys[MonitorWMI] is.sys.mui[MofResourceName] 9 A B 5 3 8 0 6 E 8 8 6 6 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0 Ҧn�^�� ͝��C�l �2��2�� K � WMIBinaryMofResource C:\Windows\System32\drivers\monitor.sys[MonitorWMI] [MofResourceName] 9 A B 5 3 8 0 6 E 8 8 6 6 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0 Ҧn�^�� ͝��C�l �2��2�� K � WMIBinaryMofResource C:\Windows\System32\drivers\monitor.sys[MonitorWMI] ows\system32\kernelbase.dll[MofResourceName] ied. �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 Уn�^��
͝��C�� ( J.3�� ] � WDMClassesOfDriver MSWmi_ProviderInfo C:\Windows\system32\kernelbase.dll[MofResourceName] is applied. �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 Уn�^��
͝��C�� ( J.3�� ] � WDMClassesOfDriver MSWmi_ProviderInfo C:\Windows\system32\kernelbase.dll[MofResourceName] ied. �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 Уn�^��
͝��C�� ( J.3�� ] � WDMClassesOfDriver MSWmi_ProviderInfo C:\Windows\system32\kernelbase.dll[MofResourceName] �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 Уn�^��
͝��C�� ( J.3�� ] � WDMClassesOfDriver MSWmi_ProviderInfo C:\Windows\system32\kernelbase.dll[MofResourceName] applied. �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 Уn�^��
͝��C�� ( J.3�� ] � WDMClassesOfDriver MSWmi_ProviderInfo C:\Windows\system32\kernelbase.dll[MofResourceName] applied. �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 Уn�^��
͝��C�� ( J.3�� ] � WDMClassesOfDriver MSWmi_ProviderInfo C:\Windows\system32\kernelbase.dll[MofResourceName] �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 Уn�^��
͝��C�� ( J.3�� ] � WDMClassesOfDriver MSWmi_ProviderInfo C:\Windows\system32\kernelbase.dll[MofResourceName] applied. �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 Уn�^��
͝��C�� ( J.3�� ] � WDMClassesOfDriver MSWmi_ProviderInfo C:\Windows\system32\kernelbase.dll[MofResourceName] ge is applied. �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 Уn�^��
͝��C�� ( J.3�� ] � WDMClassesOfDriver MSWmi_ProviderInfo C:\Windows\system32\kernelbase.dll[MofResourceName] �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 Уn�^��
͝��C�� ( J.3�� ] � WDMClassesOfDriver MSWmi_ProviderInfo C:\Windows\system32\kernelbase.dll[MofResourceName] ied. �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 Уn�^��
͝��C�� ( J.3�� ] � WDMClassesOfDriver MSWmi_ProviderInfo C:\Windows\system32\kernelbase.dll[MofResourceName] lied. �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 Уn�^��
͝��C�� ( J.3�� ] � WDMClassesOfDriver MSWmi_ProviderInfo C:\Windows\system32\kernelbase.dll[MofResourceName] age is applied. �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 Уn�^��
͝��C�� ( J.3�� ] � WDMClassesOfDriver MSWmi_ProviderInfo C:\Windows\system32\kernelbase.dll[MofResourceName] applied. �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 Уn�^��
͝��C�� ( J.3�� ] � WDMClassesOfDriver MSWmi_ProviderInfo C:\Windows\system32\kernelbase.dll[MofResourceName] applied. �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 Уn�^��
͝��C�� ( J.3�� ] � WDMClassesOfDriver MSWmi_ProviderInfo C:\Windows\system32\kernelbase.dll[MofResourceName] sys[MonitorWMI] dows\system32\kernelbase.dll[MofResourceName] __ �� WIN-F6NF7R6I6PJ ROOT\Microsoft\ProtectionManagement ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � Add B� ��O� �� implemented static * WIN-F6NF7R6I6PJ ROOT\Microsoft\ProtectionManagement ���� � �� G �� + � � � � u P � o
�
� w
� � ^ � P ] � * � � �
) . � �
� � � UUUU�������������������������������������������������������������������i � __PARAMETERS abstract ExclusionPath string
� 9 In
� 9 ` �� ID )
� � ` ��� string ExclusionExtension string
� � In
� � �� ID )
� � ��L string ExclusionProcess string
� � In
� � � �� ID )
� C � �� string ExclusionIpAddress string
� q In
� q � �� ID )
� � ��� string ThreatIDDefaultAction_Ids sint64
� 6 In
� 6 ] �� ID )
� � ] ��� sint64 ThreatIDDefaultAction_Actions uint8
� � In
� � % �� s v y | � � 1 2 3 6 8 9 10 ValueMap )
� � % ��� S ID 6
� % ��� S � uint8 AttackSurfaceReductionOnlyExclusions string
� Q In
� Q x �� ID )
� � x ��� string AttackSurfaceReductionRules_Ids string
� In
� C �� ID )
� � C ��q string AttackSurfaceReductionRules_Actions uint8
� � In
� � �� W Z ] ` c 0 1 2 5 6 ValueMap )
� � ��f ? ID 6
� � ��f ? � uint8 $ ControlledFolderAccessAllowedApplications string $
� 3 In $
� 3 Z �� ID $ )
� � Z ��� string
( ControlledFolderAccessProtectedFolders string
(
� In
(
� , �� ID
( )
� � , ��Z
string , SharedSignaturesPath string ,
� � in ,
� � � �� ID , )
� U
� ��
string 0 AttackSurfaceReductionRules_RuleSpecificExclusions_Id string 0
� �
In 0
� �
�
�� ID 0 )
� 6 �
���
string
4 AttackSurfaceReductionRules_RuleSpecificExclusions string
4
� � In
4
� � � �� ID
4 )
� � ���
string 8 RemoteEncryptionProtectionExclusions string 8
� T In 8
� T { �� ID 8 )
� � { ��� string < BruteForceProtectionExclusions string <
�
In <
�
E
�� ID < )
� �
E
��s
string @ Force boolean @
� �
In @
� �
�
�� ID @ )
� ` �
��% boolean __ �� WIN-F6NF7R6I6PJ ROOT\Microsoft\ProtectionManagement ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � __ �
I I S _ C g i _ T r a n s >�4 �
IIS_Cgi_Trans ) � ��
) 4 _������������� � W3CGIEnd EventType EventLevel ContextId
A
� � � � � � �� � �� object WmiDataId extension Guid ActivityID � I I S _ R e w r i t e _ T r a n s �5h�b � IIS_Rewrite_Trans ] � �� + 8 R ] l | � � � � F Q � � � [ i _������������������������3 � RewriteAction DisplayName RewriteAction Description Rewrite action performed EventType EventTypeName REWRITE_ACTION EventLevel locale MS\0x409 AppendQueryString 6
� � � � �� boolean WmiDataId Description True if the Query String was appended or preserved ContextId
N
� � � � � � � � �� � �� object WmiDataId Description Context ID extension Guid ActivityID LogRewrittenURL 6
� K T _ l � �� boolean WmiDataId Description True if the rewritten URL must be logged RewriteURL P
� - @ P X � �� string WmiDataId Description Rewrite URL StringTermination NullTerminated Format w Substitution P
� � � � � ( 0 � �� string WmiDataId Description Format used to build the URL StringTermination NullTerminated Format w � I I S _ R e w r i t e _ T r a n s �5h�b �� IIS_Rewrite_Trans ] � �� - : U
` o � � � � � K V � \ i # 1 _��������������������������� � RedirectAction DisplayName RedirectAction Description Redirect action performed EventType EventTypeName REDIRECT_ACTION EventLevel locale MS\0x409 AppendQueryString 6
� � � � �� boolean WmiDataId Description True if the Query String was appended or preserverd ContextId
N
� � � � � � � � �� � �� object WmiDataId Description Context ID extension Guid ActivityID RedirectType ]
� t | � � � � J U � �� uint32 WmiDataId ValueDescriptions � � � � Permanent Found SeeOther Temporary ValueMap � � � 301 302 303 307 Values # . 5 ? Permanent Found SeeOther Temporary ValueType index RedirectURL P
� � � � � � � �� string WmiDataId Description Redirect URL StringTermination NullTerminated Format w Substitution P
� � � � � � � � � � �� string WmiDataId Description Format used to build the URL StringTermination NullTerminated Format w �0 8 9 9 3 0 7 4 0 8 A 3 2 0 4 0 A 6 D A 1 9 C 0 B 1 E C 2 7 4 5 A 3 D 6 0 4 B A A 9 D F F E 8 E E 4 B 7 5 C 3 D 9 1 E 1 6 1 0 9 CJV��ȝ��C�� A � � __EventProviderRegistration % select * from MSFT_MpEvent \\.\root\Microsoft\ProtectionManagement:__Win32Provider.Name="ProtectionManagement" # R O O T \ M i c r o s o f t \ P r o t e c t i o n M a n a g e m e n t _ _ E v e n t P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ B 6 7 9 1 A 1 C F 7 8 0 2 A 9 0 1 B 1 5 3 4 C A D B B 1 A 0 E 8 2 F B 1 5 4 1 0 0 B 2 B E 0 8 A F 4 7 3 8 6 C 4 3 C E C 4 6 2 A \ K I _ 0 8 9 9 3 0 7 4 0 8 A 3 2 0 4 0 A 6 D A 1 9 C 0 B 1 E C 2 7 4 5 A 3 D 6 0 4 B A A 9 D F F E 8 E E 4 B 7 5 C 3 D 9 1 E 1 6 1 0 9 \ I _ E 8 B 0 A E 6 6 5 C C 1 B 0 C A 8 3 C 8 A 4 2 3 B 1 9 4 2 F 6 0 D 1 F 2 C 8 F 5 D B 0 B 8 0 4 5 F C D A E C 2 6 A 2 6 9 E 1 C 6 E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C DJV�� ȝ��C�� � �������� u � __InstanceProviderRegistration \\.\root\Microsoft\ProtectionManagement:__Win32Provider.Name="ProtectionManagement" # R O O T \ M i c r o s o f t \ P r o t e c t i o n M a n a g e m e n t _ _ I n s t a n c e P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ B 6 7 9 1 A 1 C F 7 8 0 2 A 9 0 1 B 1 5 3 4 C A D B B 1 A 0 E 8 2 F B 1 5 4 1 0 0 B 2 B E 0 8 A F 4 7 3 8 6 C 4 3 C E C 4 6 2 A \ K I _ E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C \ I _ E 8 B 0 A E 6 6 5 C C 1 B 0 C A 8 3 C 8 A 4 2 3 B 1 9 4 2 F 6 0 D 1 F 2 C 8 F 5 D B 0 B 8 0 4 5 F C D A E C 2 6 A 2 6 9 E 1 C 6 ` 9��E 1 C 6 stRestor4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 |�X��
͝��C�� 3 ��� �� h � WDMClassesOfDriver MSMCAEvent_SwitchToCMCPolling C:\Windows\system32\kernelbase.dll[MofResourceName] C 6 A
� � � � � � �� � �� object WmiDataId extension Guid ActivityID �ourceName] g � � 9 " � � � \ � � c �c O � � �* -+ 0 � a> M? vJ �J 8K �K g � �$ �$ & �& + � � � O! � �! �" �" e# �# 1$ O% �% �' �( �7 �8 '7 �7 � L �` Ba o6 �6 79 $: UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU�������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������q � __PARAMETERS abstract DisableAutoExclusions boolean
� A In
� A i �� ID )
� � i ��� boolean ExclusionPath string
� � In
� � # �� ID )
� � # ��Q string ExclusionExtension string
� � In
� � � �� ID )
� J � �� string
ExclusionProcess string
� v In
� v � �� ID
)
� � ��� string ExclusionIpAddress string
� 4 In
� 4 [ �� ID )
� � [ ��� string QuarantinePurgeItemsAfterDelay boolean
� � In
� � & �� ID )
� � & ��T boolean RealTimeScanDirection boolean
� � In
� � � �� ' * - 0 1 2 ValueMap )
� � � ��0 ID 6
� � � ��0 q boolean RemediationScheduleDay boolean
� � In
� � �� j m p s v y | � 0 1 2 3 4 5 6 7 8 ValueMap )
� � ��� B ID 6
� ��� B � boolean RemediationScheduleTime boolean
� B In
� B j �� ID )
� � j ��� boolean RemoteEncryptionProtectionConfiguredState boolean
� In
� A �� � � � � 0 1 2 4 ValueMap )
� A ��� o ID 6
� A ��� o � boolean
RemoteEncryptionProtectionMaxBlockTime boolean
� [ In
� [ � �� ID
)
� � � ���
boolean RemoteEncryptionProtectionAggressiveness boolean
� 1
In
� 1
Y
�� �
�
�
0 1 2 ValueMap )
� 1
Y
���
�
ID 6
� ) Y
���
�
�
boolean RemoteEncryptionProtectionExclusions string
� j In
� j � �� ID )
� � � ��� string
$ BruteForceProtectionConfiguredState boolean
$
� 9 In
$
� 9 a �� � � � � 0 1 2 4 ValueMap
$ )
� 9 a ��� � ID
$ 6
� 8
a ��� � �
boolean & BruteForceProtectionMaxBlockTime boolean &
� u
In &
� u
�
�� ID & )
� �
���
boolean ( BruteForceProtectionAggressiveness boolean (
� E In (
� E m �� � � � 0 1 2 ValueMap ( )
� E m ��� � ID ( 6
� = m ��� � � boolean * BruteForceProtectionExclusions string *
� x In *
� x � �� ID * )
� � ��� string . BruteForceProtectionLocalNetworkBlocking boolean .
� L In .
� L t �� ID . )
� � t ��� boolean 0 BruteForceProtectionSkipLearningPeriod boolean 0
� In 0
� H �� ID 0 )
� � H ��v boolean 2 ReportingAdditionalActionTimeOut boolean 2
� � In 2
� � �� ID 2 )
� ��D boolean 4 ReportingCriticalFailureTimeOut boolean 4
� � In 4
� � � �� ID 4 )
� L � �� boolean 6 ReportingNonCriticalTimeOut boolean 6
� � In 6
� � � �� ID 6 )
� � ��� boolean 8 ServiceHealthReportInterval boolean 8
� M In 8
� M u �� ID 8 )
� � u ��� boolean : ReportDynamicSignatureDroppedEvent boolean :
� In :
� E �� ID : )
� � E ��s boolean < ScanAvgCPULoadFactor boolean <
� � In <
� � �� ID < )
� p ��5 boolean > CheckForSignaturesBeforeRunningScan boolean >
� � In >
� � � �� ID > )
� A � �� boolean @ ScanPurgeItemsAfterDelay boolean @
� v In @
� v � �� ID @ )
� � ��� boolean B ScanOnlyIfIdleEnabled boolean B
� 9 In B
� 9 a �� ID B )
� � a ��� boolean D ScanParameters boolean D
� � In D
� � �� W Z 1 2 ValueMap D )
� � ��] K ID D 6
� � ��] K � boolean F ScanScheduleDay boolean F
� In F
� : �� � � � � � � � � � 0 1 2 3 4 5 6 7 8 ValueMap F )
� : ��� h ID F 6
� 4 : ��� h � boolean H ScanScheduleQuickScanTime boolean H
� j In H
� j � �� ID H )
� � � ��� boolean J ScanScheduleTime boolean J
� ( In J
� ( P �� ID J )
� � P ��~ boolean L ThrottleForScheduledScanOnly boolean L
� � In L
� � �� ID L )
� � ��H boolean ! N SignatureFirstAuGrac ComputerSystem Select * from Win32_ComputerSystem b � L �w � A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 �u 9 A �4 �: �: � MSFT_CliVerb Rename Renaming a computer can be performed only by a member of the Administrators local group on the computer. You cannot call this Rename function remotely for domain computers. /nPassword and Username must use a high authentication level (i.e. no less than RPC_C_AUTHN_LEVEL_PKT_PRIVACY) when they connect to winmgmt (i.e. in the call to obtain the IWbemServices interface) or SetProxyBlanket on their IWbemServices ptr. If they are local to winmgmt then this is not a concern because their authentication level is as good as RPC_C_AUTHN_LEVEL_PKT_PRIVACY as well as their client request never goes over the wire to get to the winmgmt. /nIf Password and Username are left null, the provider does not care. /nIf the provider determines that the authentication level is too low and a Password or Username has been specified then WBEM_E_ENCRYPTED_CONNECTION_REQUIRED will be returned. /nThe method can return the following values: /n0 - Success. Reboot required. /nOther - For integer values other than those listed above, refer to Win32 error code documentation. Rename Q � �' g � ? L s } � ePeriod boolean ! N
� � In ! N
� � � �� ID ! N )
� L � �� ! boolean " P SignatureAuGracePeriod boolean " P
� In " P
� � �� ID " P )
� � ��� " boolean # R SignatureDefinitionUpdateFileSharesSources boolean # R
� W In # R
� W �� ID # R )
� � ��� # boolean $ T SignatureDisableUpdateOnStartupWithoutEngine boolean $ T
� 1 In $ T
� 1 Y �� ID $ T )
� � Y ��� $ boolean % V SignatureFallbackOrder boolean % V
� � In % V
� � ! �� ID % V )
� �! ! ��K! % boolean & X SignatureScheduleDay boolean & X
� �! In & X
� �! �! �� 5" 8" ;" >" A" D" G" J" M" 0 1 2 3 4 5 6 7 8 ValueMap & X )
� �! �! ��P"
" ID & X 6
� �" �! ��P"
" �" & boolean ' Z SignatureScheduleTime boolean ' Z
� # In ' Z
� # 3# �� ID ' Z )
� �# 3# ��a# ' boolean ( \ SignatureUpdateCatchupInterval boolean ( \
� �# In ( \
� �# �# �� ID ( \ )
� h$ �# ��-$ ( boolean ) ^ SignatureBlobFileSharesSources boolean ) ^
� �$ In ) ^
� �$ �$ �� ID ) ^ )
� 4% �$ ���$ ) boolean * ` SignatureUpdateInterval boolean * `
� h% In * `
� h% �% �� ID * ` )
� �% �% ���% * boolean + b SignatureBlobUpdateInterval boolean + b
� 1& In + b
� 1& Y& �� ID + b )
� �& Y& ���& + boolean , d MAPSReporting boolean , d
� �& In , d
� �& ' �� R' U' X' 0 1 2 ValueMap , d )
� �& ' ��[' B' ID , d 6
� �' ' ��[' B' �' , boolean - f SubmitSamplesConsent boolean - f
� ( In - f
� ( =( �� ( �( �( �( 0 1 2 3 ValueMap - f )
� ( =( ���( k( ID - f 6
� ) =( ���( k( �( - boolean . h DisablePrivacyMode boolean . h
� C) In . h
� C) k) �� ID . h )
� �) k) ���) . boolean / j RandomizeScheduleTaskTimes boolean / j
� * In / j
� * 3* �� ID / j )
� �* 3* ��a* / boolean 0 l SchedulerRandomizationTime boolean 0 l
� �* In 0 l
� �* �* �� ID 0 l )
� d+ �* ��)+ 0 boolean 1 n DisableBehaviorMonitoring boolean 1 n
� �+ In 1 n
� �+ �+ �� ID 1 n )
� +, �+ ���+ 1 boolean 2 p DisableIntrusionPreventionSystem boolean 2 p
� h, In 2 p
� h, �, �� ID 2 p )
� �, �, ���, 2 boolean 3 r DisableIOAVProtection boolean 3 r
� +- In 3 r
� +- S- �� ID 3 r )
� �- S- ���- 3 boolean 4 t DisableRealtimeMonitoring boolean 4 t
� �- In 4 t
� �- . �� ID 4 t )
� �. . ��H. 4 boolean 5 v DisableScriptScanning boolean 5 v
� �. In 5 v
� �. �. �� ID 5 v )
� F/ �. �� / 5 boolean 6 x DisableArchiveScanning boolean 6 x
� y/ In 6 x
� y/ �/ �� ID 6 x )
�
0 �/ ���/ 6 boolean 7 z DisableCatchupFullScan boolean 7 z
� =0 In 7 z
� =0 e0 �� ID 7 z )
� �0 e0 ���0 7 boolean 8 | DisableCatchupQuickScan boolean 8 |
� 1 In 8 |
� 1 *1 �� ID 8 | )
� �1 *1 ��X1 8 boolean 9 ~ DisableEmailScanning boolean 9 ~
� �1 In 9 ~
� �1 �1 �� ID 9 ~ )
� U2 �1 ��2 9 boolean : � DisableRemovableDriveScanning boolean : �
� �2 In : �
� �2 �2 �� ID : � )
� 3 �2 ���2 : boolean ; � DisableRestorePoint boolean ; �
� P3 In ; �
� P3 x3 �� ID ; � )
� �3 x3 ���3 ; boolean < � DisableScanningMappedNetworkDrivesForFullScan boolean < �
� +4 In < �
� +4 S4 �� ID < � )
� �4 S4 ���4 < boolean = � DisableScanningNetworkFiles boolean = �
� �4 In = �
� �4 5 �� ID = � )
� �5 5 ��J5 = boolean > � ApplyDisableNetworkScanningToIOAV boolean > �
� �5 In > �
� �5 �5 �� ID > � )
� T6 �5 ��6 > boolean ? � UILockdown boolean ? �
� {6 In ? �
� {6 �6 �� ID ? � )
� 7 �6 ���6 ? boolean @ � ThreatIDDefaultAction_Ids sint64 @ �
� B7 In @ �
� B7 i7 �� ID @ � )
� �7 i7 ���7 @ sint64 A � ThreatIDDefaultAction_Actions uint8 A �
� 8 In A �
� 8 18 �� 8 �8 �8 �8 �8 �8 �8 1 2 3 6 8 9 10 ValueMap A � )
� 8 18 ���8 _8 ID A � 6
� 9 18 ���8 _8 �8 A uint8 B � UnknownThreatDefaultAction boolean B �
� S9 In B �
� S9 {9 �� �9 �9 �9 �9 �9 �9 �9 1 2 3 6 8 9 10 ValueMap B � )
� S9 {9 ���9 �9 ID B � 6
� h: {9 ���9 �9 : B boolean C � LowThreatDefaultAction boolean C �
� �: In C �
� �: �: �� ; ; ; ; ; ; #; 1 2 3 6 8 9 10 ValueMap C � )
� �: �: ��'; �: ID C � 6
� �; �: ��'; �: h; C boolean D � ModerateThreatDefaultAction boolean D �
� �; In D �
� �; < �� ^< a< d< g< j< m< p< 1 2 3 6 8 9 10 ValueMap D � )
� �; < ��t< >< ID D � 6
� �< < ��t< >< �< D boolean E � HighThreatDefaultAction boolean E �
� 1= In E �
� 1= Y= �� �= �= �= �= �= �= �= 1 2 3 6 8 9 10 ValueMap E � )
� 1= Y= ���= �= ID E � 6
� F> Y= ���= �= �= E boolean F � SevereThreatDefaultAction boolean F �
� |> In F �
� |> �> �� �> �> �> �> �> ? ? 1 2 3 6 8 9 10 ValueMap F � )
� |> �> ��? �> ID F � 6
� �? �> ��? �> I? F boolean G � PUAProtection boolean G �
� �? In G �
� �? �? �� !@ $@ '@ 0 1 2 ValueMap G � )
� �? �? ��*@ @ ID G � 6
� �@ �? ��*@ @ k@ G boolean H � DisableBlockAtFirstSeen boolean H �
� �@ In H �
� �@ A �� ID H � )
� xA A ��=A H boolean I � CloudBlockLevel boolean I �
� �A In I �
� �A �A �� B B B B B 0 1 2 4 6 ValueMap I � )
� �A �A ��!B �A ID I � 6
� �B �A ��!B �A bB I boolean J � CloudExtendedTimeout boolean J �
� �B In J �
� �B C �� ID J � )
� lC C ��1C J boolean K � EnableNetworkProtection boolean K �
� �C In K �
� �C �C �� D D D 0 1 2 ValueMap K � )
� �C �C ��D �C ID K � 6
� �D �C ��D �C PD K boolean L � EnableControlledFolderAccess boolean L �
� �D In L �
� �D �D �� ?E BE EE HE KE 0 1 2 3 4 ValueMap L � )
� �D �D ��NE 'E ID L � 6
� �E �D ��NE 'E �E L boolean M � AttackSurfaceReductionOnlyExclusions string M �
� F In M �
� F ?F �� ID M � )
� �F ?F ��mF M string N � AttackSurfaceReductionRules_Ids string N �
� �F In N �
� �F
G �� ID N � )
� sG
G ��8G N string O � AttackSurfaceReductionRules_Actions uint8 O �
� �G In O �
� �G �G �� H !H $H 'H *H 0 1 2 5 6 ValueMap O � )
� �G �G ��-H H ID O � 6
� �H �G ��-H H nH O uint8 P � ControlledFolderAccessAllowedApplications string P �
� �H In P �
� �H !I �� ID P � )
� �I !I ��OI P string Q � ControlledFolderAccessProtectedFolders string Q �
� �I In Q �
� �I �I �� ID Q � )
� \J �I ��!J Q string R � SharedSignaturesPath boolean R �
� �J In R �
� �J �J �� ID R � )
� K �J ���J R boolean S � SharedSignaturesPathUpdateAtScheduledTimeOnly boolean S �
� gK In S �
� gK �K �� ID S � )
� �K �K ���K S boolean T � EnableLowCpuPriority boolean T �
� )L In T �
� )L QL �� ID T � )
� �L QL ��L T boolean U � EnableFileHashComputation boolean U �
� �L In U �
� �L M �� ID U � )
� �M M ��FM U boolean V � MeteredConnectionUpdates boolean V �
� �M In V �
� �M �M �� ID V � )
� GN �M �� N V boolean W � AllowNetworkProtectionOnWinServer boolean W �
� �N In W �
� �N �N �� ID W � )
� O �N ���N W boolean X � DisableDatagramProcessing boolean X �
� LO In X �
� LO tO �� ID X � )
� �O tO ���O X boolean Y � EnableConvertWarnToBlock boolean Y �
� P In Y �
� P :P �� ID Y � )
� �P :P ��hP Y boolean Z � DisableCpuThrottleOnIdleScans boolean Z �
� �P In Z �
� �P Q �� ID Z � )
� nQ Q ��3Q Z boolean [ � EnableFullScanOnBatteryPower boolean [ �
� �Q In [ �
� �Q �Q �� ID [ � )
� 8R �Q ���Q [ boolean \ � ProxyPacUrl boolean \ �
� `R In \ �
� `R �R �� ID \ � )
� �R �R ���R \ boolean ] � ProxyServer boolean ] �
� S In ] �
� S AS �� ID ] � )
� �S AS ��oS ] boolean ^ � ProxyBypass boolean ^ �
� �S In ^ �
� �S �S �� ID ^ � )
� cT �S ��(T ^ boolean _ � ForceUseProxyOnly boolean _ �
� �T In _ �
� �T �T �� ID _ � )
� "U �T ���T _ boolean ` � DisableTlsParsing boolean ` �
� PU In ` �
� PU xU �� ID ` � )
� �U xU ���U ` boolean a � DisableHttpParsing boolean a �
� V In a �
� V 8V �� ID a � )
� �V 8V ��fV a boolean b � DisableDnsParsing boolean b �
� �V In b �
� �V �V �� ID b � )
� `W �V ��%W b boolean c � DisableDnsOverTcpParsing boolean c �
� �W In c �
� �W �W �� ID c � )
� &X �W ���W c boolean d � DisableSshParsing boolean d �
� TX In d �
� TX |X �� ID d � )
� �X |X ���X d boolean e � PlatformUpdatesChannel boolean e �
� Y In e �
� Y @Y �� ID e � )
� �Y @Y ��nY e boolean f � EngineUpdatesChannel boolean f �
� �Y In f �
� �Y Z �� ID f � )
� kZ Z ��0Z f boolean g � DefinitionUpdatesChannel boolean g �
� �Z In g �
� �Z �Z �� ID g � )
� 1[ �Z ���Z g boolean h � DisableGradualRelease boolean h �
� c[ In h �
� c[ �[ �� ID h � )
� �[ �[ ���[ h boolean i � AllowNetworkProtectionDownLevel boolean i �
� 0\ In i �
� 0\ X\ �� ID i � )
� �\ X\ ���\ i boolean j � AllowDatagramProcessingOnWinServer boolean j �
� ] In j �
� ] (] �� ID j � )
� �] (] ��V] j boolean k � Enable� � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � 3 � � C K � MSFT_CliParam The Name parameter specifies the new name. The name cannot include control characters, leading or trailing spaces, or any of the following characters: / \ [ ] : | < > + = ; , ? Name � � , � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING j , � MSFT_CliQualifier CIMTYPE $ string � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING j � � MSFT_CliQualifier Description ( The Name parameter specifies the new name. The name cannot include control characters, leading or trailing spaces, or any of the following characters: / \ [ ] : | < > + = ; , ? � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e " � MSFT_CliQualifier ID 0 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True STRING � � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING O 3 � � � � � MSFT_CliParam If the UserName parameter specifies an account name, the Password parameter must point to the password to use when connecting to the domain controller. Otherwise, this parameter must be NULL. /nPassword and Username must use a high authentication level (i.e. no less than RPC_C_AUTHN_LEVEL_PKT_PRIVACY) when they connect to winmgmt (i.e. in the call to obtain the IWbemServices interface) or SetProxyBlanket on their IWbemServices ptr. If they are local to winmgmt then this is not a concern because their authentication level is as good as RPC_C_AUTHN_LEVEL_PKT_PRIVACY as well as their client request never goes over the wire to get to the winmgmt. /nIf Password and Username are left null, the provider does not care. /nIf the provider determines that the authentication level is too low and a Password or Username has been specified then WBEM_E_ENCRYPTED_CONNECTION_REQUIRED will be returned. /nThis parameter is only used for domain renames on Windows 2000 platforms and beyond. Password # � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING j , � MSFT_CliQualifier CIMTYPE $ string f � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � * � MSFT_CliQualifier Description ( If the UserName parameter specifies an account name, the Password parameter must point to the password to use when connecting to the domain controller. Otherwise, this parameter must be NULL. /nPassword and Username must use a high authentication level (i. � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e " � MSFT_CliQualifier ID 1 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True STRING DnsSinkhole boolean k �
� �] In k �
� �] �] �� ID k � )
� P^ �] ��^ k boolean l � DisableInboundConnectionFiltering boolean l �
� �^ In l �
� �^ �^ �� ID l � )
� _ �^ ���^ l boolean m � DisableRdpParsing boolean m �
� M_ In m �
� M_ u_ �� ID m � )
� �_ u_ ���_ m boolean n � DisableNetworkProtectionPerfTelemetry boolean n �
� ` In n �
� ` H` �� ID n � )
� �` H` ��v` n boolean o � TrustLabelProtectionStatus boolean o �
� �` In o �
� �` a �� ID o � )
� ya a ��>a o boolean p � DisableFtpParsing boolean p �
� �a In p �
� �a �a �� ID p � )
� 8b �a ���a p boolean q � AllowSwitchToAsyncInspection boolean q �
� qb In q �
� qb �b �� ID q � )
� c �b ���b q boolean r � ScanScheduleOffset boolean r �
� 1c In r �
� 1c Yc �� ID r � )
� �c Yc ���c r boolean s DisableTDTFeature boolean s
� �c In s
� �c d �� ID s )
� �d d ��Fd s boolean t DisableSmtpParsing boolean t
� �d In t
� �d �d �� ID t )
� Ae �d ��e t boolean u DisableQuicParsing boolean u
� pe In u
� pe �e �� ID u )
� f �e ���e u boolean v NetworkProtectionReputationMode boolean v
� =f In v
� =f ef �� ID v )
� �f ef ���f v boolean w IntelTDTEnabled boolean w
� �f In w
� �f "g �� ID w )
� �g "g ��Pg w boolean x
AttackSurfaceReductionRules_RuleSpecificExclusions_Id string x
� �g In x
� �g h �� ID x
)
� mh h ��2h x string y AttackSurfaceReductionRules_RuleSpecificExclusions string y
� �h In y
� �h �h �� ID y )
� Ki �h ��i y string z OobeEnableRtpAndSigUpdate boolean z
� �i In z
� �i �i �� ID z )
� j �i ���i z boolean { PerformanceModeStatus boolean {
� Cj In {
� Cj kj �� �j �j 0 1 ValueMap { )
� Cj kj ���j �j ID { 6
� 4k kj ���j �j �j { boolean | QuickScanIncludeExclusions boolean |
� kk In |
� kk �k �� �k �k 0 1 ValueMap | )
� kk �k ���k �k ID | 6
� \l �k ���k �k l | boolean } RemoveScanningThreadPoolCap boolean }
� �l In }
� �l �l �� ID } )
� %m �l ���l } boolean ~ DisableCacheMaintenance boolean ~
� Ym In ~
� Ym �m �� ID ~ )
� �m �m ���m ~ boolean DisableCoreServiceECSIntegration boolean
� 'n In
� 'n On �� ID )
� �n On ��}n boolean � DisableCoreServiceTelemetry boolean �
� �n In �
� �n o �� ID � )
� �o o ��Fo � boolean � EnableUdpSegmentationOffload boolean �
� �o In �
� �o �o �� ID � )
� Kp �o ��p � boolean � " EnableUdpReceiveOffload boolean � "
� p In � "
� p �p �� ID � " )
� q �p ���p � boolean � $ Force boolean � $
� 2q In � $
� 2q Zq �� ID � $ )
� �q Zq ���q � boolean ��� � ��F
� � 0��� � <� M �� W l&=�\ � 1��
� E��� � Xj�% � �O2j� � Ct� � �
B� � �,� � 1w�� 2� ;� ,ٝ��C�� ) � �� � 5 F R � � � � U����������������W � MDM_DeviceStatus InPartition ' local-system DMWmiBridgeProv DomainName '
� � � �� � string InstanceID
� � � �� string ParentID
� � �� string SecureBootState '
� O � �� � sint32 M � -ٝ��C�� ) - � �� � C T ` � � � � $ U����������������a � MDM_DeviceStatus_Antispyware01 InPartition 5 local-system DMWmiBridgeProv InstanceID
� � � �� string ParentID
� � � �� string SignatureStatus '
� � �� � sint32 Status '
� Y � �� � sint32 M � .ٝ��C�� ) + � �� � A R ^ � � � � " U����������������_ � MDM_DeviceStatus_Antivirus01 InPartition 3 local-system DMWmiBridgeProv InstanceID
� � � �� string ParentID
� � � �� string SignatureStatus '
� � �� � sint32 Status '
� W � �� � sint32 M � /ٝ��C�5 ) ) � �� � ? P j � � � 4 > p x U���������������������� � MDM_DeviceStatus_Battery01 InPartition 1 local-system DMWmiBridgeProv EstimatedChargeRemaining '
� � � �� � sint32 EstimatedRuntime '
� � � �� � sint32 InstanceID
� , � �� string ParentID
� h � �� string Status '
� � � �� � sint32 � 0ٝ��C�? ) * 7 � �� � M ^ y � � � = I { � � � R a UU����������������������������� � MDM_DeviceStatus_CellularIdentities01_01 InPartition ? local-system DMWmiBridgeProv CommercializationOperator '
� � � �� � string ICCID '
� � � �� � string IMSI '
� 5 � �� � string InstanceID
� s � �� string ParentID
� � � �� string PhoneNumber '
� � � �� � string RoamingCompliance '
� I � �� � boolean RoamingStatus '
� � � �� � boolean � 1ٝ��C�� ) , � �� � B S i � � � � U����������! � MDM_DeviceStatus_Compliance01 InPartition 4 local-system DMWmiBridgeProv EncryptionCompliance '
� � � �� � boolean InstanceID
� � � �� string ParentID
� � �� string 01 � 3ٝ��C�w
) * � �� � @ Q ] � � � � U������������ � MDM_DeviceStatus_Firewall01 InPartition 2 local-system DMWmiBridgeProv InstanceID
� � � �� string ParentID
� � � �� string Status '
� � �� � sint32 01 � 4ٝ��C�� ) * 7 � �� � M ^ j � � � � 0 = { � � � U������������������������ � MDM_DeviceStatus_NetworkIdentifiers01_01 InPartition ? local-system DMWmiBridgeProv InstanceID
� � � �� string IPAddressV4 '
� � � �� � string IPAddressV6 '
� ( � �� � string IsConnected '
� r � �� � boolean ParentID
� � � �� string Type '
� � � �� � sint32 � 5ٝ��C�� ) $ � �� � : K T � � � � U����������������N � MDM_DeviceStatus_OS01 InPartition , local-system DMWmiBridgeProv Edition '
� � � �� � string InstanceID
� � � �� string Mode '
�
� �� � string ParentID
� F � �� string M � 6ٝ��C��
) % � �� � ; L X � � � � U������������ � MDM_DeviceStatus_TPM01 InPartition - local-system DMWmiBridgeProv InstanceID
� � � �� string ParentID
� � � �� string SpecificationVersion '
� � �� � string nP � 7ٝ��C�r
) % � �� � ; L X � � � � U������������ � MDM_DeviceStatus_UAC01 InPartition - local-system DMWmiBridgeProv InstanceID
� � � �� string ParentID
� � � �� string Status '
� � �� � sint32 nP � 8ٝ��C�� 2 ) # � �� � 9
J T � � � � ( e n � � � � . 6 s � � � � A J � � UUU������������������������������������������������ � MDM_EnterpriseAPN_01 InPartition + local-system DMWmiBridgeProv AlwaysOn
& '
� � � �� � �� boolean APNName '
� � � �� � �� string AuthType '
� � �� � �� string ClassId '
� ] � �� � �� string Enabled ( '
� � � �� � �� boolean IccId " '
� � � �� � �� string InstanceID
� & � �� string IPType '
� k � �� � �� string IsAttachAPN '
� � � �� � �� boolean ParentID
� � � �� string Password '
� 9 � �� � �� string Roaming * '
� � �� � �� string UserName '
� � � �� � �� string � �ٝ��C��
) % 2 � �� � H Y q � � � � U������������( � MDM_Policy_Config01_TaskScheduler02 InPartition : local-system DMWmiBridgeProv EnableXboxGameSaveTask '
� � � �� � �� sint32 InstanceID
� � � �� string ParentID
� � �� string ch �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� , J.3�� a � WDMClassesOfDriver MSNdis_NotifyVcArrival C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� 0 J.3�� e � WDMClassesOfDriver MSNdis_NotifyFilterRemoval C:\Windows\system32\kernelbase.dll[MofResourceName] ll.mui[MofResourceName] eName] � �� string ch � 5
� ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � 3 � � �
�
� MSFT_CliParam The Username parameter is a pointer to a constant null-terminated character string that specifies the account name to use when connecting to the domain controller. The string must specify either a domain NetBIOS name and user account (for example, "REDMOND\user") or the user principal name (UPN) of the user in the form of an Internet-style login name (for example, "someone@microsoft.com"). If this parameter is NULL, the caller's context is used. /nPassword and Username must use a high authentication level (i.e. no less than RPC_C_AUTHN_LEVEL_PKT_PRIVACY) when they connect to winmgmt (i.e. in the call to obtain the IWbemServices interface) or SetProxyBlanket on their IWbemServices ptr. If they are local to winmgmt then this is not a concern because their authentication level is as good as RPC_C_AUTHN_LEVEL_PKT_PRIVACY as well as their client request never goes over the wire to get to the winmgmt. /nIf Password and Username are left null, the provider does not care. /nIf the provider determines that the authentication level is too low and a Password or Username has been specified then WBEM_E_ENCRYPTED_CONNECTION_REQUIRED will be returned. /nThis parameter is only used for domain renames on Windows 2000 platforms and beyond. UserName % � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING j , � MSFT_CliQualifier CIMTYPE $ string e � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � ) � MSFT_CliQualifier Description ( The Username parameter is a pointer to a constant null-terminated character string that specifies the account name to use when connecting to the domain controller. The string must specify either a domain NetBIOS name and user account (for example, "REDMON � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e " � MSFT_CliQualifier ID 2 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True STRING 5 r7 �8 �9 f � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � * � MSFT_CliQualifier Description ( Renaming a computer can be performed only by a member of the Administrators local group on the computer. You cannot call this Rename function remotely for domain computers. /nPassword and Username must use a high authentication level (i.e. no less than RPC � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING n . � MSFT_CliQualifier Implemented ( True � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING k 0 � MSFT_CliQualifier ValueMap ) , 0 .. � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i 7 � MSFT_CliQualifier Values ' 0 Success Other Rename 6� � A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 ;� % 3 qV H\ _\ � MSFT_CliVerb JoinDomainOrWorkgroup The JoinDomainOrWorkgroup method joins computer systems to a domain or workgroup. This method is only available on Windows 2000 platforms and beyond. The method can return the following values:/n0 - Success./nOther - For integer values other than those listed above, refer to Win32 error code documentation./nPassword and Username must use a high authentication level (i.e. no less than RPC_C_AUTHN_LEVEL_PKT_PRIVACY) when they connect to winmgmt (i.e. in the call to obtain the IWbemServices interface) or SetProxyBlanket on their IWbemServices ptr. If they are local to winmgmt then this is not a concern because their authentication level is as good as RPC_C_AUTHN_LEVEL_PKT_PRIVACY as well as their client request never goes over the wire to get to the winmgmt. /nIf Password and Username are left null, the provider does not care. /nIf the provider determines that the authentication level is too low and a Password or Username has been specified then WBEM_E_ENCRYPTED_CONNECTION_REQUIRED will be returned. JoinDomainOrWorkgroup K � /) �5 �I g � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � 3 q | C K � MSFT_CliParam The AccountOU optionally specifies the pointer to a constant null-terminated character string that contains the RFC 1779 format name of the organizational unit (OU) for the computer account. If you specify this parameter, the string must contain a full path, for example, OU=testOU, DC=domain, DC=Domain,DC=com. Otherwise, this parameter must be NULL. AccountOU � � , � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING j , � MSFT_CliQualifier CIMTYPE $ string e � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � ) � MSFT_CliQualifier Description ( The AccountOU optionally specifies the pointer to a constant null-terminated character string that contains the RFC 1779 format name of the organizational unit (OU) for the computer account. If you specify this parameter, the string must contain a full pa � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e " � MSFT_CliQualifier ID 3 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True STRING u � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � 3 � � k s � MSFT_CliParam The FJoinOptions parameter contains a set of bit flags defining the join options. This parameter can be one or more of the following values: /nJoin Domain - Joins the computer to a domain. If this value is not specified, joins the computer to a workgroup. 0 bit - Join Domain - If not present, a workgroup is joined. /n1 bit - Acct Create - Creates the account on the domain. /n2 bit - Acct Delete - Delete the account when a domain is left. /n4 bit - Win9X Upgrade - The join operation is occurring as part of an upgrade of Windows 95/98 to Windows NT/Windows 2000. /n5 bit - Domain Join If Joined - Allows a join to a new domain even if the computer is already joined to a domain. /n6 bit - Join Unsecure - Performs an unsecured join./n7 bit - Machine Password Passed - Indicates that the machine (not user) password is passed. This option is only valid for unsecure joins /n8 bit - Deferred SPN Set - Specifies that writing SPN and DnsHostName attributes on the computer object should be deferred until the rename that will follow the join. /n18 bit - Install Invocation - The APIs were invoked during install. /nThe method returns a 0 if no options are involved. FJoinOptions � V � � = T
� � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � _ � MSFT_CliQualifier BitMap C F I L O R U X [ 0 1 2 4 5 6 7 8 18 ] � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier BitValues F S ` m | � � � � Join Domain Acct Create Acct Delete Win9X Upgrade Domain Join If Joined Join Unsecure Machine Password Passed Deferred SPN Set Install Invocation � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING j , � MSFT_CliQualifier CIMTYPE $ uint32 f � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � * � MSFT_CliQualifier Description ( The FJoinOptions parameter contains a set of bit flags defining the join options. This parameter can be one or more of the following values: /nJoin Domain - Joins the computer to a domain. If this value is not specified, joins the computer to a workgroup. � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e " � MSFT_CliQualifier ID 4 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True UINT32 � � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING
3 m s � � � MSFT_CliParam The Name parameter specifies the domain or workgroup to join. This parameter cannot be NULL. Name � � i � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING j , � MSFT_CliQualifier CIMTYPE $ string � � @ P __ �� WIN-F6NF7R6I6PJ ROOT\Microsoft\Windows\Defender ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � Add �� ���� �� implemented static & WIN-F6NF7R6I6PJ ROOT\Microsoft\Windows\Defender ���� � �� G �� + � � � � u P � o
�
� w
� � ^ � P ] � * � � �
) . � �
� � � UUUU�������������������������������������������������������������������i � __PARAMETERS abstract ExclusionPath string
� 9 In
� 9 ` �� ID )
� � ` ��� string ExclusionExtension string
� � In
� � �� ID )
� � ��L string ExclusionProcess string
� � In
� � � �� ID )
� C � �� string ExclusionIpAddress string
� q In
� q � �� ID )
� � ��� string ThreatIDDefaultAction_Ids sint64
� 6 In
� 6 ] �� ID )
� � ] ��� sint64 ThreatIDDefaultAction_Actions uint8
� � In
� � % �� s v y | � � 1 2 3 6 8 9 10 ValueMap )
� � % ��� S ID 6
� % ��� S � uint8 AttackSurfaceReductionOnlyExclusions string
� Q In
� Q x �� ID )
� � x ��� string AttackSurfaceReductionRules_Ids string
� In
� C �� ID )
� � C ��q string AttackSurfaceReductionRules_Actions uint8
� � In
� � �� W Z ] ` c 0 1 2 5 6 ValueMap )
� � ��f ? ID 6
� � ��f ? � uint8 $ ControlledFolderAccessAllowedApplications string $
� 3 In $
� 3 Z �� ID $ )
� � Z ��� string
( ControlledFolderAccessProtectedFolders string
(
� In
(
� , �� ID
( )
� � , ��Z
string , SharedSignaturesPath string ,
� � in ,
� � � �� ID , )
� U
� ��
string 0 AttackSurfaceReductionRules_RuleSpecificExclusions_Id string 0
� �
In 0
� �
�
�� ID 0 )
� 6 �
���
string
4 AttackSurfaceReductionRules_RuleSpecificExclusions string
4
� � In
4
� � � �� ID
4 )
� � ���
string 8 RemoteEncryptionProtectionExclusions string 8
� T In 8
� T { �� ID 8 )
� � { ��� string < BruteForceProtectionExclusions string <
�
In <
�
E
�� ID < )
� �
E
��s
string @ Force boolean @
� �
In @
� �
�
�� ID @ )
� ` �
��% boolean __ �� WIN-F6NF7R6I6PJ ROOT\Microsoft\Windows\Defender ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ �71B5082C266A650E31EF6D5019382724244B685F217C0AAE00A921 I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1847.3534150184.180 NS_1A8E82799C1533DB9FBAB0C0F04C00F4B58AD9F63A6874474DB57A9DDEF264A6 CD_29496EE13A50FC208C78C52B2E38D7EBB9517F3108A323CCB520DE03AFA2EB81.2251.3718534952.7330 CD_33DCEF5A25E042E234D6018C36A73BB8BD2E0A0D570AA0A57D43D363A2232E3B.2232.1.15005 CD_5125E87B865F9C6DC59486D1BB02124F8523E09293ABB2126C845245277E44EE.2250.167805008.2001 CD_90D6DB96E4E52DF3FCB751D8C2491313C169EEA2DEA2212CBFE4EFF8C0A5E947.2230.1.9836 CD_916EF6B6122453D1C58D648E96BD869758A18BA38D348DDAE67570192E8AB140.2247.1270618730.6819 CD_9E784A36A3818CCEF710DDD5C36D397926DEF1DD3DBF75F107C211B75FEBAA90.2248.1.8451 CD_A0C4181E36B5BF6BE271221B7FC9D6F392B6369BD0BAB6A546F2790003BEF7B3.2228.3486257370.1830 CD_A845C3809E8DF42635819F5D4441FC804E08EFF7CF893C7B960B207ABE392F53.2234.1.86747 CD_AD7EFADAD1289B4A3FEF0D60EBF19DD1D014EA7A1302D0431E7F57E3F564CBFB.2229.499331387.3209 CD_B77F00C0AAB396341AF90E0CBAB7DE2932BB0B2F69B6D24907BE1A641C3162D0.2254.1.10988 CD_BC8A5D3527D1BDCB19AA2B963526E673CF7D0B41B579C91C1089F6FC06405DFC.2229.3481772730.3240 CD_C793B9525D878D9706E959E8F468E81449F6D48F127A802D380F8F7D8B8795DB.2252.1.13418 CD_D7F3D9E12DEEE204449B9CAA8D3A0464D39F0FE9902E503068BD45CB162CC389.2245.1.12124 CD_EB9E795F43B762D3D38837138F4AB68D1F6C9489A93A8726D25010DC91A8FC39.2250.4275465084.3262 CD_F63E9DDBFEF6B5F00A102DFF31BE7441561DE4396AD9FF89BE26AD8D006CEB79.2229.862109618.359 CI_41C53E6DB1ACF2453CEFD41398198E613F10DFF47709ECAB1D7F037756AC8CE7 IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2098.4276468132.368 CI_FD1C1D414B71B5082C266A650E31EF6D5019382724244B685F217C0AAE00A921 IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1203.1959252033.180 CR_AD7EFADAD1289B4A3FEF0D60EBF19DD1D014EA7A1302D0431E7F57E3F564CBFB C_90D6DB96E4E52DF3FCB751D8C2491313C169EEA2DEA2212CBFE4EFF8C0A5E947 CR_BC8A5D3527D1BDCB19AA2B963526E673CF7D0B41B579C91C1089F6FC06405DFC C_AD7EFADAD1289B4A3FEF0D60EBF19DD1D014EA7A1302D0431E7F57E3F564CBFB CR_E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 C_29496EE13A50FC208C78C52B2E38D7EBB9517F3108A323CCB520DE03AFA2EB81 C_33DCEF5A25E042E234D6018C36A73BB8BD2E0A0D570AA0A57D43D363A2232E3B C_5125E87B865F9C6DC59486D1BB02124F8523E09293ABB2126C845245277E44EE C_916EF6B6122453D1C58D648E96BD869758A18BA38D348DDAE67570192E8AB140 C_9E784A36A3818CCEF710DDD5C36D397926DEF1DD3DBF75F107C211B75FEBAA90 C_A0C4181E36B5BF6BE271221B7FC9D6F392B6369BD0BAB6A546F2790003BEF7B3 CD_0DFC323CB20829C5E894EB23D45A1551C36C2D6CBC549C00B9D8952023FE2DC0.2250.12098602.2768 C_0DFC323CB20829C5E894EB23D45A1551C36C2D6CBC549C00B9D8952023FE2DC0 CD_0F988AA56217E8EB25B7DE4FB153503009567FC06222C017E84DCD1623DC5829.2251.2394654245.801 CR_0DFC323CB20829C5E894EB23D45A1551C36C2D6CBC549C00B9D8952023FE2DC0 C_0F988AA56217E8EB25B7DE4FB153503009567FC06222C017E84DCD1623DC5829 CD_E49207E0C3E41BA550956778A93F67569B375398AA2B0937EEF0E61C098A3BAA.2256.2958925334.3084 C_E49207E0C3E41BA550956778A93F67569B375398AA2B0937EEF0E61C098A3BAA CD_3893EDBA1FFE14E31D305F26A8C305A156A91E1EF7F83521E3C67BFA88E1702E.2256.591691269.950 C_3893EDBA1FFE14E31D305F26A8C305A156A91E1EF7F83521E3C67BFA88E1702E CD_1E73C355FB885E2163DC95C015545482A2598C9FF194EA43A47495D556BA0B0B.2256.706916242.1213 C_1E73C355FB885E2163DC95C015545482A2598C9FF194EA43A47495D556BA0B0B CD_E60EF1B207B541A3969FE52605168C53DE4EA7E5A1D37600D0478D235286E6BE.2256.2063248128.951 CD_9EA1914F1B3969D0904DC11AB6E8C7BAC75F195080FB4370BDA5C6102822240F.2256.3391165489.466 C_9EA1914F1B3969D0904DC11AB6E8C7BAC75F195080FB4370BDA5C6102822240F CD_C817DD8C4529B1D43D8C1DAC084B54DB9AB1718E7FD5F201164920A53BE23ADD.2256.909635188.819 CD_A81E4033C09F5F8E3B3660FFFCB2BDD5A79334D687873FAF6A85B55A7F0A7A5A.2256.3605444679.470 C_A81E4033C09F5F8E3B3660FFFCB2BDD5A79334D687873FAF6A85B55A7F0A7A5A CD_5872AF16FB59CA1F21F2D919AFAC7561AC0FBDAA19BFF7FE9364C3663EA2969D.254.359606174.374 C_5872AF16FB59CA1F21F2D919AFAC7561AC0FBDAA19BFF7FE9364C3663EA2969D I_A41A2A506F07DE19FA26EBBA5A53B62D2C62BAF775EC8BEA2B152B5D21A711E3.1847.314782136.339 KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD I_C2E2D7F294A39E950FCB0FE91EB41D6C66630273B2EF4990C97F60DB582F2E17.1847.2684313436.278 R_7F0C45BECF0AE38ABEC381EFAA7EA36E4140C97C5F097E86E0524E666D767CEA.1847.2724232345.562 R_BB27EFE66C80515ACDA70B8D93AC3E041408A503B4091461E3CAAE9E0BE7A5DB.3547.2766200725.560 KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C I_C2E2D7F294A39E950FCB0FE91EB41D6C66630273B2EF4990C97F60DB582F2E17.1384.1608759806.302 MS_SmBios A � �� � ! ��& , T _ u } � � L R U��������������� � MSSmBios_Sysid1394List WMIProv WMI guid {8F680855-A584-11d1-BF38-00A0C9062910} GuidName1 SYSID_1394_DATA_GUID Active
� � � �� boolean Count )
� � � � �� uint32 WmiDataId InstanceName '
� D � �� � �� string List
6
� � � � � � �� object:MSSmBios_Sysid1394 WmiDataId WmiSizeIs Count oo � �jj��= �� � MSMCAInfo abstract AI �9 A B 5 3 8 0 6 E 8 8 6 6 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0 S�b��5� ͝��C�l -e3 �5��� K � WMIBinaryMofResource C:\Windows\System32\Drivers\portcls.SYS[PortclsMof] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� % *!!�2�� _ � WDMClassesOfDriver HDAudioBus_Enum C:\Windows\System32\drivers\HDAudBus.sys[HDAudioMofName] B 2 1 4 E F E C 4 2 4 D 2 B 0 \ K I _ E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C \ I _ C 2 E 2 D 7 F 2 9 4 A 3 9 E 9 5 0 F C B 0 F E 9 1 E B 4 1 D 6 C 6 6 6 3 0 2 7 3 B 2 E F 4 9 9 0 C 9 7 F 6 0 D B 5 8 2 F 2 E 1 7 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� % *!!�2�� _ � WDMClassesOfDriver HDAudioBus_Enum C:\Windows\System32\drivers\HDAudBus.sys[HDAudioMofName] 9 0 C 9 7 F 6 0 D B 5 8 2 F 2 E 1 7 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� % *!!�2�� _ � WDMClassesOfDriver HDAudioBus_Enum C:\Windows\System32\drivers\HDAudBus.sys[HDAudioMofName] [MofResourceName] 2 F 2 E 1 7 7 4 9 9 0 C 9 7 F 6 0 D B 5 8 2 F 2 E 1 7 �& o��C�{/ n ) � �� � ) � 1 U } � � � / W z � � � x � � � R y � � u � � � 0 W � � � i � � � A p � � � V n � � � � 1 Y r � � � �
=
e
�
�
�
�
4 N v � � � � * A i } � � �
/
V
~
�
�
�
�
1 L t � � � � ' O l � � � � " J c � � � � H b � � � � & N d � � � < Z � � > R y � � � � � # A i � � . F � � 8 ` } � 8 S { � � � d q � � � � e � � � 3 [ r � � ` y � � " M � � � F c � � � � A h � � � � � ' 7 � � � � X! l! �! �! �! �! " ." U" r" �" �" '# =# d# �# �# �# �# $ A$ ^$ �$ �$ �$ % .% F% m% �% �% �% G& ^& �& �& �& �& ' $' �' �' ( .( U( s( �( �( �( �( ) .) PUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUu�) �������������������� ������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������) � MSFT_MpPreference ProtectionManagement locale AllowDatagramProcessingOnWinServer k
� t boolean AllowNetworkProtectionDownLevel j
� � boolean AllowNetworkProtectionOnWinServer X �
� boolean AllowSwitchToAsyncInspection s "
� N boolean ApplyDisableNetworkScanningToIOAV > �
� � boolean AttackSurfaceReductionOnlyExclusions M �
� � string AttackSurfaceReductionRules_Actions O �
� @ G Q uint8 ValueMap i l o r u 0 1 2 5 6 AttackSurfaceReductionRules_Ids N �
� � string AttackSurfaceReductionRules_RuleSpecificExclusions { 8
� string AttackSurfaceReductionRules_RuleSpecificExclusions_Id z 4
� q string BruteForceProtectionAggressiveness /
� � � � uint8 ValueMap � � � 0 1 2 BruteForceProtectionConfiguredState *
� D K U uint8 ValueMap i l o r 0 1 2 4 BruteForceProtectionExclusions 0
� � string BruteForceProtectionLocalNetworkBlocking 4
� boolean BruteForceProtectionMaxBlockTime +
� O uint32 BruteForceProtectionSkipLearningPeriod 6
� � boolean CheckForSignaturesBeforeRunningScan K
� � boolean CloudBlockLevel I �
� 1 8 B uint8 ValueMap Z ] ` c f 0 1 2 4 6 CloudExtendedTimeout J �
� � uint32 ComputerID '
� � � �� � �� string ControlledFolderAccessAllowedApplications P �
� 9 string ControlledFolderAccessDefaultProtectedFolders R �
� � string ControlledFolderAccessProtectedFolders Q �
� � string DefinitionUpdatesChannel h
� , 3 = uint8 ValueMap M P S 0 4 5 DisableArchiveScanning 6 �
� � boolean DisableAutoExclusions
� � boolean DisableBehaviorMonitoring 2 �
� boolean DisableBlockAtFirstSeen H �
� P boolean DisableCacheMaintenance ~ ?
� � boolean DisableCatchupFullScan 7 �
� � boolean DisableCatchupQuickScan 8 �
�
boolean DisableCoreServiceECSIntegration � D
� \
boolean DisableCoreServiceTelemetry � F
� �
boolean DisableCpuThrottleOnIdleScans [ �
� �
boolean DisableDatagramProcessing Y �
� + boolean DisableDnsOverTcpParsing d
� m boolean DisableDnsParsing c
� � boolean DisableEmailScanning 9 �
� � boolean DisableFtpParsing r
� ! boolean DisableGradualRelease i
� ` boolean DisableHttpParsing b
� � boolean DisableInboundConnectionFiltering m
� � boolean DisableIOAVProtection 3 �
� &
boolean DisableNetworkProtectionPerfTelemetry o
� u
boolean DisablePrivacyMode / �
� �
boolean DisableQuicParsing w ,
� �
boolean DisableRdpParsing n
� ( boolean DisableRealtimeMonitoring 4 �
� k boolean DisableRemovableDriveScanning : �
� � boolean DisableRestorePoint ; �
� � boolean DisableScanningMappedNetworkDrivesForFullScan < �
� F boolean DisableScanningNetworkFiles = �
� � boolean DisableScriptScanning 5 �
� � boolean DisableSmtpParsing v *
� boolean DisableSshParsing e
� A boolean DisableTamperProtection u (
� � boolean DisableTlsParsing a �
� � boolean EnableControlledFolderAccess L �
� ! uint8 ValueMap 9 < ? B E 0 1 2 3 4 EnableConvertWarnToBlock Z �
� � boolean EnableDnsSinkhole l
� � boolean EnableFileHashComputation V �
� � boolean EnableFullScanOnBatteryPower \ �
� E boolean EnableLowCpuPriority U �
� � boolean EnableNetworkProtection K �
� � � � uint8 ValueMap � � � 0 1 2 EnableUdpReceiveOffload � J
� 3 boolean EnableUdpSegmentationOffload � H
� y boolean EngineUpdatesChannel g
� � � � uint8 ValueMap � � � � � 0 2 3 4 5 6 ExclusionExtension
� 6 string ExclusionIpAddress
� q string ExclusionPath
� � string ExclusionProcess
� � string ForceUseProxyOnly ` �
� boolean HideExclusionsFromLocalUsers q
� ` boolean HighThreatDefaultAction E �
� � � � uint8 ValueMap � � � � � � � 1 2 3 6 8 9 10 IntelTDTEnabled y 2
� % boolean LowThreatDefaultAction C �
� r y � uint8 ValueMap � � � � � � � 1 2 3 6 8 9 10 MAPSReporting - �
� � � uint8 ValueMap 0 1 2 MeteredConnectionUpdates W �
� W boolean ModerateThreatDefaultAction D �
� � � � uint8 ValueMap � � � � � � � 1 2 3 6 8 9 10 NetworkProtectionReputationMode x .
� 0 uint32 OobeEnableRtpAndSigUpdate | <
� r boolean PerformanceModeStatus } >
� � � � uint8 ValueMap � � 0 1 PlatformUpdatesChannel f
� % , 6 uint8 ValueMap R U X [ ^ a 0 2 3 4 5 6 ProxyBypass _ �
� � string ProxyPacUrl ] �
� � string ProxyServer ^ �
� � str�y� � ��/� * ?� � Ư��� l m� G � ��n� � ��ٜ p Ի
+ ����7 S
��l� ��
� :
B a s e S t a t u s _��C�� " BaseStatus ) � �� � %
- 9 � 3 = p { � � 9 H z � � C O � � TUp� ����������������������� � MSFT_MpThreat ProtectionManagement locale CategoryID )
� p w � � �� uint8 ValueMap . = @ C F I L O R W Z ^ b f j n r v z ~ � � � � � � � � � � � � � � � � � � � � � � � � � � � 0 1 2 3 4 5 6 7,8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 36 37 38 39 40 42 43 44 45 46 47 48 DidThreatExecute
� * � �� boolean IsActive
� g � �� boolean Resources
� � � �� string RollupStatus )
� � � � �� uint32 BitMap " % ( + . 1 5 0 1 2 4 8 16 32 SchemaVersion
� r � �� string SeverityID )
� � � � � �� uint8 ValueMap � � � � � � 0 1 2 3 4 5 ThreatID '
� ; � �� � �� sint64 ThreatName
� y � �� string TypeID )
� � � � � �� uint8 ValueMap � � � � � 0 1 2 3 4 1.0.0.0 � 7 ; � � Remove " ��/ �� implemented static � ae442007200009F ROOT\Microsoft\Windows\Defender ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ �
B a s e S t a t u s `��C�� BaseStatus ) � �� � , 4 @ � w � � � � U����������������s � MSFT_MpThreatCatalog ProtectionManagement locale CategoryID
)
� w ~ � � �� uint8 ValueMap . D G J M P S V Y ^ a e i m q u y } � � � � � � � � � � � � � � � � � � � � � � � � � � � � � 0 1 2 3 4 5 6 7,8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 36 37 38 39 40 42 43 44 45 46 47 48 SeverityID )
� 8 ? I � �� uint8 ValueMap e h k n q t 0 1 2 3 4 5 ThreatID '
� � � �� � �� sint64 ThreatName
� � � �� string TypeID )
� ; B L � �� uint8 ValueMap d g j m p 0 1 2 3 4 lo �
B a s e S t a t u s a��C�� : BaseStatus ) � �� � . 6 E x � t � � � M m � � & = � � P l � � � � $ / a k � � � UUUA��������������������������������������������� ����� � MSFT_MpThreatDetection ProtectionManagement locale ActionSuccess 0
� o � �� boolean AdditionalActionsBitMask 2 )
� � � � � �� uint32 ValueMap " % ( , 0 4 8 < C J Q X _ f m 0 4 8 12 16 20 24 28 32768 32772 32776 32780 32784 32788 32792 32796 AMProductVersion
,
� � � �� string CleaningActionID + )
� � �� uint8 BitMap 4 7 : = @ C F I 0 1 2 3 6 8 9 10 CurrentThreatExecutionStatusID % )
� � � � � �� uint8 ValueMap � � � � � 0 1 2 3 4 DetectionID '
� � �� � �� string DetectionSourceTypeID )
� t { � � �� uint8 ValueMap � � � � � � � � � 0 1 2 3 4 5 7 8 9 DomainUser
� � � �� string InitialDetectionTime e
� F � �� datetime LastThreatStatusChangeTime e
� � � �� datetime ProcessName
� � � �� string RemediationTime e !
� � �� datetime Resources
� Y � �� string ThreatID '
� � � �� � �� sint64 ThreatStatusErrorCode '
� � � �� sint32 ThreatStatusID
& )
� 8 ? I � �� uint8 ValueMap
� � � � � � � � � � � � � 0 1 2 3 4 5 6 Blocked 102 103 104 105 107 � b��C�p ) � �� � & . � MSFT_MpWDOScan ProtectionManagement locale � 6 : � � Start ! ��. �� implemented static � ae442007200009F ROOT\Microsoft\Windows\Defender ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ �6 4 6 5 9 A B 9 F 8 F 1 C 4 B 5 6 8 D B 6 4 3 8 B A E 1 1 B 2 6 E E 8 F 9 3 C B 5 F 8 1 9 5 E 2 1 E 8 C 3 8 3 D 6 C 4 4 C C 4 1 c��C�ȝ��C�:
# � __NAMESPACE protectionManagement F D 1 C 1 D 4 1 4 B 7 1 B 5 0 8 2 C 2 6 6 A 6 5 0 E 3 1 E F 6 D 5 0 1 9 3 8 2 7 2 4 2 4 4 B 6 8 5 F 2 1 7 C 0 A A E 0 0 A 9 2 1 d��C�Cȝ��C�$ � __SystemSecurity 4 1 C 5 3 E 6 D B 1 A C F 2 4 5 3 C E F D 4 1 3 9 8 1 9 8 E 6 1 3 F 1 0 D F F 4 7 7 0 9 E C A B 1 D 7 F 0 3 7 7 5 6 A C 8 C E 7 f��C�ȝ��C�� � � __thisNAMESPACE � �� � � ? I m a g e _ V 2 ��jj��
Image_V2
� �� < I G������������� � LoaderBaseEvent EventType � � � � � � � BaseAddress 6
� � � � � � �� uint64 WmiDataId format x �5 7 E 5 F 3 A D D 9 E 2 4 2 C 4 E 9 F 9 E D F 7 9 A A 9 7 F 7 9 E 7 9 1 1 C 5 A 8 B 9 0 2 E C 1 5 0 D 6 4 4 2 E 3 B 8 5 A 5 A A צn�^��ȝ��C�� �����K @ 9 a � __Win32Provider {A7C452EF-8E9F-42EB-9F2B-245613CA0DC9} LocalServiceHost ProtectionManagement 7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D ئn�^��
ȝ��C�� s � __MethodProviderRegistration \\.\root\Microsoft\ProtectionManagement:__Win32Provider.Name="ProtectionManagement" # R O O T \ M i c r o s o f t \ P r o t e c t i o n M a n a g e m e n t _ _ M e t h o d P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ B 6 7 9 1 A 1 C F 7 8 0 2 A 9 0 1 B 1 5 3 4 C A D B B 1 A 0 E 8 2 F B 1 5 4 1 0 0 B 2 B E 0 8 A F 4 7 3 8 6 C 4 3 C E C 4 6 2 A \ K I _ 7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D \ I _ E 8 B 0 A E 6 6 5 C C 1 B 0 C A 8 3 C 8 A 4 2 3 B 1 9 4 2 F 6 0 D 1 F 2 C 8 F 5 D B 0 B 8 0 4 5 F C D A E C 2 6 A 2 6 9 E 1 C 6 2 6 9 E 1 C 6 �# ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � MSFT_CliQualifier Description ( The Name parameter specifies the domain or workgroup to join. This parameter cannot be NULL. � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e " � MSFT_CliQualifier ID 0 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True STRING � � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING J 3 � � d l � MSFT_CliParam If the UserName parameter specifies an account name, the Password parameter must point to the password to use when connecting to the domain controller. Otherwise, this parameter must be NULL. /nPassword and Username must use a high authentication level (i.e. no less than RPC_C_AUTHN_LEVEL_PKT_PRIVACY) when they connect to winmgmt (i.e. in the call to obtain the IWbemServices interface) or SetProxyBlanket on their IWbemServices ptr. If they are local to winmgmt then this is not a concern because their authentication level is as good as RPC_C_AUTHN_LEVEL_PKT_PRIVACY as well as their client request never goes over the wire to get to the winmgmt. /nIf Password and Username are left null, the provider does not care. /nIf the provider determines that the authentication level is too low and a Password or Username has been specified then WBEM_E_ENCRYPTED_CONNECTION_REQUIRED will be returned. Password � � 6 M � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING j , � MSFT_CliQualifier CIMTYPE $ string f � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � * � MSFT_CliQualifier Description ( If the UserName parameter specifies an account name, the Password parameter must point to the password to use when connecting to the domain controller. Otherwise, this parameter must be NULL. /nPassword and Username must use a high authentication level (i. � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e " � MSFT_CliQualifier ID 1 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True STRING � � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING �
3 � � e
m
� MSFT_CliParam The Username parameter is a pointer to a constant null-terminated character string that specifies the account name to use when connecting to the domain controller. The string must specify either a domain NetBIOS name and user account (for example, "REDMOND\user") or �絰 q�� D�}_�
O L�}6 < @�Y �Q�_ ӱ�p A �.��� 8 X;� 2 L̠p > �=�4 �q ) � �� � ' / � MSFT_MpRollback ProtectionManagement locale � 6 � j � Start ! ��. �� implemented static � WIN-F6NF7R6I6PJ ROOT\Microsoft\Windows\Defender ���� � �6 �� * � � B ����� � __PARAMETERS abstract Engine boolean
� 2 In
� 2 Z �� ID )
� � Z ��� boolean Platform boolean
� � In
� � �� ID )
� y ��> boolean __ �� WIN-F6NF7R6I6PJ ROOT\Microsoft\Windows\Defender ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � �=�4 �q ) � �� � ' / � MSFT_MpRollback ProtectionManagement locale � 6 � r � Start ! ��. �� implemented static � WIN-F6NF7R6I6PJ ROOT\Microsoft\ProtectionManagement ���� � �6 �� * � � B ����� � __PARAMETERS abstract Engine boolean
� 2 In
� 2 Z �� ID )
� � Z ��� boolean Platform boolean
� � In
� � �� ID )
� y ��> boolean __ �� WIN-F6NF7R6I6PJ ROOT\Microsoft\ProtectionManagement ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ �
I I S _ C g i _ T r a n s >�4 �
IIS_Cgi_Trans ) � ��
) 4 _������������� � W3CGIEnd EventType EventLevel ContextId
A
� � � � � � �� � �� object WmiDataId extension Guid ActivityID � I I S _ R e w r i t e _ T r a n s �5h�b � IIS_Rewrite_Trans ] � �� + 8 R ] l | � � � � F Q � � � [ i _������������������������3 � RewriteAction DisplayName RewriteAction Description Rewrite action performed EventType EventTypeName REWRITE_ACTION EventLevel locale MS\0x409 AppendQueryString 6
� � � � �� boolean WmiDataId Description True if the Query String was appended or preserved ContextId
N
� � � � � � � � �� � �� object WmiDataId Description Context ID extension Guid ActivityID LogRewrittenURL 6
� K T _ l � �� boolean WmiDataId Description True if the rewritten URL must be logged RewriteURL P
� - @ P X � �� string WmiDataId Description Rewrite URL StringTermination NullTerminated Format w Substitution P
� � � � � ( 0 � �� string WmiDataId Description Format used to build the URL StringTermination NullTerminated Format w � I I S _ R e w r i t e _ T r a n s �5h�b �� IIS_Rewrite_Trans ] � �� - : U
` o � � � � � K V � \ i # 1 _��������������������������� � RedirectAction DisplayName RedirectAction Description Redirect action performed EventType EventTypeName REDIRECT_ACTION EventLevel locale MS\0x409 AppendQueryString 6
� � � � �� boolean WmiDataId Description True if the Query String was appended or preserverd ContextId
N
� � � � � � � � �� � �� object WmiDataId Description Context ID extension Guid ActivityID RedirectType ]
� t | � � � � J U � �� uint32 WmiDataId ValueDescriptions � � � � Permanent Found SeeOther Temporary ValueMap � � � 301 302 303 307 Values # . 5 ? Permanent Found SeeOther Temporary ValueType index RedirectURL P
� � � � � � � �� string WmiDataId Description Redirect URL StringTermination NullTerminated Format w Substitution P
� � � � � � � � � � �� string WmiDataId Description Format used to build the URL StringTermination NullTerminated Format w �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 Φn�^��
͝��C�� &
��2�� ^ � WDMClassesOfDriver ProcessorAcpiTsd C:\Windows\System32\drivers\processr.sys[PROCESSORWMI] 0 8 9 9 3 0 7 4 0 8 A 3 2 0 4 0 A 6 D A 1 9 C 0 B 1 E C 2 7 4 5 A 3 D 6 0 4 B A A 9 D F F E 8 E E 4 B 7 5 C 3 D 9 1 E 1 6 1 0 9 ٦n�^��ȝ��C�� A � � __EventProviderRegistration % select * from MSFT_MpEvent \\.\root\Microsoft\ProtectionManagement:__Win32Provider.Name="ProtectionManagement" # R O O T \ M i c r o s o f t \ P r o t e c t i o n M a n a g e m e n t _ _ E v e n t P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ B 6 7 9 1 A 1 C F 7 8 0 2 A 9 0 1 B 1 5 3 4 C A D B B 1 A 0 E 8 2 F B 1 5 4 1 0 0 B 2 B E 0 8 A F 4 7 3 8 6 C 4 3 C E C 4 6 2 A \ K I _ 0 8 9 9 3 0 7 4 0 8 A 3 2 0 4 0 A 6 D A 1 9 C 0 B 1 E C 2 7 4 5 A 3 D 6 0 4 B A A 9 D F F E 8 E E 4 B 7 5 C 3 D 9 1 E 1 6 1 0 9 \ I _ E 8 B 0 A E 6 6 5 C C 1 B 0 C A 8 3 C 8 A 4 2 3 B 1 9 4 2 F 6 0 D 1 F 2 C 8 F 5 D B 0 B 8 0 4 5 F C D A E C 2 6 A 2 6 9 E 1 C 6 E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C ڦn�^�� ȝ��C�� � �������� u � __InstanceProviderRegistration \\.\root\Microsoft\ProtectionManagement:__Win32Provider.Name="ProtectionManagement" # R O O T \ M i c r o s o f t \ P r o t e c t i o n M a n a g e m e n t _ _ I n s t a n c e P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ B 6 7 9 1 A 1 C F 7 8 0 2 A 9 0 1 B 1 5 3 4 C A D B B 1 A 0 E 8 2 F B 1 5 4 1 0 0 B 2 B E 0 8 A F 4 7 3 8 6 C 4 3 C E C 4 6 2 A \ K I _ E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C \ I _ E 8 B 0 A E 6 6 5 C C 1 B 0 C A 8 3 C 8 A 4 2 3 B 1 9 4 2 F 6 0 D 1 F 2 C 8 F 5 D B 0 B 8 0 4 5 F C D A E C 2 6 A 2 6 9 E 1 C 6 C 6 6 A
� � � � � � �� � �� object WmiDataId extension Guid ActivityID �ourceName] the user principal name (UPN) of the user in the form of an Internet-style login name (for example, "someone@microsoft.com"). If this parameter is NULL, the caller's context is used. /nPassword and Username must use a high authentication level (i.e. no less than RPC_C_AUTHN_LEVEL_PKT_PRIVACY) when they connect to winmgmt (i.e. in the call to obtain the IWbemServices interface) or SetProxyBlanket on their IWbemServices ptr. If they are local to winmgmt then this is not a concern because their authentication level is as good as RPC_C_AUTHN_LEVEL_PKT_PRIVACY as well as their client request never goes over the wire to get to the winmgmt. /nIf Password and Username are left null, the provider does not care. /nIf the provider determines that the authentication level is too low and a Password or Username has been specified then WBEM_E_ENCRYPTED_CONNECTION_REQUIRED will be returned. UserName � � 7 N � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING j , � MSFT_CliQualifier CIMTYPE $ string e � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � ) � MSFT_CliQualifier Description ( The Username parameter is a pointer to a constant null-terminated character string that specifies the account name to use when connecting to the domain controller. The string must specify either a domain NetBIOS name and user account (for example, "REDMON � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e " � MSFT_CliQualifier ID 2 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True STRING �V �X Z -[ g � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � + � MSFT_CliQualifier Description ( The JoinDomainOrWorkgroup method joins computer systems to a domain or workgroup. This method is only available on Windows 2000 platforms and beyond. The method can return the following values:/n0 - Success./nOther - For integer values other than those lis � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING n . � MSFT_CliQualifier Implemented ( True � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING k 0 � MSFT_CliQualifier ValueMap ) , 0 .. � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i 7 � MSFT_CliQualifier Values ' 0 Success Other JoinDomainOrWorkgroup ing PUAProtection G �
� ; B L uint8 ValueMap \ _ b 0 1 2 QuarantinePurgeItemsAfterDelay
� � uint32 QuickScanIncludeExclusions A
� � � uint8 ValueMap 0 1 RandomizeScheduleTaskTimes 0 �
� R boolean RealTimeScanDirection
� � � � uint8 ValueMap � � � 0 1 2 RemediationScheduleDay
� uint8 ValueMap E H K N Q T W Z ] 0 1 2 3 4 5 6 7 8 RemediationScheduleTime e
� � datetime RemoteEncryptionProtectionAggressiveness %
� � � uint8 ValueMap 0 1 2 RemoteEncryptionProtectionConfiguredState
� y � � uint8 ValueMap � � � � 0 1 2 4 RemoteEncryptionProtectionExclusions
&
� � string RemoteEncryptionProtectionMaxBlockTime !
� > uint32 RemoveScanningThreadPoolCap � B
� � boolean ReportDynamicSignatureDroppedEvent H
� � boolean ReportingAdditionalActionTimeOut 8
� uint32 ReportingCriticalFailureTimeOut <
� ` uint32 ReportingNonCriticalTimeOut @
� � uint32 ScanAvgCPULoadFactor J
� � uint8 ScanOnlyIfIdleEnabled Q
� boolean ScanParameters S
� c j t uint8 ValueMap � � 1 2 ScanPurgeItemsAfterDelay M
� � uint32 ScanScheduleDay T
� ! ! ! uint8 ValueMap =! @! C! F! I! L! O! R! U! 0 1 2 3 4 5 6 7 8 ScanScheduleOffset t $
� �! uint32 ScanScheduleQuickScanTime e U
� �! datetime ScanScheduleTime e Y
� " datetime SchedulerRandomizationTime 1 �
� M" uint32 ServiceHealthReportInterval D
� �" uint32 SevereThreatDefaultAction F �
� �" �" �" uint8 ValueMap # # # # # # ## 1 2 3 6 8 9 10 SharedSignaturesPath S �
� \# string SharedSignaturesPathUpdateAtScheduledTimeOnly T �
� �# boolean SignatureAuGracePeriod # c
� �# uint32 SignatureBlobFileSharesSources + ~
� 9$ string SignatureBlobUpdateInterval , �
� }$ uint32 SignatureDefinitionUpdateFileSharesSources $ g
� �$ string SignatureDisableUpdateOnStartupWithoutEngine % k
� %% boolean SignatureFallbackOrder & m
� e% string SignatureFirstAuGracePeriod " _
� �% uint32 SignatureScheduleDay ' q
� �% �% & uint8 ValueMap ,& /& 2& 5& 8& ;& >& A& D& 0 1 2 3 4 5 6 7 8 SignatureScheduleTime e ( r
� }& datetime SignatureUpdateCatchupInterval ) v
� �& uint32 SignatureUpdateInterval * z
� ' uint32 SubmitSamplesConsent . �
� P' W' a' uint8 ValueMap u' x' {' ~' 0 1 2 3 ThreatIDDefaultAction_Actions A �
� �' �' �' uint8 ValueMap �' ( ( ( ( ( ( 1 2 3 6 8 9 10 ThreatIDDefaultAction_Ids @ �
� M( sint64 ThrottleForScheduledScanOnly ! ]
� �( boolean TrustLabelProtectionStatus p
� �( uint32 UILockdown ? �
� ) boolean UnknownThreatDefaultAction B �
� Z) a) k) uint8 ValueMap �) �) �) �) �) �) �) 1 2 3 6 8 9 10 J� 4 � �� �� �� h� �� � 2� `� ��� Set ��, �� implemented static �� WIN-F6NF7R6I6PJ ROOT\Microsoft\ProtectionManagement ���� � �k� j ��� �] 5^ �\ e] �M mN ,c �c V5 �5 �E F G H RF �F !j �j @i �i � � < � � =
�
� ^ c � 1A B _B �B _H �H 4I �I �Z �[ / �/ * � 5+ �+ l@ �@ �n Eo �/ M0 �0 1 �o p ep �p LP �P �N 4O W wW DV �V d1 �1 mb �b '\ �\ �U �U F_ �_ �+ x, �, ;- �` Ua �( U) �f fg ` �` �- . &2 �2 �2 `3 �3 ;4 �4 5 T. �. 8f �f �W 6X se �e �d !e �T 2U GD %E �O �O �^ �^ cL �L Q �Q �K L C �C �q kr .q �q �Y �Z � � � U d � �r s T sT �< �= �h �h 5: ; �& ^' *M �M y; e< �g 2h �j tk �k �l �X gY OS �S �Q GR �R �R N? @ � W �l �m �) * � q � � � � �
� � 2 � ' � n �n � S � + | � G � � � i � v 4 � � � �c cd � � S o* �* � > �> J uJ �J OK 7 � I$ �$ �% L& � ~ � W � ! p � k! ]" �" ,# # �# % �% �' �( �7 �8 �6 Q7 � �a b %6 �6 �8 �9 UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU�����������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������^s � __PARAMETERS abstract DisableAutoExclusions boolean
� A In
� A i �� ID )
� � i ��� boolean ExclusionPath string
� � In
� � # �� ID )
� � # ��Q string ExclusionExtension string
� � In
� � � �� ID )
� J � �� string
ExclusionProcess string
� v In
� v � �� ID
)
� � ��� string ExclusionIpAddress string
� 4 In
� 4 [ �� ID )
� � [ ��� string QuarantinePurgeItemsAfterDelay uint32
� � In
� � % �� ID )
� � % ��S uint32 RealTimeScanDirection uint8
� � In
� � � �� # & ) 0 1 2 ValueMap )
� � � ��, ID 6
� � � ��, m uint8 RemediationScheduleDay uint8
� � In
� � �� b e h k n q t w z 0 1 2 3 4 5 6 7 8 ValueMap )
� � ��} : ID 6
� ��} : � uint8 e RemediationScheduleTime datetime e
� 8 In e
� 8 a �� ID e )
� � a ��� datetime RemoteEncryptionProtectionConfiguredState uint8
� In
� 7 �� y | � 0 1 2 4 ValueMap )
� 7 ��� e ID 6
� 7 ��� e � uint8
RemoteEncryptionProtectionMaxBlockTime uint32
� O In
� O v �� ID
2��(� �[� L ���8 ��l@
g �;Ö� � �� �r � ʻ�r� l ��Ǖe � ��2) � �t]� � ��� } �6� � X e S q l P k g _ x t p _ c r e a t e _ p r o c e d u r e �S��7 �� ' XeSqlPkg_xtp_create_procedure ) � �� ! / ; � � < H � �
� � W���������������������������� � xtp_create_procedure EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� ) 1 � �� uint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId object_id )
� � � �� uint32 WmiDataId RemainingLength 6
� b j u � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �S��7 �$ XeSqlPkg
C � �� ' W ] � � � � c����� � XeSqlPkg_xtp_deploy_done Description Occurs at completion of XTP object deployment. Guid {e58d2740-0db4-49c7-b8c7-55ed1804d19c} locale MS\0x409 DisplayName xtp_deploy_done � X e S q l P k g _ x t p _ d e p l o y _ d o n e �S��7 �� " XeSqlPkg_xtp_deploy_done ) � �� * 6 � � 7 C � � � � W���������������������������� � xtp_deploy_done EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� $ , � �� uint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId object_id )
� � � � �� uint32 WmiDataId RemainingLength 6
� ] e p } � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �S��7 �? XeSqlPkg
C � ��# 0 i o � � � � c����� � XeSqlPkg_xtp_storage_table_create Description Occurs at just before the XTP storage table is created. Guid {179C98A0-5A68-47F9-81F3-A2ABB608C660} locale MS\0x409 DisplayName xtp_storage_table_create �! X e S q l P k g _ x t p _ s t o r a g e _ t a b l e _ c r e a t e �S��7 �q + XeSqlPkg_xtp_storage_table_create # ) � �� % 3 ? � � @ L � � B R W�������������������������� � xtp_storage_table_create EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� - 5 � �� uint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� $ 1 � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �S��7 �_ XeSqlPkg
C � ��3 @ y � � � � c����� � XeSqlPkg_natively_compiled_proc_execution_started Description Fired before a natively compiled procedure is executed. Guid {4adf8b3d-f931-483d-b57d-b94885a52689} locale MS\0x409 DisplayName natively_compiled_proc_execution_started �1 X e S q l P k g _ n a t i v e l y _ c o m p i l e d _ p r o c _ e x e c u t i o n _ s t a r t e d �S��7 �� ; XeSqlPkg_natively_compiled_proc_execution_started 3 ) � ��* 5 C O � P \ � � ! 2 � � W����������������������������+ � natively_compiled_proc_execution_started EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� = E � �� uint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId object_id )
� � �� uint32 WmiDataId RemainingLength 6
� v ~ � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �S��7 �� XeSqlPkg
C � ��> K � � � � � � c����- � XeSqlPkg_before_natively_compiled_proc_entry_removal_on_drop Description Fired before the procedure cache entry is flushed when dropping a natively compiled procedure. Guid {d4ba6205-0fc9-4fa5-b279-b2bc50ac8c47} locale MS\0x409 DisplayName before_natively_compiled_proc_entry_removal_on_drop �< X e S q l P k g _ b e f o r e _ n a t i v e l y _ c o m p i l e d _ p r o c _ e n t r y _ r e m o v a l _ o n _ d r o p �S��7 � F XeSqlPkg_before_natively_compiled_proc_entry_removal_on_drop > ) � ��5 @ N Z [ g � � , = � � W����������������������������6 � before_natively_compiled_proc_entry_removal_on_drop EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� H P � �� uint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId object_id )
� ! � �� uint32 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� & � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �S��7 �� XeSqlPkg
C � ��= J � � � � � � c����* � XeSqlPkg_after_natively_compiled_proc_entry_removal_on_drop Description Fired after the procedure cache entry is flushed when dropping a natively compiled procedure. Guid {2a889a49-3cf4-4e56-abc7-36d95e2bac83} locale MS\0x409 DisplayName after_natively_compiled_proc_entry_removal_on_drop � X e S q l P k g �W��7 �U XeSqlPkg
C � ��) 6 y � � � � c����� � XeSqlPkg_check_batch_execution_complete Description Event fired to indicate that a batch of objects has been checked. Guid {ef68d13b-06b3-42d3-847f-b63866e2f9bf} locale MS\0x409 DisplayName check_batch_execution_complete �4 3 C 8 6 C 3 E 5 B 2 B 7 F 1 D D 0 4 4 3 A 6 D A 4 E 1 7 A A 9 5 D 6 5 F 5 6 E E 0 C 1 9 C F 4 F D 3 B 5 D 9 A 5 F 6 3 C 5 2 2 A<K�]�u͝��C�q 0 9 �� P � HNet_Connection {C0781781-644C-4CF8-A31C-56E74AB1CB46} Local Area Connection �L � A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 �J ' 1 J �9 �? �? � MSFT_CliVerb UnjoinDomainOrWorkgroup The UnjoinDomainOrWorkgroup method un-joins or removes a computer system from a domain or workgroup. This method is only available on Windows 2000 platforms and beyond. The method can return the following values:/n0 - Success./nOther - For integer values other than those listed above, refer to Win32 error code documentation./nPassword and Username must use a high authentication level (i.e. no less than RPC_C_AUTHN_LEVEL_PKT_PRIVACY) when they connect to winmgmt (i.e. in the call to obtain the IWbemServices interface) or SetProxyBlanket on their IWbemServices ptr. If they are local to winmgmt then this is not a concern because their authentication level is as good as RPC_C_AUTHN_LEVEL_PKT_PRIVACY as well as their client request never goes over the wire to get to the winmgmt. /nIf Password and Username are left null, the provider does not care. /nIf the provider determines that the authentication level is too low and a Password or Username has been specified then WBEM_E_ENCRYPTED_CONNECTION_REQUIRED will be returned. UnjoinDomainOrWorkgroup Z - � � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � 3 � � � � � MSFT_CliParam The FUnjoinOptions parameter specifies the unjoin options. If this parameter is NETSETUP_ACCT_DELETE, the account is disabled when the unjoin occurs. Note that this option does not delete the account. Currently, there are no other unjoin options defined. /n2 bit - Acct Delete - Delete the account when a domain is left. /nThe method returns a 0 if no options are involved. FUnjoinOptions � � � q � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i & � MSFT_CliQualifier BitMap # 2 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING l 3 � MSFT_CliQualifier BitValues & Acct Delete � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING j , � MSFT_CliQualifier CIMTYPE $ uint32 e � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � ) � MSFT_CliQualifier Description ( The FUnjoinOptions parameter specifies the unjoin options. If this parameter is NETSETUP_ACCT_DELETE, the account is disabled when the unjoin occurs. Note that this option does not delete the account. Currently, there are no other unjoin options defined. � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e " � MSFT_CliQualifier ID 2 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True UINT32 � � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING J 3 � � d l � MSFT_CliParam If the UserName parameter specifies an account name, the Password parameter must point to the password to use when connecting to the domain controller. Otherwise, this parameter must be NULL. /nPassword and Username must use a high authentication level (i.e. no less than RPC_C_AUTHN_LEVEL_PKT_PRIVACY) when they connect to winmgmt (i.e. in the call to obtain the IWbemServices interface) or SetProxyBlanket on their IWbemServices ptr. If they are local to winmgmt then this is not a concern because their authentication level is as good as RPC_C_AUTHN_LEVEL_PKT_PRIVACY as well as their client request never goes over the wire to get to the winmgmt. /nIf Password and Username are left null, the provider does not care. /nIf the provider determines that the authentication level is too low and a Password or Username has been specified then WBEM_E_ENCRYPTED_CONNECTION_REQUIRED will be returned. Password � � 6 M � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING j , � MSFT_CliQualifier CIMTYPE $ string f � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � * � MSFT_CliQualifier Description ( If the UserName parameter specifies an account name, the Password parameter must point to the password to use when connecting to the domain controller. Otherwise, this parameter must be NULL. /nPassword and Username must use a high authentication level (i. � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e " � MSFT_CliQualifier ID 0 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True STRING � � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING ? 3 � � �
�
� MSFT_CliParam The Username parameter is a pointer to a constant null-terminated character string that specifies the account name to use when connecting to the domain controller. The string must specify either a domain NetBIOS name and user account (for example, "REDMOND\user") or the user principal name (UPN) of the user in the form of an Internet-style login name (for example, "someone@microsoft.com"). If this parameter is NULL, the caller's context is used. Blank password is passed by using an empty string /nPassword and Username must use a high authentication level (i.e. no less than RPC_C_AUTHN_LEVEL_PKT_PRIVACY) when they connect to winmgmt (i.e. in the call to obtain the IWbemServices interface) or SetProxyBlanket on their IWbemServices ptr. If they are local to winmgmt then this is not a concern because their authentication level is as good as RPC_C_AUTHN_LEVEL_PKT_PRIVACY as well as their client request never goes over the wire to get to the winmgmt. /nIf Password and Username are left null, the provider does not care. /nIf the provider determines that the authentication level is too low and a Password or Username has been specified then WBEM_E_ENCRYPTED_CONNECTION_REQUIRED will be returned. UserName � i � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING j , � MSFT_CliQualifier CIMTYPE $ string e � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � ) � MSFT_CliQualifier Description ( The Username parameter is a pointer to a constant null-terminated character string that specifies the account name to use when connecting to the domain controller. The string must specify either a domain NetBIOS name and user account (for example, "REDMON � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e " � MSFT_CliQualifier ID 1 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True STRING : o< �= �> g � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � + � MSFT_CliQualifier Description ( The UnjoinDomainOrWorkgroup method un-joins or removes a computer system from a domain or workgroup. This method is only available on Windows 2000 platforms and beyond. The method can return the following values:/n0 - Success./nOther - For integer values o � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING n . � MSFT_CliQualifier Implemented ( True � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING k 0 � MSFT_CliQualifier ValueMap ) , 0 .. � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i 7 � MSFT_CliQualifier Values ' 0 Success Other UnjoinDomainOrWorkgroup 1xXΰ | ���, � ��۳ � ���C
� 3w�� � �-�MU � ��q'� ��x�� } 6�Z�l � �sH�� * X e S q l P k g _ s t r e t c h _ d a t a b a s e _ e n a b l e _ c o m p l e t e d 3T��7 � , 4 XeSqlPkg_stretch_database_enable_completed , ) � ��# . < H � � I V � � � O [ � � 1 � � WU������������������������������������������* � stretch_database_enable_completed EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� 6 > � �� uint32 WmiDataId duration_ms )
� � � � �� sint64 WmiDataId error_number ! )
� � � � �� sint32 WmiDataId error_state % )
� < D � �� sint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId is_success )
� � �� sint8 WmiDataId RemainingLength 6
� u } � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� �
� �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g 4T��7 �_ XeSqlPkg
C � ��1 > { � � � � � c����� � XeSqlPkg_stretch_database_reauthorize_completed Description Reports the completion of a sp_rda_reauthorize_db spec proc Guid {5F697FDA-0D00-4F2F-92E6-96605995CDC7} locale MS\0x409 DisplayName stretch_database_reauthorize_completed �/ X e S q l P k g _ s t r e t c h _ d a t a b a s e _ r e a u t h o r i z e _ c o m p l e t e d 5T��7 � , 9 XeSqlPkg_stretch_database_reauthorize_completed 1 ) � ��( 3 A M � N [ � � �
T ` � � % 6 � � WU������������������������������������������/ � stretch_database_reauthorize_completed EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� ; C � �� uint32 WmiDataId duration_ms )
� � � � �� sint64 WmiDataId error_number ! )
� � � � �� sint32 WmiDataId error_state % )
� A I � �� sint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId is_success )
� � �� sint8 WmiDataId RemainingLength 6
� z � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g 6T��7 �j XeSqlPkg
C � ��- : � � � � � � c����� � XeSqlPkg_stretch_database_disable_completed Description Reports the completion of a ALTER DATABASE SET REMOTE_DATA_ARCHIVE OFF command Guid {799F03AD-4075-466E-BB13-1946B20AB9C3} locale MS\0x409 DisplayName stretch_database_disable_completed �+ X e S q l P k g _ s t r e t c h _ d a t a b a s e _ d i s a b l e _ c o m p l e t e d 7T��7 � , 5 XeSqlPkg_stretch_database_disable_completed - ) � ��$ / = I � J W � � � P \ � � ! 2 � � WU������������������������������������������+ � stretch_database_disable_completed EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� 7 ? � �� uint32 WmiDataId duration_ms )
� � � � �� sint64 WmiDataId error_number ! )
� � � � �� sint32 WmiDataId error_state % )
� = E � �� sint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId is_success )
� � �� sint8 WmiDataId RemainingLength 6
� v ~ � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g 8T��7 �b XeSqlPkg
C � ��) 6 � � � � � � c����� � XeSqlPkg_stretch_table_validation_error Description Reports the completion of validation for a table when the user enables stretch Guid {4AAF7C1E-234D-43F9-884E-9784F13534E1} locale MS\0x409 DisplayName stretch_table_validation_error �' X e S q l P k g _ s t r e t c h _ t a b l e _ v a l i d a t i o n _ e r r o r 9T��7 �� , 1 XeSqlPkg_stretch_table_validation_error ) ) � �� +
9 E � � F T � � � q } � � a r � � k u WU������������������������������������������ � stretch_table_validation_error EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� 3 ; � �� uint32 WmiDataId error_number )
� � � � �� sint32 WmiDataId error_state ! )
� � � � �� sint32 WmiDataId FragmentId 6
� E M X e � �� uint32 WmiDataId Description FragmentId is_success )
� � � � �� sint8 WmiDataId message
% C
� (
� ��3 F V ^ string WmiDataId StringTermination NullTerminated Format w RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� ; C N [ � �� uint32 WmiDataId Description SequenceNumber table_id )
� � � � �� uint32 WmiDataId � X e S q l P k g :T��7 �U XeSqlPkg
C � ��* 7 x ~ � � � � c����� � XeSqlPkg_stretch_table_codegen_completed Description Reports the completion of code generation for a stretched table Guid {9CA47064-16DC-4329-BC6A-1881E7C0E7DE} locale MS\0x409 DisplayName stretch_table_codegen_completed � X e S q l P k g Y��7 �Y XeSqlPkg
C � ��* 7 | � � � � � c����� � XeSqlPkg_hadr_transport_register_partner Description Event which fires when we're registering a database replica partner Guid {43AB7347-B302-4650-BA9B-0B4739687B09} locale MS\0x409 DisplayName hadr_transport_register_partner �A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 B<K�]�v͝��C�| �� Z � HNet_ConnectionProperties HNet_Connection.Guid="{C0781781-644C-4CF8-A31C-56E74AB1CB46}" eName] m!ݰ C �|�� � ��_� m �£
q ڤ� � �KG � � gSqy� [ � � � � �L� , X e S q l P k g _ q u e r y _ e x e c u t i o n _ b a t c h _ s p i l l _ s t a r t e d =]��7 �� ' 6 XeSqlPkg_query_execution_batch_spill_started . ) � ��% 0 > J � p � � � / @ � � 9 T � � WU�������������������������������������� � query_execution_batch_spill_started EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid FragmentId 6
� D L W d � �� uint32 WmiDataId Description FragmentId partitions_number )
� � � � �� sint32 WmiDataId query_operator_node_id )
� $ � �� sint32 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� ) � �� uint32 WmiDataId Description SequenceNumber spilled_partitions_number )
� � � � �� sint32 WmiDataId spilling_level )
� � � � �� sint32 WmiDataId � X e S q l P k g >]��7 �� XeSqlPkg
C � ��9 F � � � � � � c���� � XeSqlPkg_query_execution_batch_global_string_dictionary Description Occurs when a global string dictionary is used in hash join or hash aggregate. Guid {02B6D7FB-A588-46EE-A932-5F4CD73E21E3} locale MS\0x409 DisplayName query_execution_batch_global_string_dictionary �7 X e S q l P k g _ q u e r y _ e x e c u t i o n _ b a t c h _ g l o b a l _ s t r i n g _ d i c t i o n a r y ?]��7 �� ( A XeSqlPkg_query_execution_batch_global_string_dictionary 9 ) � ��0 ; I U � V b � � / ? � � 3 D � � = G WU��������������������������������������� � query_execution_batch_global_string_dictionary EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� C K � �� sint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId is_dictionary_used )
� $ � �� sint8 WmiDataId key_column_ids ! C
� � � � ��� � � � string WmiDataId StringTermination NullTerminated Format w query_operator_node_id )
� ( � �� sint32 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
�
- � �� uint32 WmiDataId Description SequenceNumber table_id )
� ~ � � �� sint32 WmiDataId � X e S q l P k g @]��7 �I XeSqlPkg
C � ��) 6 m s � � � � c����� � XeSqlPkg_query_execution_wait_syncpoint Description Occurs when batch mode hash join reaches a syncpoint. Guid {38E199B6-5CE7-490C-8F91-B7CC3869F6B0} locale MS\0x409 DisplayName query_execution_wait_syncpoint �' X e S q l P k g _ q u e r y _ e x e c u t i o n _ w a i t _ s y n c p o i n t A]��7 �[ , 1 XeSqlPkg_query_execution_wait_syncpoint ) ) � �� + 9 E � � k � � � S c � � , < � � � � WU������������������������������������������x � query_execution_wait_syncpoint EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid FragmentId 6
� ? G R _ � �� uint32 WmiDataId Description FragmentId query_operator_node_id )
� � � � �� sint32 WmiDataId RemainingLength 6
� " * 5 B � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber start_wait )
� ! � �� sint8 WmiDataId sync_timestamp )
� s { � �� uint64 WmiDataId thread_id )
� � � � �� uint32 WmiDataId wait_type % C
� 7 ? � ��J ] m u string WmiDataId StringTermination NullTerminated Format w � X e S q l P k g B]��7 �� XeSqlPkg
C � �� * � � * c����> � XeSqlPkg_file_handle_in_use Description Fired when a file handle we're trying to delete is in use and we don't expect it to be. The typical response is dumping all the handles in the system via SysInternals HANDLE.EXE Guid {DF0D99BE-58C2-4420-9877-09B05CB44DBC} locale MS\0x409 DisplayName file_handle_in_use � X e S q l P k g _ f i l e _ h a n d l e _ i n _ u s e C]��7 �
% XeSqlPkg_file_handle_in_use ) � �� - 9 � � � � �
� � W����������������������������\ � file_handle_in_use EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid file_name C
� ? G � ��R e u } string WmiDataId StringTermination NullTerminated Format w FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� Q Y d q � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber win32error )
� I Q � �� uint32 WmiDataId � X e S q l P k g D]��7 �b XeSqlPkg
C � ��. ; � � � � � � c����� � XeSqlPkg_sql_transaction_commit_single_phase Description Occurs when a sql transaction is committed with single phase commit. Guid {ea9b3b62-a546-4268-9732-b173f66458f0} locale MS\0x409 DisplayName sql_transaction_commit_single_phase �A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 D<K�]�v͝��C�| �� Z � HNet_ConnectionProperties HNet_Connection.Guid="{6D6FAD49-98D4-4AF6-82F1-221EC7EFF561}" R O O T \ M i c r o s o f t \ H o m e N e t H N e t _ C o n n e c t i o n P r o p e r t i e s
C o n n e c t i o n � N S _ 5 1 1 6 2 6 F A E 4 F 5 7 D B D 2 0 D F 5 C D 4 4 A 4 1 D A E C E D 2 8 C F 7 B 3 F D 8 B 1 2 0 1 2 C 7 F 4 B 5 8 F 4 4 E 6 6 5 \ K I _ A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 \ I _ 3 2 2 7 0 8 7 3 0 E 5 A 1 6 7 8 7 C 8 D 7 F 8 0 D 7 A 5 B 7 0 8 4 5 6 4 0 6 1 6 5 F F 0 0 C 6 6 F B E 6 0 9 5 4 F 3 A 7 7 6 1 B o_V2_SimpleOp C:\Windows\system32\kernelbase.dll[MofResourceName] |�C� � l2."V
� (a�*� � �k�;� � Bd V� q ���� � ƠN�� � �aJ � P�m�� �a� & X e S q l P k g _ d d l _ w i t h _ w a i t _ a t _ l o w _ p r i o r i t y -]��7 �B : 0 XeSqlPkg_ddl_with_wait_at_low_priority ( ) � �� * 8 J � � ! 0 � � > I � � 6 D � � � � � � � � 2 8 WUU������������������������������������������������������* � ddl_with_wait_at_low_priority EventType EventVersion abort_after_wait P
� � � � ��� 0 � � � � uint8 WmiDataId XEMapId ValueMap � � � 0 1 2 Values � NONE BLOCKERS SELF ActivityId
N
� | � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� � �� uint32 WmiDataId database_name * C
� � � � ��� � � � string WmiDataId StringTermination NullTerminated Format w FragmentId 6
� % 2 � �� uint32 WmiDataId Description FragmentId host_name & C
� � � � ��� � � � string WmiDataId StringTermination NullTerminated Format w host_process_id )
� # + � �� sint32 WmiDataId max_duration )
� { � � �� uint32 WmiDataId object_id
" )
� � �
� �� sint32 WmiDataId object_name
. C
� A I
� ��T g w string WmiDataId StringTermination NullTerminated Format w RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� \ d o | � �� uint32 WmiDataId Description SequenceNumber target_object_name 2 C
� � � � �� ' / string WmiDataId StringTermination NullTerminated Format w type P
� � � � ��� 1 � � � � uint8 WmiDataId XEMapId ValueMap � � � 0 1 2 Values � ALTER TABLE REBUILD ALTER TABLE SWITCH ALTER INDEX REBUILD � X e S q l P k g .]��7 �| XeSqlPkg
C � ��1 > � � � � � � c����
� XeSqlPkg_query_store_persist_on_shutdown_failed Description Occurs when SQL Server fails to store dirty entries in Query Store on database shutdown. Guid {ff3cf2d2-e9a6-46b4-857b-8a5d060696dd} locale MS\0x409 DisplayName query_store_persist_on_shutdown_failed �/ X e S q l P k g _ q u e r y _ s t o r e _ p e r s i s t _ o n _ s h u t d o w n _ f a i l e d /]��7 �� 9 XeSqlPkg_query_store_persist_on_shutdown_failed 1 ) � ��( 3 A M � � G S � � I Y W�������������������������� � query_store_persist_on_shutdown_failed EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid dbId )
� 4 < � �� sint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� + 8 � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g 0]��7 �h XeSqlPkg
C � ��4 A � � � � � � c����� � XeSqlPkg_logconsolidation_defunct_cleanup_complete Description Occurs when log consolidation cleans up single defunct tenant. Guid {CEDB5E0F-044D-4157-B105-769B29C02D95} locale MS\0x409 DisplayName logconsolidation_defunct_cleanup_complete �2 X e S q l P k g _ l o g c o n s o l i d a t i o n _ d e f u n c t _ c l e a n u p _ c o m p l e t e 1]��7 �� < XeSqlPkg_logconsolidation_defunct_cleanup_complete 4 ) � ��+ 6 D P � v � �
T d � � W����������������������������- � logconsolidation_defunct_cleanup_complete EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid FragmentId 6
� J R ] j � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength rows_deleted )
� A I � �� uint32 WmiDataId SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber tenant_id )
� " � �� sint32 WmiDataId � X e S q l P k g 2]��7 �� XeSqlPkg
C � ��2 ? � � � � � � c���� � XeSqlPkg_logconsolidation_sectors_moving_to_data Description Occurs when log consolidation begins one move-log-to-data task, but before any sectors are moved. Guid {1E66918C-680B-4219-B56B-3D3F8ADA7247} locale MS\0x409 DisplayName logconsolidation_sectors_moving_to_data �0 X e S q l P k g _ l o g c o n s o l i d a t i o n _ s e c t o r s _ m o v i n g _ t o _ d a t a 3]��7 �, : XeSqlPkg_logconsolidation_sectors_moving_to_data 2 ) � ��) 4 B N � t � �
W���������������������~ � logconsolidation_sectors_moving_to_data EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid FragmentId 6
� H P [ h � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� N V a n � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g 4]��7 �f XeSqlPkg
C � ��1 > � � � � � � c����� � XeSqlPkg_logconsolidation_sectors_moved_to_data Description Occurs when log consolidation completes one move-log-to-data task. Guid {E29D9B01-D88D-4A8C-81E6-DEB09DC9BD3B} locale MS\0x409 DisplayName logconsolidation_sectors_moved_to_data � R O O T \ M i c r o s o f t \ H o m e N e t H N e t _ C o n n e c t i o n P r o p e r t i e s
C o n n e c t i o n � N S _ 5 1 1 6 2 6 F A E 4 F 5 7 D B D 2 0 D F 5 C D 4 4 A 4 1 D A E C E D 2 8 C F 7 B 3 F D 8 B 1 2 0 1 2 C 7 F 4 B 5 8 F 4 4 E 6 6 5 \ K I _ A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 \ I _ 4 F B 0 3 6 E C A 4 4 1 5 1 5 6 D E 9 D 1 0 D 8 0 E 7 9 3 5 D A F 8 1 A 6 9 A B D E 8 E 1 1 6 C 7 9 E 9 5 9 6 F 0 7 F 4 9 1 9 4 9 3 - 4 3 C 8 6 C 3 E 5 B 2 B 7 F 1 D D 0 4 4 3 A 6 D A 4 E 1 7 A A 9 5 D 6 5 F 5 6 E E 0 C 1 9 C F 4 F D 3 B 5 D 9 A 5 F 6 3 C 5 2 2 C<K�]�u͝��C�s 0 9 �� R � HNet_Connection {6D6FAD49-98D4-4AF6-82F1-221EC7EFF561} Local Area Connection 2 eName] ilities Indicates the specific power-related capabilities of a computer system and its associated running operating system. The values, 0="Unknown", 1="Not Supported", and 2="Disabled" are self-explanatory. The value, 3="Enabled" indicates that the power management features are currently enabled but the exact feature set is unknown or the information is unavailable. "Power Saving Modes Entered Automatically" (4) describes that a system can change its power state based on usage or other criteria. "Power State Settable" (5) indicates that the SetPowerState method is supported. "Power Cycling Supported" (6) indicates that the SetPowerState method can be invoked with the PowerState parameter set to 5 ("Power Cycle"). "Timed Power On Supported" (7) indicates that the SetPowerState method can be invoked with the PowerState parameter set to 5 ("Power Cycle") and the Time parameter set to a specific date and time, or interval, for power-on. PowerManagementCapabilities k � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values ? H W a j � � � Unknown Not Supported Disabled Enabled Power Saving Modes Entered Automatically Power State Settable Power Cycling Supported Timed Power On Supported � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � , ! ; � MSFT_CliProperty PowerManagementSupported Boolean indicating that the computer system, with its running operating system, support power management. This boolean does not indicate that power management features are currently enabled, only that the system is capable of power management. PowerManagementSupported � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier { ) � � N � MSFT_CliProperty PowerOnPasswordStatus The PowerOnPasswordStatus property identifies the system-wide hardware security settings for Power On Password Status. PowerOnPasswordStatus � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � \ � MSFT_CliQualifier Values / 9 B S Disabled Enabled Not Implemented Unknown s 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier 9 � � � MSFT_CliProperty PowerState Indicates the current power state of the computer system and its associated operating system. Regarding the power saving states, these are defined as follows: Value 4 (Unknown) indicates that the system is known to be in a power save mode, but its exact status in this mode is unknown; 2 (Low Power Mode) indicates that the system is in a power save state but still functioning, and may exhibit degraded performance; 3 (Standby) describes that the system is not functioning but could be brought to full power 'quickly'; and value 7 (Warning) indicates that the computerSystem is in a warning state, though also in a power save mode. PowerState � p � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values ? H T q � � � � Unknown Full Power Power Save - Low Power Mode Power Save - Standby Power Save - Unknown Power Cycle Power Off Power Save - Warning o 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier )
� � v ���
uint32 ! RemoteEncryptionProtectionAggressiveness uint8 !
� #
In !
� #
I
�� �
�
�
0 1 2 ValueMap ! )
� #
I
���
w
ID ! 6
� I
���
w
�
uint8 " RemoteEncryptionProtectionExclusions string "
� X In "
� X �� ID " )
� � ��� string
& BruteForceProtectionConfiguredState uint8
&
� ' In
&
� ' M �� � � � � 0 1 2 4 ValueMap
& )
� ' M ��� { ID
& 6
� $
M ��� { �
uint8 ' BruteForceProtectionMaxBlockTime uint32 '
� _
In '
� _
�
�� ID ' )
� �
�
���
uint32 + BruteForceProtectionAggressiveness uint8 +
� - In +
� - S �� � � � 0 1 2 ValueMap + )
� - S ��� � ID + 6
� # S ��� � � uint8 , BruteForceProtectionExclusions string ,
� \ In ,
� \ � �� ID , )
� � � ��� string 0 BruteForceProtectionLocalNetworkBlocking boolean 0
� 0 In 0
� 0 X �� ID 0 )
� � X ��� boolean 2 BruteForceProtectionSkipLearningPeriod boolean 2
� In 2
� , �� ID 2 )
� � , ��Z boolean 4 ReportingAdditionalActionTimeOut uint32 4
� � In 4
� � � �� ID 4 )
� b � ��' uint32 8 ReportingCriticalFailureTimeOut uint32 8
� � In 8
� � � �� ID 8 )
� - � ��� uint32 < ReportingNonCriticalTimeOut uint32 <
� d In <
� d � �� ID < )
� � � ��� uint32 @ ServiceHealthReportInterval uint32 @
� + In @
� + R �� ID @ )
� � R ��� uint32 D ReportDynamicSignatureDroppedEvent boolean D
� � In D
� � ! �� ID D )
� � ! ��O boolean F ScanAvgCPULoadFactor uint8 F
� � In F
� � � �� ID F )
� J � �� uint8 G CheckForSignaturesBeforeRunningScan boolean G
� � In G
� � � �� ID G )
� � ��� boolean I ScanPurgeItemsAfterDelay uint32 I
� N In I
� N u �� ID I )
� � u ��� uint32 M ScanOnlyIfIdleEnabled boolean M
� In M
� 7 �� ID M )
� � 7 ��e boolean O ScanParameters uint8 O
� � In O
� � � �� + . 1 2 ValueMap O )
� � � ��1 ID O 6
� � � ��1 r uint8 P ScanScheduleDay uint8 P
� � In P
� �
�� ` c f i l o r u x 0 1 2 3 4 5 6 7 8 ValueMap P )
� �
��{ 8 ID P 6
�
��{ 8 � uint8 e Q ScanScheduleQuickScanTime datetime e Q
� 8 In e Q
� 8 a �� ID e Q )
� � a ��� datetime e U ScanScheduleTime datetime e U
� � In e U
� � ! �� ID e U )
� � ! ��O datetime Y ThrottleForScheduledScanOnly boolean Y
� � In Y
� � � �� ID Y )
� U � �� boolean ! [ SignatureFirstAuGracePeriod uint32 ! [
� � In ! [
� � � �� ID ! [ )
� � ��� ! uint32 " _ SignatureAuGracePeriod uint32 " _
� O In " _
� O v �� ID " _ )
� � v ��� " uint32 # c SignatureDefinitionUpdateFileSharesSources string # c
� % In # c
� % L �� ID # c )
� � L ��z # string $ g SignatureDisableUpdateOnStartupWithoutEngine boolean $ g
� � In $ g
� � % �� ID $ g )
� � % ��S $ boolean % i SignatureFallbackOrder string % i
� � In % i
� � � �� ID % i )
� Q! � ��! % string & m SignatureScheduleDay uint8 & m
� �! In & m
� �! �! �� �! " " " " " " " " 0 1 2 3 4 5 6 7 8 ValueMap & m )
� �! �! ��" �! ID & m 6
� �" �! ��" �! Y" & uint8 e ' n SignatureScheduleTime datetime e ' n
� �" In e ' n
� �" �" �� ID e ' n )
� c# �" ��(# ' datetime ( r SignatureUpdateCatchupInterval uint32 ( r
� �# In ( r
� �# �# �� ID ( r )
� /$ �# ���# ( uint32 ) v SignatureBlobFileSharesSources string ) v
� i$ In ) v
� i$ �$ �� ID ) v )
� �$ �$ ���$ ) string * z SignatureUpdateInterval uint32 * z
� ,% In * z
� ,% S% �� ID * z )
� �% S% ���% * uint32 + ~ SignatureBlobUpdateInterval uint32 + ~
� �% In + ~
� �% & �� ID + ~ )
� �& & ��H& + uint32 , � MAPSReporting uint8 , �
� �& In , �
� �& �& �� ' ' ' 0 1 2 ValueMap , � )
� �& �& ��' ' ID , � 6
� �' �& ��' ' Z' , uint8 - � SubmitSamplesConsent uint8 - �
� �' In - �
� �' �' �� 9( <( ?( B( 0 1 2 3 ValueMap - � )
� �' �' ��E( %( ID - � 6
� �( �' ��E( %( �( - uint8 . � DisablePrivacyMode boolean . �
� �( In . �
� �( #) �� ID . � )
� �) #) ��Q) . boolean / � RandomizeSc
� F D 3 B B D 4 C 4 2 A C 2 F 7 F E F 2 6 4 3 4 0 A 9 E B 7 8 A 5 8 1 F E 5 C 2 8 5 6 1 C B 6 3 E D F 7 8 0 B 3 2 9 E A C 2 E E 4 �b��5��͝��C�z� � + < � � '� F� � MSFT_CliAlias � F N u � � � � �
U�������������������������4 � MSFT_CliConnection Authority
� > STRING Locale
� m STRING NameSpace
� � STRING Password
� � STRING Server
� � STRING User
� , STRING | � ( + � MSFT_CliConnection ms_409 ROOT\CIMV2 . CPU management. T oq B � �� o �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty $n �K � MSFT_CliFormat LIST FULL , � � 6 � � T � z 2 � � I � � b � p "! �" �$ 5& �' �) Q+ �, �. k0 -2 �3 �5 R7 9 �: d< > �? qA /C �D �F CH �I � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty AddressWidth AddressWidth � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty Architecture Architecture � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty Availability Availability � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty Caption Caption � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � * B � MSFT_CliProperty ConfigManagerErrorCode ConfigManagerErrorCode � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � + D � MSFT_CliProperty ConfigManagerUserConfig ConfigManagerUserConfig � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty CpuStatus CpuStatus � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier z � % 8 � MSFT_CliProperty CreationClassName CreationClassName � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier z � % 8 � MSFT_CliProperty CurrentClockSpeed CurrentClockSpeed � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier w � " 2 � MSFT_CliProperty CurrentVoltage CurrentVoltage � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty DataWidth DataWidth � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier t � , � MSFT_CliProperty Description Description � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier q � & � MSFT_CliProperty DeviceID DeviceID � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty ErrorCleared ErrorCleared � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier y � $ 6 � MSFT_CliProperty ErrorDescription ErrorDescription � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier q � heduleTaskTimes boolean / �
� �) In / �
� �) �) �� ID / � )
� T* �) ��* / boolean 0 � SchedulerRandomizationTime uint32 0 �
� �* In 0 �
� �* �* �� ID 0 � )
� + �* ���* 0 uint32 1 � DisableBehaviorMonitoring boolean 1 �
� P+ In 1 �
� P+ x+ �� ID 1 � )
� �+ x+ ���+ 1 boolean 2 � DisableIntrusionPreventionSystem boolean 2 �
� , In 2 �
� , F, �� ID 2 � )
� �, F, ��t, 2 boolean 3 � DisableIOAVProtection boolean 3 �
� �, In 3 �
� �, - �� ID 3 � )
� r- - ��7- 3 boolean 4 � DisableRealtimeMonitoring boolean 4 �
� �- In 4 �
� �- �- �� ID 4 � )
� 9. �- ���- 4 boolean 5 � DisableScriptScanning boolean 5 �
� k. In 5 �
� k. �. �� ID 5 � )
� �. �. ���. 5 boolean 6 � DisableArchiveScanning boolean 6 �
� // In 6 �
� // W/ �� ID 6 � )
� �/ W/ ���/ 6 boolean 7 � DisableCatchupFullScan boolean 7 �
� �/ In 7 �
� �/ 0 �� ID 7 � )
� �0 0 ��I0 7 boolean 8 � DisableCatchupQuickScan boolean 8 �
� �0 In 8 �
� �0 �0 �� ID 8 � )
� I1 �0 ��1 8 boolean 9 � DisableEmailScanning boolean 9 �
� z1 In 9 �
� z1 �1 �� ID 9 � )
� 2 �1 ���1 9 boolean : � DisableRemovableDriveScanning boolean : �
� E2 In : �
� E2 m2 �� ID : � )
� �2 m2 ���2 : boolean ; � DisableRestorePoint boolean ; �
� 3 In ; �
� 3 .3 �� ID ; � )
� �3 .3 ��\3 ; boolean < � DisableScanningMappedNetworkDrivesForFullScan boolean < �
� �3 In < �
� �3 4 �� ID < � )
� r4 4 ��74 < boolean = � DisableScanningNetworkFiles boolean = �
� �4 In = �
� �4 �4 �� ID = � )
� ;5 �4 �� 5 = boolean > � ApplyDisableNetworkScanningToIOAV boolean > �
� y5 In > �
� y5 �5 �� ID > � )
�
6 �5 ���5 > boolean ? � UILockdown boolean ? �
� 16 In ? �
� 16 Y6 �� ID ? � )
� �6 Y6 ���6 ? boolean @ � ThreatIDDefaultAction_Ids sint64 @ �
� �6 In @ �
� �6 7 �� ID @ � )
� �7 7 ��M7 @ sint64 A � ThreatIDDefaultAction_Actions uint8 A �
� �7 In A �
� �7 �7 �� 58 88 ;8 >8 A8 D8 G8 1 2 3 6 8 9 10 ValueMap A � )
� �7 �7 ��K8 8 ID A � 6
� �8 �7 ��K8 8 �8 A uint8 B � UnknownThreatDefaultAction uint8 B �
� 9 In B �
� 9 /9 �� }9 �9 �9 �9 �9 �9 �9 1 2 3 6 8 9 10 ValueMap B � )
� 9 /9 ���9 ]9 ID B � 6
� : /9 ���9 ]9 �9 B uint8 C � LowThreatDefaultAction uint8 C �
� M: In C �
� M: s: �� �: �: �: �: �: �: �: 1 2 3 6 8 9 10 ValueMap C � )
� M: s: ���: �: ID C � 6
� `; s: ���: �: ; C uint8 D � ModerateThreatDefaultAction uint8 D �
� �; In D �
� �; �; ��
<
< < < < < < 1 2 3 6 8 9 10 ValueMap D � )
� �; �; �� < �; ID D � 6
� �< �; �� < �; a< D uint8 E � HighThreatDefaultAction uint8 E �
� �< In E �
� �< = �� O= R= U= X= [= ^= a= 1 2 3 6 8 9 10 ValueMap E � )
� �< = ��e= /= ID E � 6
� �= = ��e= /= �= E uint8 F � SevereThreatDefaultAction uint8 F �
� "> In F �
� "> H> �� �> �> �> �> �> �> �> 1 2 3 6 8 9 10 ValueMap F � )
� "> H> ���> v> ID F � 6
� 5? H> ���> v> �> F uint8 G � PUAProtection uint8 G �
� ]? In G �
� ]? �? �� �? �? �? 0 1 2 ValueMap G � )
� ]? �? ���? �? ID G � 6
� S@ �? ���? �? @ G uint8 H � DisableBlockAtFirstSeen boolean H �
� �@ In H �
� �@ �@ �� ID H � )
� A �@ ���@ H boolean I � CloudBlockLevel uint8 I �
� BA In I �
� BA hA �� �A �A �A �A �A 0 1 2 4 6 ValueMap I � )
� BA hA ���A �A ID I � 6
� FB hA ���A �A �A I uint8 J � CloudExtendedTimeout uint32 J �
� uB In J �
� uB �B �� ID J � )
� C �B ���B J uint32 K � EnableNetworkProtection uint8 K �
� 8C In K �
� 8C ^C �� �C �C �C 0 1 2 ValueMap K � )
� 8C ^C ���C �C ID K � 6
� .D ^C ���C �C �C K uint8 L � EnableControlledFolderAccess uint8 L �
� eD In L �
� eD �D �� �D �D �D �D �D 0 1 2 3 4 ValueMap L � )
� eD �D ���D �D ID L � 6
� iE �D ���D �D !E L uint8 M � AttackSurfaceReductionOnlyExclusions string M �
� �E In M �
� �E �E �� ID M � )
� 8F �E ���E M string N � AttackSurfaceReductionRules_Ids string N �
� sF In N �
� sF �F �� ID N � )
� G �F ���F N string O � AttackSurfaceReductionRules_Actions uint8 O �
� BG In O �
� BG hG �� �G �G �G �G �G 0 1 2 5 6 ValueMap O � )
� BG hG ���G �G ID O � 6
� FH hG ���G �G �G O uint8 P � ControlledFolderAccessAllowedApplications string P �
� �H In P �
� �H �H �� ID P � )
� I �H ���H P string Q � ControlledFolderAccessProtectedFolders string Q �
� \I In Q �
� \I �I �� I & � MSFT_CliProperty ExtClock ExtClock � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o � " � MSFT_CliProperty Family Family � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier t � , � MSFT_CliProperty InstallDate InstallDate � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier t � , � MSFT_CliProperty L2CacheSize L2CacheSize � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty L2CacheSpeed L2CacheSpeed � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier v � ! 0 � MSFT_CliProperty LastErrorCode LastErrorCode � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier n � � MSFT_CliProperty Level Level � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier w � " 2 � MSFT_CliProperty LoadPercentage LoadPercentage � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty Manufacturer Manufacturer � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier v � ! 0 � MSFT_CliProperty MaxClockSpeed MaxClockSpeed � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier m � � MSFT_CliProperty Name Name � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � * B � MSFT_CliProperty OtherFamilyDescription OtherFamilyDescription � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier t � , � MSFT_CliProperty PNPDeviceID PNPDeviceID � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � / L � MSFT_CliProperty PowerManagementCapabilities PowerManagementCapabilities � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � , F � MSFT_CliProperty PowerManagementSupported PowerManagementSupported � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier t � , � MSFT_CliProperty ProcessorId ProcessorId � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier v � ! 0 � MSFT_CliProperty ProcessorType ProcessorType � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier q � & � MSFT_CliProperty Revision Revision � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier m � � MSFT_CliProperty Role Role � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier z � % 8 � MSFT_CliProperty SocketDesignation SocketDesignation � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o � " � MSFT_CliProperty Status Status � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier s � * � MSFT_CliProperty StatusInfo StatusInfo � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier q � & � MSFT_CliProperty Stepping Stepping � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � + D � MSFT_CliProperty SystemCreationClassName SystemCreationClassName � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier s � * � MSFT_CliProperty SystemName SystemName � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier q � & � MSFT_CliProperty UniqueId UniqueId � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier v � ! 0 � MSFT_CliProperty UpgradeMethod UpgradeMethod � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty Version Version � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier t � , � MSFT_CliProperty VoltageCaps VoltageCaps D Q � )
� �I �I ���I Q string R � SharedSignaturesPath string R �
� J In R �
� J CJ �� ID R � )
� �J CJ ��qJ R string S � SharedSignaturesPathUpdateAtScheduledTimeOnly boolean S �
� �J In S �
� �J K �� ID S � )
� �K K ��KK S boolean T � EnableLowCpuPriority boolean T �
� �K In T �
� �K �K �� ID T � )
� HL �K ��
L T boolean U � EnableFileHashComputation boolean U �
� ~L In U �
� ~L �L �� ID U � )
� M �L ���L U boolean V � MeteredConnectionUpdates boolean V �
� DM In V �
� DM lM �� ID V � )
� �M lM ���M V boolean W � AllowNetworkProtectionOnWinServer boolean W �
� N In W �
� N ;N �� ID W � )
� �N ;N ��iN W boolean X � DisableDatagramProcessing boolean X �
� �N In X �
� �N O �� ID X � )
� kO O ��0O X boolean Y � EnableConvertWarnToBlock boolean Y �
� �O In Y �
� �O �O �� ID Y � )
� 1P �O ���O Y boolean Z � DisableCpuThrottleOnIdleScans boolean Z �
� kP In Z �
� kP �P �� ID Z � )
� �P �P ���P Z boolean [ � EnableFullScanOnBatteryPower boolean [ �
� 5Q In [ �
� 5Q ]Q �� ID [ � )
� �Q ]Q ���Q [ boolean \ � ProxyPacUrl string \ �
� �Q In \ �
� �Q R �� ID \ � )
� ~R R ��CR \ string ] � ProxyServer string ] �
� �R In ] �
� �R �R �� ID ] � )
� 5S �R ���R ] string ^ � ProxyBypass string ^ �
� \S In ^ �
� \S �S �� ID ^ � )
� �S �S ���S ^ string _ � ForceUseProxyOnly boolean _ �
� T In _ �
� T AT �� ID _ � )
� �T AT ��oT _ boolean ` � DisableTlsParsing boolean ` �
� �T In ` �
� �T U �� ID ` � )
� iU U ��.U ` boolean a � DisableHttpParsing boolean a �
� �U In a �
� �U �U �� ID a � )
� )V �U ���U a boolean b � DisableDnsParsing boolean b �
� WV In b �
� WV V �� ID b � )
� �V V ���V b boolean c � DisableDnsOverTcpParsing boolean c �
� W In c �
� W EW �� ID c � )
� �W EW ��sW c boolean d DisableSshParsing boolean d
� �W In d
� �W X �� ID d )
� mX X ��2X d boolean e PlatformUpdatesChannel uint8 e
� �X In e
� �X �X �� Y Y Y Y Y Y 0 2 3 4 5 6 ValueMap e )
� �X �X ��"Y �X ID e 6
� �Y �X ��"Y �X cY e uint8 f EngineUpdatesChannel uint8 f
� �Y In f
� �Y Z �� JZ MZ PZ SZ VZ YZ 0 2 3 4 5 6 ValueMap f )
� �Y Z ��\Z .Z ID f 6
� �Z Z ��\Z .Z �Z f uint8 g DefinitionUpdatesChannel uint8 g
� [ In g
� [ >[ �� |[ [ �[ 0 4 5 ValueMap g )
� [ >[ ���[ l[ ID g 6
� \ >[ ���[ l[ �[ g uint8 h DisableGradualRelease boolean h
� >\ In h
� >\ f\ �� ID h )
� �\ f\ ���\ h boolean i AllowNetworkProtectionDownLevel boolean i
� ] In i
� ] 3] �� ID i )
� �] 3] ��a] i boolean j
AllowDatagramProcessingOnWinServer boolean j
� �] In j
� �] ^ �� ID j
)
� l^ ^ ��1^ j boolean k EnableDnsSinkhole boolean k
� �^ In k
� �^ �^ �� ID k )
� +_ �^ ���^ k boolean l DisableInboundConnectionFiltering boolean l
� i_ In l
� i_ �_ �� ID l )
� �_ �_ ���_ l boolean m DisableRdpParsing boolean m
� (` In m
� (` P` �� ID m )
� �` P` ��~` m boolean n DisableNetworkProtectionPerfTelemetry boolean n
� �` In n
� �` #a �� ID n )
� �a #a ��Qa n boolean o TrustLabelProtectionStatus uint32 o
� �a In o
� �a �a �� ID o )
� Sb �a ��b o uint32 p DisableFtpParsing boolean p
� �b In p
� �b �b �� ID p )
� c �b ���b p boolean q AllowSwitchToAsyncInspection boolean q
� Jc In q
� Jc rc �� ID q )
� �c rc ���c q boolean r ScanScheduleOffset uint32 r
�
d In r
�
d 1d �� ID r )
� �d 1d ��_d r uint32 s DisableTDTFeature boolean s
� �d In s
� �d �d �� ID s )
� Xe �d �� e s boolean t " DisableTamperProtection boolean t "
� �e In t "
� �e �e �� ID t " )
� f �e ���e t boolean u $ DisableSmtpParsing boolean u $
� Lf In u $
� Lf tf �� ID u $ )
� �f tf ���f u boolean v & DisableQuicParsing boolean v &
� g In v &
� g 4g �� ID v & )
� �g 4g ��bg v boolean w ( NetworkProtectionReputationMode uint32 w (
� �g In w (
� �g h �� ID w ( )
� ih h ��.h w uint32 x , IntelTDTEnabled boolean x ,
� �h In x ,
� �h �h �� ID x , )
� %i �h ���h x boolean y . AttackSurfaceReductionRules_RuleSpecificExclusions_Id string y .
� wi In y . �r�` � ��"� M ��Hs8 ���: L Q|�;� c % X e S q l P k g _ q u e r y _ p r e _ e x e c u t i o n _ s h o w p l a n [X��7 �) ] / XeSqlPkg_query_pre_execution_showplan ' ) � �� ) 7 C � � � � � � 7 G � �
j { � � & p } � � � � o � � � q � WUUU����������������������������������������������������������������������������������������� � query_pre_execution_showplan EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_name T C
� M U � ��` s � � string WmiDataId StringTermination NullTerminated Format w dop H )
� � � � �� uint32 WmiDataId estimated_cost
$ )
� $ ,
� �� sint32 WmiDataId estimated_rows )
� ~ � � �� sint32 WmiDataId FragmentId 6
� � � � � �� uint32 WmiDataId Description FragmentId granted_memory_kb @ )
� W _ � �� uint64 WmiDataId ideal_memory_kb
8 )
� � �
� �� uint64 WmiDataId nest_level )
� � �� uint16 WmiDataId object_id )
� ] e � �� sint32 WmiDataId object_name L C
� � � � ��� � string WmiDataId StringTermination NullTerminated Format w object_type P
� z � � ��� a � � Z
b
uint16 WmiDataId XEMapId ValueMap p d k r y � � � � � � � � � � � � � � � � � � � � % , 3 9 @ G N U \ c j q x � � � � � � � � � � � � � � � � � � �
% , 3 : A G N U \ d k r y � � � � � � � � � � � � � � � � � � �
%
+
1
8
?
F
M
S
20801 17985 19521 21825 2 1 20545 21057 21313 19265 8257 18241 20034 19267 21059 19523 21827 8259 19779 21571 17475 20547 16964 21828 16708 21316 17220 20036 21060 21572 17732 8260 19268 17221 20549 20037 21061 17477 17989 19536 21840 16716 19525 19544 22597 21573 21848 8262 21318 21574 17222 19526 20038 21831 22601 17993 21321 21577 0 65536 22604 19277 21581 4 20047 19283 16975 18000 20816 21072 19280 8272 17232 20550 21328 131072 18002 18258 19538 21586 8274 17235 20563 20307 21075 22099 19539 21843 16723 20291 17491 18259 8276 17747 21587 20819 20051 8275 18004 16724 21076 22868 20821 21333 8277 8278 18263 19543 21847 22611 8280 21080 Values p & - 2 = G L Q V _ d m t � � � � � � � � � � � � �
$
*
2
;
D
I
O
Y
c
i
u
�
�
�
�
�
�
�
�
�
�
�
�
�
�
" , 5 > E L W ` j t | � � � � � � � � � � � � � � � � ) 2 @ K V _ h r ~ � � � � � � � � � � � � � � � ADHOC AGG AKEYLOGIN AKEYUSER ALL ANY APP APPROLE ASM ASYMKEY AUDIT AVAILABILITYGROUP BINDING CEK CERT CERTLOGIN CERTUSER CHECK CMK CONTRACT CREDENTIAL CRYPTOPROVIDER DATABASE DBAUDIT DBAUDITSPEC DBCONFIG DBCREDENTIAL DBEVTNOT DBRG DBTRIG DBXESES DEFAULT DEK EDGE ENDPOINT EVTNOTIF EXRP EXTDATASRC EXTFILEFMT EXTGRPLOGIN EXTGRPUSER EXTLANG EXTLIB EXTLOGIN EXTSCRIPT EXTTAB EXTUSER FKEY FNSCLASM FNTABASM FTCAT FTSTPLIST FUNCTION GROUPUSER INDEX INLFUNC INLSCLFN INTLTAB INVALID LOCAL LOGIN MASTERKEY MSGTYPE NOTADHOC OBEVTNOT OBFKEY OBJ PFUN PREPARED PRIORITY PRKEY PROC PROCASM PROPERTYLIST PSCHEME REMOTE REPLPROC RG ROLE ROUTE RULE SCHEMA SECPOLICY SEQUENCE SERVER SERVICE SQLLOGIN SQLUSER SRVAUDITSPEC SRVCONFIG SRVEVTNOT SRVROLE SRVTRIG SRVXESES STATISTICS SVCQ SYNONYM SYSTAB TABFUNC TRIGASM TRIGGER TYPE UQKEY USER USRTAB VIEW WINGROUP WINLOGIN WINUSER XMLSCHEMA XPROC XREL RemainingLength 6
� [ c n { � �� uint32 WmiDataId Description RemainingLength requested_memory_kb 0 )
� � � � �� uint64 WmiDataId SequenceNumber 6
� ? G R _ � �� uint32 WmiDataId Description SequenceNumber serial_ideal_memory_kb ( )
� � � � �� uint64 WmiDataId showplan_xml P C
� 0 8 � ��C V f n string WmiDataId StringTermination NullTerminated Format w source_database_id )
� � � � �� uint32 WmiDataId � X e S q l P k g \X��7 �% XeSqlPkg
C � ��( 5 J P x � � � c����� � XeSqlPkg_query_post_execution_showplan Description Occurs after a SQL statement is executed. This event returns an XML representation of the actual query plan. Using this event can have a significant performance overhead so it should only be used when troubleshooting or monitoring specific problems for brief periods of time. Guid {7bd6d19a-adb3-436b-bb29-cd2ee4d2468c} locale MS\0x409 DisplayName query_post_execution_showplan �! X e S q l P k g _ q u e r y _ r x _ r e l e a s e _ b u f f e r s kX��7 �� + + XeSqlPkg_query_rx_release_buffers # ) � �� % 3 ? � � = M � � g � � � P ` WU������������������������������������������ � query_rx_release_buffers EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid brick_id )
� * 2 � �� uint32 WmiDataId destination_id )
� � � � �� uint32 WmiDataId FragmentId 6
� � � � � �� uint32 WmiDataId Description FragmentId query_id )
� T \ � �� uint64 WmiDataId query_operation_node_id )
� � � � �� uint32 WmiDataId RemainingLength 6
� ' 2 ? � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g lX��7 �$ XeSqlPkg
C � ��# 0 N T | � � � c����� � XeSqlPkg_query_rx_sending_buffers Description RX about to send row buffers Guid {6462c046-f901-480f-8826-ed0c3061c266} locale MS\0x409 DisplayName query_rx_sending_buffers � X e S q l P k g �]��7 �; XeSqlPkg
C � ��$ 1 d j � � � � c����� � XeSqlPkg_disable_rowgroup_for_fpga Description A rowgroup has been disabled for FPGA processing. Guid {8074364D-56F8-46B1-ACD3-3DC2972A34B0} locale MS\0x409 DisplayName disable_rowgroup_for_fpga �pga �9 A B 5 3 8 0 6 E 8 8 6 6 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0 � ���� ͝��C�n xC���� M � WMIBinaryMofResource C:\Windows\system32\drivers\ndis.sys[MofResourceName] rceName] �
�
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � a
� MSFT_CliFormat TABLE BRIEF : � � J � � � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty Caption Caption � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier q � & � MSFT_CliProperty DeviceID DeviceID � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty Manufacturer Manufacturer � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier v � ! 0 � MSFT_CliProperty MaxClockSpeed MaxClockSpeed � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier m � � MSFT_CliProperty Name Name � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier z � % 8 � MSFT_CliProperty SocketDesignation SocketDesignation � �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � C � MSFT_CliFormat TABLE STATUS
K � � c � |
0 �
� � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty Availability Availability � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty CpuStatus CpuStatus � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier w � " 2 � MSFT_CliProperty CurrentVoltage CurrentVoltage � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier q � & � MSFT_CliProperty DeviceID DeviceID � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty ErrorCleared ErrorCleared � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier y � $ 6 � MSFT_CliProperty ErrorDescription ErrorDescription � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier v � ! 0 � MSFT_CliProperty LastErrorCode LastErrorCode � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier w � " 2 � MSFT_CliProperty LoadPercentage LoadPercentage � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o � " � MSFT_CliProperty Status Status � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier s � * � MSFT_CliProperty StatusInfo StatusInfo � �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � k � MSFT_CliFormat TABLE CONFIG
W
� i � }
1 �
� S � � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty AddressWidth AddressWidth � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty DataWidth DataWidth � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier q � & � MSFT_CliProperty DeviceID DeviceID � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier q � & � MSFT_CliProperty ExtClock ExtClock � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier t � , � MSFT_CliProperty L2CacheSize L2CacheSize � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty L2CacheSpeed L2CacheSpeed � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier v � ! 0 � MSFT_CliProperty MaxClockSpeed MaxClockSpeed � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � , F � MSFT_CliProperty PowerManagementSupported PowerManagementSupported � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier v � ! 0 � MSFT_CliProperty ProcessorType ProcessorType � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier q � & � MSFT_CliProperty Revision Revision � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier z � % 8 � MSFT_CliProperty SocketDesignation SocketDesignation � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty Version Version � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier t � , � MSFT_CliProperty VoltageCaps VoltageCaps Q �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty ^ ! � � MSFT_CliFormat TABLE INSTANCE ) � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier q � & � MSFT_CliProperty DeviceID DeviceID CPU Where DeviceID='#' Select * from WIN32_PROCESSOR �g F D 3 B B D 4 C 4 2 A C 2 F 7 F E F 2 6 4 3 4 0 A 9 E B 7 8 A 5 8 1 F E 5 C 2 8 5 6 1 C B 6 3 E D F 7 8 0 B 3 2 9 E A C 2 E E 4 �b��5��͝��C�/g � + ^ �f �f �f �f � MSFT_CliAlias � F N u � � � � �
U�������������������������4 � MSFT_CliConnection Authority
� > STRING Locale
� m STRING NameSpace
� � STRING Password
� � STRING Server
� � STRING User
� , STRING | � ( + � MSFT_CliConnection ms_409 ROOT\CIMV2 . Computer system product information from SMBIOS. v � <! �) K s �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � + � MSFT_CliFormat SYSTEM
D � � U � b
�
x � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty __CLASS __CLASS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __DERIVATION __DERIVATION � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __DYNASTY __DYNASTY � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty __GENUS __GENUS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier t � , � MSFT_CliProperty __NAMESPACE __NAMESPACE � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o � " � MSFT_CliProperty __PATH __PATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier y � $ 6 � MSFT_CliProperty __PROPERTY_COUNT __PROPERTY_COUNT � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __RELPATH __RELPATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier q � & � MSFT_CliProperty __SERVER __SERVER � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __SUPERCLASS __SUPERCLASS K �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty X � � MSFT_CliFormat INSTANCE�0N�� � ��Z � 8��z5 � ��� jlգ � })�� # ��&� t �}�֑ � ��; � ��.e � u�%!� vٝ��C�� " ) - � �� � C T l � � � O Y � � � � : V � � UU��������������������������������� � MDM_Policy_Config01_Kerberos02 InPartition 5 local-system DMWmiBridgeProv AllowForestSearchOrder '
� � � �� � �� string InstanceID
� � � �� string KerberosClientSupportsClaimsCompoundArmor '
� G � �� � �� string ParentID
� � � �� string RequireKerberosArmoring '
� � � �� � �� string RequireStrictKDCValidation '
� 2 � �� � �� string SetMaximumContextTokenSize '
� � � �� � �� string UPNNameHints '
� � � �� � �� string � wٝ��C�� ' ) $ 1 � �� � W h ~ � � N f � � � H T � � � � UU������������������������������������� � MDM_Policy_Config01_KioskBrowser02 InPartition = K local-system local-user DMWmiBridgeProv BlockedUrlExceptions '
� � � �� � �� string BlockedUrls '
� � � �� � �� string DefaultURL '
� F � �� � �� string EnableEndSessionButton '
� � � �� � �� sint32 EnableHomeButton '
� � � �� � �� sint32 EnableNavigationButtons '
� @ � �� � �� sint32 InstanceID
� ~ � �� string ParentID
� � � �� string RestartOnIdleTime '
�
� �� � �� sint32 � xٝ��C��
) ) 6 � �� � L ] x � � � � U������������/ � MDM_Policy_Config01_LanmanWorkstation02 InPartition > local-system DMWmiBridgeProv EnableInsecureGuestLogons '
� � � �� � �� sint32 InstanceID
� � � �� string ParentID
� ' � �� string nW � yٝ��C� ) ! . � �� � D U z � � & X b U����������������� � MDM_Policy_Config01_Licensing02 InPartition 6 local-system DMWmiBridgeProv AllowWindowsEntitlementReactivation '
� � � �� � �� sint32 DisallowKMSClientOnlineAVSValidation '
� � �� � �� sint32 InstanceID
� P � �� string ParentID
� � � �� string M � ~ٝ��C�� " ) ' 4 � �� � J [ � � � $ : w � � � ( 2 d � � � UU��������������������������������< � MDM_Policy_Config01_MSSecurityGuide02 InPartition < local-system DMWmiBridgeProv ApplyUACRestrictionsToLocalAccountsOnNetworkLogon '
� � � �� � �� string ConfigureSMBV1ClientDriver '
� � �� � �� string ConfigureSMBV1Server '
� o � �� � �� string EnableStructuredExceptionHandlingOverwriteProtection '
� � � �� � �� string InstanceID
� � �� string ParentID
� \ � �� string TurnOnWindowsDefenderProtectionAgainstPotentiallyUnwantedApplications '
� � � �� � �� string WDigestAuthentication '
� 4 � �� � �� string � ٝ��C� ) ! . � �� � D U � � I U � � � C M U������������������������� � MDM_Policy_Config01_MSSLegacy02 InPartition 6 local-system DMWmiBridgeProv AllowICMPRedirectsToOverrideOSPFGeneratedRoutes '
� � � �� � �� string AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers '
� A � �� � �� string InstanceID
� � �� string IPSourceRoutingProtectionLevel '
� � � �� � �� string IPv6SourceRoutingProtectionLevel '
� ; � �� � �� string ParentID
� w � �� string � �ٝ��C�\ + ) ( 5 � �� � K
\ v � � # ` � � � 4 q � � � & c m UU������������������������������������������ � MDM_Policy_Config01_NetworkIsolation02 InPartition = local-system DMWmiBridgeProv EnterpriseCloudResources '
� � � �� � �� string EnterpriseInternalProxyServers '
� � �� � �� string EnterpriseIPRange '
� X � �� � �� string EnterpriseIPRangesAreAuthoritative '
� � � �� � �� sint32 EnterpriseNetworkDomainNames '
� � �� � �� string EnterpriseProxyServers '
� i � �� � �� string EnterpriseProxyServersAreAuthoritative '
� � � �� � �� sint32 InstanceID
� � �� string NeutralResources $ '
� [ � �� � �� string ParentID
� � � �� string � �ٝ��C��
) % 2 � �� � H Y t � � � � U������������+ � MDM_Policy_Config01_Notifications02 InPartition : local-system DMWmiBridgeProv DisallowCloudNotification '
� � � �� � �� sint32 InstanceID
� � � �� string ParentID
� # � �� string ic � �ٝ��C�� ' ) # 0 � �� � F W o � � � � ; E w � � � , i � � � UU������������������������������������� � MDM_Policy_Config01_RemoteShell02 InPartition 8 local-system DMWmiBridgeProv AllowRemoteShellAccess '
� � � �� � �� string InstanceID
� � � �� string MaxConcurrentUsers '
� 3 � �� � �� string ParentID
� o � �� string SpecifyIdleTimeout '
� � � �� � �� string SpecifyMaxMemory '
� � �� � �� string SpecifyMaxProcesses '
� a � �� � �� string SpecifyMaxRemoteShells '
� � � �� � �� string SpecifyShellTimeout '
� � �� � �� string � �ٝ��C��
) ( 5 � �� � K \ v � � � � U������������- � MDM_Policy_Config01_RestrictedGroups02 InPartition = local-system DMWmiBridgeProv ConfigureGroupMembership '
� � � �� � �� string InstanceID
� � � �� string ParentID
� % � �� string ic �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� - J.3�� b � WDMClassesOfDriver MSNdis_MaximumFrameSize C:\Windows\system32\kernelbase.dll[MofResourceName] urceName] ] ceName] " � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o � " � MSFT_CliProperty __PATH __PATH ^ �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty k � MSFT_CliFormat table STATUS + � � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier m � � MSFT_CliProperty Name Name 1 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � ; D g � MSFT_CliProperty Version Product version information. Version L � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 64 j! �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty w � � MSFT_CliFormat list FULL < a g � N
! � ! 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � F S � MSFT_CliProperty Description A textual description of the product. Description 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � % � � � � MSFT_CliProperty IdentifyingNumber Product identification such as a serial number on software or a die number on a hardware chip. IdentifyingNumber � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 64 % 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � 5 ; ^ � MSFT_CliProperty Name Commonly used product name. Name C � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ( � MSFT_CliQualifier MaxLen # 256 � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � L W z � MSFT_CliProperty SKUNumber Product SKU (stock keeping unit) information. SKUNumber _ � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 64 � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � MSFT_CliProperty UUID The UUID property contains the Universally Unique Identifier (UUID) for this product. A UUID is a 128-bit identifier that is guaranteed to be different from other generated UUIDs. (If a UUID is not available, a UUID of all zeros is used). UUID � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier f @ H k � MSFT_CliProperty Vendor The name of the product's supplier. Vendor P � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ( � MSFT_CliQualifier MaxLen # 256 1 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � ; D g � MSFT_CliProperty Version Product version information. Version L � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 64 � �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � � � MSFT_CliFormat TABLE BRIEF 6 < e � � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � % � � � � MSFT_CliProperty IdentifyingNumber Product identification such as a serial number on software or a die number on a hardware chip. IdentifyingNumber � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 64 % 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � 5 ; ^ � MSFT_CliProperty Name Commonly used product name. Name C � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ( � MSFT_CliQualifier MaxLen # 256 " 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � � � MSFT_CliProperty Vendor The name of the product's supplier. Corresponds to the vendor property in the product object in the DMTF Solution Exchange Standard. Vendor � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ( � MSFT_CliQualifier MaxLen # 256 1 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � ; D g � MSFT_CliProperty Version Product version information. Version L � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 64 / 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � 9 B e � MSFT_CliProperty Caption A short textual description. Caption J � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 64 CSProduct Select * from Win32_ComputerSystemProduct 1ED8F1C3EB8104F5B04F97.299.340200108.336 IL_51D55482B7AF4894C57C3464572BF16B3F50568D4C97132E3EE18E297A796DF9.299.133372667.315 CI_8467A5D32DFAA09A39BDC8BB8DDCC953CDC4A4C5E390EC615CB5FA0C07CF5251 IL_77E8F3E5C979A568F3203DE2542233AA744B340EA7CD046A020B3F37D5ECA5F4.313.2787408018.315 CI_47C79E62C2227EDD0FF29BF44D87F2FAF9FEDF60A18D9F82597602BD95E20BD3 IL_2797AA0512B80E7E1C1A6BA2AC1D2A5EAB929047EBF4944B5812DE3C32DEE06C.313.3339732749.299 CI_0A7ABE63F36E2B2920FEDAFAE849823AF9429CC0EA373FFEE1507EDB21FD9170 IL_8E80D45658E49966FC3BA567F2C75690AE48EBAB9A2568429675180214107ACE.313.3794122579.331 NS_E1578D36E8972985C3607CB2490418C572C190C71151F301302674342C5C885D KI_FD3BBD4C42AC2F7FEF264340A9EB78A581FE5C28561CB63EDF780B329EAC2EE4 CI_64659AB9F8F1C4B568DB6438BAE11B26EE8F93CB5F8195E21E8C383D6C44CC41 IL_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.297.1196371280.188 I_F461AA66D8B7B7D281791B03410E52860C27B31270AE3EE90F1659A118058546.389.1.47882 I_FD7092A4531E1D5420328B4DF5F17D0BB4CCBF2A132542C00A61B45BBF11451C.395.1.26559 I_E3D6956C9AC5D82845A5B017A22EF25487755E3C3A9322BE0116D0C7010A0C20.570.1.55789 I_F693673C4CEEE255A0773D7A8C79A487F5442508823CBC6EC11DEA6527F363E6.577.1.17537 I_F65757B9154C5EBDDAE70D4285BD74985CCB42751F841E9E56AE020776DD15BB.580.1.61471 I_EFEB887E59EC8D83C39D53CCF57EF6AD0D608FCDC88B6F50F3452B5EEBD4BF9F.598.1.47802 I_E00A8EF4F74D23B882355F3A0D21293BA28C6F1C8A1BC8F9B30030B2F4330712.656.1.32485 I_E14960055650ADAC2C06C29022467C3EF58831F50C9AFF42B1D1C7B072FAC7F1.669.1.53493 I_E0F2EFD539B7928A3CD461462D4CD79A5C30C390909F42CDB98D7B4B987E4A6E.716.1.265536 I_DE468BF74FB57C16C2FE0AF90126FE83C9B098410A7D38A4977B5C5D80E7C5B5.798.1.60719 I_F90254E7F99DA09977CCA3AFC876E2F69B143A5C7B620A38194806CCC0551447.811.1.92690 I_E21083758A128727DEF6FF7FB30AAB8529BDD6F7C5C936DBCA6F06226211C86C.854.1.52579 I_D66C684E9FC811F59DEEE01676A52DEC4EE3ED220BA185CD83762B906B852957.884.1.79329 I_D4987B113B08C3865459E47A2D1ADCA49682B6AFDB4DC21088112FF54FBA16D7.894.1.69984 I_DC022C56ADDC30CC3E115551AF0C2E3A0D951D2FE3A0143EA391171B0F62E529.947.1.67353 I_DBCFCBC22EEC426EE5798CBD5AADB02EA04474BB9D6D7248938C46C668E4F016.958.1.126857 I_F55E9786D9F50DBDFB52762DDD65690364DF865004D37F7A0B919F2DED2C5FD1.318.1.19893 I_DE57F7AE8FB501996807E146319066676112A55DF9DC0135A1A8C6E4EBECC8B8.342.1.89245 Property Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __RELPATH __RELPATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier q � & � MSFT_CliProperty __SERVER __SERVER � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __SUPERCLASS __SUPERCLASS I �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty V � � MSFT_CliFormat INSTANCE �L F D 3 B B D 4 C 4 2 A C 2 F 7 F E F 2 6 4 3 4 0 A 9 E B 7 8 A 5 8 1 F E 5 C 2 8 5 6 1 C B 6 3 E D F 7 8 0 B 3 2 9 E A C 2 E E 4 �b��5��͝��C� L + � q { � � �K� MSFT_CliAlias � F N u � � � � �
U�������������������������4 � MSFT_CliConnection Authority
� > STRING Locale
� m STRING NameSpace
� � STRING Password
� � STRING Server
� � STRING User
� , STRING | � ( + � MSFT_CliConnection ms_409 ROOT\CIMV2 . CIM_DataFile is a type of logical file that is a named collection of data or executable code./n<B>The behavior of the provider backing this class will be changed in future releases. Currently the provider returns both files on fixed disks as well as files on mapped logical disks. In the future, only instances of files on local fixed disks will be returned.<B> � � t# ^I k K �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty X � � MSFT_CliFormat INSTANCE " � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o � � � � MSFT_CliProperty Name The Name property is a string representing the inherited name that serves as a key of a logical file instance within a file system. Full path names should be provided. Example: c:\winnt\system\win.ini Name s �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � + � MSFT_CliFormat SYSTEM
D � � U � b
�
x � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty __CLASS __CLASS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __DERIVATION __DERIVATION � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __DYNASTY __DYNASTY � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty __GENUS __GENUS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier t � , � MSFT_CliProperty __NAMESPACE __NAMESPACE � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o � " � MSFT_CliProperty __PATH __PATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier y � $ 6 � MSFT_CliProperty __PROPERTY_COUNT __PROPERTY_COUNT � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __RELPATH __RELPATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier q � & � MSFT_CliProperty __SERVER __SERVER � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __SUPERCLASS __SUPERCLASS �% �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty �$ � � MSFT_CliFormat TABLE STATUS + � � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � � � MSFT_CliProperty Status The Status property is a string indicating the current status of the object. Various operational and non-operational statuses can be defined. Operational statuses are "OK", "Degraded" and "Pred Fail". "Pred Fail" indicates that an element may be functioning properly but predicting a failure in the near future. An example is a SMART-enabled hard drive. Non-operational statuses can also be specified. These are "Error", "Starting", "Stopping" and "Service". The latter, "Service", could apply during mirror-resilvering of a disk, reload of a user permissions list, or other administrative work. Not all such work is on-line, yet the managed element is neither "OK" nor in one of the other states. Status � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 10 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING ` � � MSFT_CliQualifier ValueMap Q U \ f o z � � � � � � OK Error Degraded Unknown Pred Fail Starting Stopping Service Stressed NonRecover No Contact Lost Comm � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING Q � � MSFT_CliQualifier Values O S Z d m x � � � � � � OK Error Degraded Unknown Pred Fail Starting Stopping Service Stressed NonRecover No Contact Lost Comm � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o � � � � MSFT_CliProperty Name The Name property is a string representing the inherited name that serves as a key of a logical file instance within a file system. Full path names should be provided. Example: c:\winnt\system\win.ini Name ��y� � E2L� �:�� � ;7�a� ��ټ n���� d蒐� 16�$�
x�p ^%@�
�pܠ- jp��> ���W �9��q z�@� �bCv� 1-� V�=� p��n� HRF� J� � ��S*2 �ZK 0mFi �|} K�!� �ٝ��C��
) 0 = � �� � S d p � � � , U������������i � MDM_Policy_Result01_WindowsConnectionManager02 InPartition E local-system DMWmiBridgeProv InstanceID
� � � �� string ParentID
� � � �� string ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork '
� a � �� � string ws � ڝ��C�� ) * 7 � �� � K \ { � � M W U����������������� � MDM_Policy_User_Config01_Notifications02 InPartition ? local-user DMWmiBridgeProv DisallowNotificationMirroring '
� � � �� � �� sint32 DisallowTileNotification '
� � �� � �� sint32 InstanceID
� E � �� string ParentID
� � � �� string M �7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D z��C�
ȝ��C�k T � __MethodProviderRegistration \\.\root\cimv2\mdm:__Win32Provider.Name="MDMAppProv" 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 #�n�^��
͝��C�� - J.3�� b � WDMClassesOfDriver MSNdis_CoHardwareStatus C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 $�n�^��
͝��C�� - J.3�� b � WDMClassesOfDriver MSNdis_CoMediaSupported C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 %�n�^��
͝��C�� ) J.3�� ^ � WDMClassesOfDriver MSNdis_CoMediaInUse C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 &�n�^��
͝��C�� ( J.3�� ] � WDMClassesOfDriver MSNdis_CoLinkSpeed C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 '�n�^��
͝��C� ' J.3�� \ � WDMClassesOfDriver MSNdis_CoVendorId C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 (�n�^��
͝��C�� 0 J.3�� e � WDMClassesOfDriver MSNdis_CoVendorDescription C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 )�n�^��
͝��C�� , J.3�� a � WDMClassesOfDriver MSNdis_CoDriverVersion C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 *�n�^��
͝��C�� ) J.3�� ^ � WDMClassesOfDriver MSNdis_CoMacOptions C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 +�n�^��
͝��C�� 1 J.3�� f � WDMClassesOfDriver MSNdis_CoMediaConnectStatus C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ,�n�^��
͝��C�� 2 J.3�� g � WDMClassesOfDriver MSNdis_CoVendorDriverVersion C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 -�n�^��
͝��C�� / J.3�� d � WDMClassesOfDriver MSNdis_CoMinimumLinkSpeed C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 .�n�^��
͝��C�� - J.3�� b � WDMClassesOfDriver MSNdis_CoTransmitPdusOk C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 /�n�^��
͝��C�� , J.3�� a � WDMClassesOfDriver MSNdis_CoReceivePdusOk C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 0�n�^��
͝��C�� 0 J.3�� e � WDMClassesOfDriver MSNdis_CoTransmitPduErrors C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 1�n�^��
͝��C�� / J.3�� d � WDMClassesOfDriver MSNdis_CoReceivePduErrors C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 2�n�^��
͝��C�� 2 J.3�� g � WDMClassesOfDriver MSNdis_CoReceivePdusNoBuffer C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 3�n�^��
͝��C�� 0 J.3�� e � WDMClassesOfDriver MSNdis_AtmSupportedVcRates C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 4�n�^��
͝��C�� 8 J.3�� m � WDMClassesOfDriver MSNdis_AtmSupportedServiceCategory C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 5�n�^��
͝��C�� 1 J.3�� f � WDMClassesOfDriver MSNdis_AtmSupportedAalTypes C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 6�n�^��
͝��C�� 6 J.3�� k � WDMClassesOfDriver MSNdis_AtmHardwareCurrentAddress C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 7�n�^��
͝��C�� , J.3�� a � WDMClassesOfDriver MSNdis_AtmMaxActiveVcs C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 8�n�^��
͝��C�� 0 J.3�� e � WDMClassesOfDriver MSNdis_AtmMaxActiveVciBits C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 9�n�^��
͝��C�� 0 J.3�� e � WDMClassesOfDriver MSNdis_AtmMaxActiveVpiBits C:\Windows\system32\kernelbase.dll[MofResourceName] EthernetReceiveErrorAlignment C:\Windows\system32\kernelbase.dll[MofResourceName] �! �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � � � MSFT_CliFormat TABLE BRIEF F � � � ' �
E g ? 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � r ~ � MSFT_CliProperty Compressed The Compressed property is a boolean value indicating that the file is compressed. Compressed ; 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � o z � MSFT_CliProperty Encrypted The Encrypted property is a boolean value indicating that the file is encrypted. Encrypted * 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � _ e � MSFT_CliProperty FileSize The FileSize property represents the size of the file (in bytes). Size - 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � d l � MSFT_CliProperty Hidden The Hidden property is a boolean value indicating if the file is hidden. Hidden � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o � � � � MSFT_CliProperty Name The Name property is a string representing the inherited name that serves as a key of a logical file instance within a file system. Full path names should be provided. Example: c:\winnt\system\win.ini Name 5 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � j t � MSFT_CliProperty Readable The Readable property is a boolean value indicating if the file can be read. Readable 4 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � k x � MSFT_CliProperty System The system property is a boolean value indicating if the file is a system file. System File 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � T ] � MSFT_CliProperty Version Version string from version resource if one is present. Version ; 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � o z � MSFT_CliProperty Writeable The Writeable property is a boolean value indicating if the file can be written. Writeable W� �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty d� Ba � MSFT_CliFormat LIST FULL ! � � =
J d � � S � � � �" �& <) �+ �- 0 x2 �4 �6 d9 �; > p@ �B NE �G �I �Z �\ _ V 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � � MSFT_CliProperty AccessMask The AccessMask property is a bit array representing the access rights to the given file or directory held by the user or group on whose behalf the instance is returned. This property is only supported under Windows NT and Windows 2000. On Windows 98 and on Windows NT/2000 FAT volumes, FULL_ACCESS is returned, indicating no security has been set on the object. Access Rights ; 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � q � � MSFT_CliProperty Archive The Archive property is a boolean value indicating that the file should be archived. Should Be Archived � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � q z � � MSFT_CliProperty Caption The Caption property is a short textual description (one-line string) of the object. Caption � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 64 ? 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � r ~ � MSFT_CliProperty Compressed The Compressed property is a boolean value indicating that the file is compressed. Compressed 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � % B V � MSFT_CliProperty CompressionMethod The CompressionMethod property is a free form string indicating the algorithm or tool used to compress the logical file. If it is not possible (or not desired) to describe the compression scheme (perhaps because it is not known), use the following words: "Unknown" to represent that it is not known whether the logical file is compressed or not, "Compressed" to represent that the file is compressed but either its compression scheme is not known or not disclosed, and "Not Compressed" to represent that the logical file is not compressed. Compression Method H 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � % t � � MSFT_CliProperty CreationClassName The CreationClassName property is a string indicating the name of this class. Class Name C 9 E R y � � U������ � gh\w s ��}� � �}0 ~ ݣp�
�
4�ܪ { ж��% � CR� � [�<O �E� R , X e S q l P k g _ s q l _ t r a n s a c t i o n _ c o m m i t _ s i n g l e _ p h a s e E]��7 �W # 6 XeSqlPkg_sql_transaction_commit_single_phase . ) � ��% 0 > J � K W � � $ 5 � � . > WU���������������������������������� � sql_transaction_commit_single_phase EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� 8 @ � �� uint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId is_delayed_durable )
� � �� sint8 WmiDataId RemainingLength 6
� y � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � �� uint32 WmiDataId Description SequenceNumber transaction_id )
� u } � �� sint64 WmiDataId � X e S q l P k g F]��7 �K XeSqlPkg
C � ��! . w } � � � � c����� � XeSqlPkg_rpc_starting_aggregate Description Occurs periodically, aggregating all occasions an rpc call is started. Guid {3C504899-AA99-4C69-8E2B-5F2258FB0934} locale MS\0x409 DisplayName rpc_starting_aggregate � X e S q l P k g _ r p c _ s t a r t i n g _ a g g r e g a t e G]��7 �? ' ) XeSqlPkg_rpc_starting_aggregate ! ) � �� # 1 = � � � � � s � � } � ' WU�������������������������������������q � rpc_starting_aggregate EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid app_name C
� B J � ��U h x � string WmiDataId StringTermination NullTerminated Format w FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId low_key
6
� L T � ��_ j object WmiDataId Extension Variant RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� M U ` m � �� uint32 WmiDataId Description SequenceNumber tablegroup_name C
� � � � ��� string WmiDataId StringTermination NullTerminated Format w total )
� ^ f � �� uint32 WmiDataId � X e S q l P k g H]��7 �V XeSqlPkg
C � ��' 4 | � � � � � c����� � XeSqlPkg_sql_batch_starting_aggregate Description Occurs periodically, aggregating all occasions a sql batch is started. Guid {CA3974E7-5865-4CF5-8AE3-FA398C4A756E} locale MS\0x409 DisplayName sql_batch_starting_aggregate �% X e S q l P k g _ s q l _ b a t c h _ s t a r t i n g _ a g g r e g a t e I]��7 �K ' / XeSqlPkg_sql_batch_starting_aggregate ' ) � �� ) 7 C � � � � y � � � � & - WU�������������������������������������w � sql_batch_starting_aggregate EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid app_name C
� H P � ��[ n ~ � string WmiDataId StringTermination NullTerminated Format w FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId low_key
6
� R Z � ��e p object WmiDataId Extension Variant RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� S [ f s � �� uint32 WmiDataId Description SequenceNumber tablegroup_name C
� � � � ��� # string WmiDataId StringTermination NullTerminated Format w total )
� d l � �� uint32 WmiDataId � X e S q l P k g J]��7 �S XeSqlPkg
C � ��% 2 { � � � � � c����� � XeSqlPkg_rpc_starting_aggregate_xdb Description Occurs periodically, aggregating all occasions an rpc call is started. Guid {1DFE34E7-BB5D-498E-B2E3-C316ECFC6D36} locale MS\0x409 DisplayName rpc_starting_aggregate_xdb �# X e S q l P k g _ r p c _ s t a r t i n g _ a g g r e g a t e _ x d b K]��7 �F 3 - XeSqlPkg_rpc_starting_aggregate_xdb % ) � �� '
5 A � � � � � � _ r � � ] n � � � � WU������������������������������������������������X � rpc_starting_aggregate_xdb EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid db_name ( C
� E M � ��X k { � string WmiDataId StringTermination NullTerminated Format w fabric_replica_id )
� � � � �� sint64 WmiDataId FragmentId 6
� 3 ; F S � �� uint32 WmiDataId Description FragmentId hadr_partition_id
$ 6
� � � � ��� � object:guid WmiDataId Extension Guid hadr_replica_id
6
� 4 A � ��L W object:guid WmiDataId Extension Guid RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength replica_name
, C
� B J
� ��U h x � string WmiDataId StringTermination NullTerminated Format w SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber total )
� E M � �� uint32 WmiDataId � X e S q l P k g L]��7 �^ XeSqlPkg
C � ��+ 8 � � � � � � c����� � XeSqlPkg_sql_batch_starting_aggregate_xdb Description Occurs periodically, aggregating all occasions a sql batch is started. Guid {12CC1134-7F0F-4D13-B021-BD93D13D474A} locale MS\0x409 DisplayName sql_batch_starting_aggregate_xdb �4 3 C 8 6 C 3 E 5 B 2 B 7 F 1 D D 0 4 4 3 A 6 D A 4 E 1 7 A A 9 5 D 6 5 F 5 6 E E 0 C 1 9 C F 4 F D 3 B 5 D 9 A 5 F 6 3 C 5 2 2 E<K�]�u͝��C�s 0 9 �� R � HNet_Connection {1AF0CA1E-7D0E-40C4-9D41-612E11B0685D} Local Area Connection 2 A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 F<K�]�v͝��C�| �� Z � HNet_ConnectionProperties HNet_Connection.Guid="{1AF0CA1E-7D0E-40C4-9D41-612E11B0685D}" Offload C:\Windows\system32\kernelbase.dll[MofResourceName] SequenceNumber �8E3E94B92567D31F8ED34E1C8D99E55FFB8F4 n XactSequence �e] ���������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � t � � MSFT_CliProperty CreationDate The CreationDate property is a datetime value indicating the file's creation date. Creation Date X 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � ' � � � MSFT_CliProperty CSCreationClassName The CSCreationClassName property is a string indicating the class of the computer system. Computer System Class Name 0 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � g } � MSFT_CliProperty CSName The CSName property is a string indicating the name of the computer system. Computer System Name 6 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � h u � MSFT_CliProperty Description The Description property provides a textual description of the object. Description J 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � � MSFT_CliProperty Drive The Drive property is a string representing the drive letter (including colon) of the file. Example: c: Drive � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier F � ) � � � MSFT_CliProperty EightDotThreeFileName The EightDotThreeFileName property is a string representing the DOS-compatible file name for this file./nExample: c:\progra~1 Eight Dot Three File Name ; 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � o z � MSFT_CliProperty Encrypted The Encrypted property is a boolean value indicating that the file is encrypted. Encrypted 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � $ 5 H � MSFT_CliProperty EncryptionMethod The EncryptionMethod property is a free form string indicating the algorithm or tool used to encrypt the logical file. If it is not possible (or not desired) to describe the encryption scheme (perhaps for security reasons), use the following words: "Unknown" to represent that it is not known whether the logical file is encrypted or not, "Encrypted" to represent that the file is encrypted but either its encryption scheme is not known or not disclosed, and "Not Encrypted" to represent that the logical file is not encrypted. Encryption Method Z 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � � MSFT_CliProperty Extension The Extension property is a string representing the file's extension (without the dot). Example: txt, mof, mdb. File Extension W 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � � MSFT_CliProperty FileName The FileName property is a string representing the filename (without extension) of the file. Example: autoexec File Name * 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � _ e � MSFT_CliProperty FileSize The FileSize property represents the size of the file (in bytes). Size W 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � � MSFT_CliProperty FileType The FileType property is a string descriptor representing the file type (indicated by the Extension property). File Type T 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � ' ~ � � MSFT_CliProperty FSCreationClassName The FSCreationClassName property is a string indicating the class of the file system. File System Class Name * 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � a s � MSFT_CliProperty FSName The FSName property is string indicating the name of the file system. File System Name - 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � d l � MSFT_CliProperty Hidden The Hidden property is a boolean value indicating if the file is hidden. Hidden � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier O � � � � MSFT_CliProperty InstallDate The InstallDate property is datetime value indicating when the object was installed. A lack of a value does not indicate that the object is not installed. Install Date d 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier * � � � � MSFT_CliProperty InUseCount The InUseCount property is an integer indicating the number of 'file opens' that are currently active against the file. Current File Open Count N 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � MSFT_CliProperty LastAccessed The LastAccessed property is a datetime value indicating the time the file was last accessed. Last Accessed N 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � MSFT_CliProperty LastModified The LastModified property is a datetime value indicating the time the file was last modified. Last Modified - 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � ^ l � MSFT_CliProperty Manufacturer Manufacturer string from version resource if one is present. Manufacturer � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o � � � � MSFT_CliProperty Name The Name property is a string representing the inherited name that serves as a key of a logical file instance within a file system. Full path names should be provided. Example: c:\winnt\system\win.ini Name k 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier 1 � � � � MSFT_CliProperty Path The Path property is a string representing the path of the file. This includes leading and trailing backslashes. Example: \windows\system\ Path 5 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � j t � MSFT_CliProperty Readable The Readable property is a boolean value indicating if the file can be read. Readable � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � � � MSFT_CliProperty Status The Status property is a string indicating the current status of the object. Various operational and non-operational statuses can be defined. Operational statuses are "OK", "Degraded" and "Pred Fail". "Pred Fail" indicates that an element may be functioning properly but predicting a failure in the near future. An example is a SMART-enabled hard drive. Non-operational statuses can also be specified. These are "Error", "Starting", "Stopping" and "Service". The latter, "Service", could apply during mirror-resilvering of a disk, reload of a user permissions list, or other administrative work. Not all such work is on-line, yet the managed element is neither "OK" nor in one of the other states. Status � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 10 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING ` � � MSFT_CliQualifier ValueMap Q U \ f o z � � � � � � OK Error Degraded Unknown Pred Fail Starting Stopping Service Stressed NonRecover No Contact Lost Comm � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING Q � � MSFT_CliQualifier Values O S Z d m x � � � � � � OK Error Degraded Unknown Pred Fail Starting Stopping Service Stressed NonRecover No Contact Lost Comm 4 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � k x � MSFT_CliProperty System The system property is a boolean value indicating if the file is a system file. System File 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � T ] � MSFT_CliProperty Version Version string from version resource if one is present. Version ; 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � o z � MSFT_CliProperty Writeable The Writeable property is a boolean value indicating if the file can be written. Writeable |ᥢ` �]� h K X�a� Z #Z�m
� ��tצ N S Q L T r a c e E v e n t 1 2 9 P��7 �� SQLTraceEvent129 6 � �� % S ^ m p � 7 C � � t � 1 = � � / > � � j t � � ^ i # � � L Z
� � �
�
� � 8 J
q
|
�
�
a k ) � � UUUUUU������������������������������������������������������������������������������������������������������������������������� � SQLTraceEvent129_TYPE0 Description Audit Database Object Management Event Type0 EventType EventTypeName 0 ApplicationName P
� � � � � . � �� string WmiDataId Description ApplicationName format w StringTermination Counted DatabaseID 6
� � � � � � �� sint32 WmiDataId Description DatabaseID DatabaseName L P
� ' 2 ? M U X k � �� string WmiDataId Description DatabaseName format w StringTermination Counted DBUserName T P
� � � � �
( � �� string WmiDataId Description DBUserName format w StringTermination Counted EventClass
< 6
� � � � � � �� sint32 WmiDataId Description EventClass EventSequence h 6
� � �� sint64 WmiDataId Description EventSequence EventSubClass 4 6
� � � � � � �� sint32 WmiDataId Description EventSubClass HostName P
� ! , 9 C K N a � �� string WmiDataId Description HostName format w StringTermination Counted IsSystem p 6
� � � � � � �� sint32 WmiDataId Description IsSystem LineNumber 6
� 2 : E R � �� sint32 WmiDataId Description LineNumber LoginName $ P
� � � � � � � � � �� string WmiDataId Description LoginName format w StringTermination Counted LoginSid X P
� � � � � � � � � � �� string WmiDataId Description LoginSid format c StringTermination Counted NestLevel D 6
� ! ) 4 A � �� sint32 WmiDataId Description NestLevel NTDomainName P
� � � � � � � � � �� string WmiDataId Description NTDomainName format w StringTermination Counted NTUserName P
� w � � � � � � � �� string WmiDataId Description NTUserName format w StringTermination Counted ObjectName H P
� 4
<
G
T
`
h
k
~
� �� string WmiDataId Description ObjectName format w StringTermination Counted ObjectType @ 6
� �
�
�
�
� �� sint32 WmiDataId Description ObjectType OwnerName P P
� l t � � � � � � �� string WmiDataId Description OwnerName format w StringTermination Counted RequestID \ 6
�
- � �� sint32 WmiDataId Description RequestID SessionLoginName t P
� � � � � � � � � � �� string WmiDataId Description SessionLoginName format w StringTermination Counted SPID ( 6
� K
S
^
k
� �� sint32 WmiDataId Description SPID StartTime
, 6
� �
�
�
�
� �� uint64 WmiDataId Description StartTime Success 8 6
� 8 @
K X � �� sint32 WmiDataId Description Success TextData P
� � � � � � � � � �� string WmiDataId Description TextData format w StringTermination Counted TransactionID 6
� m u � � � �� sint64 WmiDataId Description TransactionID XactSequence ` 6
� � � � �� sint64 WmiDataId Description XactSequence � M S S Q L S E R V E R T r a c e !P��7 � MSSQLSERVERTrace 6 � �� J P v � � � SQLTraceEvent130 Description Audit Database Principal Management Event Guid 84e993e6-0082-4d70-97ef-3824ed2c4e93 DisplayName Audit Database Principal Management Event io � X e S q l P k g 2Q��7 �2 XeSqlPkg
C � ��) 6 V \ � � � � c����� � XeSqlPkg_host_task_ring_buffer_recorded Description AppDomain ring buffer recorded Guid {767976cf-67f7-4736-90f1-35de8df6ee74} locale MS\0x409 DisplayName host_task_ring_buffer_recorded �' X e S q l P k g _ h o s t _ t a s k _ r i n g _ b u f f e r _ r e c o r d e d 3Q��7 �3 D 1 XeSqlPkg_host_task_ring_buffer_recorded ) ) � �� + 9 F � � r ~ ( 4 � � : M � � � X l � � < L � � Y p � � WUU���������������������������������������������������������������� � host_task_ring_buffer_recorded EventType EventVersion abort_state
8 C
� � �
� ��� � � � string WmiDataId StringTermination NullTerminated Format w action 0 C
� 1 9 � ��D W g o string WmiDataId StringTermination NullTerminated Format w ActivityId
N
� � � � � �� � �� " object:guid WmiDataId Description ActivityId ActivityID Extension Guid call_stack
< C
� � � � ��� � � � object WmiDataId Extension Variant XEVLD callstack FragmentId 6
� ! . � �� uint32 WmiDataId Description FragmentId host_task_address
4
� � � � ��� �� object WmiDataId Pointer id )
� � � � �� uint32 WmiDataId leave_runtime_count ( )
� E M � �� sint32 WmiDataId non_yielding_count
, )
� � �
� �� sint32 WmiDataId RemainingLength 6
� + � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber state 4 C
� � ��+ > N V string WmiDataId StringTermination NullTerminated Format w thread_affinity_count $ )
� � � � �� sint32 WmiDataId timestamp0 )
� � � �� uint64 WmiDataId � X e S q l P k g 4Q��7 �& XeSqlPkg
C � ��% 2 N T | � � � c����� � XeSqlPkg_error_ring_buffer_recorded Description Error ring buffer recorded Guid {757e6281-b8b7-47b8-bbe0-3d4944fcc16a} locale MS\0x409 DisplayName error_ring_buffer_recorded �ded �9 A B 5 3 8 0 6 E 8 8 6 6 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0 �"�zw`� ͝��C�l Xѣ� D� K � WMIBinaryMofResource C:\Windows\System32\drivers\monitor.sys[MonitorWMI] DataFile Where Name = '#' Select * from CIM_DataFile � �- ZJ �X :g �s ,� �� �� �� �� � 2 �< � � A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 �
� - ' 6 � MSFT_CliVerb TakeOwnerShip The TakeOwnerShip method obtains ownership of the logical file specified in the object path . If the logical file is actually a directory, then TakeOwnerShip will act recursively, taking ownership of all the files and sub-directories the directory contain TakeOwnerShip 9 � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap
U X [ ^ a e i m q u y } � 0 2 8 9 10 11 12 13 14 15 16 17 21 X � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � R � MSFT_CliQualifier Values
S \ k � � � � � � + ? Success Access Denied Unspecified failure Invalid object Object already exists File system not NTFS Platform not NT/Windows 2000 Drive not the same Directory not empty Sharing violation Invalid start file Privilege not held Invalid parameter TakeOwnerShip � � A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 � ) * E U O
j
� MSFT_CliVerb ChangeSecurityPermissions The ChangeSecurityPermissions method changes the security permissions for the logical file specified in the object path. If the logical file is actually a directory, then ChangeSecurityPermissions will act recursively, changing the security permissions of ChangeSecurityPermissions Q � r � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � ? 6 > � MSFT_CliParam Option � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True UINT32 � � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � ? # B J � MSFT_CliParam SecurityDescriptor + � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True OBJECT a � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap
U X [ ^ a e i m q u y } � 0 2 8 9 10 11 12 13 14 15 16 17 21 X � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � R � MSFT_CliQualifier Values
S \ k � � � � � � + ? Success Access Denied Unspecified failure Invalid object Object already exists File system not NTFS Platform not NT/Windows 2000 Drive not the same Directory not empty Sharing violation Invalid start file Privilege not held Invalid parameter ChangeSecurityPermissions f � A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 k � � � � MSFT_CliVerb Copy The Copy method copies the logical file or directory specified in the object path to the location specified by the input parameter. Copy returns an integer value of 0 if the file was successfully copied, and any other number to indicate an error. A copy i Copy # v � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � ? 8 @ � MSFT_CliParam FileName ! � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True STRING � ; � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap
U X [ ^ a e i m q u y } � 0 2 8 9 10 11 12 13 14 15 16 17 21 X � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � R � MSFT_CliQualifier Values
S \ k � � � � � � + ? Success Access Denied Unspecified failure Invalid object Object already exists File system not NTFS Platform not NT/Windows 2000 Drive not the same Directory not empty Sharing violation Invalid start file Privilege not held Invalid parameter Copy r � A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 w � � � � MSFT_CliVerb Rename The Rename method renames the logical file (or directory) specified in the object path. Rename returns an integer value of 0 if the file was successfully renamed, and any other number to indicate an error. A rename is not supported if the destination is o Rename ' v � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � ? 8 @ � MSFT_CliParam FileName ! � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True STRING � ? � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap
U X [ ^ a e i m q u y } � 0 2 8 9 10 11 12 13 14 15 16 17 21 X � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � R � MSFT_CliQualifier Values
S \ k � � � � � � + ? Success Access Denied Unspecified failure Invalid object Object already exists File system not NTFS Platform not NT/Windows 2000 Drive not the same Directory not empty Sharing violation Invalid start file Privilege not held Invalid parameter Rename o � A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 t
� " � MSFT_CliVerb Delete The Delete method will delete the logical file (or directory) specified in the object path. Delete returns an integer value of 0 if the file was successfully deleted, and any other number to indicate an error./nIt returns one of the following integer value Delete , � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap
U X [ ^ a e i m q u y } � 0 2 8 9 10 11 12 13 14 15 16 17 21 X � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � R � MSFT_CliQualifier Values
S \ k � � � � � � + ? Success Access Denied Unspecified failure Invalid object Object already exists File system not NTFS Platform not NT/Windows 2000 Drive not the same Directory not empty Sharing violation Invalid start file Privilege not held Invalid parameter Delete { � A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 �
� $ ( � MSFT_CliVerb Compress The Compress method compresses the logical file (or directory) specified in the object path. Compress returns an integer value of 0 if the file was successfully compressed, and any other number to indicate an error./nIt returns one of the following integer Compress 0 � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap
U X [ ^ a e i m q u y } � 0 2 8 9 10 11 12 13 14 15 16 17 21 X � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � R � MSFT_CliQualifier Values
S \ k � � � � � � + ? Success Access Denied Unspecified failure Invalid object Object already exists File system not NTFS Platform not NT/Windows 2000 Drive not the same Directory not empty Sharing violation Invalid start file Privilege not held Invalid parameter Compress � � A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 �
� ( " . � MSFT_CliVerb Uncompress The Uncompress method uncompresses the logical file (or directory) specified in the object path. Uncompress returns an integer value of 0 if the file was successfully decompressed, and any other number to indicate an error./nIt returns one of the following Uncompress 4 � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap
U X [ ^ a e i m q u y } � 0 2 8 9 10 11 12 13 14 15 16 17 21 X � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � R � MSFT_CliQualifier Values
S \ k � � � � � � + ? Success Access Denied Unspecified failure Invalid object Object already exists File system not NTFS Platform not NT/Windows 2000 Drive not the same Directory not empty Sharing violation Invalid start file Privilege not held Invalid parameter Uncompress � � A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 � 1 � � � � MSFT_CliVerb TakeOwnerShipEx The TakeOwnerShipEx method obtains ownership of the logical file specified in the object path. If the logical file is actually a directory, then this method will act recursively, taking ownership of all the files and sub-directories the directory contains TakeOwnerShipEx A � A x � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � ? 9 B � MSFT_CliParam Recursive " � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True BOOLEAN � � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � ? = E � MSFT_CliParam StartFileName & � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True STRING � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � ? = E � MSFT_CliParam StopFileName % � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING f & � MSFT_CliQualifier Out True STRING � b
� � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap
U X [ ^ a e i m q u y } � 0 2 8 9 10 11 12 13 14 15 16 17 21 X � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � R � MSFT_CliQualifier Values
S \ k � � � � � � + ? Success Access Denied Unspecified failure Invalid object Object already exists File system not NTFS Platform not NT/Windows 2000 Drive not the same Directory not empty Sharing violation Invalid start file Privilege not held Invalid parameter TakeOwnerShipEx � � A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 � + , I � � � � MSFT_CliVerb ChangeSecurityPermissionsEx The ChangeSecurityPermissionsEx method changes the security permissions for the logical file specified in the object path. If the logical file is actually a directory, then this method will act recursively, changing the security permissions of all the fil ChangeSecurityPermissionsEx a � S � e r � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � ? 6 > � MSFT_CliParam Option � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True UINT32 x � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � ? 9 B � MSFT_CliParam Recursive " � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True BOOLEAN � � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � ? # B J � MSFT_CliParam SecurityDescriptor + � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True OBJECT � � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � ? = E � MSFT_CliParam StartFileName & � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True STRING � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � ? = E � MSFT_CliParam StopFileName % � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING f & � MSFT_CliQualifier Out True STRING � � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap
U X [ ^ a e i m q u y } � 0 2 8 9 10 11 12 13 14 15 16 17 21 X � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � R � MSFT_CliQualifier Values
S \ k � � � � � � + ? Success Access Denied Unspecified failure Invalid object Object already exists File system not NTFS Platform not NT/Windows 2000 Drive not the same Directory not empty Sharing violation Invalid start file Privilege not held Invalid parameter ChangeSecurityPermissionsEx q � A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 v 0 * 2 � MSFT_CliVerb CopyEx The CopyEx method copies the logical file or directory specified in the object path to the location specified by the FileName parameter. CopyEx returns an integer value of 0 if the file was successfully copied, and any other number to indicate an error. A CopyEx 3 � ) � v � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � ? 8 @ � MSFT_CliParam FileName ! � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True STRING x � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � ? 9 B � MSFT_CliParam Recursive " � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True BOOLEAN � � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � ? = E � MSFT_CliParam StartFileName & � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True STRING � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � ? = E � MSFT_CliParam StopFileName % � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING f & � MSFT_CliQualifier Out True STRING < � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap
U X [ ^ a e i m q u y } � 0 2 8 9 10 11 12 13 14 15 16 17 21 X � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � R � MSFT_CliQualifier Values
S \ k � � � � � � + ? Success Access Denied Unspecified failure Invalid object Object already exists File system not NTFS Platform not NT/Windows 2000 Drive not the same Directory not empty Sharing violation Invalid start file Privilege not held Invalid parameter CopyEx � � A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 � # 6 0
:
� MSFT_CliVerb DeleteEx The DeleteEx method will delete the logical file (or directory) specified in the object path. DeleteEx returns an integer value of 0 if the file was successfully deleted, and any other number to indicate an error. DeleteEx is an extended version of the De DeleteEx / � � � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � ? = E � MSFT_CliParam StartFileName & � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True STRING � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � ? = E � MSFT_CliParam StopFileName % � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING f & � MSFT_CliQualifier Out True STRING B � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap
U X [ ^ a e i m q u y } � 0 2 8 9 10 11 12 13 14 15 16 17 21 X � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � R � MSFT_CliQualifier Values
S \ k � � � � � � + ? Success Access Denied Unspecified failure Invalid object Object already exists File system not NTFS Platform not NT/Windows 2000 Drive not the same Directory not empty Sharing violation Invalid start file Privilege not held Invalid parameter DeleteEx � � A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 � ' � � � � MSFT_CliVerb CompressEx The CompressEx method compresses the logical file (or directory) specified in the object path. CompressEx returns an integer value of 0 if the file was successfully compressed, and any other number to indicate an error. CompressEx is an extended version o CompressEx 7 � 7 x � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � ? 9 B � MSFT_CliParam Recursive " � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True BOOLEAN � � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � ? = E � MSFT_CliParam StartFileName & � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True STRING � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � ? = E � MSFT_CliParam StopFileName % � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING f & � MSFT_CliQualifier Out True STRING � X
� � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap
U X [ ^ a e i m q u y } � 0 2 8 9 10 11 12 13 14 15 16 17 21 X � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � R � MSFT_CliQualifier Values
S \ k � � � � � � + ? Success Access Denied Unspecified failure Invalid object Object already exists File system not NTFS Platform not NT/Windows 2000 Drive not the same Directory not empty Sharing violation Invalid start file Privilege not held Invalid parameter CompressEx �@z�� � �j9u= � H�I� � �� J�3� v�� � ��IeO
� ��u� ڝ��C��
) % 2 � �� � F W c � � � � U������������. � MDM_Policy_User_Result01_Printers02 InPartition : local-user DMWmiBridgeProv InstanceID
� � � �� string ParentID
� � � �� string PointAndPrintRestrictions_User '
� & � �� � string Pr � ڝ��C��
) $ 1 � �� � E V p � � � � U������������' � MDM_Policy_User_Result01_Privacy02 InPartition 9 local-user DMWmiBridgeProv DisablePrivacyExperience '
� � � �� � sint32 InstanceID
� � � �� string ParentID
� � �� string Pr � ڝ��C��
) % 2 � �� � F W c � � � � U������������1 � MDM_Policy_User_Result01_Security02 InPartition : local-user DMWmiBridgeProv InstanceID
� � � �� string ParentID
� � � �� string RecoveryEnvironmentAuthentication '
� ) � �� � sint32 Se � ڝ��C�� ) % 2 � �� � F W q � � � = G U����������������y � MDM_Policy_User_Result01_Settings02 InPartition : local-user DMWmiBridgeProv ConfigureTaskbarCalendar '
� � � �� � sint32 InstanceID
� � � �� string PageVisibilityList '
� 5 � �� � string ParentID
� q � �� string M � ڝ��C� + ) " / � �� � C
T i � � � = U � � � � 0 G � � � � � UU�����������������������������������������H � MDM_Policy_User_Result01_Start02 InPartition 7 local-user DMWmiBridgeProv DisableContextMenus '
� � � �� � sint32 ForceStartSize '
� � � �� � sint32 HideAppList '
� 5 � �� � sint32 HideFrequentlyUsedApps '
� � � �� � sint32 HidePeopleBar '
� � � �� � sint32 HideRecentJumplists '
� ( � �� � sint32 HideRecentlyAddedApps '
� | � �� � sint32 InstanceID
� � � �� string ParentID
� � � �� string StartLayout $ '
� @ � �� � string � ڝ��C��
) # 0 � �� � D U e � � � � U������������ � MDM_Policy_User_Result01_System02 InPartition 8 local-user DMWmiBridgeProv AllowTelemetry '
� � � �� � sint32 InstanceID
� � � �� string ParentID
� � �� string Sy � ڝ��C� ) � �� � 3 D P � � E��������� � MDM_RemoteWipe InPartition % local-system DMWmiBridgeProv InstanceID
� z � �� string ParentID
� � � �� string b lo * + � geP � � � z � � � 5 R n o
� � doWipeMethod �� implemented � ae442007200009F ROOT\cimv2\mdm\dmmap ���� � �� �� * � ����� � __PARAMETERS abstract param string
� 1 In
� 1 X �� ID )
� � X ��� string __ �� ae442007200009F ROOT\cimv2\mdm\dmmap ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � doWipePersistProvisionedDataMethod � �� implemented � ae442007200009F ROOT\cimv2\mdm\dmmap ���� � �� �� * � ����� � __PARAMETERS abstract param string
� 1 In
� 1 X �� ID )
� � X ��� string __ �� ae442007200009F ROOT\cimv2\mdm\dmmap ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � doWipeProtectedMethod � �� implemented � ae442007200009F ROOT\cimv2\mdm\dmmap ���� � �� �� * � ����� � __PARAMETERS abstract param string
� 1 In
� 1 X �� ID )
� � X ��� string __ �� ae442007200009F ROOT\cimv2\mdm\dmmap ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � doWipePersistUserDataMethod a �� implemented � ae442007200009F ROOT\cimv2\mdm\dmmap ���� � �� �� * � ����� � __PARAMETERS abstract param string
� 1 In
� 1 X �� ID )
� � X ��� string __ �� ae442007200009F ROOT\cimv2\mdm\dmmap ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 :�n�^��
͝��C�� 1 J.3�� f � WDMClassesOfDriver MSNdis_AtmMaxAal0PacketSize C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 C�����
͝��C�~ & ��8��� [ � WDMClassesOfDriver PortCls_PinState C:\Windows\System32\Drivers\portcls.SYS[PortclsMof] }J�M` � ���_ ���k �#!� � G�f� L-�� /�&� �QӪ
3��z� �L���
� ��!� ɡP�� J�
u� U �� ��Dd �3& " 4�H
�3�~R ��=�b ����x ~t`~ 4 3 C 8 6 C 3 E 5 B 2 B 7 F 1 D D 0 4 4 3 A 6 D A 4 E 1 7 A A 9 5 D 6 5 F 5 6 E E 0 C 1 9 C F 4 F D 3 B 5 D 9 A 5 F 6 3 C 5 2 2 �"�U�T�u͝��C�o 0 9 �� N � HNet_Connection {047525BC-A893-436A-91E8-557852561637} Ethernet Instance 0 A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 �"�U�T�v͝��C�| �� Z � HNet_ConnectionProperties HNet_Connection.Guid="{047525BC-A893-436A-91E8-557852561637}" R O O T \ M i c r o s o f t \ H o m e N e t H N e t _ C o n n e c t i o n P r o p e r t i e s
C o n n e c t i o n � N S _ 5 1 1 6 2 6 F A E 4 F 5 7 D B D 2 0 D F 5 C D 4 4 A 4 1 D A E C E D 2 8 C F 7 B 3 F D 8 B 1 2 0 1 2 C 7 F 4 B 5 8 F 4 4 E 6 6 5 \ K I _ A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 \ I _ 5 A B E 0 A 3 C 0 3 A 4 B D C 6 C E 5 A C 2 2 6 1 4 4 B A 9 8 A B D 8 1 F C 1 9 0 5 8 9 D 6 1 F 4 F B 6 7 A 3 4 2 5 2 F 7 4 F D X 4 3 C 8 6 C 3 E 5 B 2 B 7 F 1 D D 0 4 4 3 A 6 D A 4 E 1 7 A A 9 5 D 6 5 F 5 6 E E 0 C 1 9 C F 4 F D 3 B 5 D 9 A 5 F 6 3 C 5 2 2 �"�U�T�u͝��C�f 0 9 �� E � HNet_Connection {D12DED2F-AEFC-4788-A733-FAA9E04B44C7} Ethernet 2 A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 �"�U�T�v͝��C�| �� Z � HNet_ConnectionProperties HNet_Connection.Guid="{D12DED2F-AEFC-4788-A733-FAA9E04B44C7}" R O O T \ M i c r o s o f t \ H o m e N e t H N e t _ C o n n e c t i o n P r o p e r t i e s
C o n n e c t i o n � N S _ 5 1 1 6 2 6 F A E 4 F 5 7 D B D 2 0 D F 5 C D 4 4 A 4 1 D A E C E D 2 8 C F 7 B 3 F D 8 B 1 2 0 1 2 C 7 F 4 B 5 8 F 4 4 E 6 6 5 \ K I _ A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 \ I _ 5 A 8 2 1 8 7 B A D F D 0 5 C B F 9 0 D D A D A B 6 2 8 3 3 2 B F 3 B 6 4 F E A B C 1 C 8 9 9 9 5 4 6 5 9 A 9 4 C F 1 2 8 C 8 1 ��4 3 C 8 6 C 3 E 5 B 2 B 7 F 1 D D 0 4 4 3 A 6 D A 4 E 1 7 A A 9 5 D 6 5 F 5 6 E E 0 C 1 9 C F 4 F D 3 B 5 D 9 A 5 F 6 3 C 5 2 2 �"�U�T�u͝��C�q 0 9 �� P � HNet_Connection {0A645F4E-68C0-4C76-B4A3-0921C9718BDD} Local Area Connection A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 �"�U�T�v͝��C�| �� Z � HNet_ConnectionProperties HNet_Connection.Guid="{0A645F4E-68C0-4C76-B4A3-0921C9718BDD}" R O O T \ M i c r o s o f t \ H o m e N e t H N e t _ C o n n e c t i o n P r o p e r t i e s
C o n n e c t i o n � N S _ 5 1 1 6 2 6 F A E 4 F 5 7 D B D 2 0 D F 5 C D 4 4 A 4 1 D A E C E D 2 8 C F 7 B 3 F D 8 B 1 2 0 1 2 C 7 F 4 B 5 8 F 4 4 E 6 6 5 \ K I _ A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 \ I _ 4 1 F 4 0 B 0 A E D 8 0 D A 6 4 6 B B 3 A 5 4 C 3 4 C B D A F 7 2 A D B 4 E 6 4 1 4 1 4 1 6 C 5 4 3 4 8 9 2 B 2 4 E B 7 F 4 2 9 ��4 3 C 8 6 C 3 E 5 B 2 B 7 F 1 D D 0 4 4 3 A 6 D A 4 E 1 7 A A 9 5 D 6 5 F 5 6 E E 0 C 1 9 C F 4 F D 3 B 5 D 9 A 5 F 6 3 C 5 2 2 �"�U�T�u͝��C�f 0 9 �� E � HNet_Connection {2DBE1C3C-12E7-4095-90AF-AC78BF10DD42} Ethernet 2 A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 �"�U�T�v͝��C�| �� Z � HNet_ConnectionProperties HNet_Connection.Guid="{2DBE1C3C-12E7-4095-90AF-AC78BF10DD42}" R O O T \ M i c r o s o f t \ H o m e N e t H N e t _ C o n n e c t i o n P r o p e r t i e s
C o n n e c t i o n � N S _ 5 1 1 6 2 6 F A E 4 F 5 7 D B D 2 0 D F 5 C D 4 4 A 4 1 D A E C E D 2 8 C F 7 B 3 F D 8 B 1 2 0 1 2 C 7 F 4 B 5 8 F 4 4 E 6 6 5 \ K I _ A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 \ I _ 6 3 1 0 7 F 0 6 1 0 D 2 0 6 9 9 8 9 5 2 C 3 8 8 A 6 8 4 3 8 6 1 6 0 A 4 D C D E F 3 7 F A 7 5 D A 7 E 7 E 7 9 4 B 0 0 5 E 0 3 5 9 A B 5 3 8 0 6 E 8 8 6 6 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0 �b��5� ͝��C�x �f3��5��� W � WMIBinaryMofResource C:\Windows\System32\drivers\en-US\ACPI.sys.mui[ACPIMOFResource] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �b��5�
͝��C�� �f3��5� ` � WDMClassesOfDriver ACPITrace C:\Windows\System32\drivers\en-US\ACPI.sys.mui[ACPIMOFResource] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4
�b��5�
͝��C�� # �f3��5� d � WDMClassesOfDriver AMLIEvalData1 C:\Windows\System32\drivers\en-US\ACPI.sys.mui[ACPIMOFResource] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �b��5�
͝��C�� . �f3��5� o � WDMClassesOfDriver AMLIEvalData1_TypeGroup1 C:\Windows\System32\drivers\en-US\ACPI.sys.mui[ACPIMOFResource] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ^�b��5�
͝��C�z " -e3 �5� W � WDMClassesOfDriver PortClsEvent C:\Windows\System32\Drivers\portcls.SYS[PortclsMof] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/pl\}�
͝��C�� ��
�S}� ] � WDMClassesOfDriver WMIEvent C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/pl\}�
͝��C�� $ ��
�S}� c � WDMClassesOfDriver MS_WmiInternal C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ͣn�^��
͝��C�v J.3�� S � WDMClassesOfDriver WMIEvent C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 Σn�^��
͝��C�| $ J.3�� Y � WDMClassesOfDriver MS_WmiInternal C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 9 A B 5 3 8 0 6 E 8 8 6 6 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0 �n�^�� ͝��C�l �2��2�� K � WMIBinaryMofResource C:\Windows\System32\drivers\monitor.sys[MonitorWMI] is.sys.mui[MofResourceName] 9 A B 5 3 8 0 6 E 8 8 6 6 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0 �n�^�� ͝��C�l �2��2�� K � WMIBinaryMofResource C:\Windows\System32\drivers\monitor.sys[MonitorWMI] [MofResourceName] 9 A B 5 3 8 0 6 E 8 8 6 6 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0 �n�^�� ͝��C�l �2��2�� K � WMIBinaryMofResource C:\Windows\System32\drivers\monitor.sys[MonitorWMI] \Windows\system32\kernelbase.dll[MofResourceName] ame] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 Σn�^��
͝��C�| $ J.3�� Y � WDMClassesOfDriver MS_WmiInternal C:\Windows\system32\kernelbase.dll[MofResourceName] � � A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 � + � � � � MSFT_CliVerb UncompressEx The UncompressEx method uncompresses the logical file (or directory) specified in the object path. UncompressEx returns an integer value of 0 if the file was successfully decompressed, and any other number to indicate an error. UncompressEx is an extended UncompressEx ; � ; x � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � ? 9 B � MSFT_CliParam Recursive " � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True BOOLEAN � � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � ? = E � MSFT_CliParam StartFileName & � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True STRING � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � ? = E � MSFT_CliParam StopFileName % � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING f & � MSFT_CliQualifier Out True STRING � \
� � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap
U X [ ^ a e i m q u y } � 0 2 8 9 10 11 12 13 14 15 16 17 21 X � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � R � MSFT_CliQualifier Values
S \ k � � � � � � + ? Success Access Denied Unspecified failure Invalid object Object already exists File system not NTFS Platform not NT/Windows 2000 Drive not the same Directory not empty Sharing violation Invalid start file Privilege not held Invalid parameter UncompressEx � � A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 � & ( @ � � �
� wi �i �� ID y . )
� j �i ���i y string z 2 AttackSurfaceReductionRules_RuleSpecificExclusions string z 2
� Uj In z 2
� Uj |j �� ID z 2 )
� �j |j ���j z string { 6 OobeEnableRtpAndSigUpdate boolean { 6
� k In { 6
� k Bk �� ID { 6 )
� �k Bk ��pk { boolean | 8 PerformanceModeStatus uint8 | 8
� �k In | 8
� �k l �� =l @l 0 1 ValueMap | 8 )
� �k l ��Cl 1l ID | 8 6
� �l l ��Cl 1l �l | uint8 } 9 QuickScanIncludeExclusions uint8 } 9
� m In } 9
� m 'm �� am dm 0 1 ValueMap } 9 )
� m 'm ��gm Um ID } 9 6
� �m 'm ��gm Um �m } uint8 ~ : RemoveScanningThreadPoolCap boolean ~ :
� &n In ~ :
� &n Nn �� ID ~ : )
� �n Nn ��|n ~ boolean < DisableCacheMaintenance boolean <
� �n In <
� �n o �� ID < )
� |o o ��Ao boolean � > DisableCoreServiceECSIntegration boolean � >
� �o In � >
� �o �o �� ID � > )
� Jp �o ��p � boolean � @ DisableCoreServiceTelemetry boolean � @
� �p In � @
� �p �p �� ID � @ )
� q �p ���p � boolean � B EnableUdpSegmentationOffload boolean � B
� Lq In � B
� Lq tq �� ID � B )
� �q tq ���q � boolean � D EnableUdpReceiveOffload boolean � D
� r In � D
� r 9r �� ID � D )
� �r 9r ��gr � boolean � F Force boolean � F
� �r In � F
� �r �r �� ID � F )
� Us �r ��s � boolean � MSFT_CliVerb GetEffectivePermission The GetEffectivePermission method determines whether the caller has the aggregated permissions specified by the Permission argument not only on the file object, but on the share the file or directory resides on (if it is on a share). /nThe method returns a GetEffectivePermission H | � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � ? ; C � MSFT_CliParam Permissions $ � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True UINT32 � j � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap Y \ _ b e i m q u y } � � � 0 2 8 9 10 11 12 13 14 15 16 17 21 .. X � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � R � MSFT_CliQualifier Values
S \ k � � � � � � + ? Success Access Denied Unspecified failure Invalid object Object already exists File system not NTFS Platform not NT/Windows 2000 Drive not the same Directory not empty Sharing violation Invalid start file Privilege not held Invalid parameter GetEffectivePermission � = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty Manufacturer Manufacturer � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier v � ! 0 � MSFT_CliProperty MaxClockSpeed MaxClockSpeed � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier m � � MSFT_CliProperty Name Name � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � * B � MSFT_CliProperty OtherFamilyDescription OtherFamilyDescription � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier t � , � MSFT_CliProperty PNPDeviceID PNPDeviceID � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � / L � MSFT_CliProperty PowerManagementCapabilities PowerManagementCapabilities � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � , F � MSFT_CliProperty PowerManagementSupported PowerManagementSupported � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier t � , � MSFT_CliProperty ProcessorId ProcessorId � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier v � ! 0 � MSFT_CliProperty ProcessorType ProcessorType � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier q � & � MSFT_CliProperty Revision Revision � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier m � � MSFT_CliProperty Role Role � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
�= F D 3 B B D 4 C 4 2 A C 2 F 7 F E F 2 6 4 3 4 0 A 9 E B 7 8 A 5 8 1 F E 5 C 2 8 5 6 1 C B 6 3 E D F 7 8 0 B 3 2 9 E A C 2 E E 4 �b��5��͝��C�= � + I �< �< �< �< � MSFT_CliAlias � F N u � � � � �
U�������������������������4 � MSFT_CliConnection Authority
� > STRING Locale
� m STRING NameSpace
� � STRING Password
� � STRING Server
� � STRING User
� , STRING | � ( + � MSFT_CliConnection ms_409 ROOT\CIMV2 . DCOM Application management. a O )! �
�
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � � � MSFT_CliFormat list FULL 4 � � D � � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier n � � MSFT_CliProperty AppID AppID � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier t � , � MSFT_CliProperty Description Description � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier t � , � MSFT_CliProperty InstallDate InstallDate � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier m � � MSFT_CliProperty Name Name � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o � " � MSFT_CliProperty Status Status � �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � 7 � MSFT_CliFormat table BRIEF . � � � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier n � � MSFT_CliProperty AppID AppID � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier t � , � MSFT_CliProperty InstallDate InstallDate � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier m � � MSFT_CliProperty Name Name I �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty V � � MSFT_CliFormat INSTANCE " � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier m � � MSFT_CliProperty Name Name � �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � � � MSFT_CliFormat table STATUS + � � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier m � � MSFT_CliProperty Name Name � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o � " � MSFT_CliProperty Status Status s �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � + � MSFT_CliFormat SYSTEM
D � � U � b
�
x � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty __CLASS __CLASS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __DERIVATION __DERIVATION � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __DYNASTY __DYNASTY � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty __GENUS __GENUS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier t � , � MSFT_CliProperty __NAMESPACE __NAMESPACE � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o � " � MSFT_CliProperty __PATH __PATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier y � $ 6 � MSFT_CliProperty __PROPERTY_COUNT __PROPERTY_COUNT � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __RELPATH __RELPATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier q � & � MSFT_CliProperty __SERVER __SERVER � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __SUPERCLASS __SUPERCLASS DCOMAPP WHERE Name='#' Select * from WIN32_DCOMApplication >n F D 3 B B D 4 C 4 2 A C 2 F 7 F E F 2 6 4 3 4 0 A 9 E B 7 8 A 5 8 1 F E 5 C 2 8 5 6 1 C B 6 3 E D F 7 8 0 B 3 2 9 E A C 2 E E 4 �b��5��͝��C��m � + G Dm Mm ]m zm � MSFT_CliAlias � F N u � � � � �
U�������������������������4 � MSFT_CliConnection Authority
� > STRING Locale
� m STRING NameSpace
� � STRING Password
� � STRING Server
� � STRING User
� , STRING | � ( + � MSFT_CliConnection ms_409 ROOT\CIMV2 . User's Desktop management. _ �9 �G �J tf s7 �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty �6 �" � MSFT_CliFormat list FULL p " � � ; � �
Y � y $ � � F � � g � � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier t � , � MSFT_CliProperty BorderWidth BorderWidth � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier s � * � MSFT_CliProperty CoolSwitch CoolSwitch � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier x � # 4 � MSFT_CliProperty CursorBlinkRate CursorBlinkRate � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier t � , � MSFT_CliProperty Description Description � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier x � # 4 � MSFT_CliProperty DragFullWindows DragFullWindows � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier x � # 4 � MSFT_CliProperty GridGranularity GridGranularity � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier t � , � MSFT_CliProperty IconSpacing IconSpacing � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier z � % 8 � MSFT_CliProperty IconTitleFaceName IconTitleFaceName � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier v � ! 0 � MSFT_CliProperty IconTitleSize IconTitleSize � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier v � ! 0 � MSFT_CliProperty IconTitleWrap IconTitleWrap � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier m � � MSFT_CliProperty Name Name � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty Pattern Pattern � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier z � % 8 � MSFT_CliProperty ScreenSaverActive ScreenSaverActive � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier ~ � ) @ � MSFT_CliProperty ScreenSaverExecutable ScreenSaverExecutable � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier z � % 8 � MSFT_CliProperty ScreenSaverSecure ScreenSaverSecure � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier { � & : � MSFT_CliProperty ScreenSaverTimeout ScreenSaverTimeout v�P� � 1�:Xt Z p�� � `���
� �ڷ � ���� ~ �� � }DA� b �f�i � ~U� � =�%d� �w��� �ϯ@� ڝ��C�| ' ) � �� � 1 B L � � � � $ / l w � � � � : D v � � �
] v UUU������������������������������������� � MDM_VPNv2_01 InPartition # local-system DMWmiBridgeProv AlwaysOn '
� � � �� � �� boolean ByPassForLocal '
� � � �� � �� boolean DeviceTunnel '
� � �� � �� boolean DnsSuffix '
� d � �� � �� string EdpModeId '
� � � �� � �� string InstanceID
� � � �� string LockDown '
� 1 � �� � �� boolean ParentID
� n � �� string ProfileXML '
� � � �� � �� string RegisterDNS '
� � �� � �� boolean RememberCredentials '
� T � �� � �� boolean TrustedNetworkDetection
'
� � � �� � �� string � ڝ��C�B ) % � �� � K \ m � � � 9 O � � � � Y c UU������������������������������� � MDM_VPNv2_APNBinding02 InPartition 1 ? local-system local-user DMWmiBridgeProv AccessPointName '
� � � �� � �� string AuthenticationType '
� � � �� � �� string InstanceID
� 1 � �� string IsCompressionEnabled '
� � � �� � �� boolean ParentID
� � � �� string Password '
� � �� � �� string ProviderId '
� Q � �� � �� string UserName '
� � � �� � �� string � ڝ��C�� ) " / � �� � U f j � � � � ! ' U����������������d � MDM_VPNv2_AppTriggerList02_App04 InPartition ; I local-system local-user DMWmiBridgeProv Id '
� � � �� � �� string InstanceID
� � � �� string ParentID
� � �� string Type '
� \ � �� � string M � ڝ��C�� ) ) � �� � O ` l � � � � & 2 U����������������o � MDM_VPNv2_Authentication03 InPartition 5 C local-system local-user DMWmiBridgeProv InstanceID
� � � �� string MachineMethod '
� � � �� � �� string ParentID
� � �� string UserMethod '
� g � �� � �� string M � ڝ��C�� ) & � �� � L ] b � � � � " , U����������������^ � MDM_VPNv2_Certificate04 InPartition 2 @ local-system local-user DMWmiBridgeProv Eku '
� � � �� � �� string InstanceID
� � � �� string Issuer '
� � �� � �� string ParentID
� V � �� string M � !ڝ��C�f " ) , � �� � R c � � � " _ q � � � ? I { � UU��������������������������������� � MDM_VPNv2_CryptographySuite03 InPartition 8 F local-system local-user DMWmiBridgeProv AuthenticationTransformConstants '
� � � �� � �� string CipherTransformConstants '
� � �� � �� string DHGroup '
� W � �� � �� string EncryptionMethod '
� � � �� � �� string InstanceID
� � � �� string IntegrityCheckMethod '
� 7 � �� � �� string ParentID
� s � �� string PfsGroup '
� � � �� � �� string � "ڝ��C�� ) + � �� � Q b k � � � � U����������# � MDM_VPNv2_DeviceCompliance02 InPartition 7 E local-system local-user DMWmiBridgeProv Enabled '
� � � �� � �� boolean InstanceID
� � � �� string ParentID
� � �� string 2 � #ڝ��C�J ) * 7 � �� � ] n { � � K [ � � � � \ m UU����������������������������� � MDM_VPNv2_DomainNameInformationList02_01 InPartition C Q local-system local-user DMWmiBridgeProv AutoTrigger '
� � � �� � �� boolean DnsServers '
� � � �� � �� string DomainName '
� C � �� � �� string DomainNameType '
� � � �� � string InstanceID
� � � �� string ParentID
�
� �� string Persistent '
� S � �� � �� boolean WebProxyServers '
� � � �� � �� string � $ڝ��C�� ) � �� � D U d � � � � ! U����������������^ � MDM_VPNv2_Eap04 InPartition * 8 local-system local-user DMWmiBridgeProv Configuration '
� � � �� � �� string InstanceID
� � � �� string ParentID
� � �� string Type '
� V � �� � �� sint32 M � %ڝ��C�~
) ! � �� � G X d � � � � U������������ � MDM_VPNv2_Manual03 InPartition - ; local-system local-user DMWmiBridgeProv InstanceID
� � � �� string ParentID
� � � �� string Server '
� � �� � �� string ti � &ڝ��C�� ) ( � �� � N _ ~ � � � @ T � � � � & U��������������������������c � MDM_VPNv2_NativeProfile02 InPartition 4 B local-system local-user DMWmiBridgeProv DisableClassBasedDefaultRoute '
� � � �� � �� boolean InstanceID
� � � �� string L2tpPsk '
� 8 � �� � �� string NativeProtocolType '
� � � �� � �� string ParentID
� � � �� string RoutingPolicyType '
� � �� � �� string Servers '
� [ � �� � �� string � E n u m T r u s t e d D o m s Qܝ��C�� EnumTrustedDoms C � �� $ = H W ^ f p � EnumTrustedDoms_Start Description EnumerateTrustedDomains EventType EventTypeName Start locale MS\0x409 �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ;�n�^��
͝��C�� 1 J.3�� f � WDMClassesOfDriver MSNdis_AtmMaxAal1PacketSize C:\Windows\system32\kernelbase.dll[MofResourceName] ResourceName] G��G� � �1�h� � �["�: � ˦�>� 7 Н��
� �� s�
� �" �� � ���Q^ � �8�c> � J珴� � ��ۥ� A �� � �M�� 'ڝ��C�� ) ( � �� � N _ t � � �
< F x � � � U������������������������� � MDM_VPNv2_PluginProfile02 InPartition 4 B local-system local-user DMWmiBridgeProv CustomConfiguration '
� � � �� � �� string CustomStoreUrl '
� � � �� � �� string InstanceID
� 4 � �� string ParentID
� p � �� string PluginPackageFamilyName '
� � � �� � �� string ServerUrlList '
� � �� � �� string � (ڝ��C��
) � �� � F W f � � � � U������������ � MDM_VPNv2_Proxy02 InPartition , : local-system local-user DMWmiBridgeProv AutoConfigUrl '
� � � �� � �� string InstanceID
� � � �� string ParentID
� � �� string it � )ڝ��C�� ) ' � �� � M ^ g � � � � 0 8 u � � U������������������������ � MDM_VPNv2_RouteList02_01 InPartition 3 A local-system local-user DMWmiBridgeProv Address '
� � � �� � �� string ExclusionRoute '
� � � �� � �� boolean InstanceID
� ( � �� string Metric '
� m � �� � �� sint32 ParentID
� � � �� string PrefixSize '
� � � �� � �� sint32 � *ڝ��C� ) � �� � D U Z � � � � ( e o U�������������������� � MDM_VPNv2_Sso03 InPartition * 8 local-system local-user DMWmiBridgeProv Eku '
� � � �� � �� string Enabled '
� � � �� � �� boolean InstanceID
� � �� string IssuerHash
'
� ] � �� � �� string ParentID
� � � �� string � +ڝ��C�� ' ) " / � �� � U f n � � � � : K � � � � ] o � � UU�������������������������������������� � MDM_VPNv2_TrafficFilterList02_01 InPartition ; I local-system local-user DMWmiBridgeProv Claims '
� � � �� � �� string InstanceID
� � � �� string LocalAddressRanges '
� 2 � �� � �� string LocalPortRanges '
� � � �� � �� string ParentID
� � � �� string Protocol '
� � �� � �� sint32 RemoteAddressRanges '
� U � �� � �� string RemotePortRanges '
� � � �� � �� string RoutingPolicyType '
� � � �� � �� string � ,ڝ��C�� ) % 2 � �� � X i m � � � � $ * U����������������g � MDM_VPNv2_TrafficFilterList02_App04 InPartition > L local-system local-user DMWmiBridgeProv Id '
� � � �� � �� string InstanceID
� � � �� string ParentID
� � �� string Type '
� _ � �� � string M � -ڝ��C�� ! ) � �� � 4 E O � � � � # . k w � � � � . C � � UU�������������������������������� � MDM_VPNv2_User_01 InPartition ( local-user DMWmiBridgeProv AlwaysOn '
� � � �� � �� boolean ByPassForLocal '
� � � �� � �� boolean DnsSuffix '
� � �� � �� string EdpModeId '
� c � �� � �� string InstanceID
� � � �� string ParentID
� � � �� string ProfileXML '
� & � �� � �� string RememberCredentials '
� x � �� � �� boolean TrustedNetworkDetection '
� � � �� � �� string � 5ڝ��C�� ) % � �� � ; M W � � � � U����������������U � MDM_ApplicationControl InPartition - local-system DMWmiBridgeProv1 DeviceID '
� � � �� � string InstanceID
� � � �� string ParentID
� � �� string TenantID '
� M � �� � string M � 6ڝ��C��
) & 3 � �� � I [ g � � � � U������������2 � MDM_ApplicationControl_Policies01_01 InPartition ; local-system DMWmiBridgeProv1 InstanceID
� � � �� string ParentID
� � � �� string Policy 2
� % �� � �� � �� string Octetstring � 7ڝ��C�� ) $ 1 � �� � G Y e � � � � U��������������O � MDM_ApplicationControl_PolicyIDs03 InPartition 9 local-system DMWmiBridgeProv1 InstanceID
� � � �� string IsVariableLeaf
� � boolean ParentID
� � �� string Value '
� G � �� � string � 8ڝ��C�) ) % 2 � �� � H Z h � � � � / ; y � � � E N UU��������������������������� � MDM_ApplicationControl_PolicyInfo03 InPartition : local-system DMWmiBridgeProv1 FriendlyName '
� � � �� � string InstanceID
� � � �� string IsAuthorized '
� & � �� � boolean IsDeployed '
� p � �� � boolean IsEffective '
� � � �� � boolean ParentID
� � � �� string Status '
� = � �� � sint32 Version '
� � � �� � string � 9ڝ��C�� ) - � �� � C U a � � � � U��������������K � MDM_ApplicationControl_Token03 InPartition 5 local-system DMWmiBridgeProv1 InstanceID
� � � �� string IsVariableLeaf
� � boolean ParentID
� � � �� string Value '
� C � �� � string �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 <�n�^��
͝��C�� 2 J.3�� g � WDMClassesOfDriver MSNdis_AtmMaxAal34PacketSize C:\Windows\system32\kernelbase.dll[MofResourceName] ourceName] 8 0 6 E 8 8 6 6 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0 3� n� ͝��C�n xC���� M � WMIBinaryMofResource C:\Windows\system32\drivers\ndis.sys[MofResourceName] � __ �� WIN-F6NF7R6I6PJ ROOT\Microsoft\ProtectionManagement ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � Remove �� ���� �� implemented static �� WIN-F6NF7R6I6PJ ROOT\Microsoft\ProtectionManagement ���� � � � G ��� �\ Z] \ �\ bN �N Sb �b �5 6 �E qF �G rH �F <G �h i �g 6h ! � � X � " � S
�
� z �
�A fB �B 5C �H SI �I %J �Z �Z a/ �/ * � + �+ �@ AA @m �m %0 �0 �0 \1 n �n �n Jo �P 7Q 1O �O {W �W �V )W �1 2 �a b L[ �[ �U jV k^ �^ F, �, - �- �_ z` /) �) \e �e :_ �_ �- L. p2 �2 ;3 �3 �3 �4 �4 N5 �. / � � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty SettingID SettingID � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty Wallpaper Wallpaper � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier { � & : � MSFT_CliProperty WallpaperStretched WallpaperStretched � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier w � " 2 � MSFT_CliProperty WallpaperTiled WallpaperTiled �
�
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � � � MSFT_CliFormat table BRIEF 6 � � Q
� 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier m � � MSFT_CliProperty Name Name � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier z � % 8 � MSFT_CliProperty ScreenSaverActive ScreenSaverActive � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier z � % 8 � MSFT_CliProperty ScreenSaverSecure ScreenSaverSecure � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier { � & : � MSFT_CliProperty ScreenSaverTimeout ScreenSaverTimeout � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty SettingID SettingID I �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty V � � MSFT_CliFormat INSTANCE " � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier m � � MSFT_CliProperty Name Name s �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � + � MSFT_CliFormat SYSTEM
D � � U � b
�
x � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty __CLASS __CLASS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __DERIVATION __DERIVATION � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __DYNASTY __DYNASTY � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty __GENUS __GENUS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier t � , � MSFT_CliProperty __NAMESPACE __NAMESPACE � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o � " � MSFT_CliProperty __PATH __PATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier y � $ 6 � MSFT_CliProperty __PROPERTY_COUNT __PROPERTY_COUNT � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __RELPATH __RELPATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier q � & � MSFT_CliProperty __SERVER __SERVER � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __SUPERCLASS __SUPERCLASS � �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � � � MSFT_CliFormat STATUS $ � � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier m � � MSFT_CliProperty Name Name � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier z � % 8 � MSFT_CliProperty ScreenSaverActive ScreenSaverActive DESKTOP WHERE Name='#' Select * from WIN32_DESKTOP BE7A5C3AB54515C19F31277BB3701F61C98AD4F3CEB32242F741C.861.1.30027 I_6456463FE04288A1885C6F7DFFFA4040E415617C14B667F2C51BCDF537F3D501.865.1.21995 I_CF17F65BDE5D27AA83EF3274842254733535B217A340E131A413188964603E19.868.1.35696 I_BA51ED41265DA7310954BAE161AF50CE2679B701DA6D3DEB06FA741A8D05CD90.910.1.70636 I_990444B5147B385848F6A331FB9B78A4118CD4F34316765DD7E05BFBAFD92E46.919.1.39586 I_5F52E98B4905E86733B57BDB8229A4CEC75FA5749D918B5DBC7157473B48B71F.956.1.13002 I_60E5E385E51F7170564DC3A25AAA1E35C0C27B9240E9CAF9E2086D795B396162.974.1.8675 I_4F28049B29ED0162FE0090B43C7F9ACB02BB2A7DA2E5515A9A1D50C0DC210D88.976.1.48287 I_74CF1EDBEB2A88AE2B7F2B31226DC6989203AD486527D338B157184A36F210BE.982.1.23321 I_897EACA2347FBC71DC0E8FBFE21FA1F13FC9EAEDDE7A34C1DE772DFD6AAE17B6.985.1.15604 I_4CD34998191B7D33C77F03D776D618320C603FD3921842E1B0BD47475C056851.1000.1.51109 I_4C10C5441FCE04BC41DDEC512892264D846021BB7D560E4EBF1E528C17B43826.1007.1.31956 I_6EACF9EBFCA10986AA504ECF943BEA549FB8DE4850FBADD0F165D6E5FD0E4DBB.1011.1.30190 I_C59E83547F1BC933FE30770D4EDB5077AA988B54FE242F5F66DA214D449E875A.321.1.62809 I_55BA3B97EE945A5FFAA048F94EB0B1F3BCDC2B26C8F2588BFFB42050A21365DE.338.1.27578 I_6E3B4399FA4EDE750602EAE85FB276C1B64644E78344F6BB3EF3F442D17FE8D8.353.1.287457 d
e AX �X �c Jd =U �U �D �E �O lP �] ^ �L JM �Q R L �L �C TD fp �p �o p �Y 4Z � � � U d � +q �q ~T �T = > �f Tg �: l; �& �' �M N �; �< f �f ei �i ,j �j Y rY �S ,T SR �R S sS �? o@ � X Ok l �) e* � u � � ) �
�
� � D � 3 � wl �l � w � H � g � � 9 " � � � \ � � c �c O � � �* -+ 0 � a> M? vJ �J 8K �K g � �$ �$ & �& + � � � O! � �! �" �" e# �# 1$ O% �% �' �( �7 �8 '7 �7 � L �` Ba o6 �6 79 $: UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU�������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������q � __PARAMETERS abstract DisableAutoExclusions boolean
� A In
� A i �� ID )
� � i ��� boolean ExclusionPath string
� � In
� � # �� ID )
� � # ��Q string ExclusionExtension string
� � In
� � � �� ID )
� J � �� string
ExclusionProcess string
� v In
� v � �� ID
)
� � ��� string ExclusionIpAddress string
� 4 In
� 4 [ �� ID )
� � [ ��� string QuarantinePurgeItemsAfterDelay boolean
� � In
� � & �� ID )
� � & ��T boolean RealTimeScanDirection boolean
� � In
� � � �� ' * - 0 1 2 ValueMap )
� � � ��0 ID 6
� � � ��0 q boolean RemediationScheduleDay boolean
� � In
� � �� j m p s v y | � 0 1 2 3 4 5 6 7 8 ValueMap )
� � ��� B ID 6
� ��� B � boolean RemediationScheduleTime boolean
� B In
� B j �� ID )
� � j ��� boolean RemoteEncryptionProtectionConfiguredState boolean
� In
� A �� � � � � 0 1 2 4 ValueMap )
� A ��� o ID 6
� A ��� o � boolean
RemoteEncryptionProtectionMaxBlockTime boolean
� [ In
� [ � �� ID
)
� � � ���
boolean RemoteEncryptionProtectionAggressiveness boolean
� 1
In
� 1
Y
�� �
�
�
0 1 2 ValueMap )
� 1
Y
���
�
ID 6
� ) Y
���
�
�
boolean RemoteEncryptionProtectionExclusions string
� j In
� j � �� ID )
� � � ��� string
$ BruteForceProtectionConfiguredState boolean
$
� 9 In
$
� 9 a �� � � � � 0 1 2 4 ValueMap
$ )
� 9 a ��� � ID
$ 6
� 8
a ��� � �
boolean & BruteForceProtectionMaxBlockTime boolean &
� u
In &
� u
�
�� ID & )
� �
���
boolean ( BruteForceProtectionAggressiveness boolean (
� E In (
� E m �� � � � 0 1 2 ValueMap ( )
� E m ��� � ID ( 6
� = m ��� � � boolean * BruteForceProtectionExclusions string *
� x In *
� x � �� ID * )
� � ��� string . BruteForceProtectionLocalNetworkBlocking boolean .
� L In .
� L t �� ID . )
� � t ��� boolean 0 BruteForceProtectionSkipLearningPeriod boolean 0
� In 0
� H �� ID 0 )
� � H ��v boolean 2 ReportingAdditionalActionTimeOut boolean 2
� � In 2
� � �� ID 2 )
� ��D boolean 4 ReportingCriticalFailureTimeOut boolean 4
� � In 4
� � � �� ID 4 )
� L � �� boolean 6 ReportingNonCriticalTimeOut boolean 6
� � In 6
� � � �� ID 6 )
� � ��� boolean 8 ServiceHealthReportInterval boolean 8
� M In 8
� M u �� ID 8 )
� � u ��� boolean : ReportDynamicSignatureDroppedEvent boolean :
� In :
� E �� ID : )
� � E ��s boolean < ScanAvgCPULoadFactor boolean <
� � In <
� � �� ID < )
� p ��5 boolean > CheckForSignaturesBeforeRunningScan boolean >
� � In >
� � � �� ID > )
� A � �� boolean @ ScanPurgeItemsAfterDelay boolean @
� v In @
� v � �� ID @ )
� � ��� boolean B ScanOnlyIfIdleEnabled boolean B
� 9 In B
� 9 a �� ID B )
� � a ��� boolean D ScanParameters boolean D
� � In D
� � �� W Z 1 2 ValueMap D )
� � ��] K ID D 6
� � ��] K � boolean F ScanScheduleDay boolean F
� In F
� : �� � � � � � � � � � 0 1 2 3 4 5 6 7 8 ValueMap F )
� : ��� h ID F 6
� 4 : ��� h � boolean H ScanScheduleQuickScanTime boolean H
� j In H
� j � �� ID H )
� � � ��� boolean J ScanScheduleTime boolean ��#x m ����} �t�� � ���
pR��
��P�( s[H�A ��b�W ��1qn ��eM� ��@� ��� IDŽ�� % ���' g�ON " `�9 ! [��C�r ) � �� � ( 0 � MSFT_MpHeartBeat ProtectionManagement locale � 5 9 � � Send ��- �� implemented static � ae442007200009F ROOT\Microsoft\Windows\Defender ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � ]��C�m ) � �� �
# + � MSFT_MpScan ProtectionManagement locale � 6 � f � Start ! ��. �� implemented static � ae442007200009F ROOT\Microsoft\Windows\Defender ���� � �2 �� � ? * � �����~ � __PARAMETERS abstract ScanType uint8
� 4 In
� 4 Z �� ID )
� � Z ��� uint8 ScanPath string
� � In
� �
�� ID )
� v
��; string __ �� ae442007200009F ROOT\Microsoft\Windows\Defender ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � ^��C�r ) � �� � ( 0 � MSFT_MpSignature ProtectionManagement locale 7 S � � Update " ��/ �� implemented static ae442007200009F ROOT\Microsoft\Windows\Defender ���� � �� �� * � �� � __PARAMETERS abstract UpdateSource uint8
� 8 In
� 8 ^ �� ID )
� � ^ ��� uint8 __ �� ae442007200009F ROOT\Microsoft\Windows\Defender ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � R O O T \ c i m v 2 \ m d m _ _ I n s t a n c e P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 3 9 0 E B 4 5 D 3 2 F 6 8 9 2 8 2 4 0 8 A D A 5 2 0 C E 6 3 9 3 A 4 1 E C 4 6 1 8 E E 2 0 4 A A 0 F B C 3 2 C F 2 D 7 4 6 9 E 3 \ K I _ E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C \ I _ 8 E C E B 1 8 F 5 D 5 9 5 6 A D B B 9 2 C 6 0 B 6 B B F 6 5 7 3 8 6 F 0 B E 5 9 6 C E C 9 4 3 5 A A B D 1 8 5 E A E 1 B 6 B 4 2 � Z��C�� " 4 �� � �� � 0 8 H z � � � � � V s � � U��������������������������������N � MSFT_MpEvent Indication ProtectionManagement locale AdditionalData
� r � �� sint64 CategoryDiscriminant 4
� � � � � �� � �� uint32 ValueMap � � � 1 2 4 8 ComputerNotificationsValue )
� W _ g � �� uint32 BitMap � � � � � � � 1 2 4 8 16 32 64 NotificationTime e
� � � �� datetime ScanNotificationsValue )
� 4 < D � �� uint32 BitMap P S 1 2 SignatureNotificationsValue )
� � � � � �� uint32 BitMap � 1 ThreatNotificationsValue )
� & � �� uint32 BitMap > A D G J 1 2 4 8 16 �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 =�n�^��
͝��C�� 1 J.3�� f � WDMClassesOfDriver MSNdis_AtmMaxAal5PacketSize C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 >�n�^��
͝��C�� . J.3�� c � WDMClassesOfDriver MSNdis_AtmReceiveCellsOk C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ?�n�^��
͝��C�� / J.3�� d � WDMClassesOfDriver MSNdis_AtmTransmitCellsOk C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 @�n�^��
͝��C�� 3 J.3�� h � WDMClassesOfDriver MSNdis_AtmReceiveCellsDropped C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 A�n�^��
͝��C�� 5 J.3�� j � WDMClassesOfDriver MSNdis_EthernetPermanentAddress C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 B�n�^��
͝��C�� 3 J.3�� h � WDMClassesOfDriver MSNdis_EthernetCurrentAddress C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 C�n�^��
͝��C�� 2 J.3�� g � WDMClassesOfDriver MSNdis_EthernetMulticastList C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 D�n�^��
͝��C�� = J.3�� r � WDMClassesOfDriver MSNdis_EthernetMaximumMulticastListSize C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 E�n�^��
͝��C�� / J.3�� d � WDMClassesOfDriver MSNdis_EthernetMacOptions C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 F�n�^��
͝��C�� : J.3�� o � WDMClassesOfDriver MSNdis_EthernetReceiveErrorAlignment C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 G�n�^��
͝��C�� 9 J.3�� n � WDMClassesOfDriver MSNdis_EthernetOneTransmitCollision C:\Windows\system32\kernelbase.dll[MofResourceName] �� �� s � WDMClassesOfDriver MSNdis_TokenRingLastOpenStatus C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] \processr.sys[PROCESSORWMI] m� F D 3 B B D 4 C 4 2 A C 2 F 7 F E F 2 6 4 3 4 0 A 9 E B 7 8 A 5 8 1 F E 5 C 2 8 5 6 1 C B 6 3 E D F 7 8 0 B 3 2 9 E A C 2 E E 4
�b��5��͝��C�݂ � + H a� q� �� �� � MSFT_CliAlias � F N u � � � � �
U�������������������������4 � MSFT_CliConnection Authority
� > STRING Locale
� m STRING NameSpace
� � STRING Password
� � STRING Server
� � STRING User
� , STRING | � ( + � MSFT_CliConnection ms_409 ROOT\CIMV2 . Desktop Monitor management. d : �G �U �c �f �7 �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty �6 u) � MSFT_CliFormat list FULL � 3 � � ^ �
q $ � � < � � \ � u 1 � �" e$ & �' � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty Availability Availability � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty Bandwidth Bandwidth � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � * B � MSFT_CliProperty ConfigManagerErrorCode ConfigManagerErrorCode � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � + D � MSFT_CliProperty ConfigManagerUserConfig ConfigManagerUserConfig � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier t � , � MSFT_CliProperty Description Description � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier q � & � MSFT_CliProperty DeviceID DeviceID � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier t � , � MSFT_CliProperty DisplayType DisplayType � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty ErrorCleared ErrorCleared � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier y � $ 6 � MSFT_CliProperty ErrorDescription ErrorDescription � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier t � , � MSFT_CliProperty InstallDate InstallDate � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier q � & � MSFT_CliProperty IsLocked IsLocked � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier v � ! 0 � MSFT_CliProperty LastErrorCode LastErrorCode � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier | � ' < � MSFT_CliProperty MonitorManufacturer MonitorManufacturer � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier t � , � MSFT_CliProperty MonitorType MonitorType � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier m � � MSFT_CliProperty Name Name � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier t � , � MSFT_CliProperty PNPDeviceID PNPDeviceID � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier ~ � ) @ � MSFT_CliProperty PixelsPerXLogicalInch PixelsPerXLogicalInch � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier ~ � ) @ � MSFT_CliProperty PixelsPerYLogicalInch PixelsPerYLogicalInch � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � / L � MSFT_CliProperty PowerManagementCapabilities PowerManagementCapabilities � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � , F � MSFT_CliProperty PowerManagementSupported PowerManagementSupported � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty ScreenHeight ScreenHeight � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier t � , � MSFT_CliProperty ScreenWidth ScreenWidth � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o � " � MSFT_CliProperty Status Status � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier s � * � MSFT_CliProperty StatusInfo StatusInfo �
�
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � r
� MSFT_CliFormat table CONFIG ; � � Q
� � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier q � & � MSFT_CliProperty DeviceID DeviceID � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier m � � MSFT_CliProperty Name Name � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier ~ � ) @ � MSFT_CliProperty PixelsPerXLogicalInch PixelsPerXLogicalInch � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier ~ � ) @ � MSFT_CliProperty PixelsPerYLogicalInch PixelsPerYLogicalInch � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty ScreenHeight ScreenHeight � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier t � , � MSFT_CliProperty ScreenWidth ScreenWidth �
�
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � V
� MSFT_CliFormat table STATUS ; � � M � � � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier q � & � MSFT_CliProperty DeviceID DeviceID � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier q � & � MSFT_CliProperty IsLocked IsLocked � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier v � ! 0 � MSFT_CliProperty LastErrorCode LastErrorCode � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier m � � MSFT_CliProperty Name Name � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o � " � MSFT_CliProperty Status Status � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier s � * � MSFT_CliProperty StatusInfo StatusInfo �
�
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � e
� MSFT_CliFormat table BRIEF : � � U � � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier q � & � MSFT_CliProperty DeviceID DeviceID � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier t � , � MSFT_CliProperty DisplayType DisplayType � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier | � ' < � MSFT_CliProperty MonitorManufacturer MonitorManufacturer � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier m � � MSFT_CliProperty Name Name � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty ScreenHeight ScreenHeight � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier t � , � MSFT_CliProperty ScreenWidth ScreenWidth Q �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty ^ ! � � MSFT_CliFormat TABLE INSTANCE ) � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier q � & � MSFT_CliProperty DeviceID DeviceID s �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � + � MSFT_CliFormat SYSTEM
D � � U � b
�
x � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty __CLASS __CLASS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __DERIVATION __DERIVATION � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __DYNASTY __DYNASTY � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty __GENUS __GENUS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier t � , � MSFT_CliProperty __NAMESPACE __NAMESPACE � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o � " � MSFT_CliProperty __PATH __PATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier y � $ 6 � MSFT_CliProperty __PROPERTY_COUNT __PROPERTY_COUNT � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __RELPATH __RELPATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier q � & � MSFT_CliProperty __SERVER __SERVER � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __SUPERCLASS __SUPERCLASS DesktopMonitor WHERE DEVICEID='#' Select * from WIN32_DESKTOPMONITOR ? ? ? # ? ? ? . ? ? > ? ? ? 4 ? + ?
? ? ? ? ? $ ? ' ? ? ? ? " ? : ? ? ? ! ? 7 ? 8 @ D |_
�
�� ���
c�/ q �^�i�
�� ?
N x@�� m�� � /���Z;O��o � (�+�
� �T�� J�
�NS_E1578D36E8972985C3607CB2490418C572C190C71151F301302674342C5C885D CI_FD3BBD4C42AC2F7FEF264340A9EB78A581FE5C28561CB63EDF780B329EAC2EE4 IL_BC62D2F1A8964BE05CE3C8E4A92D6196F3ABA9FF68221E9970F3291305AD53F0.420.1.28222 IL_5619F5F895C3D573343163A85231441998067CF9B7F0925D97380D29EEA3F575.424.1.33645 IL_A9B77B6FB8EEFAA0386ECE3D9F763120D7E0B46CF98ACF71EF752F98F67AAC11.429.1.32140 IL_5DF699F99654C2DBF66C5FDB8987B09A99F1CFAA95812890C5421B937233B9AB.433.1.100514 IL_BD93AFD54A2CBC0AAE6AC538B824779A9A1273B2B91BB9D43D9256B804C5A7BC.446.1.30870 IL_A652C2031A398BA1BCC19829AA29BBA940B833717CFD10EB3A678C370F38E883.450.1.60127 IL_53CE600361D9DC049AB7920A4B0095959C43531AA0DA3E5EEA49EBF699C0A9D2.458.1.47278 IL_AA1B5BB8A762366D711DCFE877B29E175333778C99FBCFF14D33452DE7A9A746.464.1.297697 IL_3E5C71F597B81038891F6DBE304274708E2BB2389008548AA6B8A0CCE07BBFD8.501.1.38483 IL_8DD5B4325D414AEB9A2E89B2A9012972DB466402E099F6F23B86F048D798271C.506.1.85098 IL_663060429A6938D1B4C13319904DC9CB4D95E1E1D71EE9B0A8EA8DACAE58E45C.517.1.45904 IL_133AE77889577C41679A67ADB2FE6AD9A47EDBC4C9E19AA735345C392697BF03.523.1.61884 IL_CA599D6A29EF58E9CC298260942301AFE42CF6FFCEB9502DACD0BAA50DED4DEE.531.1.21465 IL_993D150D0C9C8AECC30617FB0FF207B447C72B60CB9837CA152ECAA0421F80ED.534.1.143330 IL_75757880EAB8961D1A3C186FDB42A3E5F36F1FCF20B2679D12A2FFFCA63470FF.552.1.33689 IL_95836D7E2E497A1F78FB3DE04D6CC7B1E86FB113E1FC2C16F2960FB52159CE1E.557.1.28406 IL_9A1B596721539D9615A6900B0F6364E9823374D126BDDBDF36FABAC428F02B9B.561.1.66330 IL_37ECB0FC067D850AC282384258FD54C71F901EB4FE0DA87DE18B8C19E1262A36.588.1.74409 IL_B8A661C1D622FBC77353C6283693E0067AFF965D515809B24B4E9FF26EFC7D7E.604.1.105338 IL_0255C72DE857C2548B152EEC30DB6E16802B631CB06DED8AAADBC49C9509FDEB.617.1.272838 IL_84F7DA8FDA90FAE6187111C2192FDA36DDBDE6FDE609673EA728B3013AF37B7B.651.1.36555 IL_0BE16089DDC1582CDB25043DB42CD7AE12C51808071C234ECBB1734648B1CD8B.660.1.73443 IL_662CB144681343CD914A84B6324D30356940F0E892AC14E72E79452BFD8511B8.676.1.129842 IL_CE1AB475306539B9E244C98908B04E7D335C952B0802573B7D36EFEB15743AA7.696.1.29172 IL_CEEB04238836B14B55751D5FC8F0C378A54AF1942F10226666FDE7520B51B7EC.700.1.57184 IL_5306A39AE8099BE250137B7B473C6C6DC916A35E8018A185B5C9A31EB97EDE85.707.1.27844 IL_8DA716445EA26247BDCD502C872559133B29770F7B55AFBFF871D80915CA3DBD.711.1.40746 IL_5361F0B5BCF344E5F8BAFF7D3C773CFDA995B3843B674DB9DB34AC35EA55A657.749.1.63404 IL_5A83D395085B6B03108F7917D2C4F3D0683B0E479C446703225592BD963CB748.757.1.38386 IL_C1B039C6B15CB1268319C147066B90BAE1F5E0DA59EE23E8DFE59CEDEE8D5513.762.1.144923 IL_A600B813C3AEE4D495996259138D2BE996C368532199D64507DCA6E373C2D027.780.1.56137 IL_5A594905C8F81E999D9B9057D3667626B70DB4CAA9232253B2044B135DF40086.787.1.31819 IL_3C2C2907345FD9238E14A72F66B1B84060440D64FBC7FA8518759968C7E4B75B.791.1.49293 IL_5430A0963BDFE45F48448BEFE49162AB9A7F5390BEE895620AB94C03956A31E5.806.1.36972 IL_4A3DDCEADF875B43B86031D680AEC99D3EBB91A5667B84178BECB0ED04142818.823.1.43301 IL_725C909F3FE4FF1D4452519DC5E7319F49B4FDA30799FA428AB30E8A93652894.829.1.81389 IL_66FFF9930E5CCC0D760D3BBAE923EAA766D470F40F422E860FC653AA3204A9F2.839.1.60167 IL_205887C744703AC8F3F642361E4742AB22945D825FED20CA5B721B6BD1D35235.847.1.54129 IL_A1C1D10CC78BE7A5C3AB54515C19F31277BB3701F61C98AD4F3CEB32242F741C.861.1.30027 IL_6456463FE04288A1885C6F7DFFFA4040E415617C14B667F2C51BCDF537F3D501.865.1.21995 IL_CF17F65BDE5D27AA83EF3274842254733535B217A340E131A413188964603E19.868.1.35696 IL_03F5649201FD452B0914A7C2ABB834EB3774DB65ACE24E9A57AE71F5B3E8D405.873.1.88433 IL_0869E7F30E2A5BF6BEAEB4AC9D6BA65E60DD3C3396A670DFF5952A5180C69165.903.1.56485 IL_BA51ED41265DA7310954BAE161AF50CE2679B701DA6D3DEB06FA741A8D05CD90.910.1.70636 IL_990444B5147B385848F6A331FB9B78A4118CD4F34316765DD7E05BFBAFD92E46.919.1.39586 IL_49645A7E73D822346D709311ADBAC1C95851F17A85507279169A1C26AD7A76DF.924.1.104721 IL_109FF4DB06F1B7E43B4FFA991E46E1AC64566587215453FAD438A316C11699CC.937.1.74580 IL_5F52E98B4905E86733B57BDB8229A4CEC75FA5749D918B5DBC7157473B48B71F.956.1.13002 IL_60E5E385E51F7170564DC3A25AAA1E35C0C27B9240E9CAF9E2086D795B396162.974.1.8675 IL_4F28049B29ED0162FE0090B43C7F9ACB02BB2A7DA2E5515A9A1D50C0DC210D88.976.1.48287 IL_74CF1EDBEB2A88AE2B7F2B31226DC6989203AD486527D338B157184A36F210BE.982.1.23321 IL_897EACA2347FBC71DC0E8FBFE21FA1F13FC9EAEDDE7A34C1DE772DFD6AAE17B6.985.1.15604 IL_2FD8DCDD9272028411CDB92D628888781F863A853FD409FF5C59AF68D5452AC6.987.1.101109 IL_4CD34998191B7D33C77F03D776D618320C603FD3921842E1B0BD47475C056851.1000.1.51109 IL_4C10C5441FCE04BC41DDEC512892264D846021BB7D560E4EBF1E528C17B43826.1007.1.31956 IL_6EACF9EBFCA10986AA504ECF943BEA549FB8DE4850FBADD0F165D6E5FD0E4DBB.1011.1.30190 IL_C59E83547F1BC933FE30770D4EDB5077AA988B54FE242F5F66DA214D449E875A.321.1.62809 IL_43E62AB0AD3F0F54666953AC95C414EE36B3A6541513F8BFD8A755EEC9A7E6E5.329.1.65559 IL_55BA3B97EE945A5FFAA048F94EB0B1F3BCDC2B26C8F2588BFFB42050A21365DE.338.1.27578 IL_6E3B4399FA4EDE750602EAE85FB276C1B64644E78344F6BB3EF3F442D17FE8D8.353.1.287457 IL_BF593FDA4BA33F9ED167DAD655EB0DCA41D164E127B57BF7155EB8BC36FD4AEB.399.1.150684 IL_C004F31EED0C3389D3663FFEDC2379761F7F253446DFB3E07A859B8D44F5D78E.418.1.15778 � �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � k � MSFT_CliFormat TABLE CONFIG
W
� i � }
1 �
� S � � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty AddressWidth AddressWidth � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
�} F D 3 B B D 4 C 4 2 A C 2 F 7 F E F 2 6 4 3 4 0 A 9 E B 7 8 A 5 8 1 F E 5 C 2 8 5 6 1 C B 6 3 E D F 7 8 0 B 3 2 9 E A C 2 E E 4 �b��5��͝��C��| � + P �| �| �| �| � MSFT_CliAlias � F N u � � � � �
U�������������������������4 � MSFT_CliConnection Authority
� > STRING Locale
� m STRING NameSpace
� � STRING Password
� � STRING Server
� � STRING User
� , STRING | � ( + � MSFT_CliConnection ms_409 ROOT\CIMV2 . Device memory addresses management. h `% �@ *D 1X �" �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty " C � MSFT_CliFormat TABLE STATUS / C � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � i q � � MSFT_CliProperty Status The Status property is a string indicating the current status of the object. Status � � / � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 10 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap A E L V _ j t ~ OK Error Degraded Unknown Pred Fail Starting Stopping Service � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values ? C J T ] h r | OK Error Degraded Unknown Pred Fail Starting Stopping Service # 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � \ b � MSFT_CliProperty Name The Name property defines the label by which the object is known. Name � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � { � � � MSFT_CliProperty MemoryType The MemoryType property indicates the characteristics of the memory resource on the system. MemoryType � ! � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � _ � MSFT_CliQualifier ValueMap 1 < F Q ReadWrite ReadOnly WriteOnly Prefetchable � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � ] � MSFT_CliQualifier Values / : D O ReadWrite ReadOnly WriteOnly Prefetchable s �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � + � MSFT_CliFormat SYSTEM
D � � U � b
�
x � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty __CLASS __CLASS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __DERIVATION __DERIVATION � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __DYNASTY __DYNASTY � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty __GENUS __GENUS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier t � , � MSFT_CliProperty __NAMESPACE __NAMESPACE � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o � " � MSFT_CliProperty __PATH __PATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier y � $ 6 � MSFT_CliProperty __PROPERTY_COUNT __PROPERTY_COUNT � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __RELPATH __RELPATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier q � & � MSFT_CliProperty __SERVER __SERVER � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __SUPERCLASS __SUPERCLASS O �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty \ ! � � MSFT_CliFormat TABLE INSTANCE ) � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o � " � MSFT_CliProperty __PATH __PATH �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty B � MSFT_CliFormat TABLE BRIEF . . U
� 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � { � � � MSFT_CliProperty MemoryType The MemoryType property indicates the characteristics of the memory resource on the system. MemoryType � ! � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � _ � MSFT_CliQualifier ValueMap 1 < F Q ReadWrite ReadOnly WriteOnly Prefetchable � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � ] � MSFT_CliQualifier Values / : D O ReadWrite ReadOnly WriteOnly Prefetchable # 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � \ b � MSFT_CliProperty Name The Name property defines the label by which the object is known. Name � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � i q � � MSFT_CliProperty Status The Status property is a string indicating the current status of the object. Status � � / � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 10 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap A E L V _ j t ~ OK Error Degraded Unknown Pred Fail Starting Stopping Service � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values ? C J T ] h r | OK Error Degraded Unknown Pred Fail Starting Stopping Service S$ �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty `# � � MSFT_CliFormat TABLE FULL 9 s � � � � 6 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � h u � MSFT_CliProperty Description The Description property provides a textual description of the object. Description > 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � ! n } � MSFT_CliProperty EndingAddress The EndingAddress property contains the ending address of memory mapped I/O EndingAddress � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � { � � � MSFT_CliProperty MemoryType The MemoryType property indicates the characteristics of the memory resource on the system. MemoryType � ! � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � _ � MSFT_CliQualifier ValueMap 1 < F Q ReadWrite ReadOnly WriteOnly Prefetchable � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � ] � MSFT_CliQualifier Values / : D O ReadWrite ReadOnly WriteOnly Prefetchable # 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � \ b � MSFT_CliProperty Name The Name property defines the label by which the object is known. Name � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier } � # � � � MSFT_CliProperty StartingAddress The StartingAddress property contains the starting address of memory mapped I/O. The hardware resource identifier property should be set to this value to construct the mapped I/O resource key. StartingAddress � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � i q � � MSFT_CliProperty Status The Status property is a string indicating the current status of the object. Status � � / � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 10 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap A E L V _ j t ~ OK Error Degraded Unknown Pred Fail Starting Stopping Service � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values ? C J T ] h r | OK Error Degraded Unknown Pred Fail Starting Stopping Service DeviceMemoryAddress Select * from Win32_DeviceMemoryAddress rty DeviceID DeviceID � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier m � � MSFT_CliProperty Name Name � 9 E R y � � U����������������� � MSFT_CliProperty Der �� F D 3 B B D 4 C 4 2 A C 2 F 7 F E F 2 6 4 3 4 0 A 9 E B 7 8 A 5 8 1 F E 5 C 2 8 5 6 1 C B 6 3 E D F 7 8 0 B 3 2 9 E A C 2 E E 4 �b��5��͝��C�� � + M �� �� �� އ� MSFT_CliAlias � F N u � � � � �
U�������������������������4 � MSFT_CliConnection Authority
� > STRING Locale
� m STRING NameSpace
� � STRING Password
� � STRING Server
� � STRING User
� , STRING | � ( + � MSFT_CliConnection ms_409 ROOT\CIMV2 . Physical disk drive management. m *T �o �r M� �� <? �Q �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty �P �4 � MSFT_CliFormat Table STATUS ? f � @ ' Z) k2 # 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � * [ s � � MSFT_CliProperty ConfigManagerErrorCode Indicates the Configuration Manager error code. ConfigManagerErrorCode { 9 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values � � � � � / u � � 0 K ` � � l � � ) � � F � � � 0 ` � This device is working properly. This device is not configured correctly. Windows cannot load the driver for this device. The driver for this device might be corrupted, or your system may be running low on memory or other resources. This device is not working properly. One of its drivers or your registry might be corrupted. The driver for this device needs a resource that Windows cannot manage. The boot configuration for this device conflicts with other devices. Cannot filter. The driver loader for the device is missing. This device is not working properly because the controlling firmware is reporting the resources for the device incorrectly. This device cannot start. This device failed. This device cannot find enough free resources that it can use. Windows cannot verify this device's resources. This device cannot work properly until you restart your computer. This device is not working properly because there is probably a re-enumeration problem. Windows cannot identify all the resources this device uses. This device is asking for an unknown resource type. Reinstall the drivers for this device. Your registry might be corrupted. System failure: Try changing the driver for this device. If that does not work, see your hardware documentation.Windows is removing this device. This device is disabled. System failure: Try changing the driver for this device. If that doesn't work, see your hardware documentation. This device is not present, is not working properly, or does not have all its drivers installed. Windows is still setting up this device. Windows is still setting up this device. This device does not have valid log configuration. The drivers for this device are not installed. This device is disabled because the firmware of the device did not give it the required resources. This device is using an Interrupt Request (IRQ) resource that another device is using. This device is not working properly because Windows cannot load the drivers required for this device. = 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � ! m | � MSFT_CliProperty LastErrorCode LastErrorCode captures the last error code reported by the logical device. LastErrorCode � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier [ � ! � � � MSFT_CliProperty NeedsCleaning Boolean indicating that the media access device needs cleaning. Whether manual or automatic cleaning is possible is indicated in the Capabilities array property. NeedsCleaning � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � * � MSFT_CliProperty Status The Status property is a string indicating the current status of the object. Various operational and non-operational statuses can be defined. Operational statuses are "OK", "Degraded" and "Pred Fail". "Pred Fail" indicates that an element may be functioning properly but predicting a failure in the near future. An example is a SMART-enabled hard drive. Non-operational statuses can also be specified. These are "Error", "Starting", "Stopping" and "Service". The latter, "Service", could apply during mirror-resilvering of a disk, reload of a user permissions list, or other administrative work. Not all such work is on-line, yet the managed element is neither "OK" nor in one of the other states. Status � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 10 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap A E L V _ j t ~ OK Error Degraded Unknown Pred Fail Starting Stopping Service � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values ? C J T ] h r | OK Error Degraded Unknown Pred Fail Starting Stopping Service V 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � � MSFT_CliProperty DeviceID The DeviceID property contains a string uniquely identifying the disk drive with other devices on the system. DeviceID
9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � + � � MSFT_CliProperty StatusInfo StatusInfo is a string indicating whether the logical device is in an enabled (value = 3), disabled (value = 4) or some other (1) or unknown (2) state. If this property does not apply to the logical device, the value, 5 ("Not Applicable"), should be used. StatusInfo 7 T � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING k D � MSFT_CliQualifier ValueMap 5 8 ; > A 1 2 3 4 5 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � f � MSFT_CliQualifier Values 3 : C L V Other Unknown Enabled Disabled Not Applicable p 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier 6 � � � � MSFT_CliProperty Partitions The Partitions property indicates the number of partitions on this physical disk drive that are recognized by the operating system. Partitions s �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � + � MSFT_CliFormat SYSTEM
D � � U � b
�
x � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty __CLASS __CLASS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __DERIVATION __DERIVATION � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __DYNASTY __DYNASTY � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty __GENUS __GENUS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier t � , � MSFT_CliProperty __NAMESPACE __NAMESPACE � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o � " � MSFT_CliProperty __PATH __PATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier y � $ 6 � MSFT_CliProperty __PROPERTY_COUNT __PROPERTY_COUNT � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __RELPATH __RELPATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier q � & � MSFT_CliProperty __SERVER __SERVER � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __SUPERCLASS __SUPERCLASS N �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty [ ! � � MSFT_CliFormat Table INSTANCE ) � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier n � � MSFT_CliProperty Index Index V �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty c � � MSFT_CliFormat TABLE BRIEF 6 � : V p 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier 6 � � � � MSFT_CliProperty Partitions The Partitions property indicates the number of partitions on this physical disk drive that are recognized by the operating system. Partitions V 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � � MSFT_CliProperty DeviceID The DeviceID property contains a string uniquely identifying the disk drive with other devices on the system. DeviceID 2 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � j q � MSFT_CliProperty Model The Model property indicates the manufacturer's model number of the disk drive. Model 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � Q W � MSFT_CliProperty Size The Size property indicates the size of the disk drive. Size � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier L Q Z } � MSFT_CliProperty Caption The Caption property is a short textual description. Caption b � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 64 R �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty _ �
� MSFT_CliFormat TABLE SCSI 9 � � # z � V 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � � MSFT_CliProperty DeviceID The DeviceID property contains a string uniquely identifying the disk drive with other devices on the system. DeviceID \ 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier " � � � � MSFT_CliProperty Index The Index property indicates the physical drive number of the given drive. This member is filled by Get Drive Map Info. Index , 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � b k � MSFT_CliProperty SCSIBus The SCSIBus property indicates the SCSI bus number of the disk drive. SCSIBus S 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � # � � � MSFT_CliProperty SCSILogicalUnit The SCSILogicalUnit property indicates the SCSI logical unit number (LUN) of the disk drive. SCSILogicalUnit 0 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � e o � MSFT_CliProperty SCSIPort The SCSIPort property indicates the SCSI port number of the disk drive. SCSIPort : 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � k y � MSFT_CliProperty SCSITargetId The SCSITargetId property indicates the SCSI ID number of the disk drive. SCSITargetId �� �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty �� �� � MSFT_CliFormat list FULL . � & � �
1( * �, �. P1 �3 c6 �8 6; }= �? B ED zF �H �J (O ]Q �S �U SX �Z ]] �_ �d Lg |i �k n Ep �r �t �w ]� n� � w� �� � U� J 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier M [ = � MSFT_CliProperty Availability The availability and status of the device. Availability g � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap e h k n q t w z } � � � � � � � � 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 0 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � \ � MSFT_CliQualifier Values c j s � � � � � � � � � � # 9 F Other Unknown Running/Full Power Warning In Test Not Applicable Power Off Off Line Off Duty Degraded Not Installed Install Error Power Save - Unknown Power Save - Low Power Mode Power Save - Standby Power Cycle Power Save - Warning Z 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � " � � � MSFT_CliProperty BytesPerSector The BytesPerSector property indicates the number of bytes in each sector for the physical disk drive. BytesPerSector � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier S � � $ � MSFT_CliProperty Capabilities Capabilities of the media access device. For example, the device may support "Random Access", removable media and "Automatic Cleaning". Capabilities � ^ � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values
G P W j y � � � � � Unknown Other Sequential Access Random Access Supports Writing Encryption Compression Supports Removable Media Manual Cleaning Automatic Cleaning � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier Y � * � � � MSFT_CliProperty CapabilityDescriptions An array of free-form strings providing more detailed explanations for any of the access device features indicated in the Capabilities array. CapabilityDescriptions Z 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � % � � � MSFT_CliProperty CompressionMethod A free form string indicating the algorithm or tool used by the device to support compression. CompressionMethod # 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � * [ s � � MSFT_CliProperty ConfigManagerErrorCode Indicates the Configuration Manager error code. ConfigManagerErrorCode { 9 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values � � � � � / u � � 0 K ` � � l � � ) � � F � � � 0 ` � This device is working properly. This device is not configured correctly. Windows cannot load the driver for this device. The driver for this device might be corrupted, or your system may be running low on memory or other resources. This device is not working properly. One of its drivers or your registry might be corrupted. The driver for this device needs a resource that Windows cannot manage. The boot configuration for this device conflicts with other devices. Cannot filter. The driver loader for the device is missing. This device is not working properly because the controlling firmware is reporting the resources for the device incorrectly. This device cannot start. This device failed. This device cannot find enough free resources that it can use. Windows cannot verify this device's resources. This device cannot work properly until you restart your computer. This device is not working properly because there is probably a re-enumeration problem. Windows cannot identify all the resources this device uses. This device is asking for an unknown resource type. Reinstall the drivers for this device. Your registry might be corrupted. System failure: Try changing the driver for this device. If that does not work, see your hardware documentation.Windows is removing this device. This device is disabled. System failure: Try changing the driver for this device. If that doesn't work, see your hardware documentation. This device is not present, is not working properly, or does not have all its drivers installed. Windows is still setting up this device. Windows is still setting up this device. This device does not have valid log configuration. The drivers for this device are not installed. This device is disabled because the firmware of the device did not give it the required resources. This device is using an Interrupt Request (IRQ) resource that another device is using. This device is not working properly because Windows cannot load the drivers required for this device. J 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � + p � � MSFT_CliProperty ConfigManagerUserConfig Indicates whether the device is using a user-defined configuration. ConfigManagerUserConfig 9 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � $ T f � MSFT_CliProperty DefaultBlockSize Default block size, in bytes, for this device. DefaultBlockSize 6 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � h u � MSFT_CliProperty Description The Description property provides a textual description of the object. Description V 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � � MSFT_CliProperty DeviceID The DeviceID property contains a string uniquely identifying the disk drive with other devices on the system. DeviceID ` 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier & � � � � MSFT_CliProperty ErrorCleared ErrorCleared is a boolean property indicating that the error reported in LastErrorCode property is now cleared. ErrorCleared � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier q � $ � � � MSFT_CliProperty ErrorDescription ErrorDescription is a free-form string supplying more information about the error recorded in LastErrorCode property, and information on any corrective actions that may be taken. ErrorDescription o 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier 5 � $ � � � MSFT_CliProperty ErrorMethodology ErrorMethodology is a free-form string describing the type of error detection and correction supported by this device. ErrorMethodology \ 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier " � � � � MSFT_CliProperty Index The Index property indicates the physical drive number of the given drive. This member is filled by Get Drive Map Info. Index C 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � u � � MSFT_CliProperty InstallDate The InstallDate property is datetime value indicating when the object was installed. InstallDate B 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � ! r � � MSFT_CliProperty InterfaceType The InterfaceType property indicates the interface type of physical disk drive. InterfaceType = 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � ! m | � MSFT_CliProperty LastErrorCode LastErrorCode captures the last error code reported by the logical device. LastErrorCode = 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � n | � MSFT_CliProperty Manufacturer The Manufacturer property indicates the name of the disk drive manufacturer. Manufacturer 1 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � b p � MSFT_CliProperty MaxBlockSize Maximum block size, in bytes, for media accessed by this device. MaxBlockSize , 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � ] k � MSFT_CliProperty MaxMediaSize Maximum size, in Kbytes, of media supported by this device. MaxMediaSize B 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � t � � MSFT_CliProperty MediaLoaded The MediaLoaded property determines whether the media for a disk drive is loaded. MediaLoaded 4 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � k v � MSFT_CliProperty MediaType The MediaType property is the type of media used or accessed by this device. MediaType ~ � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � V � MSFT_CliQualifier Values + < M Removable media Fixed hard disk Unknown 1 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � b p � MSFT_CliProperty MinBlockSize Minimum block size, in bytes, for media accessed by this device. MinBlockSize 2 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � j q � MSFT_CliProperty Model The Model property indicates the manufacturer's model number of the disk drive. Model # 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � \ b � MSFT_CliProperty Name The Name property defines the label by which the object is known. Name � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier [ � ! � � � MSFT_CliProperty NeedsCleaning Boolean indicating that the media access device needs cleaning. Whether manual or automatic cleaning is possible is indicated in the Capabilities array property. NeedsCleaning � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier X � * � � � MSFT_CliProperty NumberOfMediaSupported When the media access device supports multiple individual media, this property defines the maximum number which can be supported or inserted. NumberOfMediaSupported p 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier 6 � � � � MSFT_CliProperty Partitions The Partitions property indicates the number of partitions on this physical disk drive that are recognized by the operating system. Partitions - 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � _ l � MSFT_CliProperty PNPDeviceID Indicates the Plug and Play device ID of the logical device. PNPDeviceID T 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier / z � � MSFT_CliProperty PowerManagementCapabilities Indicates the specific power-related capabilities of the logical device. PowerManagementCapabilities � k � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values ? H W a j � � � Unknown Not Supported Disabled Enabled Power Saving Modes Entered Automatically Power State Settable Power Cycling Supported Timed Power On Supported b 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier ( � , � � � MSFT_CliProperty PowerManagementSupported Indicates that the device can be power managed - i.e. can be put into suspend mode, etc. PowerManagementSupported , 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � b k � MSFT_CliProperty SCSIBus The SCSIBus property indicates the SCSI bus number of the disk drive. SCSIBus S 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � # � � � MSFT_CliProperty SCSILogicalUnit The SCSILogicalUnit property indicates the SCSI logical unit number (LUN) of the disk drive. SCSILogicalUnit 0 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � e o � MSFT_CliProperty SCSIPort The SCSIPort property indicates the SCSI port number of the disk drive. SCSIPort : 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � k y � MSFT_CliProperty SCSITargetId The SCSITargetId property indicates the SCSI ID number of the disk drive. SCSITargetId _ 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier % � # � � � MSFT_CliProperty SectorsPerTrack The SectorsPerTrack property indicates the number of sectors in each track for this physical disk drive. SectorsPerTrack L 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier �� � � MSFT_CliProperty Signature The Signature property is used to identify a disk. It can be used to identify a shared resource. Signature � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier g � � � � MSFT_CliProperty Size The Size property indicates the size of the disk drive. It is calculated by multiplying the total number of cylinders, tracks in each cylinder, sectors in each track, and bytes in each sector. Size � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � * � MSFT_CliProperty Status The Status property is a string indicating the current status of the object. Various operational and non-operational statuses can be defined. Operational statuses are "OK", "Degraded" and "Pred Fail". "Pred Fail" indicates that an element may be functioning properly but predicting a failure in the near future. An example is a SMART-enabled hard drive. Non-operational statuses can also be specified. These are "Error", "Starting", "Stopping" and "Service". The latter, "Service", could apply during mirror-resilvering of a disk, reload of a user permissions list, or other administrative work. Not all such work is on-line, yet the managed element is neither "OK" nor in one of the other states. Status � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 10 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap A E L V _ j t ~ OK Error Degraded Unknown Pred Fail Starting Stopping Service � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values ? C J T ] h r | OK Error Degraded Unknown Pred Fail Starting Stopping Service
9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � + � � MSFT_CliProperty StatusInfo StatusInfo is a string indicating whether the logical device is in an enabled (value = 3), disabled (value = 4) or some other (1) or unknown (2) state. If this property does not apply to the logical device, the value, 5 ("Not Applicable"), should be used. StatusInfo 7 T � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING k D � MSFT_CliQualifier ValueMap 5 8 ; > A 1 2 3 4 5 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � f � MSFT_CliQualifier Values 3 : C L V Other Unknown Enabled Disabled Not Applicable � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier s � * � MSFT_CliProperty SystemName SystemName T 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � " � � � MSFT_CliProperty TotalCylinders The TotalCylinders property indicates the total number of cylinders on the physical disk drive. TotalCylinders < 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � o { � MSFT_CliProperty TotalHeads The TotalHeads property indicates the total number of heads on the disk drive. TotalHeads M 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � ~ � � MSFT_CliProperty TotalSectors The TotalSectors property indicates the total number of sectors on the physical disk drive. TotalSectors I 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � { � � MSFT_CliProperty TotalTracks The TotalTracks property indicates the total number of tracks on the physical disk drive. TotalTracks f 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier , � % � � � MSFT_CliProperty TracksPerCylinder The TracksPerCylinder property indicates the number of tracks in each cylinder on the physical disk drive. TracksPerCylinder o���` e 4��2� � E�I{� � ���/� ����� F M S F T _ N e t A d a p t e r S e t t i n g D a t a �wR|�C�� b $ MSFT_NetAdapterSettingData ) ! . T ��_ g o � ( 1 � � ] � � � � 3 T � � X i � � p � � � * > J � � ��UUUU��������������������������������������������������������������������������������������������O
� MSFT_NetAdapterSriovSettingData Description SRIOV settings for a network adapter AMENDMENT LOCALE MS_409 CurrentCapabilities
*
� � � � object:MSFT_NetAdapterSriovCapabilities Description The SRIOV capabilities currently enabled on the network adapter. Enabled
� ] f s boolean Description Indicates if SRIOV is currently enabled on the Adapter. HardwareCapabilities
&
� � $ object:MSFT_NetAdapterSriovCapabilities Description The SRIOV capabilities reported by the network adapter. NumActiveDefaultVPortMacAddresses L
� � � � uint32 Description The number of active MAC addresses on the default VPort. NumActiveDefaultVPortVlanIds T
� E M Z uint32 Description The number of active VLAN IDs on the default VPort NumActiveNonDefaultVPortMacAddresses P
� � � � uint32 Description The number of active MAC addresses on the non-default VPorts NumActiveNonDefaultVPortVlanIds X
� � � � uint32 Description The number of active VLAN IDs on the non-default VPorts NumActiveVPorts @
� uint32 Description The number of VPorts currently allocated on the switch NumAllocatedVFs 8
� � � � uint32 Description The number of Virtual Functions currently allocated. NumQueuePairsForDefaultVPort D
� * 2 ? uint32 Description The number of Queue pairs for the default VPort NumQueuePairsForNonDefaultVPorts H
� � � � uint32 Description The number of Queue pairs for the non-default VPort NumVFs 4
� < D Q uint32 Description The number of Virtual Functions that can be allocated on the switch NumVPorts <
� � � � uint32 Description The number of VPorts that can be allocated on the switch SriovSupport " +
� c k s uint32 Values � � � � � � � � Unknown Supported MissingAcs MissingPfDriver NoBusResources NoIoMmuSupport NoVfBarSpace NoOscSupport Description Indicates the SRIOV support for the device. SwitchName
0
� v ~ � string Description The name of the switch SwitchType . +
� � � �
$
uint16 Values
Unknown External Description Indicates the type of the embedded switch � \ ` � � V � Enable & Description Enables the SRIOV properties on the network adapter. F a42c9160500003S ROOT\standardcimv2\MS_409 ���� � �� �� * � D ��������n � __PARAMETERS abstract
cmdletOutput object
� 8 Out
� 8 _ �� ID
)
� � _ ��� object:MSFT_NetAdapterSriovSettingData ReturnValue uint32
� 7 uint32 out
� 7 ? �� __ � Disable � � Description Disables the SRIOV properties on the network adapter. F a42c9160500003S ROOT\standardcimv2\MS_409 ���� � �� �� * � D ��������n � __PARAMETERS abstract
cmdletOutput object
� 8 Out
� 8 _ �� ID
)
� � _ ��� object:MSFT_NetAdapterSriovSettingData ReturnValue uint32
� 7 uint32 out
� 7 ? �� __ �! M S F T _ N e t A d a p t e r E l e m e n t S e t t i n g D a t a �wR|�C�� + MSFT_NetAdapterElementSettingData # ) & 3 f ��q y � � ���������������� � MSFT_NetAdapterSriovVfElementSetting Description Associates a network port with its SRIOV VF data. AMENDMENT LOCALE MS_409 SettingData f@
� � � � ref:MSFT_NetAdapterSriovVfSettingData Description The SRIOV setting data for a network adapter. � M S F T _ N e t A d a p t e r S e t t i n g D a t a �wR|�C�� B $ MSFT_NetAdapterSettingData ) # 0 \ ��g o w � � d y � � X h � � � ��UU��������������������������������������������������������������� � MSFT_NetAdapterSriovVfSettingData Description SRIOV VPort settings for a network adapter AMENDMENT LOCALE MS_409 CurrentMacAddress
2
� � � � string Description The current MAC address of the Virtual Function. FunctionID
� 5 = J uint16 Description The Virtual Function ID. PermanentMacAddress 6
� � � � string Description The permanent MAC address of the Virtual Function. SwitchID "
� $ , 9 uint32 Description The identifier of the switch. VmFriendlyName
&
� � � � string Description The friendly name of the Virtual Machine to which the Virtual Function is assigned. VmID *
� 0 8 E string Description The ID of the Virtual Machine to which the Virtual Function is assigned. VmNicID .
� � � � string Description The VM NIC ID to which the Virtual Function is associated. VPortID :
� J R _ uint32 Description The list of Virtual Port IDs attached to this Virtual Function. �! M S F T _ N e t A d a p t e r E l e m e n t S e t t i n g D a t a �wR|�C�� + MSFT_NetAdapterElementSettingData # ) ) 6 } ��� � � � ����������������> � MSFT_NetAdapterStatisticsElementSetting Description Associates a network adapter with the setting data of its statistics. AMENDMENT LOCALE MS_409 SettingData f@
� � � ref:MSFT_NetAdapterStatisticsSettingData Description The statistics setting data for the network adapter. � M S F T _ D S C C o n f i g u r a t i o n O u t p u t �xR|�C�� % MSFT_DSCConfigurationOutput ) ( 5 z ��� � � � MSFT_DSCConfigurationOutputWriteObject Description Resulting streamed output from GetConfigurationResultOutput method. AMENDMENT LOCALE MS_409 �409 �9 A B 5 3 8 0 6 E 8 8 6 6 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0 $=�4 � ͝��C�o ��� D��� N � WMIBinaryMofResource C:\Windows\System32\drivers\processr.sys[PROCESSORWMI] eH �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty rG �, � MSFT_CliFormat LIST CONFIG n � W � X � � 8 � B � J! �# �% 3( �* Z 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � " � � � MSFT_CliProperty BytesPerSector The BytesPerSector property indicates the number of bytes in each sector for the physical disk drive. BytesPerSector J 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � + p � � MSFT_CliProperty ConfigManagerUserConfig Indicates whether the device is using a user-defined configuration. ConfigManagerUserConfig 9 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � $ T f � MSFT_CliProperty DefaultBlockSize Default block size, in bytes, for this device. DefaultBlockSize V 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � � MSFT_CliProperty DeviceID The DeviceID property contains a string uniquely identifying the disk drive with other devices on the system. DeviceID \ 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier " � � � � MSFT_CliProperty Index The Index property indicates the physical drive number of the given drive. This member is filled by Get Drive Map Info. Index C 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � u � � MSFT_CliProperty InstallDate The InstallDate property is datetime value indicating when the object was installed. InstallDate B 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � ! r � � MSFT_CliProperty InterfaceType The InterfaceType property indicates the interface type of physical disk drive. InterfaceType 1 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � b p � MSFT_CliProperty MaxBlockSize Maximum block size, in bytes, for media accessed by this device. MaxBlockSize , 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � ] k � MSFT_CliProperty MaxMediaSize Maximum size, in Kbytes, of media supported by this device. MaxMediaSize 1 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � b p � MSFT_CliProperty MinBlockSize Minimum block size, in bytes, for media accessed by this device. MinBlockSize � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier X � * � � � MSFT_CliProperty NumberOfMediaSupported When the media access device supports multiple individual media, this property defines the maximum number which can be supported or inserted. NumberOfMediaSupported p 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier 6 � � � � MSFT_CliProperty Partitions The Partitions property indicates the number of partitions on this physical disk drive that are recognized by the operating system. Partitions _ 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier % � # � � � MSFT_CliProperty SectorsPerTrack The SectorsPerTrack property indicates the number of sectors in each track for this physical disk drive. SectorsPerTrack � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier g � � � � MSFT_CliProperty Size The Size property indicates the size of the disk drive. It is calculated by multiplying the total number of cylinders, tracks in each cylinder, sectors in each track, and bytes in each sector. Size T 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � " � � � MSFT_CliProperty TotalCylinders The TotalCylinders property indicates the total number of cylinders on the physical disk drive. TotalCylinders < 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � o { � MSFT_CliProperty TotalHeads The TotalHeads property indicates the total number of heads on the disk drive. TotalHeads M 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � ~ � � MSFT_CliProperty TotalSectors The TotalSectors property indicates the total number of sectors on the physical disk drive. TotalSectors I 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � { � � MSFT_CliProperty TotalTracks The TotalTracks property indicates the total number of tracks on the physical disk drive. TotalTracks f 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier , � % � � � MSFT_CliProperty TracksPerCylinder The TracksPerCylinder property indicates the number of tracks in each cylinder on the physical disk drive. TracksPerCylinder DiskDrive WHERE Index=# Select * from Win32_DiskDrive �x F D 3 B B D 4 C 4 2 A C 2 F 7 F E F 2 6 4 3 4 0 A 9 E B 7 8 A 5 8 1 F E 5 C 2 8 5 6 1 C B 6 3 E D F 7 8 0 B 3 2 9 E A C 2 E E 4
�b��5��͝��C�x � + O �w �w �w � MSFT_CliAlias � F N u � � � � �
U�������������������������4 � MSFT_CliConnection Authority
� > STRING Locale
� m STRING NameSpace
� � STRING Password
� � STRING Server
� � STRING User
� , STRING | � ( + � MSFT_CliConnection ms_409 ROOT\CIMV2 . disk space usage for NTFS volumes. k � 1! �, �> �T K �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty X � � MSFT_CliFormat INSTANCE " � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o � " � MSFT_CliProperty __PATH __PATH s �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � + � MSFT_CliFormat SYSTEM
D � � U � b
�
x � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty __CLASS __CLASS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __DERIVATION __DERIVATION � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __DYNASTY __DYNASTY � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty __GENUS __GENUS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier t � , � MSFT_CliProperty __NAMESPACE __NAMESPACE � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o � " � MSFT_CliProperty __PATH __PATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier y � $ 6 � MSFT_CliProperty __PROPERTY_COUNT __PROPERTY_COUNT � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __RELPATH __RELPATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier q � & � MSFT_CliProperty __SERVER __SERVER � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __SUPERCLASS __SUPERCLASS v �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty �
! � MSFT_CliFormat table STATUS + � � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o � " � MSFT_CliProperty __PATH __PATH E 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier ] e � � MSFT_CliProperty Status A Status property indicates the current status of the Disk Quota. Status q � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING k 6 � MSFT_CliQualifier ValueMap - 0 3 0 1 2 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i B � MSFT_CliQualifier Values + / 8 OK Warning Exceeded � �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty
? � MSFT_CliFormat table BRIEF 2 � � f 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier , � ! � � � MSFT_CliProperty DiskSpaceUsed The DiskSpaceUsed property indicates the current number of Bytes currently in use by this particular user or group. DiskSpaceUsed 0 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � h o � MSFT_CliProperty Limit The Limit property indicates the limit set for this particular user or group. Limit : 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � l y � MSFT_CliProperty QuotaVolume The QuotaVolume reference represents the disk volume which has disk quotas. QuotaVolume - 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � f l � MSFT_CliProperty User The User reference represents the user account associated with a disk quota. User * �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty 7 � � MSFT_CliFormat TABLE FULL 9 � � ^
� f 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier , � ! � � � MSFT_CliProperty DiskSpaceUsed The DiskSpaceUsed property indicates the current number of Bytes currently in use by this particular user or group. DiskSpaceUsed 0 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � h o � MSFT_CliProperty Limit The Limit property indicates the limit set for this particular user or group. Limit : 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � l y � MSFT_CliProperty QuotaVolume The QuotaVolume reference represents the disk volume which has disk quotas. QuotaVolume E 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier ] e � � MSFT_CliProperty Status A Status property indicates the current status of the Disk Quota. Status q � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING k 6 � MSFT_CliQualifier ValueMap - 0 3 0 1 2 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i B � MSFT_CliQualifier Values + / 8 OK Warning Exceeded - 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � f l � MSFT_CliProperty User The User reference represents the user account associated with a disk quota. User M 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � ~ � � MSFT_CliProperty WarningLimit The WarningLimit property indicates the warning limit set for this particular user or group. WarningLimit �" �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty �! F � MSFT_CliFormat WRITEABLE ' �
9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � h o � � MSFT_CliProperty Limit The Limit property indicates the limit set for this particular user or group. Limit � � � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING j , � MSFT_CliQualifier CIMTYPE $ uint64 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING g ' � MSFT_CliQualifier read ! True � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING h ) � MSFT_CliQualifier Units " Bytes � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING h ( � MSFT_CliQualifier write " True 7 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � ~ � � MSFT_CliProperty WarningLimit The WarningLimit property indicates the warning limit set for this particular user or group. WarningLimit � � � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING j , � MSFT_CliQualifier CIMTYPE $ uint64 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING g ' � MSFT_CliQualifier read ! True � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING h ) � MSFT_CliQualifier Units " Bytes � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING h ( � MSFT_CliQualifier write " True DiskQuota Select * from Win32_DiskQuota �� F D 3 B B D 4 C 4 2 A C 2 F 7 F E F 2 6 4 3 4 0 A 9 E B 7 8 A 5 8 1 F E 5 C 2 8 5 6 1 C B 6 3 E D F 7 8 0 B 3 2 9 E A C 2 E E 4 �b��5��͝��C�O� � + [ �� �� �� � � MSFT_CliAlias � F N u � � � � �
U�������������������������4 � MSFT_CliConnection Authority
� > STRING Locale
� m STRING NameSpace
� � STRING Password
� � STRING Server
� � STRING User
� , STRING | � ( + � MSFT_CliConnection ms_409 ROOT\CIMV2 . Direct memory access (DMA) channel management. s �% hA 4E � z# �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty �" � MSFT_CliFormat table STATUS + � � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � * � MSFT_CliProperty Status The Status property is a string indicating the current status of the object. Various operational and non-operational statuses can be defined. Operational statuses are "OK", "Degraded" and "Pred Fail". "Pred Fail" indicates that an element may be functioning properly but predicting a failure in the near future. An example is a SMART-enabled hard drive. Non-operational statuses can also be specified. These are "Error", "Starting", "Stopping" and "Service". The latter, "Service", could apply during mirror-resilvering of a disk, reload of a user permissions list, or other administrative work. Not all such work is on-line, yet the managed element is neither "OK" nor in one of the other states. Status � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 10 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap A E L V _ j t ~ OK Error Degraded Unknown Pred Fail Starting Stopping Service � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values ? C J T ] h r | OK Error Degraded Unknown Pred Fail Starting Stopping Service # 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � \ b � MSFT_CliProperty Name The Name property defines the label by which the object is known. Name s �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � + � MSFT_CliFormat SYSTEM
D � � U � b
�
x � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty __CLASS __CLASS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __DERIVATION __DERIVATION � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __DYNASTY __DYNASTY � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty __GENUS __GENUS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier t � , � MSFT_CliProperty __NAMESPACE __NAMESPACE � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o � " � MSFT_CliProperty __PATH __PATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier y � $ 6 � MSFT_CliProperty __PROPERTY_COUNT __PROPERTY_COUNT � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __RELPATH __RELPATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier q � & � MSFT_CliProperty __SERVER __SERVER � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __SUPERCLASS __SUPERCLASS � �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � L � MSFT_CliFormat INSTANCE " & 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � Y e � MSFT_CliProperty DMAChannel A part of the object's key value, the DMA channel number. DMAChannel � �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty �� dO � MSFT_CliFormat LIST FULL ` �
� � �! $ �& �( _+ �- q= �? �G � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier n ] j � � MSFT_CliProperty AddressSize An integer indicating the DMA channel address size in bits. AddressSize r � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING k G � MSFT_CliQualifier ValueMap 5 8 ; ? C 0 8 16 32 64 � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � b p 8 � MSFT_CliProperty Availability The Availability property indicates the availability of the DMA. Availability | � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING k D � MSFT_CliQualifier ValueMap 5 8 ; > A 1 2 3 4 5 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values 3 : C N d Other Unknown Available In Use/Not Available In Use and Available/Shareable 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � S ^ � MSFT_CliProperty BurstMode Indicate whether the DMA channel supports burst mode BurstMode � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier v � � z � MSFT_CliProperty ByteMode Indicates whether DMA may execute in 'count by byte' mode (value=4) or not (value=3). Also, "Other" (1) and "Unknown" (2) may be defined. ByteMode � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING k = � MSFT_CliQualifier ValueMap 1 4 7 : 1 2 3 4 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values / 6 ? d Other Unknown Not execute in 'count by byte' mode Execute in 'count by byte' mode . 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � ! | � F � MSFT_CliProperty ChannelTiming DMA channel timing. For example, "Type A" (value =4) or "Type F" (6) could be specified. ChannelTiming � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING k K � MSFT_CliQualifier ValueMap 9 < ? B E H 1 2 3 4 5 6 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � o � MSFT_CliQualifier Values 7 > G W _ g Other Unknown ISA Compatible Type A Type B Type F � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier c ? G j � MSFT_CliProperty CSName The scoping computer system's name. CSName O � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ( � MSFT_CliQualifier MaxLen # 256 6 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � h u � MSFT_CliProperty Description The Description property provides a textual description of the object. Description & 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � Y e � MSFT_CliProperty DMAChannel A part of the object's key value, the DMA channel number. DMAChannel � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier O � � � � MSFT_CliProperty InstallDate The InstallDate property is datetime value indicating when the object was installed. A lack of a value does not indicate that the object is not installed. InstallDate U 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � # � � � MSFT_CliProperty MaxTransferSize The maximum number of bytes that can be transferred by this DMA channel. If unknown, enter 0. MaxTransferSize m 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier 3 � � � � MSFT_CliProperty Name The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property. Name N 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � � MSFT_CliProperty Port The Port property specifies the DMA port used by the host bus adapter. This is meaningful for MCA-type buses. Port � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � * � MSFT_CliProperty Status The Status property is a string indicating the current status of the object. Various operational and non-operational statuses can be defined. Operational statuses are "OK", "Degraded" and "Pred Fail". "Pred Fail" indicates that an element may be functioning properly but predicting a failure in the near future. An example is a SMART-enabled hard drive. Non-operational statuses can also be specified. These are "Error", "Starting", "Stopping" and "Service". The latter, "Service", could apply during mirror-resilvering of a disk, reload of a user permissions list, or other administrative work. Not all such work is on-line, yet the managed element is neither "OK" nor in one of the other states. Status � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 10 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap A E L V _ j t ~ OK Error Degraded Unknown Pred Fail Starting Stopping Service � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values ? C J T ] h r | OK Error Degraded Unknown Pred Fail Starting Stopping Service _ 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier % � " � � � MSFT_CliProperty TransferWidths An array indicating all the transfer widths (in bits) supported by this DMA channel. If unknown, enter 0. TransferWidths � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � | � MSFT_CliProperty TypeCTiming Indicates whether C type (burst) timing is supported (value=5) or not (value=4). Also, "Other" (1), "Unknown" (2) and "ISA Compatible" (3) are defined. TypeCTiming � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING k D � MSFT_CliQualifier ValueMap 5 8 ; > A 1 2 3 4 5 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � m � MSFT_CliQualifier Values 3 : C S b Other Unknown ISA Compatible Not Supported Supported � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier v � � z � MSFT_CliProperty WordMode Indicates whether DMA may execute in 'count by word' mode (value=4) or not (value=3). Also, "Other" (1) and "Unknown" (2) may be defined. WordMode � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING k = � MSFT_CliQualifier ValueMap 1 4 7 : 1 2 3 4 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values / 6 ? d Other Unknown Not execute in 'count by word' mode Execute in 'count by word' mode � �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � � � MSFT_CliFormat TABLE BRIEF 6 � P w
� 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier n ] j � � MSFT_CliProperty AddressSize An integer indicating the DMA channel address size in bits. AddressSize r � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING k G � MSFT_CliQualifier ValueMap 5 8 ; ? C 0 8 16 32 64 & 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � Y e � MSFT_CliProperty DMAChannel A part of the object's key value, the DMA channel number. DMAChannel @ 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � # n � MSFT_CliProperty MaxTransferSize The maximum number of bytes that can be transferred by this DMA channel. MaxTransferSize # 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � \ b � MSFT_CliProperty Name The Name property defines the label by which the object is known. Name ( 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � a g � MSFT_CliProperty Port The Port property specifies the DMA port used by the host bus adapter. Port DMAChannel Where DMAChannel=# Select * from Win32_DMAChannel 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � j q � MSFT_CliProperty Model The Model property indicates the manufacturer's model number of the disk drive. Model # 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � \ b � MSFT_CliProperty Name The Name property defines the label by which the object is known. Name � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier [ � ! � � � MSFT_CliProperty NeedsCleaning Boolean indicating that the media access device needs cleaning. Whether manual or automatic cleaning is possible is indicated in the Capabilities array property. NeedsCleaning � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier X � * � � � MSFT_CliProperty NumberOfMediaSupported When the media access device supports multiple individual media, this property defines the maximum number which can be supported or inserted. NumberOfMediaSupported p 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier 6 � � � � MSFT_CliProperty Partitions The Partitions property indicates the number of partitions on this physical disk drive that are recognized by the operating system. Partitions - 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � _ l � MSFT_CliProperty PNPDeviceID Indicates the Plug and Play device ID of the logical device. PNPDeviceID T 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier / z � � MSFT_CliProperty PowerManagementCapabilities Indicates the specific power-related capabilities of the logical device. PowerManagementCapabilities � k � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values ? H W a j � � � Unknown Not Supported Disabled Enabled Power Saving Modes Entered Automatically Power State Settable Power Cycling Supported Timed Power On Supported b 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier ( � , � � � MSFT_CliProperty PowerMana �� F D 3 B B D 4 C 4 2 A C 2 F 7 F E F 2 6 4 3 4 0 A 9 E B 7 8 A 5 8 1 F E 5 C 2 8 5 6 1 C B 6 3 E D F 7 8 0 B 3 2 9 E A C 2 E E 4 �b��5��͝��C� � � + T �� Ƿ ɷ � � MSFT_CliAlias � F N u � � � � �
U�������������������������4 � MSFT_CliConnection Authority
� > STRING Locale
� m STRING NameSpace
� � STRING Password
� � STRING Server
� � STRING User
� , STRING | � ( + � MSFT_CliConnection ms_409 ROOT\CIMV2 . System environment settings management. p & �A �D &j K� �# �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty �" | � MSFT_CliFormat table STATUS / � 2 � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � * � MSFT_CliProperty Status The Status property is a string indicating the current status of the object. Various operational and non-operational statuses can be defined. Operational statuses are "OK", "Degraded" and "Pred Fail". "Pred Fail" indicates that an element may be functioning properly but predicting a failure in the near future. An example is a SMART-enabled hard drive. Non-operational statuses can also be specified. These are "Error", "Starting", "Stopping" and "Service". The latter, "Service", could apply during mirror-resilvering of a disk, reload of a user permissions list, or other administrative work. Not all such work is on-line, yet the managed element is neither "OK" nor in one of the other states. Status � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 10 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap A E L V _ j t ~ OK Error Degraded Unknown Pred Fail Starting Stopping Service � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values ? C J T ] h r | OK Error Degraded Unknown Pred Fail Starting Stopping Service ? 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � x ~ � MSFT_CliProperty Name The Name property contains a character string specifying the name of a environment variable. Name F 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � " u � � MSFT_CliProperty SystemVariable The SystemVariable property indicates whether the variable is a system variable. SystemVariable s �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � + � MSFT_CliFormat SYSTEM
D � � U � b
�
x � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty __CLASS __CLASS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __DERIVATION __DERIVATION � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __DYNASTY __DYNASTY � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty __GENUS __GENUS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier t � , � MSFT_CliProperty __NAMESPACE __NAMESPACE � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o � " � MSFT_CliProperty __PATH __PATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier y � $ 6 � MSFT_CliProperty __PROPERTY_COUNT __PROPERTY_COUNT � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __RELPATH __RELPATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier q � & � MSFT_CliProperty __SERVER __SERVER � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __SUPERCLASS __SUPERCLASS K �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty X � � MSFT_CliFormat INSTANCE " � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o � " � MSFT_CliProperty __PATH __PATH F% �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty S$ $ � MSFT_CliFormat TABLE BRIEF . ~ R L 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � ! | � � MSFT_CliProperty VariableValue The VariableValue property contains the placeholder variable of an environment variable. VariableValue � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier �
x ~ � � MSFT_CliProperty Name The Name property contains a character string specifying the name of an environment variable. Name � � � � � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING j , � MSFT_CliQualifier CIMTYPE $ string � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING f & � MSFT_CliQualifier key True � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING # � � MSFT_CliQualifier MappingStrings / 5 True Win32Registry|System\CurrentControlSet\Control\Session Manager\Environment � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING k + � MSFT_CliQualifier Override % Name � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING g ' � MSFT_CliQualifier read ! True � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING h ( � MSFT_CliQualifier write " True � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � ! � MSFT_CliProperty UserName The UserName property indicates the owner of the environment setting. It is set to "<SYSTEM>" for settings that are specific to the system (as opposed to a specific user) and "<DEFAULT>" for default user settings. UserName � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ( � MSFT_CliQualifier MaxLen # 260 J
� ( In J
� ( P �� ID J )
� � P ��~ boolean L ThrottleForScheduledScanOnly boolean L
� � In L
� � �� ID L )
� � ��H boolean ! N SignatureFirstAuGracePeriod boolean ! N
� � In ! N
� � � �� ID ! N )
� L � �� ! boolean " P SignatureAuGracePeriod boolean " P
� In " P
� � �� ID " P )
� � ��� " boolean # R SignatureDefinitionUpdateFileSharesSources boolean # R
� W In # R
� W �� ID # R )
� � ��� # boolean $ T SignatureDisableUpdateOnStartupWithoutEngine boolean $ T
� 1 In $ T
� 1 Y �� ID $ T )
� � Y ��� $ boolean % V SignatureFallbackOrder boolean % V
� � In % V
� � ! �� ID % V )
� �! ! ��K! % boolean & X SignatureScheduleDay boolean & X
� �! In & X
� �! �! �� 5" 8" ;" >" A" D" G" J" M" 0 1 2 3 4 5 6 7 8 ValueMap & X )
� �! �! ��P"
" ID & X 6
� �" �! ��P"
" �" & boolean ' Z SignatureScheduleTime boolean ' Z
� # In ' Z
� # 3# �� ID ' Z )
� �# 3# ��a# ' boolean ( \ SignatureUpdateCatchupInterval boolean ( \
� �# In ( \
� �# �# �� ID ( \ )
� h$ �# ��-$ ( boolean ) ^ SignatureBlobFileSharesSources boolean ) ^
� �$ In ) ^
� �$ �$ �� ID ) ^ )
� 4% �$ ���$ ) boolean * ` SignatureUpdateInterval boolean * `
� h% In * `
� h% �% �� ID * ` )
� �% �% ���% * boolean + b SignatureBlobUpdateInterval boolean + b
� 1& In + b
� 1& Y& �� ID + b )
� �& Y& ���& + boolean , d MAPSReporting boolean , d
� �& In , d
� �& ' �� R' U' X' 0 1 2 ValueMap , d )
� �& ' ��[' B' ID , d 6
� �' ' ��[' B' �' , boolean - f SubmitSamplesConsent boolean - f
� ( In - f
� ( =( �� ( �( �( �( 0 1 2 3 ValueMap - f )
� ( =( ���( k( ID - f 6
� ) =( ���( k( �( - boolean . h DisablePrivacyMode boolean . h
� C) In . h
� C) k) �� ID . h )
� �) k) ���) . boolean / j RandomizeScheduleTaskTimes boolean / j
� * In / j
� * 3* �� ID / j )
� �* 3* ��a* / boolean 0 l SchedulerRandomizationTime boolean 0 l
� �* In 0 l
� �* �* �� ID 0 l )
� d+ �* ��)+ 0 boolean 1 n DisableBehaviorMonitoring boolean 1 n
� �+ In 1 n
� �+ �+ �� ID 1 n )
� +, �+ ���+ 1 boolean 2 p DisableIntrusionPreventionSystem boolean 2 p
� h, In 2 p
� h, �, �� ID 2 p )
� �, �, ���, 2 boolean 3 r DisableIOAVProtection boolean 3 r
� +- In 3 r
� +- S- �� ID 3 r )
� �- S- ���- 3 boolean 4 t DisableRealtimeMonitoring boolean 4 t
� �- In 4 t
� �- . �� ID 4 t )
� �. . ��H. 4 boolean 5 v DisableScriptScanning boolean 5 v
� �. In 5 v
� �. �. �� ID 5 v )
� F/ �. �� / 5 boolean 6 x DisableArchiveScanning boolean 6 x
� y/ In 6 x
� y/ �/ �� ID 6 x )
�
0 �/ ���/ 6 boolean 7 z DisableCatchupFullScan boolean 7 z
� =0 In 7 z
� =0 e0 �� ID 7 z )
� �0 e0 ���0 7 boolean 8 | DisableCatchupQuickScan boolean 8 |
� 1 In 8 |
� 1 *1 �� ID 8 | )
� �1 *1 ��X1 8 boolean 9 ~ DisableEmailScanning boolean 9 ~
� �1 In 9 ~
� �1 �1 �� ID 9 ~ )
� U2 �1 ��2 9 boolean : � DisableRemovableDriveScanning boolean : �
� �2 In : �
� �2 �2 �� ID : � )
� 3 �2 ���2 : boolean ; � DisableRestorePoint boolean ; �
� P3 In ; �
� P3 x3 �� ID ; � )
� �3 x3 ���3 ; boolean < � DisableScanningMappedNetworkDrivesForFullScan boolean < �
� +4 In < �
� +4 S4 �� ID < � )
� �4 S4 ���4 < boolean = � DisableScanningNetworkFiles boolean = �
� �4 In = �
� �4 5 �� ID = � )
� �5 5 ��J5 = boolean > � ApplyDisableNetworkScanningToIOAV boolean > �
� �5 In > �
� �5 �5 �� ID > � )
� T6 �5 ��6 > boolean ? � UILockdown boolean ? �
� {6 In ? �
� {6 �6 �� ID ? � )
� 7 �6 ���6 ? boolean @ � ThreatIDDefaultAction_Ids sint64 @ �
� B7 In @ �
� B7 i7 �� ID @ � )
� �7 i7 ���7 @ sint64 A � ThreatIDDefaultAction_Actions uint8 A �
� 8 In A �
� 8 18 �� 8 �8 �8 �8 �8 �8 �8 1 2 3 6 8 9 10 ValueMap A � )
� 8 18 ���8 _8 ID A � 6
� 9 18 ���8 _8 �8 A uint8 B � UnknownThreatDefaultAction boolean B �
� S9 In B �
� S9 {9 �� �9 �9 �9 �9 �9 �9 �9 1 2 3 6 8 9 10 ValueMap B � )
� S9 {9 ���9 �9 ID B � 6
� h: {9 ���9 �9 : B boolean C � LowThreatDefaultAction boolean C �
� �: In C �
� �: �: �� ; ; ; ; ; ; #; 1 2 3 6 8 9 10 ValueMap C � )
� �: �: ��'; �: ID C � 6
� �; �: ��'; �: h; C boolean D � ModerateThreatDefaultAction boolean D �
� �; In D �
� �; < �� ^< a< d< g< j< m< p< 1 2 3 6 8 9 10 ValueMap D � )
� �; < ��t< >< ID D � 6
� �< < ��t< >< �< D boolean E � HighThreatDefaultAction boolean E �
� 1= In E �
� 1= Y= �� �= �= �= �= �= �= �= 1 2 3 6 8 9 10 ValueMap E � )
� 1= Y= ���= �= ID E � 6
� F> Y= ���= �= �= E boolean F � SevereThreatDefaultAction boolean F �
� |> In F �
� |> �> �� �> �> �> �> �> ? ? 1 2 3 6 8 9 10 ValueMap F � )
� |> �> ��? �> ID F � 6
� �? �> ��? �> I? F boolean G � PUAProtection boolean G �
� �? In G �
� �? �? �� !@ $@ '@ 0 1 2 ValueMap G � )
� �? �? ��*@ @ ID G � 6
� �@ �? ��*@ @ k@ G boolean H � DisableBlockAtFirstSeen boolean H �
� �@ In H �
� �@ A �� ID H � )
� xA A ��=A H boolean I � CloudBlockLevel boolean I �
� �A In I �
� �A �A �� B B B B B 0 1 2 4 6 ValueMap I � )
� �A �A ��!B �A ID I � 6
� �B �A ��!B �A bB I boolean J � CloudExtendedTimeout boolean J �
� �B In J �
� �B C �� ID J � )
� lC C ��1C J boolean K � EnableNetworkProtection boolean K �
� �C In K �
� �C �C �� D D D 0 1 2 ValueMap K � )
� �C �C ��D �C ID K � 6
� �D �C ��D �C PD K boolean L � EnableControlledFolderAccess boolean L �
� �D In L �
� �D �D �� ?E BE EE HE KE 0 1 2 3 4 ValueMap L � )
� �D �D ��NE 'E ID L � 6
� �E �D ��NE 'E �E L boolean M � AttackSurfaceReductionOnlyExclusions string M �
� F In M �
� F ?F �� ID M � )
� �F ?F ��mF M string N � AttackSurfaceReductionRules_Ids string N �
� �F In N �
� �F
G �� ID N � )
� sG
G ��8G N string O � AttackSurfaceReductionRules_Actions uint8 O �
� �G In O �
� �G �G �� H !H $H 'H *H 0 1 2 5 6 ValueMap O � )
� �G �G ��-H H ID O � 6
� �H �G ��-H H nH O uint8 P � ControlledFolderAccessAllowedApplications string P �
� �H In P �
� �H !I �� ID P � )
� �I !I ��OI P string Q � ControlledFolderAccessProtectedFolders string Q �
� �I In Q �
� �I �I �� ID Q � )
� \J �I ��!J Q string R � SharedSignaturesPath boolean R �
� �J In R �
� �J �J �� ID R � )
� K �J ���J R boolean S � SharedSignaturesPathUpdateAtScheduledTimeOnly boolean S �
� gK In S �
� gK �K �� ID S � )
� �K �K ���K S boolean T � EnableLowCpuPriority boolean T �
� )L In T �
� )L QL �� ID T � )
� �L QL ��L T boolean U � EnableFileHashComputation boolean U �
� �L In U �
� �L M �� ID U � )
� �M M ��FM U boolean V � MeteredConnectionUpdates boolean V �
� �M In V �
� �M �M �� ID V � )
� GN �M �� N V boolean W � AllowNetworkProtectionOnWinServer boolean W �
� �N In W �
� �N �N �� ID W � )
� O �N ���N W boolean X � DisableDatagramProcessing boolean X �
� LO In X �
� LO tO �� ID X � )
� �O tO ���O X boolean Y � EnableConvertWarnToBlock boolean Y �
� P In Y �
� P :P �� ID Y � )
� �P :P ��hP Y boolean Z � DisableCpuThrottleOnIdleScans boolean Z �
� �P In Z �
� �P Q �� ID Z � )
� nQ Q ��3Q Z boolean [ � EnableFullScanOnBatteryPower boolean [ �
� �Q In [ �
� �Q �Q �� ID [ � )
� 8R �Q ���Q [ boolean \ � ProxyPacUrl boolean \ �
� `R In \ �
� `R �R �� ID \ � )
� �R �R ���R \ boolean ] � ProxyServer boolean ] �
� S In ] �
� S AS �� ID ] � )
� �S AS ��oS ] boolean ^ � ProxyBypass boolean ^ �
� �S In ^ �
� �S �S �� ID ^ � )
� cT �S ��(T ^ boolean _ � ForceUseProxyOnly boolean _ �
� �T In _ �
� �T �T �� ID _ � )
� "U �T ���T _ boolean ` � DisableTlsParsing boolean ` �
� PU In ` �
� PU xU �� ID ` � )
� �U xU ���U ` boolean a � DisableHttpParsing boolean a �
� V In a �
� V 8V �� ID a � )
� �V 8V ��fV a boolean b � DisableDnsParsing boolean b �
� �V In b �
� �V �V �� ID b � )
� `W �V ��%W b boolean c � DisableDnsOverTcpParsing boolean c �
� �W In c �
� �W �W �� ID c � )
� &X �W ���W c boolean d � DisableSshParsing boolean d �
� TX In d �
� TX |X �� ID d � )
� �X |X ���X d boolean e � PlatformUpdatesChannel boolean e �
� Y In e �
� Y @Y �� ID e � )
� �Y @Y ��nY e boolean f � EngineUpdatesChannel boolean f �
� �Y In f �
� �Y Z �� ID f � )
� kZ Z ��0Z f boolean g � DefinitionUpdatesChannel boolean g �
� �Z In g �
� �Z �Z �� ID g � )
� 1[ �Z ���Z g boolean h � DisableGradualRelease boolean h �
� c[ In h �
� c[ �[ �� ID h � )
� �[ �[ ���[ h boolean i � AllowNetworkProtectionDownLevel boolean i �
� 0\ In i �
� 0\ X\ �� ID i � )
� �\ X\ ���\ i boolean j � AllowDatagramProcessingOnWinServer boolean j �
� ] In j �
� ] (] �� ID j � )
� �] (] ��V] j boolean k � EnableDnsSinkhole boolean k �
� �] In k �
� �] �] �� ID k � )
� P^ �] ��^ k boolean l � DisableInboundConnectionFiltering boolean l �
� �^ In l �
� �^ �^ �� ID l � )
� _ �^ ���^ l boolean m � DisableRdpParsing boolean m �
� M_ In m �
� M_ u_ �� ID m � )
� �_ u_ ���_ m boolean n � DisableNetworkProtectionPerfTelemetry boolean n �
� ` In n �
� ` H` �� ID n � )
� �` H` ��v` n boolean o � TrustLabelProtectionStatus boolean o �
� �` In o �
� �` a �� ID o � )
� ya a ��>a o boolean p � DisableFtpParsing boolean p �
� �a In p �
� �a �a �� ID p � )
� 8b �a ���a p boolean q � AllowSwitchToAsyncInspection boolean q �
� qb In q �
� qb �b �� ID q � )
� c �b ���b q boolean r � ScanScheduleOffset boolean r �
� 1c In r �
� 1c Yc �� ID r � )
� �c Yc ���c r boolean s DisableTDTFeature boolean s
� �c In s
� �c d �� ID s )
� �d d ��Fd s boolean t DisableSmtpParsing boolean t
� �d In t
� �d �d �� ID t )
� Ae �d ��e t boolean u DisableQuicParsing boolean u
� pe In u
� pe �e �� ID u )
� f �e ���e u boolean v NetworkProtectionReputationMode boolean v
� =f In v
� =f ef �� ID v )
� �f ef ���f v boolean w IntelTDTEnabled boolean w
� �f In w
� �f "g �� ID w )
� �g "g ��Pg w boolean x
AttackSurfaceReductionRules_RuleSpecificExclusions_Id string x
� �g In x
� �g h �� ID x
)
� mh h ��2h x string y AttackSurfaceReductionRules_RuleSpecificExclusions string y
� �h In y
� �h �h �� ID y )
� Ki �h ��i y string z OobeEnableRtpAndSigUpdate boolean z
� �i In z
� �i �i �� ID z )
� j �i ���i z boolean { PerformanceModeStatus boolean {
� Cj In {
� Cj kj �� �j �j 0 1 ValueMap { )
� Cj kj ���j �j ID { 6
� 4k kj ���j �j �j { boolean | QuickScanIncludeExclusions boolean |
� kk In |
� kk �k �� �k �k 0 1 ValueMap | )
� kk �k ���k �k ID | 6
� \l �k ���k �k l | boolean } RemoveScanningThreadPoolCap boolean }
� �l In }
� �l �l �� ID } )
� %m �l ���l } boolean ~ DisableCacheMaintenance boolean ~
� Ym In ~
� Ym �m �� ID ~ )
� �m �m ���m ~ boolean DisableCoreServiceECSIntegration boolean
� 'n In
� 'n On �� ID )
� �n On ��}n boolean � DisableCoreServiceTelemetry boolean �
� �n In �
� �n o �� ID � )
� �o o ��Fo � boolean � EnableUdpSegmentationOffload boolean �
� �o In �
� �o �o �� ID � )
� Kp �o ��p � boolean � " EnableUdpReceiveOffload boolean � "
� p In � "
� p �p �� ID � " )
� q �p ���p � boolean � $ Force boolean � $
� 2q In � $
� 2q Zq �� ID � $ )
� �q Zq ���q � boolean A "� q �0��� f.� � ��
� =W^��
x��< # �]~+ 芑�I �k��e �x#� e'so� ��7N� �ۏ"� <�� w�ڢ bĦE' n��C�r ) � �� � ( 0 � MSFT_MpHeartBeat ProtectionManagement locale � 5 9 � � Send ��- �� implemented static � ae442007200009F ROOT\microsoft\protectionManagement ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � p��C�m ) � �� �
# + � MSFT_MpScan ProtectionManagement locale � 6 � n � Start ! ��. �� implemented static � ae442007200009F ROOT\microsoft\protectionManagement ���� � �2 �� � ? * � �����~ � __PARAMETERS abstract ScanType uint8
� 4 In
� 4 Z �� ID )
� � Z ��� uint8 ScanPath string
� � In
� �
�� ID )
� v
��; string __ �� ae442007200009F ROOT\microsoft\protectionManagement ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � q��C�r ) � �� � ( 0 � MSFT_MpSignature ProtectionManagement locale 7 W � � Update " ��/ �� implemented static ae442007200009F ROOT\microsoft\protectionManagement ���� � �� �� * � �� � __PARAMETERS abstract UpdateSource uint8
� 8 In
� 8 ^ �� ID )
� � ^ ��� uint8 __ �� ae442007200009F ROOT\microsoft\protectionManagement ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � ���C�� ) � �� � 1 D v � � � . U����������������U � MDM_ApplicationSetting locale MDMSettingsProv PackageFamilyName
� n � �� string SettingName
� � � �� string SettingType
� � � uint32 ValueMap 0 1 2 3 SettingValue
� M string � m��C�� " 4 �� � �� � 0 8 H z � � � � � V s � � U��������������������������������N � MSFT_MpEvent Indication ProtectionManagement locale AdditionalData
� r � �� sint64 CategoryDiscriminant 4
� � � � � �� � �� uint32 ValueMap � � � 1 2 4 8 ComputerNotificationsValue )
� W _ g � �� uint32 BitMap � � � � � � � 1 2 4 8 16 32 64 NotificationTime e
� � � �� datetime ScanNotificationsValue )
� 4 < D � �� uint32 BitMap P S 1 2 SignatureNotificationsValue )
� � � � � �� uint32 BitMap � 1 ThreatNotificationsValue )
� & � �� uint32 BitMap > A D G J 1 2 4 8 16 �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 H�n�^��
͝��C�� ; J.3�� p � WDMClassesOfDriver MSNdis_EthernetMoreTransmitCollisions C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 I�n�^��
͝��C�� 6 J.3�� k � WDMClassesOfDriver MSNdis_TokenRingPermanentAddress C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 J�n�^��
͝��C�� 4 J.3�� i � WDMClassesOfDriver MSNdis_TokenRingCurrentAddress C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 K�n�^��
͝��C�� 7 J.3�� l � WDMClassesOfDriver MSNdis_TokenRingCurrentFunctional C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 L�n�^��
͝��C�� 2 J.3�� g � WDMClassesOfDriver MSNdis_TokenRingCurrentGroup C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 M�n�^��
͝��C�� 4 J.3�� i � WDMClassesOfDriver MSNdis_TokenRingLastOpenStatus C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 N�n�^��
͝��C�� 7 J.3�� l � WDMClassesOfDriver MSNdis_TokenRingCurrentRingStatus C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 O�n�^��
͝��C�� 6 J.3�� k � WDMClassesOfDriver MSNdis_TokenRingCurrentRingState C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 P�n�^��
͝��C�� 0 J.3�� e � WDMClassesOfDriver MSNdis_TokenRingLineErrors C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 Q�n�^��
͝��C�� 0 J.3�� e � WDMClassesOfDriver MSNdis_TokenRingLostFrames C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 R�n�^��
͝��C�� 5 J.3�� j � WDMClassesOfDriver MSNdis_FddiLongPermanentAddress C:\Windows\system32\kernelbase.dll[MofResourceName] ResourceName] diShortMulticastList C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] Q � WDMClassesOfDriver MSNdis C:\Windows\system32\kernelbase.dll[MofResourceName] ] __ �� WIN-F6NF7R6I6PJ ROOT\Microsoft\ProtectionManagement ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � Add � ��*� �� implemented static * WIN-F6NF7R6I6PJ ROOT\Microsoft\ProtectionManagement ���� � �� G �� + � � � � u P � o
�
� w
� � ^ � P ] � * � � �
) . � �
� � � UUUU�������������������������������������������������������������������i � __PARAMETERS abstract ExclusionPath string
� 9 In
� 9 ` �� ID )
� � ` ��� string ExclusionExtension string
� � In
� � �� ID )
� � ��L string ExclusionProcess string
� � In
� � � �� ID )
� C � �� string ExclusionIpAddress string
� q In
� q � �� ID )
� � ��� string ThreatIDDefaultAction_Ids sint64
� 6 In
� 6 ] �� ID )
� � ] ��� sint64 ThreatIDDefaultAction_Actions uint8
� � In
� � % �� s v y | � � 1 2 3 6 8 9 10 ValueMap )
� � % ��� S ID 6
� % ��� S � uint8 AttackSurfaceReductionOnlyExclusions string
� Q In
� Q x �� ID )
� � x ��� string AttackSurfaceReductionRules_Ids string
� In
� C �� ID )
� � C ��q string AttackSurfaceReductionRules_Actions uint8
� � In
� � �� W Z ] ` c 0 1 2 5 6 ValueMap )
� � ��f ? ID 6
� � ��f ? � uint8 $ ControlledFolderAccessAllowedApplications string $
� 3 In $
� 3 Z �� ID $ )
� � Z ��� string
( ControlledFolderAccessProtectedFolders string
(
� In
(
� , �� ID
( )
� � , ��Z
string , SharedSignaturesPath string ,
� � in ,
� � � �� ID , )
� U
� ��
string 0 AttackSurfaceReductionRules_RuleSpecificExclusions_Id string 0
� �
In 0
� �
�
�� ID 0 )
� 6 �
���
string
4 AttackSurfaceReductionRules_RuleSpecificExclusions string
4
� � In
4
� � � �� ID
4 )
� � ���
string 8 RemoteEncryptionProtectionExclusions string 8
� T In 8
� T { �� ID 8 )
� � { ��� string < BruteForceProtectionExclusions string <
�
In <
�
E
�� ID < )
� �
E
��s
string @ Force boolean @
� �
In @
� �
�
�� ID @ )
� ` �
��% boolean __ �� WIN-F6NF7R6I6PJ ROOT\Microsoft\ProtectionManagement ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ �P �P �� ID Z � )
� �P �P ���P Z boolean [ � EnableFullScanOnBatteryPower boolean [ �
� 5Q In [ �
� 5Q ]Q �� ID [ � )
� �Q ]Q ���Q [ boolean \ � ProxyPacUrl string \ �
� �Q In \ �
� �Q R �� ID \ � )
� ~R R ��CR \ string ] � ProxyServer string ] �
� �R In ] �
� �R �R �� ID ] � )
� 5S �R ���R ] string ^ � ProxyBypass string ^ �
� \S In ^ �
� \S �S �� ID ^ � )
� �S �S ���S ^ string _ � ForceUseProxyOnly boolean _ �
� T In _ �
� T AT �� ID _ � )
� �T AT ��oT _ boolean ` � DisableTlsParsing boolean ` �
� �T In ` �
� �T U �� ID ` � )
� iU U ��.U ` boolean a � DisableHttpParsing boolean a �
� �U In a �
� �U �U �� ID a � )
� )V �U ���U a boolean b � DisableDnsParsing boolean b �
� WV In b �
� WV V �� ID b � )
� �V V ���V b boolean c � DisableDnsOverTcpParsing boolean c �
� W In c �
� W EW �� ID c � )
� �W EW ��sW c boolean d DisableSshParsing boolean d
� �W In d
� �W X �� ID d )
� mX X ��2X d boolean e PlatformUpdatesChannel uint8 e
� �X In e
� �X �X �� Y Y Y Y Y Y 0 2 3 4 5 6 ValueMap e )
� �X �X ��"Y �X ID e 6
� �Y �X ��"Y �X cY e uint8 f EngineUpdatesChannel uint8 f
� �Y In f
� �Y Z �� JZ MZ PZ SZ VZ YZ 0 2 3 4 5 6 ValueMap f )
� �Y Z ��\Z .Z ID f 6
� �Z Z ��\Z .Z �Z f uint8 g DefinitionUpdatesChannel uint8 g
� [ In g
� [ >[ �� |[ [ �[ 0 4 5 ValueMap g )
� [ >[ ���[ l[ ID g 6
� \ >[ ���[ l[ �[ g uint8 h DisableGradualRelease boolean h
� >\ In h
� >\ f\ �� ID h )
� �\ f\ ���\ h boolean i AllowNetworkProtectionDownLevel boolean i
� ] In i
� ] 3] �� ID i )
� �] 3] ��a] i boolean j
AllowDatagramProcessingOnWinServer boolean j
� �] In j
� �] ^ �� ID j
)
� l^ ^ ��1^ j boolean k EnableDnsSinkhole boolean k
� �^ In k
� �^ �^ �� ID k )
� +_ �^ ���^ k boolean l DisableInboundConnectionFiltering boolean l
� i_ In l
� i_ �_ �� ID l )
� �_ �_ ���_ l boolean m DisableRdpParsing boolean m
� (` In m
� (` P` �� ID m )
� �` P` ��~` m boolean n DisableNetworkProtectionPerfTelemetry boolean n
� �` In n
� �` #a �� ID n )
� �a #a ��Qa n boolean o TrustLabelProtectionStatus uint32 o
� �a In o
� �a �a �� ID o )
� Sb �a ��b o uint32 p DisableFtpParsing boolean p
� �b In p
� �b �b �� ID p )
� c �b ���b p boolean q AllowSwitchToAsyncInspection boolean q
� Jc In q
� Jc rc �� ID q )
� �c rc ���c q boolean r ScanScheduleOffset uint32 r
�
d In r
�
d 1d �� ID r )
� �d 1d ��_d r uint32 s DisableTDTFeature boolean s
� �d In s
� �d �d �� ID s )
� Xe �d �� e s boolean t " DisableTamperProtection boolean t "
� �e In t "
� �e �e �� ID t " )
� f �e ���e t boolean u $ DisableSmtpParsing boolean u $
� Lf In u $
� Lf tf �� ID u $ )
� �f tf ���f u boolean v & DisableQuicParsing boolean v &
� g In v &
� g 4g �� ID v & )
� �g 4g ��bg v boolean w ( NetworkProtectionReputationMode uint32 w (
� �g In w (
� �g h �� ID w ( )
� ih h ��.h w uint32 x , IntelTDTEnabled boolean x ,
� �h In x ,
� �h �h �� ID x , )
� %i �h ���h x boolean y . AttackSurfaceReductionRules_RuleSpecificExclusions_Id string y .
� wi In y .
� wi �}J�M` � ���_ ���k �#!� � G�f� L-�� /�&� �QӪ
3��z� �L���
� ��!� ɡP�� J�
u� U �� ��Dd �3& " 4�H
�3�~R ��=�b ����x ~t`~ 4 3 C 8 6 C 3 E 5 B 2 B 7 F 1 D D 0 4 4 3 A 6 D A 4 E 1 7 A A 9 5 D 6 5 F 5 6 E E 0 C 1 9 C F 4 F D 3 B 5 D 9 A 5 F 6 3 C 5 2 2 �"�U�T�u͝��C�o 0 9 �� N � HNet_Connection {047525BC-A893-436A-91E8-557852561637} Ethernet Instance 0 A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 �"�U�T�v͝��C�| �� Z � HNet_ConnectionProperties HNet_Connection.Guid="{047525BC-A893-436A-91E8-557852561637}" R O O T \ M i c r o s o f t \ H o m e N e t H N e t _ C o n n e c t i o n P r o p e r t i e s
C o n n e c t i o n � N S _ 5 1 1 6 2 6 F A E 4 F 5 7 D B D 2 0 D F 5 C D 4 4 A 4 1 D A E C E D 2 8 C F 7 B 3 F D 8 B 1 2 0 1 2 C 7 F 4 B 5 8 F 4 4 E 6 6 5 \ K I _ A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 \ I _ 5 A B E 0 A 3 C 0 3 A 4 B D C 6 C E 5 A C 2 2 6 1 4 4 B A 9 8 A B D 8 1 F C 1 9 0 5 8 9 D 6 1 F 4 F B 6 7 A 3 4 2 5 2 F 7 4 F D X 4 3 C 8 6 C 3 E 5 B 2 B 7 F 1 D D 0 4 4 3 A 6 D A 4 E 1 7 A A 9 5 D 6 5 F 5 6 E E 0 C 1 9 C F 4 F D 3 B 5 D 9 A 5 F 6 3 C 5 2 2 �"�U�T�u͝��C�f 0 9 �� E � HNet_Connection {D12DED2F-AEFC-4788-A733-FAA9E04B44C7} Ethernet 2 A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 �"�U�T�v͝��C�| �� Z � HNet_ConnectionProperties HNet_Connection.Guid="{D12DED2F-AEFC-4788-A733-FAA9E04B44C7}" R O O T \ M i c r o s o f t \ H o m e N e t H N e t _ C o n n e c t i o n P r o p e r t i e s
C o n n e c t i o n � N S _ 5 1 1 6 2 6 F A E 4 F 5 7 D B D 2 0 D F 5 C D 4 4 A 4 1 D A E C E D 2 8 C F 7 B 3 F D 8 B 1 2 0 1 2 C 7 F 4 B 5 8 F 4 4 E 6 6 5 \ K I _ A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 \ I _ 5 A 8 2 1 8 7 B A D F D 0 5 C B F 9 0 D D A D A B 6 2 8 3 3 2 B F 3 B 6 4 F E A B C 1 C 8 9 9 9 5 4 6 5 9 A 9 4 C F 1 2 8 C 8 1 ��4 3 C 8 6 C 3 E 5 B 2 B 7 F 1 D D 0 4 4 3 A 6 D A 4 E 1 7 A A 9 5 D 6 5 F 5 6 E E 0 C 1 9 C F 4 F D 3 B 5 D 9 A 5 F 6 3 C 5 2 2 �"�U�T�u͝��C�q 0 9 �� P � HNet_Connection {0A645F4E-68C0-4C76-B4A3-0921C9718BDD} Local Area Connection A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 �"�U�T�v͝��C�| �� Z � HNet_ConnectionProperties HNet_Connection.Guid="{0A645F4E-68C0-4C76-B4A3-0921C9718BDD}" R O O T \ M i c r o s o f t \ H o m e N e t H N e t _ C o n n e c t i o n P r o p e r t i e s
C o n n e c t i o n � N S _ 5 1 1 6 2 6 F A E 4 F 5 7 D B D 2 0 D F 5 C D 4 4 A 4 1 D A E C E D 2 8 C F 7 B 3 F D 8 B 1 2 0 1 2 C 7 F 4 B 5 8 F 4 4 E 6 6 5 \ K I _ A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 \ I _ 4 1 F 4 0 B 0 A E D 8 0 D A 6 4 6 B B 3 A 5 4 C 3 4 C B D A F 7 2 A D B 4 E 6 4 1 4 1 4 1 6 C 5 4 3 4 8 9 2 B 2 4 E B 7 F 4 2 9 ��4 3 C 8 6 C 3 E 5 B 2 B 7 F 1 D D 0 4 4 3 A 6 D A 4 E 1 7 A A 9 5 D 6 5 F 5 6 E E 0 C 1 9 C F 4 F D 3 B 5 D 9 A 5 F 6 3 C 5 2 2 �"�U�T�u͝��C�f 0 9 �� E � HNet_Connection {2DBE1C3C-12E7-4095-90AF-AC78BF10DD42} Ethernet 2 A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 �"�U�T�v͝��C�| �� Z � HNet_ConnectionProperties HNet_Connection.Guid="{2DBE1C3C-12E7-4095-90AF-AC78BF10DD42}" R O O T \ M i c r o s o f t \ H o m e N e t H N e t _ C o n n e c t i o n P r o p e r t i e s
C o n n e c t i o n � N S _ 5 1 1 6 2 6 F A E 4 F 5 7 D B D 2 0 D F 5 C D 4 4 A 4 1 D A E C E D 2 8 C F 7 B 3 F D 8 B 1 2 0 1 2 C 7 F 4 B 5 8 F 4 4 E 6 6 5 \ K I _ A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 \ I _ 6 3 1 0 7 F 0 6 1 0 D 2 0 6 9 9 8 9 5 2 C 3 8 8 A 6 8 4 3 8 6 1 6 0 A 4 D C D E F 3 7 F A 7 5 D A 7 E 7 E 7 9 4 B 0 0 5 E 0 3 5 9 A B 5 3 8 0 6 E 8 8 6 6 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0 �b��5� ͝��C�x �f3��5��� W � WMIBinaryMofResource C:\Windows\System32\drivers\en-US\ACPI.sys.mui[ACPIMOFResource] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �b��5�
͝��C�� �f3��5� ` � WDMClassesOfDriver ACPITrace C:\Windows\System32\drivers\en-US\ACPI.sys.mui[ACPIMOFResource] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4
�b��5�
͝��C�� # �f3��5� d � WDMClassesOfDriver AMLIEvalData1 C:\Windows\System32\drivers\en-US\ACPI.sys.mui[ACPIMOFResource] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �b��5�
͝��C�� . �f3��5� o � WDMClassesOfDriver AMLIEvalData1_TypeGroup1 C:\Windows\System32\drivers\en-US\ACPI.sys.mui[ACPIMOFResource] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ^�b��5�
͝��C�z " -e3 �5� W � WDMClassesOfDriver PortClsEvent C:\Windows\System32\Drivers\portcls.SYS[PortclsMof] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/pl\}�
͝��C�� ��
�S}� ] � WDMClassesOfDriver WMIEvent C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/pl\}�
͝��C�� $ ��
�S}� c � WDMClassesOfDriver MS_WmiInternal C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ͣn�^��
͝��C�v J.3�� S � WDMClassesOfDriver WMIEvent C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 Σn�^��
͝��C�| $ J.3�� Y � WDMClassesOfDriver MS_WmiInternal C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 9 A B 5 3 8 0 6 E 8 8 6 6 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0 �n�^�� ͝��C�l �2��2�� K � WMIBinaryMofResource C:\Windows\System32\drivers\monitor.sys[MonitorWMI] is.sys.mui[MofResourceName] 9 A B 5 3 8 0 6 E 8 8 6 6 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0 �n�^�� ͝��C�l �2��2�� K � WMIBinaryMofResource C:\Windows\System32\drivers\monitor.sys[MonitorWMI] [MofResourceName] 9 A B 5 3 8 0 6 E 8 8 6 6 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0 �n�^�� ͝��C�l �2��2�� K � WMIBinaryMofResource C:\Windows\System32\drivers\monitor.sys[MonitorWMI] \Windows\system32\kernelbase.dll[MofResourceName] ame] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 Σn�^��
͝��C�| $ J.3�� Y � WDMClassesOfDriver MS_WmiInternal C:\Windows\system32\kernelbase.dll[MofResourceName] L)gR� � �Q� l� ��� V�� Ca�P� L��� )�|� �*�
��ð+ t���C +g�`
KW��{ Y�,ҕ �C0o� ��v{� ��� �� ���r# �-3�: �R�S �(A1n P�� �6�1� B�%� |��v� �1�m� D D L _ S Y M M E T R I C _ K E Y _ E V E N T S kN��7 �� < " DDL_SYMMETRIC_KEY_EVENTS ������������������������������������������������������������ � DROP_SYMMETRIC_KEY �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 *J����
͝��C�� ) +/�Q �� ^ � WDMClassesOfDriver MSNdis_ObjectHeader C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 +J����
͝��C�� , +/�Q �� a � WDMClassesOfDriver MSNdis_WmiMethodHeader C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ,J����
͝��C�� ) +/�Q �� ^ � WDMClassesOfDriver MSNdis_WmiSetHeader C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 -J����
͝��C�� * +/�Q �� _ � WDMClassesOfDriver MSNdis_WmiOutputInfo C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 .J����
͝��C�� + +/�Q �� ` � WDMClassesOfDriver MSNdis_WmiEnumAdapter C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 /J����
͝��C�� * +/�Q �� _ � WDMClassesOfDriver MSNdis_LinkStateData C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 0J����
͝��C�� + +/�Q �� ` � WDMClassesOfDriver MSNdis_LinkParameters C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 M����
͝��C�� 0 +/�Q �� e � WDMClassesOfDriver MSNdis_TokenRingLineErrors C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 M����
͝��C�� 0 +/�Q �� e � WDMClassesOfDriver MSNdis_TokenRingLostFrames C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 M����
͝��C�� 5 +/�Q �� j � WDMClassesOfDriver MSNdis_FddiLongPermanentAddress C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 M����
͝��C�� 3 +/�Q �� h � WDMClassesOfDriver MSNdis_FddiLongCurrentAddress C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 M����
͝��C�� 2 +/�Q �� g � WDMClassesOfDriver MSNdis_FddiLongMulticastList C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4
M����
͝��C�� 4 +/�Q �� i � WDMClassesOfDriver MSNdis_FddiLongMaximumListSize C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 M����
͝��C�� 6 +/�Q �� k � WDMClassesOfDriver MSNdis_FddiShortPermanentAddress C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 M����
͝��C�� 4 +/�Q �� i � WDMClassesOfDriver MSNdis_FddiShortCurrentAddress C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4
M����
͝��C�� 3 +/�Q �� h � WDMClassesOfDriver MSNdis_FddiShortMulticastList C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 M����
͝��C�� 5 +/�Q �� j � WDMClassesOfDriver MSNdis_FddiShortMaximumListSize C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 M����
͝��C�� / +/�Q �� d � WDMClassesOfDriver MSNdis_FddiAttachmentType C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 M����
͝��C�� 1 +/�Q �� f � WDMClassesOfDriver MSNdis_FddiUpstreamNodeLong C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 M����
͝��C�� 3 +/�Q �� h � WDMClassesOfDriver MSNdis_FddiDownstreamNodeLong C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 M����
͝��C�� , +/�Q �� a � WDMClassesOfDriver MSNdis_FddiFrameErrors C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 M����
͝��C�� + +/�Q �� ` � WDMClassesOfDriver MSNdis_FddiFramesLost C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 M����
͝��C�� 3 +/�Q �� h � WDMClassesOfDriver MSNdis_FddiRingManagmentState C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 M����
͝��C�� , +/�Q �� a � WDMClassesOfDriver MSNdis_FddiLctFailures C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 M����
͝��C�� + +/�Q �� ` � WDMClassesOfDriver MSNdis_FddiLemRejects C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 M����
͝��C�� 1 +/�Q �� f � WDMClassesOfDriver MSNdis_FddiLConnectionState C:\Windows\system32\kernelbase.dll[MofResourceName] esourceName] 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �K�8P��
͝��C�� 1 �k+K�� f � WDMClassesOfDriver MSNdis_FddiLConnectionState C:\Windows\system32\kernelbase.dll[MofResourceName] e] e] eName] _İ�� " 6�,A� ]ň.� ��( % 9
�b�+ Eb��9 ���O " ���Jq
SF0�� 0 ,�� 0 o(��
�m�
I�* 1"sG ��e �t�{ " � � " +HkH� Ap� Ü~Y� �Ft _Ӣ� � �>< �q�PR ��~�r z�@�� " 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 1J����
͝��C�� : +/�Q �� o � WDMClassesOfDriver MSNdis_InterruptModerationParameters C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 2J����
͝��C�� + +/�Q �� ` � WDMClassesOfDriver MSNdis_StatisticsInfo C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 3J����
͝��C�� * +/�Q �� _ � WDMClassesOfDriver MSNdis_PortStateData C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 4J����
͝��C�� / +/�Q �� d � WDMClassesOfDriver MSNdis_PortAuthParameters C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 5J����
͝��C�} % +/�Q �� Z � WDMClassesOfDriver MSNdis_PortChar C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 6J����
͝��C�~ & +/�Q �� [ � WDMClassesOfDriver MSNdis_PortArray C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 7J����
͝��C�� . +/�Q �� c � WDMClassesOfDriver MSNdis_PciDeviceProperty C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 8J����
͝��C�� : +/�Q �� o � WDMClassesOfDriver MSNdis_WmiTcpLargeSendOffloadV1_IPv4 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 9J����
͝��C�� 5 +/�Q �� j � WDMClassesOfDriver MSNdis_WmiTcpLargeSendOffloadV1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 :J����
͝��C�� H +/�Q �� } � WDMClassesOfDriver MSNdis_WmiTcpIpChecksumOffload_IPv4TransmitReceive C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ;J����
͝��C�� H +/�Q �� } � WDMClassesOfDriver MSNdis_WmiTcpIpChecksumOffload_IPv6TransmitReceive C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 <J����
͝��C�� 4 +/�Q �� i � WDMClassesOfDriver MSNdis_WmiTcpIpChecksumOffload C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 =J����
͝��C�� 8 +/�Q �� m � WDMClassesOfDriver MSNdis_WmiIPSecOffloadV1_Supported C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 >J����
͝��C�� 5 +/�Q �� j � WDMClassesOfDriver MSNdis_WmiIPSecOffloadV1_IPv4AH C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ?J����
͝��C�� 6 +/�Q �� k � WDMClassesOfDriver MSNdis_WmiIPSecOffloadV1_IPv4ESP C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 @J����
͝��C�� . +/�Q �� c � WDMClassesOfDriver MSNdis_WmiIPSecOffloadV1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 AJ����
͝��C�� : +/�Q �� o � WDMClassesOfDriver MSNdis_WmiTcpLargeSendOffloadV2_IPv4 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 BJ����
͝��C�� : +/�Q �� o � WDMClassesOfDriver MSNdis_WmiTcpLargeSendOffloadV2_IPv6 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 CJ����
͝��C�� 5 +/�Q �� j � WDMClassesOfDriver MSNdis_WmiTcpLargeSendOffloadV2 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 DJ����
͝��C� ' +/�Q �� \ � WDMClassesOfDriver MSNdis_WmiOffload C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 EJ����
͝��C�� 1 +/�Q �� f � WDMClassesOfDriver MSNdis_TcpOffloadParameters C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 FJ����
͝��C�� 4 +/�Q �� i � WDMClassesOfDriver MSNdis_WmiTcpConnectionOffload C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 GJ����
͝��C�� 4 +/�Q �� i � WDMClassesOfDriver MSNdis_WmiHDSplitCurrentConfig C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 HJ����
͝��C�� . +/�Q �� c � WDMClassesOfDriver MSNdis_HDSplitParameters C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 IJ����
͝��C�� 8 +/�Q �� m � WDMClassesOfDriver MSNdis_WmiReceiveScaleCapabilities C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 JJ����
͝��C�� 6 +/�Q �� k � WDMClassesOfDriver MSNdis_ReceiveFilterCapabilities C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 KJ����
͝��C�� : +/�Q �� o � WDMClassesOfDriver MSNdis_ReceiveFilterGlobalParameters C:\Windows\system32\kernelbase.dll[MofResourceName] nelbase.dll[MofResourceName] me] e] \system32\kernelbase.dll[MofResourceName] �qi� �K�� u��� 7 � ! fp�?$ ��al@ �?��Z ��g(l n�.��
W�8� ��� X�" �
ק� ���%� iA � �8?�* i�Y�= ���P ��f ! �u%�� 8_g�� ��핺 �E��� ���� & ��m ' ���@ ���] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 LJ����
͝��C�� * +/�Q �� _ � WDMClassesOfDriver MSNdis_CountedString C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 MJ����
͝��C�� . +/�Q �� c � WDMClassesOfDriver MSNdis_ReceiveFilterInfo C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 NJ����
͝��C�� 3 +/�Q �� h � WDMClassesOfDriver MSNdis_ReceiveFilterInfoArray C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 OJ����
͝��C�� 9 +/�Q �� n � WDMClassesOfDriver MSNdis_ReceiveFilterFieldParameters C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 PJ����
͝��C�� 4 +/�Q �� i � WDMClassesOfDriver MSNdis_ReceiveFilterParameters C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 QJ����
͝��C�� 2 +/�Q �� g � WDMClassesOfDriver MSNdis_NicSwitchCapabilities C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 RJ����
͝��C�� * +/�Q �� _ � WDMClassesOfDriver MSNdis_GroupAffinity C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 SJ����
͝��C�� 3 +/�Q �� h � WDMClassesOfDriver MSNdis_ReceiveQueueParameters C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 TJ����
͝��C�� - +/�Q �� b � WDMClassesOfDriver MSNdis_ReceiveQueueInfo C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 UJ����
͝��C�� 2 +/�Q �� g � WDMClassesOfDriver MSNdis_ReceiveQueueInfoArray C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 M����
͝��C�~ & +/�Q �� [ � WDMClassesOfDriver MSNdis_LinkState C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 M����
͝��C�� 5 +/�Q �� j � WDMClassesOfDriver MSNdis_QueryInterruptModeration C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 M����
͝��C�� 3 +/�Q �� h � WDMClassesOfDriver MSNdis_SetInterruptModeration C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 M����
͝��C�� . +/�Q �� c � WDMClassesOfDriver MSNdis_SetLinkParameters C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 M����
͝��C�� 0 +/�Q �� e � WDMClassesOfDriver MSNdis_QueryStatisticsInfo C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 M����
͝��C�� + +/�Q �� ` � WDMClassesOfDriver MSNdis_QueryPortState C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 M����
͝��C�� + +/�Q �� ` � WDMClassesOfDriver MSNdis_EnumeratePorts C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 M����
͝��C�� . +/�Q �� c � WDMClassesOfDriver MSNdis_SetPortParameters C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 M����
͝��C�� 9 +/�Q �� n � WDMClassesOfDriver MSNdis_QueryPciDeviceCustomProperty C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 !M����
͝��C�� / +/�Q �� d � WDMClassesOfDriver MSNdis_EnumerateAdapterEx C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 "M����
͝��C�� 4 +/�Q �� i � WDMClassesOfDriver MSNdis_TcpOffloadCurrentConfig C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 #M����
͝��C�� 5 +/�Q �� j � WDMClassesOfDriver MSNdis_TcpOffloadHardwareConfig C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 $M����
͝��C�� 4 +/�Q �� i � WDMClassesOfDriver MSNdis_SetTcpOffloadParameters C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 %M����
͝��C�� > +/�Q �� s � WDMClassesOfDriver MSNdis_TcpConnectionOffloadCurrentConfig C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 &M����
͝��C�� ? +/�Q �� t � WDMClassesOfDriver MSNdis_TcpConnectionOffloadHardwareConfig C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 'M����
͝��C�� 5 +/�Q �� j � WDMClassesOfDriver MSNdis_ReceiveScaleCapabilities C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 (M����
͝��C�� 1 +/�Q �� f � WDMClassesOfDriver MSNdis_HDSplitCurrentConfig C:\Windows\system32\kernelbase.dll[MofResourceName] ntCapabilities C:\Windows\system32\kernelbase.dll[MofResourceName] sourceName] fResourceName] iv � ��N p � ��'� � j�j�� � ���-^ � �m{ � ��Ƥ suR|�C�� / ) % d ��o w � F a � � � � G ^ � � o � < Q # � � � � +
8
UUU���������������������������������������������
� RSOP_IEProgramSettings Description Object which contains details of program associations for IE. AMENDMENT LOCALE calendarProgram +
� � � � ' 4 string Description Specifies the Internet calendar program you want to use with Internet Explorer. DisplayName Calendar Program checkIfIEIsDefaultBrowser
( +
� � � � m z boolean Description Specifies whether you want Internet Explorer to remain your default Internet browser, even if you install additional Internet browsing software. When this check box is selected, each time Internet Explorer starts it checks to make sure it is still registered as the default Internet browser. If another program is registered as the default browser, Internet Explorer asks whether you want to restore Internet Explorer as your default browser. DisplayName Check If IE Is Default Browser contactListProgram $ +
� � � � ] j string Description Specifies the Internet contacts or address-book program you want to use with Internet Explorer. DisplayName Contact List Program emailProgram +
� � � � + 8 string Description Specifies the Internet e-mail program you want to use with Internet Explorer. DisplayName Email Program htmlEditorHKCURegData +
� � � � � � string Description DisplayName HTML Editor HKCU Registry Data htmlEditorHKLMRegData +
� + 3 @ B O string Description DisplayName HTML Editor HKLM Registry Data htmlEditorProgram +
� � � � ) string Description Specifies the HTML editing program you want to use with Internet Explorer. DisplayName HTMLEditorProgram internetCallProgram +
� � � � � � string Description Specifies the Internet call program you want to use with Internet Explorer. DisplayName Internet Call Program newsgroupsProgram +
� \ d q � � string Description Specifies the Internet newsreader program you want to use with Internet Explorer. DisplayName Newsgroups Program rsopID 6
� 1 � ��9 F j w string Description Foreign key to RSOP_PolicySetting. DisplayName RSOP ID rsopPrecedence 6
� � � ��� �
uint32 Description Foreign key to RSOP_PolicySetting. DisplayName RSOP Precedence useIEForFTP * +
� q
z
�
�
�
boolean Description DisplayName Use Internet Explorer For FTP � tuR|�C�i ) - n ��y � � D U ��������� � RSOP_IEImportedProgramSettings Description Program settings object for the IE browser, used for IEAK RSoP. AMENDMENT LOCALE policySetting f 6
� � � ��� � ' 4 ref:RSOP_IEAKPolicySetting Description Reference to the RSOP_IEAKPolicySetting. DisplayName Policy Setting programSettings f 6
� � � ��� � � � ref:RSOP_IEProgramSettings Description Reference to the imported program settings. DisplayName Program Settings Na � wuR|�C�� < ) $ 1 � ��� � � ! � � X ` � � 9 C � � " 5 � � ! ) � � g q � � K [ UUU���������������������������������������������������������� � RSOP_IEConnectionDialUpCredentials Description Object which contains details for a phone number used for dialing up to the internet. AMENDMENT LOCALE callbackID +
� � � � � uint32 Description DisplayName Callback ID callbackNumber +
� Z b o q ~ string Description DisplayName Callback Number connectionName 6
� � � ��� � : G string Description Unique name of a location from which the internet can be dialed. DisplayName Connection Name domain +
� � � � � � string Description DisplayName Domain entryName +
� - string Description DisplayName Entry Name password +
� | � � � � string Description DisplayName Password phoneNumber +
� � � string Description DisplayName Phone Number rasDialParamsData $ +
� n u � � � uint8 Description DisplayName RAS Dial Params Data rasDialParamsDataSize
( +
� � � uint32 Description DisplayName Size rsopID 6
� m � ��u � � � string Description Foreign key to RSOP_PolicySetting. DisplayName RSOP ID rsopPrecedence 6
� � �� % I V sint32 Description Foreign key to RSOP_PolicySetting. DisplayName RSOP Precedence subEntry , +
� � � � � � uint32 Description DisplayName Sub Entry userName 0 +
� $ 1 3 @ string Description DisplayName User Name windowsVersion
4 +
� � � � � � uint32 Description DisplayName Windows Version � xuR|�C�� ) ( 5 � ��� � � s � ���������6 � RSOP_IEConnectionDialUpCredentialsLink Description Dial-up credentials for a given IE internet connection , used for IEAK RSoP. AMENDMENT LOCALE dialUpCredentials f 6
� � � �� " T a ref:RSOP_IEConnectionDialUpCredentials Description Reference to the dial-up connection credentials. DisplayName Dial Up Settings policySetting f 6
� � � ��� � & ref:RSOP_IEAKPolicySetting Description Reference to the RSOP_IEAKPolicySetting. DisplayName Policy Setting s. � yuR|�C�� ) " / � ��� � � k � 3 � � Z j U��������������������� � RSOP_IEConnectionWinINetSettings Description Object which contains details for WinINet internet connection settings for a given connection. AMENDMENT LOCALE connectionName 6
� � � ��� M Z string Description Unique name of a location from which the internet can be dialed. DisplayName Connection Name internetPerConnOptionListData +
� � � � � � uint8 Description DisplayName Internet Per Connection Option List Data internetPerConnOptionListDataSize +
� l t � � � uint32 Description DisplayName Internet Per Connection Option List Data Size rsopID 6
� � �� D Q string Description Foreign key to RSOP_PolicySetting. DisplayName RSOP ID rsopPrecedence 6
� � � ��� � � � sint32 Description Foreign key to RSOP_PolicySetting. DisplayName RSOP Precedence �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 S�n�^��
͝��C�� 3 J.3�� h � WDMClassesOfDriver MSNdis_FddiLongCurrentAddress C:\Windows\system32\kernelbase.dll[MofResourceName] sourceName] �S�� ��,� ��b$� -��# >�D Z:�f* ��aD " t��f ����
P3Q�� �� ��(��
?f�� � � ��� u C2 y���O N>�g o� �t W� G��� % 7�+O� $ W���� �%7 d�m. # ��f Q t�q % 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �J����
͝��C�� 0 +/�Q �� e � WDMClassesOfDriver MSNdis_PMCapabilitiesParam C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �J����
͝��C�� + +/�Q �� ` � WDMClassesOfDriver MSNdis_PMCapabilities C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 RM����
͝��C�� - +/�Q �� b � WDMClassesOfDriver MSNdis_StatusResetStart C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 SM����
͝��C�� + +/�Q �� ` � WDMClassesOfDriver MSNdis_StatusResetEnd C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 TM����
͝��C�� / +/�Q �� d � WDMClassesOfDriver MSNdis_StatusMediaConnect C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 UM����
͝��C�� 2 +/�Q �� g � WDMClassesOfDriver MSNdis_StatusMediaDisconnect C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 VM����
͝��C�� : +/�Q �� o � WDMClassesOfDriver MSNdis_StatusMediaSpecificIndication C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 WM����
͝��C�� 2 +/�Q �� g � WDMClassesOfDriver MSNdis_StatusLinkSpeedChange C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 XM����
͝��C�� / +/�Q �� d � WDMClassesOfDriver MSNdis_StatusProtocolBind C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 YM����
͝��C�� 1 +/�Q �� f � WDMClassesOfDriver MSNdis_StatusProtocolUnbind C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ZM����
͝��C�� 0 +/�Q �� e � WDMClassesOfDriver MSNdis_StatusDevicePowerOn C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 [M����
͝��C�� 1 +/�Q �� f � WDMClassesOfDriver MSNdis_StatusDevicePowerOff C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 \M����
͝��C�� 2 +/�Q �� g � WDMClassesOfDriver MSNdis_StatusDevicePowerOnEx C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ]M����
͝��C�� 3 +/�Q �� h � WDMClassesOfDriver MSNdis_StatusDevicePowerOffEx C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ^M����
͝��C�� 4 +/�Q �� i � WDMClassesOfDriver MSNdis_StatusTaskOffloadChange C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 _M����
͝��C�� 5 +/�Q �� j � WDMClassesOfDriver MSNdis_StatusPacketFilterChange C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 `M����
͝��C�� 0 +/�Q �� e � WDMClassesOfDriver MSNdis_StatusNetworkChange C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 aM����
͝��C�� 4 +/�Q �� i � WDMClassesOfDriver MSNdis_StatusOperationalStatus C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 bM����
͝��C�� , +/�Q �� a � WDMClassesOfDriver MSNdis_StatusLinkState C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 cM����
͝��C�� , +/�Q �� a � WDMClassesOfDriver MSNdis_StatusPortState C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 dM����
͝��C�� = +/�Q �� r � WDMClassesOfDriver MSNdis_StatusExternalConnectivityChange C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 eM����
͝��C�� < +/�Q �� q � WDMClassesOfDriver MSNdis_StatusMediaSpecificIndicationEx C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 fM����
͝��C�� 7 +/�Q �� l � WDMClassesOfDriver MSNdis_StatusHDSplitCurrentConfig C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 gM����
͝��C�� 3 +/�Q �� h � WDMClassesOfDriver MSNdis_StatusDot11ScanConfirm C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 hM����
͝��C�� ; +/�Q �� p � WDMClassesOfDriver MSNdis_StatusDot11MPDUMaxLengthChange C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 iM����
͝��C�� 8 +/�Q �� m � WDMClassesOfDriver MSNdis_StatusDot11AssociationStart C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 jM����
͝��C�� = +/�Q �� r � WDMClassesOfDriver MSNdis_StatusDot11AssociationCompletion C:\Windows\system32\kernelbase.dll[MofResourceName] inkQuality C:\Windows\system32\kernelbase.dll[MofResourceName] \system32\kernelbase.dll[MofResourceName] �D7� ت�� $ 0>�4 ۦ&T ! :�a@ �9�^ j��i| " h�AS� ��k�
�LBc� �;T� �2 ��
��C� ��� a���$ ���: � ��S ��i�V �g�e ��܃i ���6�
t��P� � $� |��a� u�Z�
���(� " ~�W� 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 kM����
͝��C�� 7 +/�Q �� l � WDMClassesOfDriver MSNdis_StatusDot11ConnectionStart C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 lM����
͝��C�� < +/�Q �� q � WDMClassesOfDriver MSNdis_StatusDot11ConnectionCompletion C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 mM����
͝��C�� 4 +/�Q �� i � WDMClassesOfDriver MSNdis_StatusDot11RoamingStart C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 nM����
͝��C�� 9 +/�Q �� n � WDMClassesOfDriver MSNdis_StatusDot11RoamingCompletion C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 oM����
͝��C�� 6 +/�Q �� k � WDMClassesOfDriver MSNdis_StatusDot11Disassociation C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 pM����
͝��C�� 6 +/�Q �� k � WDMClassesOfDriver MSNdis_StatusDot11TkipmicFailure C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 qM����
͝��C�� : +/�Q �� o � WDMClassesOfDriver MSNdis_StatusDot11PmkidCandidateList C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 rM����
͝��C�� 6 +/�Q �� k � WDMClassesOfDriver MSNdis_StatusDot11PhyStateChange C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 sM����
͝��C�� 3 +/�Q �� h � WDMClassesOfDriver MSNdis_StatusDot11LinkQuality C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 tM����
͝��C�x +/�Q �� U � WDMClassesOfDriver MSKeyboard C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 uM����
͝��C�u +/�Q �� R � WDMClassesOfDriver MSMouse C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 vM����
͝��C�� 0 +/�Q �� e � WDMClassesOfDriver MSKeyboard_PortInformation C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 wM����
͝��C�� + +/�Q �� ` � WDMClassesOfDriver MSKeyboard_ExtendedID C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 xM����
͝��C�� - +/�Q �� b � WDMClassesOfDriver MSMouse_PortInformation C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 yM����
͝��C�� . +/�Q �� c � WDMClassesOfDriver MSMouse_ClassInformation C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 zM����
͝��C�� 1 +/�Q �� f � WDMClassesOfDriver MSKeyboard_ClassInformation C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 {M����
͝��C�s +/�Q �� P � WDMClassesOfDriver MSAgp C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 |M����
͝��C� ' +/�Q �� \ � WDMClassesOfDriver MSAgp_Information C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 }M����
͝��C�t +/�Q �� Q � WDMClassesOfDriver MSAcpi C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ~M����
͝��C�� 3 +/�Q �� h � WDMClassesOfDriver MSAcpi_ThermalZoneTemperature C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 M����
͝��C�z " +/�Q �� W � WDMClassesOfDriver MSDiskDriver C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�� + +/�Q �� ` � WDMClassesOfDriver MSDiskDriver_Geometry C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�� 2 +/�Q �� g � WDMClassesOfDriver MSDiskDriver_PerformanceData C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�� . +/�Q �� c � WDMClassesOfDriver MSDiskDriver_Performance C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�} % +/�Q �� Z � WDMClassesOfDriver MSStorageDriver C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�� : +/�Q �� o � WDMClassesOfDriver MSStorageDriver_FailurePredictStatus C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�� 8 +/�Q �� m � WDMClassesOfDriver MSStorageDriver_FailurePredictData C:\Windows\system32\kernelbase.dll[MofResourceName] board_ClassInformation C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] �C� ' �k+K�� \ � WDMClassesOfDriver MSSerial_CommInfo C:\Windows\system32\kernelbase.dll[MofResourceName] eName] ��r8� � �� z �̮ i�ɣ� + ���.� &7�� @��8% >��7
ynLM ���j ! <��
�![ � �F9v� ! dsҒ� " �"x� k�� iȁM/ kn1UG ��s\ � m *�� 1(~C� �WP�� �W��� �
H�� �S�� 4 3 C 8 6 C 3 E 5 B 2 B 7 F 1 D D 0 4 4 3 A 6 D A 4 E 1 7 A A 9 5 D 6 5 F 5 6 E E 0 C 1 9 C F 4 F D 3 B 5 D 9 A 5 F 6 3 C 5 2 2 {gש^�u͝��C�b 0 9 �� A � HNet_Connection {165AAE85-6CDD-7527-316D-24F72A2CECA1} Server A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 |gש^�v͝��C�| �� Z � HNet_ConnectionProperties HNet_Connection.Guid="{165AAE85-6CDD-7527-316D-24F72A2CECA1}" R O O T \ M i c r o s o f t \ H o m e N e t H N e t _ C o n n e c t i o n P r o p e r t i e s
C o n n e c t i o n � N S _ 5 1 1 6 2 6 F A E 4 F 5 7 D B D 2 0 D F 5 C D 4 4 A 4 1 D A E C E D 2 8 C F 7 B 3 F D 8 B 1 2 0 1 2 C 7 F 4 B 5 8 F 4 4 E 6 6 5 \ K I _ A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 \ I _ 7 6 F D E 5 1 B 5 6 B 3 B B A 5 E D A A E C 9 6 3 C 5 A 6 D 9 1 3 0 1 0 9 9 B 6 6 8 7 A 4 3 A 2 9 7 5 1 D 6 2 C D 4 3 A 1 E A 8 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/pl\}�
͝��C�� 9 ��
�S}� x � WDMClassesOfDriver MSMCAInfo_RawCorrectedPlatformEvent C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �J����
͝��C�� / +/�Q �� d � WDMClassesOfDriver MSNdis_PMAdminConfigState C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �J����
͝��C�� / +/�Q �� d � WDMClassesOfDriver MSNdis_PMAdminConfigParam C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �J����
͝��C�� * +/�Q �� _ � WDMClassesOfDriver MSNdis_PMAdminConfig C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �J����
͝��C�� . +/�Q �� c � WDMClassesOfDriver MSNdis_PMCapabilityState C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 @M����
͝��C�� 5 +/�Q �� j � WDMClassesOfDriver MSNdis_80211_InfrastructureMode C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 AM����
͝��C�� 9 +/�Q �� n � WDMClassesOfDriver MSNdis_80211_FragmentationThreshold C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 BM����
͝��C�� / +/�Q �� d � WDMClassesOfDriver MSNdis_80211_RTSThreshold C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 CM����
͝��C�� 3 +/�Q �� h � WDMClassesOfDriver MSNdis_80211_NumberOfAntennas C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 DM����
͝��C�� 9 +/�Q �� n � WDMClassesOfDriver MSNdis_80211_ReceiveAntennaSelected C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 EM����
͝��C�� : +/�Q �� o � WDMClassesOfDriver MSNdis_80211_TransmitAntennaSelected C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 FM����
͝��C�� , +/�Q �� a � WDMClassesOfDriver MSNdis_80211_DataRates C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 GM����
͝��C�� 3 +/�Q �� h � WDMClassesOfDriver MSNdis_80211_DesiredDataRates C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 HM����
͝��C�� 0 +/�Q �� e � WDMClassesOfDriver MSNdis_80211_Configuration C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 IM����
͝��C�� - +/�Q �� b � WDMClassesOfDriver MSNdis_80211_Statistics C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 JM����
͝��C�� ) +/�Q �� ^ � WDMClassesOfDriver MSNdis_80211_AddWEP C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 KM����
͝��C�� , +/�Q �� a � WDMClassesOfDriver MSNdis_80211_RemoveWEP C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 LM����
͝��C�� / +/�Q �� d � WDMClassesOfDriver MSNdis_80211_Disassociate C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 MM����
͝��C�� 0 +/�Q �� e � WDMClassesOfDriver MSNdis_80211_BssIdListScan C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 NM����
͝��C�� 5 +/�Q �� j � WDMClassesOfDriver MSNdis_80211_AuthenticationMode C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 OM����
͝��C�� 0 +/�Q �� e � WDMClassesOfDriver MSNdis_80211_PrivacyFilter C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 PM����
͝��C�� , +/�Q �� a � WDMClassesOfDriver MSNdis_80211_WEPStatus C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 QM����
͝��C�� 1 +/�Q �� f � WDMClassesOfDriver MSNdis_80211_ReloadDefaults C:\Windows\system32\kernelbase.dll[MofResourceName] 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ����g�
͝��C�� + ��-#=g� ` � WDMClassesOfDriver MSNdis_NetworkAddress C:\Windows\system32\kernelbase.dll[MofResourceName] l.mui[MofResourceName] +��� � �t�k ��Q5t � �|�! ��/ < ��k
r��$l 9ٝ��C��
) + � �� � A R d � � � � ( 2 U������������d � MDM_EnterpriseAPN_Settings01 InPartition 3 local-system DMWmiBridgeProv AllowUserControl '
� � � �� � �� boolean HideView
'
� � � �� � �� boolean InstanceID
� � �� string ParentID
� \ � �� string MD � Dٝ��C��
) " / � �� � E V } � � � 5 D U������������� � MDM_PassportForWork_Biometrics01 InPartition 7 local-system DMWmiBridgeProv FacialFeaturesUseEnhancedAntiSpoofing
'
� � � �� � �� boolean InstanceID
� � � �� string ParentID
� - � �� string UseBiometrics '
� y � �� � �� boolean MD � Eٝ��C�� ) ' 4 � �� � J [ g � � � � U����������0 � MDM_PassportForWork_Device_Policies02 InPartition < local-system DMWmiBridgeProv InstanceID
� � � �� string ParentID
� � � �� string UseCertificateForOnPremAuth '
� ' � �� � �� boolean Po � Iڝ��C�� ) : G � �� � ] o z � � � � 1 F U����������������� � MDM_EnterpriseModernAppManagement_ReleaseManagement03_01 InPartition O local-system DMWmiBridgeProv1 ChannelId '
� � � �� � �� string InstanceID
� � � �� string ParentID
� ) � �� string ReleaseManagementId '
� { � �� � �� string M �$ R O O T \ M i c r o s o f t \ W i n d o w s \ S e r v e r M a n a g e r _ _ M e t h o d P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 7 E 7 4 6 D 8 C C 9 7 8 8 2 C B 8 8 D F 7 3 9 9 7 2 7 6 5 9 B 5 9 A 1 3 A 9 2 A B 8 4 0 C 9 F E 6 F 8 C 0 3 E 9 F B 5 D 5 5 D B \ K I _ 7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D \ I _ 7 E E 9 A 4 1 9 A 1 3 7 C B 9 0 4 1 9 D B 8 6 B 8 F 3 8 2 6 6 6 3 6 7 5 5 A 9 4 0 6 C F 4 1 C E 7 5 F A 4 0 6 C 6 7 D 2 C 2 5 F � :ٝ��C�H " ) 8 E � �� � [ m | � � � ? N � � � � Y g UU��������������������������������� � MDM_EnterpriseModernAppManagement_AppInstallation01_01 InPartition M local-system DMWmiBridgeProv1 HostedInstall '
� � � �� � string InstanceID
� � � �� string LastError '
� 7 � �� � sint32 LastErrorDesc '
� � � �� � string ParentID
� � � �� string ProgressStatus '
� � �� � sint32 Status '
� Q � �� � sint32 StoreInstall '
� � � �� � string � 0 1 � � � � q � StoreInstallMethod # �� implemented � WIN-F6NF7R6I6PJ ROOT\cimv2\mdm\dmmap ���� � �� �� * � ����� � __PARAMETERS abstract param string
� 1 In
� 1 X �� ID )
� � X ��� string __ �� WIN-F6NF7R6I6PJ ROOT\cimv2\mdm\dmmap ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � HostedInstallMethod � �� implemented � WIN-F6NF7R6I6PJ ROOT\cimv2\mdm\dmmap ���� � �� �� * � ����� � __PARAMETERS abstract param string
� 1 In
� 1 X �� ID )
� � X ��� string __ �� WIN-F6NF7R6I6PJ ROOT\cimv2\mdm\dmmap ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � <ٝ��C� ) 6 C � �� � Y k x � � � W a U����������������� � MDM_EnterpriseModernAppManagement_AppManagement01_02 InPartition K local-system DMWmiBridgeProv1 DoNotUpdate '
� � � �� � �� sint32 InstanceID
� � � �� string MaintainProcessorArchitectureOnUpdate '
� O � �� � �� sint32 ParentID
� � � �� string M �ing M �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 a*pl\}�
͝��C�� 0 �\>�S}� e � WDMClassesOfDriver MSNdis_NotifyFilterArrival C:\Windows\system32\kernelbase.dll[MofResourceName] MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 a*pl\}�
͝��C�� 0 �\>�S}� e � WDMClassesOfDriver MSNdis_NotifyFilterArrival C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 b*pl\}�
͝��C�� 8 �\>�S}� m � WDMClassesOfDriver MSNdis_DeviceWakeOnMagicPacketOnly C:\Windows\system32\kernelbase.dll[MofResourceName] ceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 b*pl\}�
͝��C�� 8 �\>�S}� m � WDMClassesOfDriver MSNdis_DeviceWakeOnMagicPacketOnly C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 c*pl\}�
͝��C� ' �\>�S}� \ � WDMClassesOfDriver MSNdis_RSSEnabled C:\Windows\system32\kernelbase.dll[MofResourceName] dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 c*pl\}�
͝��C� ' �\>�S}� \ � WDMClassesOfDriver MSNdis_RSSEnabled C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 d*pl\}�
͝��C�� / �\>�S}� d � WDMClassesOfDriver MSNdis_NetworkDirectState C:\Windows\system32\kernelbase.dll[MofResourceName] 2\en-US\kernelbase.dll.mui[MofResourceName] dll.mui[MofResourceName] ofResourceName] F � s��� }c��� �][� �aAP �o�N I��N4 :�>�= ,h�9L
�j�ZV
�*��a �[h � ��q
��\�w
�<��
G7�m� Hۡ� �3 � �~sN� �A�� �4�j� � bG &� g # u7��C �"�_J �?��R FJ�Z
�-Q�d
��M�n 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 s=�4 �
͝��C�� & 9� (D� h � WDMClassesOfDriver MSProcessorClass C:\Windows\System32\drivers\en-US\processr.sys.mui[PROCESSORWMI] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ~N����
͝��C� ' +/�Q �� \ � WDMClassesOfDriver ALPC_Send_Message C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 N����
͝��C�� * +/�Q �� _ � WDMClassesOfDriver ALPC_Receive_Message C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�� ) +/�Q �� ^ � WDMClassesOfDriver ALPC_Wait_For_Reply C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�� / +/�Q �� d � WDMClassesOfDriver ALPC_Wait_For_New_Message C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�y ! +/�Q �� V � WDMClassesOfDriver ALPC_Unwait C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C� ' +/�Q �� \ � WDMClassesOfDriver HeapTraceProvider C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�z " +/�Q �� W � WDMClassesOfDriver HeapTrace_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�{ # +/�Q �� X � WDMClassesOfDriver HeapCreate_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�w +/�Q �� T � WDMClassesOfDriver HeapAlloc C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�y ! +/�Q �� V � WDMClassesOfDriver HeapRealloc C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�v +/�Q �� S � WDMClassesOfDriver HeapFree C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�} % +/�Q �� Z � WDMClassesOfDriver HeapSnapShot_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�} % +/�Q �� Z � WDMClassesOfDriver Heap_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�� * +/�Q �� _ � WDMClassesOfDriver Heap_SubsegmentGroup C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�� ( +/�Q �� ] � WDMClassesOfDriver HeapCommitDecommit C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�� . +/�Q �� c � WDMClassesOfDriver HeapSubsegmentInitialize C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�� / +/�Q �� d � WDMClassesOfDriver HeapAffinityManagerEnable C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�� . +/�Q �� c � WDMClassesOfDriver HeapAffinitySlotAssigned C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�� - +/�Q �� b � WDMClassesOfDriver HeapSubSegmentActivated C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�� - +/�Q �� b � WDMClassesOfDriver HeapAffinitySlotChanged C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�� ; +/�Q �� p � WDMClassesOfDriver HeapSubsegmentReuseThresholdActivated C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�w +/�Q �� T � WDMClassesOfDriver HeapTrace C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�x +/�Q �� U � WDMClassesOfDriver HeapCreate C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�x +/�Q �� U � WDMClassesOfDriver HeapExpand C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�z " +/�Q �� W � WDMClassesOfDriver HeapSnapShot C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�z " +/�Q �� W � WDMClassesOfDriver HeapContract C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�� * +/�Q �� _ � WDMClassesOfDriver CritSecTraceProvider C:\Windows\system32\kernelbase.dll[MofResourceName] l[MofResourceName] rceName] ame] C:\Windows\System32\drivers\en-US\processr.sys.mui[PROCESSORWMI] sr.sys.mui[PROCESSORWMI] ame] Su�F� i M� ` �B
y t �0l� � �K3� [ A��� � �ьܜ
ЁH� � �L� > � [�^� � - X e S q l P k g _ d a t a _ c l a s s i f i c a t i o n _ a u d i t i n g _ t r a f f i c �T��7 �� 7 XeSqlPkg_data_classification_auditing_traffic / ) � ��& 1 ? K � L X � � N f � � W����������������������������4 � data_classification_auditing_traffic EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� 9 A � �� uint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� % 0 = � �� uint32 WmiDataId Description RemainingLength sensitivity_attributes )
� � � � �� uint32 WmiDataId SequenceNumber 6
� $ � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �T��7 �8 XeSqlPkg
C � ��& 3 _ e � � � � c����� � XeSqlPkg_dbcc_inputbuffer_initialize Description Used for testing DBCC INPUTBUFFER command. Guid {910AA1BE-F12B-4710-8FBB-B17A4639E4F5} locale MS\0x409 DisplayName dbcc_inputbuffer_initialize �$ X e S q l P k g _ d b c c _ i n p u t b u f f e r _ i n i t i a l i z e �T��7 � . XeSqlPkg_dbcc_inputbuffer_initialize & ) � �� ( 6 B � � h y � � W���������������������r � dbcc_inputbuffer_initialize EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid FragmentId 6
� < D O \ � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� B J U b � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �T��7 �u XeSqlPkg
C � ��3 @ � � � � � � c���� � XeSqlPkg_implied_auth_eligible_connection_request Description Fires when a connection request is found eligible for implied authentication. Guid {062C2D2B-895D-4972-BA2D-155AFD7963A2} locale MS\0x409 DisplayName implied_auth_eligible_connection_request �1 X e S q l P k g _ i m p l i e d _ a u t h _ e l i g i b l e _ c o n n e c t i o n _ r e q u e s t �T��7 �� ; XeSqlPkg_implied_auth_eligible_connection_request 3 ) � ��* 5 C O � u � - � � W�������������������������& � implied_auth_eligible_connection_request EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid FragmentId 6
� I Q \ i � �� uint32 WmiDataId Description FragmentId incoming_login_name C
� � � � ��� string WmiDataId StringTermination NullTerminated Format w RemainingLength 6
� q y � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �T��7 �� XeSqlPkg
C � ��3 @ � � � � � � c���� � XeSqlPkg_implied_auth_security_context_overridden Description Fires when an incoming connection's security context is overridden by implied login's security context. Guid {E8F8AE36-7E36-46C7-819F-4EAF7D479FDB} locale MS\0x409 DisplayName implied_auth_security_context_overridden �1 X e S q l P k g _ i m p l i e d _ a u t h _ s e c u r i t y _ c o n t e x t _ o v e r r i d d e n �T��7 �� ; XeSqlPkg_implied_auth_security_context_overridden 3 ) � ��* 5 C O � u � 0 � � H X W����������������������������� � implied_auth_security_context_overridden EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid FragmentId 6
� I Q \ i � �� uint32 WmiDataId Description FragmentId implied_login_name C
� � � � ��� string WmiDataId StringTermination NullTerminated Format w incoming_login_name C
� � � � ��� � � � string WmiDataId StringTermination NullTerminated Format w RemainingLength 6
� * 7 � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �T��7 �m XeSqlPkg
C � ��2 ? � � � � � � c����� � XeSqlPkg_implied_auth_login_entry_added_to_store Description Fires when an implied login entry is added to implied login hash store. Guid {23700457-5CDF-45C7-AB07-73AC08B93735} locale MS\0x409 DisplayName implied_auth_login_entry_added_to_store �0 X e S q l P k g _ i m p l i e d _ a u t h _ l o g i n _ e n t r y _ a d d e d _ t o _ s t o r e �T��7 �h : XeSqlPkg_implied_auth_login_entry_added_to_store 2 ) � ��) 4 B N � v � � � � . W����������������������������� � implied_auth_login_entry_added_to_store EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid external_user_sid
6
� O W � ��b m object WmiDataId Extension Variant FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId implied_login_name C
� W _ � ��j } � � string WmiDataId StringTermination NullTerminated Format w RemainingLength 6
� � �
� �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� r z � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �T��7 �y XeSqlPkg
C � ��6 C � � � � � � c����
� XeSqlPkg_implied_auth_login_entry_removed_from_store Description Fires when an implied login entry is removed from implied login hash store. Guid {56CFA523-D6F0-4BA7-B563-388C5109EB3F} locale MS\0x409 DisplayName implied_auth_login_entry_removed_from_store �ore �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�� , �\>�S}� a � WDMClassesOfDriver ObHandleDuplicateEvent C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] ���� �7�� Kԯ�� � �)� 0�� sM��#
@�0 �yĕ? �% 4W
H#Io_ - /�w �\�
! ��rd� % �Tql� ' � �� � � �}:}# [�6 s��_> ���8Q ��nY !�+�l }/�>� �(�� J�.k� 3ޯؿ �V[\� g�z� 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�{ # +/�Q �� X � WDMClassesOfDriver RDComplete_V0 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�� ( +/�Q �� ] � WDMClassesOfDriver EventTraceEvent_V1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�� * +/�Q �� _ � WDMClassesOfDriver EventTrace_V1_Header C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�� 3 +/�Q �� h � WDMClassesOfDriver Header_Extension_V1_TypeGroup C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�{ # +/�Q �� X � WDMClassesOfDriver RDComplete_V1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�} % +/�Q �� Z � WDMClassesOfDriver EventTraceEvent C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C� ' +/�Q �� \ � WDMClassesOfDriver EventTrace_Header C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�� 0 +/�Q �� e � WDMClassesOfDriver Header_Extension_TypeGroup C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�x +/�Q �� U � WDMClassesOfDriver RDComplete C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�� 0 +/�Q �� e � WDMClassesOfDriver Header_DbgIdRSDS_TypeGroup C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�� 0 +/�Q �� e � WDMClassesOfDriver Header_BuildInfo_TypeGroup C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�� 9 +/�Q �� n � WDMClassesOfDriver Header_ProviderBinaryPath_TypeGroup C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�� = +/�Q �� r � WDMClassesOfDriver Header_PartitionInfoExtension_TypeGroup C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�� ? +/�Q �� t � WDMClassesOfDriver Header_PartitionInfoExtensionV2_TypeGroup C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�� 7 +/�Q �� l � WDMClassesOfDriver Header_LastDroppedTimes_TypeGroup C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�x +/�Q �� U � WDMClassesOfDriver Process_V0 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�� + +/�Q �� ` � WDMClassesOfDriver Process_V0_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�x +/�Q �� U � WDMClassesOfDriver Process_V1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�� + +/�Q �� ` � WDMClassesOfDriver Process_V1_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�x +/�Q �� U � WDMClassesOfDriver Process_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�� + +/�Q �� ` � WDMClassesOfDriver Process_V2_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�� 2 +/�Q �� g � WDMClassesOfDriver Process_Terminate_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�� + +/�Q �� ` � WDMClassesOfDriver Process_V2_TypeGroup2 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�� + +/�Q �� ` � WDMClassesOfDriver Process_V2_TypeGroup3 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�� + +/�Q �� ` � WDMClassesOfDriver Process_V2_TypeGroup4 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�� + +/�Q �� ` � WDMClassesOfDriver Process_V2_TypeGroup5 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�x +/�Q �� U � WDMClassesOfDriver Process_V3 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�� + +/�Q �� ` � WDMClassesOfDriver Process_V3_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] l[MofResourceName] iY� 2M� ��;P� |��� V�S
%
�-! .�r�( o�:
�p`�L A��oT
D N�a
�!4�h ��P�z <�hJ� y�!&� ��rƑ c)a� ��u�� 6���
��� A����
OmBH� �#Vj� �o�� C#�� �*�x �Rk+ 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�x +/�Q �� U � WDMClassesOfDriver Process_V4 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�� + +/�Q �� ` � WDMClassesOfDriver Process_V4_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�u +/�Q �� R � WDMClassesOfDriver Process C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�� 0 +/�Q �� e � WDMClassesOfDriver Process_Defunct_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�w +/�Q �� T � WDMClassesOfDriver Thread_V0 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�� * +/�Q �� _ � WDMClassesOfDriver Thread_V0_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�w +/�Q �� T � WDMClassesOfDriver Thread_V1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�� * +/�Q �� _ � WDMClassesOfDriver Thread_V1_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�� * +/�Q �� _ � WDMClassesOfDriver Thread_V1_TypeGroup2 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�x +/�Q �� U � WDMClassesOfDriver CSwitch_V1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�} % +/�Q �� Z � WDMClassesOfDriver WorkerThread_V1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�w +/�Q �� T � WDMClassesOfDriver Thread_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�� * +/�Q �� _ � WDMClassesOfDriver Thread_V2_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�{ # +/�Q �� X � WDMClassesOfDriver ThreadSetName C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�x +/�Q �� U � WDMClassesOfDriver CSwitch_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�t +/�Q �� Q � WDMClassesOfDriver CompCS C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�v +/�Q �� S � WDMClassesOfDriver SpinLock C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�y ! +/�Q �� V � WDMClassesOfDriver ReadyThread C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�| $ +/�Q �� Y � WDMClassesOfDriver ThreadAffinity C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�z " +/�Q �� W � WDMClassesOfDriver WorkerThread C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�� ) +/�Q �� ^ � WDMClassesOfDriver AntiStarvationBoost C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�} % +/�Q �� Z � WDMClassesOfDriver ThreadMigration C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�� ( +/�Q �� ] � WDMClassesOfDriver KernelQueueEnqueue C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�� ( +/�Q �� ] � WDMClassesOfDriver KernelQueueDequeue C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�� / +/�Q �� d � WDMClassesOfDriver WorkerThread_StartStop_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C� ' +/�Q �� \ � WDMClassesOfDriver AutoBoostSetFloor C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�� ) +/�Q �� ^ � WDMClassesOfDriver AutoBoostClearFloor C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�� . +/�Q �� c � WDMClassesOfDriver AutoBoostEntryExhaustion C:\Windows\system32\kernelbase.dll[MofResourceName] ui[MofResourceName] dll[MofResourceName] ows\system32\kernelbase.dll[MofResourceName] A193A77939E65868511053C7856CA375F94BE.2669.2928240190.272 ndows\system32\kernelbase.dll[MofResourceName] W�~� ���� 0�� �7�X� �3� ,��- ��S >�?V% �Rp-
_�06
-쁞C ��˧J
��3�\ [\� c LŲu !t�� n e � ���н q���� �ͽ� ~�*� �)�X ?ҹW �/(+ =BB 4���W H��j �O� 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�� * +/�Q �� _ � WDMClassesOfDriver SubProcessTagChanged C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�w +/�Q �� T � WDMClassesOfDriver Thread_V3 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�� * +/�Q �� _ � WDMClassesOfDriver Thread_V3_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�| $ +/�Q �� Y � WDMClassesOfDriver ThreadPriority C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�x +/�Q �� U � WDMClassesOfDriver CSwitch_V3 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�w +/�Q �� T � WDMClassesOfDriver Thread_V4 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C� ' +/�Q �� \ � WDMClassesOfDriver Thread_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�x +/�Q �� U � WDMClassesOfDriver CSwitch_V4 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�y ! +/�Q �� V � WDMClassesOfDriver PowerEvents C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�} % +/�Q �� Z � WDMClassesOfDriver IdleExitLatency C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�w +/�Q �� T � WDMClassesOfDriver DiskIo_V0 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�� * +/�Q �� _ � WDMClassesOfDriver DiskIo_V0_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�w +/�Q �� T � WDMClassesOfDriver DiskIo_V1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�� * +/�Q �� _ � WDMClassesOfDriver DiskIo_V1_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�� 0 +/�Q �� e � WDMClassesOfDriver V1_DriverMajorFunctionCall C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�� 2 +/�Q �� g � WDMClassesOfDriver V1_DriverMajorFunctionReturn C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�� . +/�Q �� c � WDMClassesOfDriver V1_DriverCompleteRequest C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�� 4 +/�Q �� i � WDMClassesOfDriver V1_DriverCompleteRequestReturn C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�w +/�Q �� T � WDMClassesOfDriver DiskIo_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�� * +/�Q �� _ � WDMClassesOfDriver DiskIo_V2_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�� * +/�Q �� _ � WDMClassesOfDriver DiskIo_V2_TypeGroup2 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�� * +/�Q �� _ � WDMClassesOfDriver DiskIo_V2_TypeGroup3 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�� - +/�Q �� b � WDMClassesOfDriver DriverMajorFunctionCall C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�� / +/�Q �� d � WDMClassesOfDriver DriverMajorFunctionReturn C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�� - +/�Q �� b � WDMClassesOfDriver DriverCompletionRoutine C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�� + +/�Q �� ` � WDMClassesOfDriver DriverCompleteRequest C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�� 1 +/�Q �� f � WDMClassesOfDriver DriverCompleteRequestReturn C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�t +/�Q �� Q � WDMClassesOfDriver DiskIo C:\Windows\system32\kernelbase.dll[MofResourceName] nelbase.dll[MofResourceName] rceName] ndows\system32\kernelbase.dll[MofResourceName] dll[MofResourceName] fResourceName] �� �� _���� V i� �ԯ�� � `�S PM�P# �V�7 �Cƿ=
�S��N
�^~_X V�g
��S(t A*v� �9�� ��� �z9Ƽ j��� t $C� ~7 ��
\z�� x�W� �� p_
4 �Y�� 7��! \�4- ��; 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C� ' +/�Q �� \ � WDMClassesOfDriver DiskIo_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C� ' +/�Q �� \ � WDMClassesOfDriver DiskIo_TypeGroup3 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C� ' +/�Q �� \ � WDMClassesOfDriver DiskIo_TypeGroup2 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�y ! +/�Q �� V � WDMClassesOfDriver Registry_V0 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�� , +/�Q �� a � WDMClassesOfDriver Registry_V0_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�y ! +/�Q �� V � WDMClassesOfDriver Registry_V1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�� , +/�Q �� a � WDMClassesOfDriver Registry_V1_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�v +/�Q �� S � WDMClassesOfDriver Registry C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�� ) +/�Q �� ^ � WDMClassesOfDriver Registry_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�z " +/�Q �� W � WDMClassesOfDriver Registry_TxR C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C� ' +/�Q �� \ � WDMClassesOfDriver Registry_Counters C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�} % +/�Q �� Z � WDMClassesOfDriver Registry_Config C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �M����
͝��C�� - +/�Q �� b � WDMClassesOfDriver Registry_HiveInitialize C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 N����
͝��C�� * +/�Q �� _ � WDMClassesOfDriver Registry_HiveDestroy C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 N����
͝��C� ' +/�Q �� \ � WDMClassesOfDriver Registry_HiveLink C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 N����
͝��C�� * +/�Q �� _ � WDMClassesOfDriver Registry_HiveRundown C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 N����
͝��C�� ( +/�Q �� ] � WDMClassesOfDriver Registry_HiveDirty C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 N����
͝��C�� 1 +/�Q �� f � WDMClassesOfDriver Registry_ChangeNotification C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 N����
͝��C�u +/�Q �� R � WDMClassesOfDriver SplitIo C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 N����
͝��C�z " +/�Q �� W � WDMClassesOfDriver SplitIo_Info C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 N����
͝��C�w +/�Q �� T � WDMClassesOfDriver FileIo_V0 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 N����
͝��C�| $ +/�Q �� Y � WDMClassesOfDriver FileIo_V0_Name C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 N����
͝��C�w +/�Q �� T � WDMClassesOfDriver FileIo_V1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4
N����
͝��C�| $ +/�Q �� Y � WDMClassesOfDriver FileIo_V1_Name C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 N����
͝��C�w +/�Q �� T � WDMClassesOfDriver FileIo_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 N����
͝��C�| $ +/�Q �� Y � WDMClassesOfDriver FileIo_V2_Name C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4
N����
͝��C�~ & +/�Q �� [ � WDMClassesOfDriver FileIo_V2_Create C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 N����
͝��C�� ( +/�Q �� ] � WDMClassesOfDriver FileIo_V2_SimpleOp C:\Windows\system32\kernelbase.dll[MofResourceName] HiveInitialize C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] dows\system32\en-US\kernelbase.dll.mui[MofResourceName] ndows\system32\kernelbase.dll[MofResourceName] 3�>� V��� ��� � �D{�
�� "48� G��� �},% "0i0
�γ�= ��aK ���T
`F0�`
�zbj hJ��| 5�8'�
5Q,W�
���S� ��d�� *�DZ V��� ȷU?� S
��� ��G�� �6��� �8�'� ��F =�E 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 N����
͝��C�� ) +/�Q �� ^ � WDMClassesOfDriver FileIo_V2_ReadWrite C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 N����
͝��C�| $ +/�Q �� Y � WDMClassesOfDriver FileIo_V2_Info C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 N����
͝��C� ' +/�Q �� \ � WDMClassesOfDriver FileIo_V2_DirEnum C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 N����
͝��C�} % +/�Q �� Z � WDMClassesOfDriver FileIo_V2_OpEnd C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 N����
͝��C� ' +/�Q �� \ � WDMClassesOfDriver FileIo_V2_MapFile C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 N����
͝��C�t +/�Q �� Q � WDMClassesOfDriver FileIo C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 N����
͝��C�y ! +/�Q �� V � WDMClassesOfDriver FileIo_Name C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 N����
͝��C�{ # +/�Q �� X � WDMClassesOfDriver FileIo_Create C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 N����
͝��C�} % +/�Q �� Z � WDMClassesOfDriver FileIo_SimpleOp C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 N����
͝��C�~ & +/�Q �� [ � WDMClassesOfDriver FileIo_ReadWrite C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 N����
͝��C�y ! +/�Q �� V � WDMClassesOfDriver FileIo_Info C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 N����
͝��C�| $ +/�Q �� Y � WDMClassesOfDriver FileIo_DirEnum C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 N����
͝��C�z " +/�Q �� W � WDMClassesOfDriver FileIo_OpEnd C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 N����
͝��C�� * +/�Q �� _ � WDMClassesOfDriver FileIo_PathOperation C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 N����
͝��C�w +/�Q �� T � WDMClassesOfDriver FltIoInit C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 N����
͝��C�} % +/�Q �� Z � WDMClassesOfDriver FltIoCompletion C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 N����
͝��C�z " +/�Q �� W � WDMClassesOfDriver FltIoFailure C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 N����
͝��C�v +/�Q �� S � WDMClassesOfDriver TcpIp_V0 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 !N����
͝��C�� ) +/�Q �� ^ � WDMClassesOfDriver TcpIp_V0_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 "N����
͝��C�v +/�Q �� S � WDMClassesOfDriver TcpIp_V1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 #N����
͝��C�~ & +/�Q �� [ � WDMClassesOfDriver TcpIp_V1_Receive C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 $N����
͝��C�� ) +/�Q �� ^ � WDMClassesOfDriver TcpIp_V1_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 %N����
͝��C�� ) +/�Q �� ^ � WDMClassesOfDriver TcpIp_V1_TypeGroup2 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 &N����
͝��C�{ # +/�Q �� X � WDMClassesOfDriver TcpIp_V1_Fail C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 'N����
͝��C�{ # +/�Q �� X � WDMClassesOfDriver TcpIp_V1_Send C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 (N����
͝��C�� ) +/�Q �� ^ � WDMClassesOfDriver TcpIp_V1_TypeGroup3 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 )N����
͝��C�s +/�Q �� P � WDMClassesOfDriver TcpIp C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 *N����
͝��C�| $ +/�Q �� Y � WDMClassesOfDriver TcpIp_SendIPV4 C:\Windows\system32\kernelbase.dll[MofResourceName] e] C 3 C 9 A A 5 4 8 6 5 F 4 ,fN�� �
͝��C�� # t�A>��� b � WDMClassesOfDriver PoolAllocFree C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 2 ndows\system32\kernelbase.dll[MofResourceName] W��.� :Q��� �3W� �G�� VF� �g�� %Կ8 ���" �H��3
y9 9�^jJ m}�`M
��=�[ F@W c `���q g��Dw ��u� �lC�� {���� m�7� u (�
�@5�� ��ځ� �OZ�
nx��� �v�� u�?� zV+� 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 +N����
͝��C�~ & +/�Q �� [ � WDMClassesOfDriver TcpIp_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ,N����
͝��C�~ & +/�Q �� [ � WDMClassesOfDriver TcpIp_TypeGroup2 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 -N����
͝��C�x +/�Q �� U � WDMClassesOfDriver TcpIp_Fail C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 .N����
͝��C�| $ +/�Q �� Y � WDMClassesOfDriver TcpIp_SendIPV6 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 /N����
͝��C�~ & +/�Q �� [ � WDMClassesOfDriver TcpIp_TypeGroup3 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 0N����
͝��C�~ & +/�Q �� [ � WDMClassesOfDriver TcpIp_TypeGroup4 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 1N����
͝��C�v +/�Q �� S � WDMClassesOfDriver UdpIp_V0 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 2N����
͝��C�� ) +/�Q �� ^ � WDMClassesOfDriver UdpIp_V0_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 3N����
͝��C�v +/�Q �� S � WDMClassesOfDriver UdpIp_V1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 4N����
͝��C�� ) +/�Q �� ^ � WDMClassesOfDriver UdpIp_V1_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 5N����
͝��C�s +/�Q �� P � WDMClassesOfDriver UdpIp C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 6N����
͝��C�~ & +/�Q �� [ � WDMClassesOfDriver UdpIp_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 7N����
͝��C�x +/�Q �� U � WDMClassesOfDriver UdpIp_Fail C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 8N����
͝��C�~ & +/�Q �� [ � WDMClassesOfDriver UdpIp_TypeGroup2 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 9N����
͝��C�v +/�Q �� S � WDMClassesOfDriver Image_V0 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 :N����
͝��C�{ # +/�Q �� X � WDMClassesOfDriver Image_V0_Load C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ;N����
͝��C�v +/�Q �� S � WDMClassesOfDriver Image_V1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 <N����
͝��C�{ # +/�Q �� X � WDMClassesOfDriver Image_V1_Load C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 =N����
͝��C�v +/�Q �� S � WDMClassesOfDriver Image_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 >N����
͝��C�{ # +/�Q �� X � WDMClassesOfDriver Image_Load_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ?N����
͝��C�} % +/�Q �� Z � WDMClassesOfDriver KernelImageBase C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 @N����
͝��C�{ # +/�Q �� X � WDMClassesOfDriver HypercallPage C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 AN����
͝��C�~ & +/�Q �� [ � WDMClassesOfDriver LoaderBasicEvent C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 BN����
͝��C�} % +/�Q �� Z � WDMClassesOfDriver LoaderBaseEvent C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 CN����
͝��C�~ & +/�Q �� [ � WDMClassesOfDriver LoaderCodedEvent C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 DN����
͝��C�s +/�Q �� P � WDMClassesOfDriver Image C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 EN����
͝��C�x +/�Q �� U � WDMClassesOfDriver Image_Load C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 FN����
͝��C�� , +/�Q �� a � WDMClassesOfDriver LoaderCodedEventStatus C:\Windows\system32\kernelbase.dll[MofResourceName] me] OfDriver PageFault_HeapRangeDestroy C:\Windows\system32\kernelbase.dll[MofResourceName] rceName] ase.dll[MofResourceName] 241B524A3939652E49FA193A77939E65868511053C7856CA375F94BE.2669.2928240190.272 ndows\system32\kernelbase.dll[MofResourceName] t�|�� ��00� ��� �bɒ � ˡ
;r�x$ �Y��6 W��G �V�1b
⁝�y 2V� ���c�
M��J� �Z$�� �n��� GO � ��q� ��b 5 а�?> ����C ���L TzC�P w�n�T ��$:c ��l ILsx ��ȱ� 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 GN����
͝��C�� * +/�Q �� _ � WDMClassesOfDriver LoaderCodedEventPath C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 HN����
͝��C� ' +/�Q �� \ � WDMClassesOfDriver LoaderNewDllEvent C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 IN����
͝��C�� , +/�Q �� a � WDMClassesOfDriver LoaderDllSearchResults C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 JN����
͝��C�� - +/�Q �� b � WDMClassesOfDriver LoaderPathSearchResults C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 KN����
͝��C�z " +/�Q �� W � WDMClassesOfDriver PageFault_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 LN����
͝��C�� * +/�Q �� _ � WDMClassesOfDriver PageFault_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 MN����
͝��C�� ) +/�Q �� ^ � WDMClassesOfDriver PageFault_HardFault C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 NN����
͝��C�� 3 +/�Q �� h � WDMClassesOfDriver PageFault_HeapRangeRundown_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ON����
͝��C�� / +/�Q �� d � WDMClassesOfDriver PageFault_HeapRangeCreate C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 PN����
͝��C�� 2 +/�Q �� g � WDMClassesOfDriver PageFault_HeapRangeTypeGroup C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 QN����
͝��C�� 0 +/�Q �� e � WDMClassesOfDriver PageFault_HeapRangeDestroy C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 RN����
͝��C�� / +/�Q �� d � WDMClassesOfDriver PageFault_ImageLoadBacked C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 SN����
͝��C�� , +/�Q �� a � WDMClassesOfDriver PageFault_VirtualAlloc C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 TN����
͝��C�� 3 +/�Q �� h � WDMClassesOfDriver PageFault_VirtualAllocRundown C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 UN����
͝��C�� - +/�Q �� b � WDMClassesOfDriver PageFault_VirtualRotate C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 VN����
͝��C�� ( +/�Q �� ] � WDMClassesOfDriver PageFault_MemReset C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 WN����
͝��C�w +/�Q �� T � WDMClassesOfDriver PageFault C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 XN����
͝��C�� 0 +/�Q �� e � WDMClassesOfDriver PageFault_HeapRangeRundown C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 YN����
͝��C�y ! +/�Q �� V � WDMClassesOfDriver PerfInfo_V0 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ZN����
͝��C�u +/�Q �� R � WDMClassesOfDriver Mark_V0 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 [N����
͝��C�y ! +/�Q �� V � WDMClassesOfDriver PerfInfo_V1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 \N����
͝��C�t +/�Q �� Q � WDMClassesOfDriver ISR_V1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ]N����
͝��C�t +/�Q �� Q � WDMClassesOfDriver DPC_V1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ^N����
͝��C� ' +/�Q �� \ � WDMClassesOfDriver SampledProfile_V1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 _N����
͝��C�y ! +/�Q �� V � WDMClassesOfDriver PerfInfo_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 `N����
͝��C�| $ +/�Q �� Y � WDMClassesOfDriver SampledProfile C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 aN����
͝��C� ' +/�Q �� \ � WDMClassesOfDriver PmcCounterProfile C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 bN����
͝��C�� / +/�Q �� d � WDMClassesOfDriver SampledProfileInterval_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] 939E65868511053C7856CA375F94BE.2669.2928240190.272 ndows\system32\kernelbase.dll[MofResourceName] ��� P " ��H�r
�
� .
a�YV� S Q L T r a c e E v e n t 1 9 4 �P��7 �� f SQLTraceEvent194 6 � �� % G R a d u + < � � - ; � � j y � � b l % � � \ g ! � � � � N \
�
�
R X � � < F �
UUUUU�������������������������������������������������������������������������������������������������w
� SQLTraceEvent194_TYPE0 Description OLEDB Provider Information Type0 EventType EventTypeName 0 ApplicationName P
� � � � � " � �� string WmiDataId Description ApplicationName format w StringTermination Counted ClientProcessID 6
� � � � � � �� sint32 WmiDataId Description ClientProcessID DatabaseID 6
� ! � �� sint32 WmiDataId Description DatabaseID DatabaseName 8 P
� � �
� � � � � � � �� string WmiDataId Description DatabaseName format w StringTermination Counted EventClass 4 6
� > F Q ^ � �� sint32 WmiDataId Description EventClass EventSequence L 6
� � � � � � �� sint64 WmiDataId Description EventSequence GroupID \ 6
� 9 A L Y � �� sint32 WmiDataId Description GroupID HostName P
� � � � � � � � � �� string WmiDataId Description HostName format w StringTermination Counted IsSystem T 6
� i q | � � �� sint32 WmiDataId Description IsSystem LinkedServerName @ P
� # 5 = @ S � �� string WmiDataId Description LinkedServerName format w StringTermination Counted LoginName $ P
� � � � � � � � � �� string WmiDataId Description LoginName format w StringTermination Counted LoginSid
< P
� � � � � � � � � �� string WmiDataId Description LoginSid format c StringTermination Counted NTDomainName P
� < D O \ j r u � � �� string WmiDataId Description NTDomainName format w StringTermination Counted NTUserName P
� � ' / 2 E � �� string WmiDataId Description NTUserName format w StringTermination Counted ProviderName D P
� � � � � � � �
� �� string WmiDataId Description ProviderName format w StringTermination Counted RequestID H 6
� ^
f
q
~
� �� sint32 WmiDataId Description RequestID SessionLoginName X P
� �
+ 3 6 I � �� string WmiDataId Description SessionLoginName format w StringTermination Counted SPID ( 6
� � �
� � � �� sint32 WmiDataId Description SPID StartTime
, 6
� $ 1 � �� uint64 WmiDataId Description StartTime TextData P
� � � � � � � � � � �� string WmiDataId Description TextData format w StringTermination Counted TransactionID 6
� H
P
[
h
� �� sint64 WmiDataId Description TransactionID � M S S Q L S E R V E R T r a c e �P��7 �� MSSQLSERVERTrace 6 � �� + 1 W d p � SQLTraceEvent195 Description Mount Tape Guid 84e993e6-00c3-4d70-97ef-3824ed2c4e93 DisplayName Mount Tape p � S Q L T r a c e E v e n t 1 9 5 �P��7 �� a SQLTraceEvent195 6 � �� % 7 B Q T e , � � + � � V _ � � H W � � L U � � { � � � � � o { , > � � e
p
�
�
UUUU��������������������������������������������������������������������������������������������� � SQLTraceEvent195_TYPE0 Description Mount Tape Type0 EventType EventTypeName 0 ApplicationName P
� � � � � � � � � �� string WmiDataId Description ApplicationName format w StringTermination Counted ClientProcessID 6
� p x � � � �� sint32 WmiDataId Description ClientProcessID DatabaseID 6
� � � � �� sint32 WmiDataId Description DatabaseID DatabaseName D P
� � � � � � � � � � �� string WmiDataId Description DatabaseName format w StringTermination Counted Duration $ 6
� , 4
? L � �� sint64 WmiDataId Description Duration EndTime 4 6
� � � � � � �� uint64 WmiDataId Description EndTime EventClass
@ 6
� $ / < � �� sint32 WmiDataId Description EventClass EventSequence H 6
� � � � � � �� sint64 WmiDataId Description EventSequence EventSubClass < 6
� %
0 = � �� sint32 WmiDataId Description EventSubClass GroupID X 6
� � � � � � �� sint32 WmiDataId Description GroupID HostName P
� * 2 = J T \ _ r � �� string WmiDataId Description HostName format w StringTermination Counted IsSystem P 6
� � � � � � �� sint32 WmiDataId Description IsSystem LoginName P
� \ d o | � � � � � �� string WmiDataId Description LoginName format w StringTermination Counted NTDomainName P
� " - : H P S f � �� string WmiDataId Description NTDomainName format w StringTermination Counted NTUserName P
� � � � �
# � �� string WmiDataId Description NTUserName format w StringTermination Counted SessionLoginName T P
� � � � � � � � � � �� string WmiDataId Description SessionLoginName format w StringTermination Counted SPID 6
� ?
G
R
_
� �� sint32 WmiDataId Description SPID StartTime
, 6
� �
�
�
�
� �� uint64 WmiDataId Description StartTime TextData P
� G O Z g q y | � � �� string WmiDataId Description TextData format w StringTermination Counted � M S S Q L S E R V E R T r a c e �P��7 �� MSSQLSERVERTrace 6 � �� . 4 Z g v � SQLTraceEvent196 Description Assembly Load Guid 84e993e6-00c4-4d70-97ef-3824ed2c4e93 DisplayName Assembly Load � �oad � �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�~ & �\>�S}� [ � WDMClassesOfDriver DebugPrint_Event C:\Windows\system32\kernelbase.dll[MofResourceName] urceName] Name] sY �p � Ŏ�B
F ��8� � �H��0 � &�s�� � ����� �wR|�C�� C ) O ��Z b j s � � z � + � � � � i � � { � % � � r � � � � � � l
w
& / UUUU���������������������������������������������������������������� � DnsClientNrptRule Description DNS Client Name Resolution Policy Table Entry AMENDMENT LOCALE MS_409 Comment :
� � � � string Description A user friendly description of the current rule. DirectAccessDnsServers
� * 2 ? string Description The DNS servers which will be queried when DA is enabled. DirectAccessEnabled
� � � � boolean Description Property which identifies if DirectAccess is enabled on the rule. DirectAccessProxyName .
� W _ l string Description The proxy server to be used when connecting to the Internet. DirectAccessProxyType
* +
� � R Z string Description The proxy server type to be used when connecting to the Internet. Values j s NoProxy UseDefault UseProxyName DirectAccessQueryIPsecEncryption & +
� � � � 4 < string Description Property to control IPsec tunnel encryption settings. Values P V [ c None Low Medium High DirectAccessQueryIPsecRequired $
� � � � boolean Description Property to tunnel DNS queries over IPsec channel. DisplayName
� 8 @ M string Description An optional friendly name for the NRPT rule. DnsSecEnabled
� � � � boolean Description Property which identifies if DNSSEC is enabled on the rule. DnsSecQueryIPsecEncryption +
� ^ f s � � string Description Property to control IPsec tunnel encryption settings. Values � � � � None Low Medium High DnsSecQueryIPsecRequired
� % . ; boolean Description Property to tunnel DNSSEC queries over IPsec channel. DnsSecValidationRequired
� � � � boolean Description Property to enable AD bit check on DNS responses. IPsecCARestriction
� A I V string Description Certification authority to validate the IPsec channel. Name
� � � � string Description Name which uniquely identifies a rule. NameEncoding 6 +
� D L Y � � string Description Encoding format for host names in the DNS query. Values � � � � Disable Utf8WithMapping Utf8WithoutMapping Punycode NameServers 2
�
-
string Description The DNS servers the DNS query is sent to when DA is disabled. Namespace
� �
�
�
string Description DNS namespace which can be a Suffix/Prefix/FQDN/Subnet/Any.In order to specify Any, the value must be .(dot) Version
� [ c p uint32 Description The version for Name Resolution Policy Table entry. � �wR|�C�. < ) + L ��W _ g � � > U � � � � � � ! ; � � � �
' � � z � � � b o +
D
UUUU��������������������������������������������������������0 � DnsClientPolicyConfiguration Description DNS Client Policy Configuration AMENDMENT LOCALE MS_409 DirectAccessDnsServers $
� � � � string Description The DNS servers which will be queried when DirectAccess is enabled. DirectAccessEnabled
� F O \ boolean Description Property which identifies if DirectAccess is enabled. DirectAccessIPsecCARestriction
� � � � string Description Certificattion authority to validate the IPsec channel for DirectAccess. DirectAccessProxyName
,
� � � � string Description The proxy server to be used when connecting to the Internet. DirectAccessProxyType ( +
� $ , 9 | � string Description The proxy server type to be used when connecting to the Internet. Values � � � � Direct UseDefault UseProxyName NoProxy DirectAccessQueryIPsecEncryption
+
� & 3 ] e string Description IPsec encryption level for DirectAccess. Values y � � None Low Medium High DirectAccessQueryIPsecRequired
� � � � boolean Description Whether IPsec is required for DirectAccess. DnsSecIPsecCARestriction
� g o | string Description Certification authority to validate the IPsec channel for DNSSEC. DnsSecQueryIPsecEncryption +
� ) M U string Description IPsec encryption level for DNSSEC. Values i o t | None Low Medium High DnsSecQueryIPsecRequired
� � � � boolean Description Whether IPsec is required for DNSSEC queries. DnsSecValidationRequired
� S \ i boolean Description Whether DNSSEC validation is required or not. NameEncoding 4 +
� � � � & . string Description Encoding format for host names in the DNS query. Values B K \ p Disable Utf8WithMapping Utf8WithoutMapping Punycode NameServers 0
� � � � string Description Generic DNS Servers Namespace
� ) string Description DNS namespace which can be a Suffix/Prefix/FQDN/Subnet. QueryPolicy +
� � � � � � string Values � � � Disable QueryIPv6Only QueryBoth Description Property for controlling DNS client query policy. SecureNameQueryFallback
+
� }
�
�
�
�
string Values �
�
�
�
Disable FallbackSecure FallbackUnsecure FallbackPrivate Description Property for controlling DNS client name resolution fallback policy. �
C I M _ L o g R e c o r d �wR|�C�v : CIM_LogRecord ) ! � ��� � ����������������������������������������������������������� � MSFT_PCSVLogRecord Description The LogRecord object can describe the definitional format for entries in a MessageLog, or can be used to instantiate the actual records in the Log. The latter approach provides a great deal more semantic definition and management control over the individual entries in a MessageLog, than do the record manipulation methods of the Log class. It is recommended that the data in individual Log entries be modeled using subclasses of LogRecord, to avoid the creation of LogRecords with one property (such as RecordData) without semantics.
Definitional formats for LogRecords could be specified by establishing a naming convention for the RecordID and Message Timestamp key properties. AMENDMENT LOCALE MS_409 �6 4 6 5 9 A B 9 F 8 F 1 C 4 B 5 6 8 D B 6 4 3 8 B A E 1 1 B 2 6 E E 8 F 9 3 C B 5 F 8 1 9 5 E 2 1 E 8 C 3 8 3 D 6 C 4 4 C C 4 1 �wR|�C�ȝ��C�,
� __NAMESPACE MS_409 F D 1 C 1 D 4 1 4 B 7 1 B 5 0 8 2 C 2 6 6 A 6 5 0 E 3 1 E F 6 D 5 0 1 9 3 8 2 7 2 4 2 4 4 B 6 8 5 F 2 1 7 C 0 A A E 0 0 A 9 2 1 �wR|�C�Cȝ��C�$ � __SystemSecurity 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 T�n�^��
͝��C�� 2 J.3�� g � WDMClassesOfDriver MSNdis_FddiLongMulticastList C:\Windows\system32\kernelbase.dll[MofResourceName] e] me] �x�� ��ay�
�74� � ����= � ��(�� -
���
� =g�u�
?ٝ��C�� ) 6 C � �� � Y j u � � � � , A U����������������~ � MDM_EnterpriseModernAppManagement_EffectiveRelease03 InPartition K local-system DMWmiBridgeProv ChannelId '
� � � �� � string InstanceID
� � � �� string ParentID
� $ � �� string ReleaseManagementId '
� v � �� � string M � @ٝ��C�� ) : G � �� � ] n y � � � � 0 E U����������������� � MDM_EnterpriseModernAppManagement_ReleaseManagement01_01 InPartition O local-system DMWmiBridgeProv ChannelId '
� � � �� � �� string InstanceID
� � � �� string ParentID
� ( � �� string ReleaseManagementId '
� z � �� � �� string M � Bٝ��C�� 1 ) $ � �� � : K X � � � N ] � � � � # @ } � � � � W _ � � UUU����������������������������������������������� � MDM_HealthAttestation InPartition , local-system DMWmiBridgeProv Certificate 2
� � � �� � �� � string Octetstring CorrelationID '
� � � �� � string CurrentProtocolVersion " '
� F � �� � sint32 ForceRetrieve '
� � � �� � �� boolean HASEndpoint '
� � � �� � �� string InstanceID
� � �� string MaxSupportedProtocolVersion * '
� u � �� � sint32 Nonce '
� � � �� � �� string ParentID
� � � �� string PreferredMaxProtocolVersion
& '
� O � �� � �� sint32 Status '
� � � �� � sint32 TpmReadyStatus '
� � � �� � sint32 � 0 4 � � VerifyHealthMethod # �� implemented � ae442007200009F ROOT\cimv2\mdm\dmmap ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � Cٝ��C�u ) " � �� � 8 I U � � � � U���������� � MDM_PassportForWork InPartition * local-system DMWmiBridgeProv InstanceID
� � �� string ParentID
� � � �� string UseBiometrics '
� � �� � �� boolean it �
M S L S A T r a c e Pܝ��C� MSLSATrace C � �� 7 = e r � � � � EnumTrustedDoms Description EnumerateTrustedDomains Guid {2306fe37-dbf6-11d2-9244-006008269001} DisplayName EnumTrustedDoms locale MS\0x409 � >ٝ��C�� ) 6 C � �� � Y k w � � � � $ U��������������a � MDM_EnterpriseModernAppManagement_AppSettingPolicy04 InPartition K local-system DMWmiBridgeProv1 InstanceID
� � � �� string IsVariableLeaf
� � boolean ParentID
� � �� string Value '
� Y � �� � �� string � Aٝ��C�H ) 6 C � �� � Y k w � � � B L ~ � U���������������������� � MDM_EnterpriseModernAppManagement_StoreLicenses02_01 InPartition K local-system DMWmiBridgeProv1 InstanceID
� � � �� string LicenseCategory '
� � � �� � string LicenseUsage '
� : � �� � string ParentID
� v � �� string RequesterID '
� � � �� � string � . / � Ent � � � u � AddLicenseMethod ! �� implemented � WIN-F6NF7R6I6PJ ROOT\cimv2\mdm\dmmap ���� � �� �� * � ����� � __PARAMETERS abstract param string
� 1 In
� 1 X �� ID )
� � X ��� string __ �� WIN-F6NF7R6I6PJ ROOT\cimv2\mdm\dmmap ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � GetLicenseFromStoreMethod � �� implemented � WIN-F6NF7R6I6PJ ROOT\cimv2\mdm\dmmap ���� � �� �� * � ����� � __PARAMETERS abstract param string
� 1 In
� 1 X �� ID )
� � X ��� string __ �� WIN-F6NF7R6I6PJ ROOT\cimv2\mdm\dmmap ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � __ �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 g*pl\}�
͝��C�� + �\>�S}� ` � WDMClassesOfDriver MSNdis_HardwareStatus C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 h*pl\}�
͝��C�� + �\>�S}� ` � WDMClassesOfDriver MSNdis_MediaSupported C:\Windows\system32\kernelbase.dll[MofResourceName] lbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 h*pl\}�
͝��C�� + �\>�S}� ` � WDMClassesOfDriver MSNdis_MediaSupported C:\Windows\system32\kernelbase.dll[MofResourceName] base.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 h*pl\}�
͝��C�� + �\>�S}� ` � WDMClassesOfDriver MSNdis_MediaSupported C:\Windows\system32\kernelbase.dll[MofResourceName] 2\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 h*pl\}�
͝��C�� + �\>�S}� ` � WDMClassesOfDriver MSNdis_MediaSupported C:\Windows\system32\kernelbase.dll[MofResourceName] Name] sourceName] ernelbase.dll.mui[MofResourceName] � �A��
r�c� �̀� �g�t� 2���
��{%
& ޛ��! ��L6
K �K wd�h\ Q��o
�� � ��� ��?� ��"��
�u6� gb�@� D�%� �x� �Y�� @(�{& �ҀA< \��O 6��?` Su�'q
T�r�~ P;+^� 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�z " +/�Q �� W � WDMClassesOfDriver CritSecTrace C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�~ & +/�Q �� [ � WDMClassesOfDriver CritSecCollision C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�y ! +/�Q �� V � WDMClassesOfDriver CritSecInit C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�x +/�Q �� U � WDMClassesOfDriver Lost_Event C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�z " +/�Q �� W � WDMClassesOfDriver RT_LostEvent C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�} % +/�Q �� Z � WDMClassesOfDriver SystemConfig_V0 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�� ) +/�Q �� ^ � WDMClassesOfDriver SystemConfig_V0_CPU C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�� - +/�Q �� b � WDMClassesOfDriver SystemConfig_V0_PhyDisk C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�� - +/�Q �� b � WDMClassesOfDriver SystemConfig_V0_LogDisk C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�� ) +/�Q �� ^ � WDMClassesOfDriver SystemConfig_V0_NIC C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�� + +/�Q �� ` � WDMClassesOfDriver SystemConfig_V0_Video C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�� . +/�Q �� c � WDMClassesOfDriver SystemConfig_V0_Services C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�� + +/�Q �� ` � WDMClassesOfDriver SystemConfig_V0_Power C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�� ) +/�Q �� ^ � WDMClassesOfDriver SystemConfig_V0_IRQ C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�� ) +/�Q �� ^ � WDMClassesOfDriver SystemConfig_V0_PnP C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�} % +/�Q �� Z � WDMClassesOfDriver SystemConfig_V1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�� ) +/�Q �� ^ � WDMClassesOfDriver SystemConfig_V1_CPU C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�� - +/�Q �� b � WDMClassesOfDriver SystemConfig_V1_PhyDisk C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�� - +/�Q �� b � WDMClassesOfDriver SystemConfig_V1_LogDisk C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�� ) +/�Q �� ^ � WDMClassesOfDriver SystemConfig_V1_NIC C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�� + +/�Q �� ` � WDMClassesOfDriver SystemConfig_V1_Video C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�� . +/�Q �� c � WDMClassesOfDriver SystemConfig_V1_Services C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�� + +/�Q �� ` � WDMClassesOfDriver SystemConfig_V1_Power C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�� ) +/�Q �� ^ � WDMClassesOfDriver SystemConfig_V1_IRQ C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�� ) +/�Q �� ^ � WDMClassesOfDriver SystemConfig_V1_PnP C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�} % +/�Q �� Z � WDMClassesOfDriver SystemConfig_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�� ) +/�Q �� ^ � WDMClassesOfDriver SystemConfig_V2_CPU C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�� - +/�Q �� b � WDMClassesOfDriver SystemConfig_V2_PhyDisk C:\Windows\system32\kernelbase.dll[MofResourceName] _V2_NumaNode C:\Windows\system32\kernelbase.dll[MofResourceName] ourceName] �s�� �s�� ��/m� �}��� ��� �� �� ���i* hq �= ��QR ۪.�l
ۏ��} ��f�� ��
��
�[�c� ��ڞ� ��=�� �9h ��9 F��*-
ɱ�:
��
�G "��X ��ni ���S �K宐 �)`� w5n� �=~�
4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 t=�4 �
͝��C�� & 9� (D� h � WDMClassesOfDriver PerformanceState C:\Windows\System32\drivers\en-US\processr.sys.mui[PROCESSORWMI] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�� - +/�Q �� b � WDMClassesOfDriver SystemConfig_V2_LogDisk C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�� ) +/�Q �� ^ � WDMClassesOfDriver SystemConfig_V2_NIC C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�� + +/�Q �� ` � WDMClassesOfDriver SystemConfig_V2_Video C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�� . +/�Q �� c � WDMClassesOfDriver SystemConfig_V2_Services C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�� + +/�Q �� ` � WDMClassesOfDriver SystemConfig_V2_Power C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�� - +/�Q �� b � WDMClassesOfDriver SystemConfig_V2_Network C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�� 2 +/�Q �� g � WDMClassesOfDriver SystemConfig_V2_OpticalMedia C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�� ) +/�Q �� ^ � WDMClassesOfDriver SystemConfig_V2_IRQ C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�� ) +/�Q �� ^ � WDMClassesOfDriver SystemConfig_V2_PnP C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�� 0 +/�Q �� e � WDMClassesOfDriver SystemConfig_V2_IDEChannel C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�� . +/�Q �� c � WDMClassesOfDriver SystemConfig_V2_NumaNode C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�� . +/�Q �� c � WDMClassesOfDriver SystemConfig_V2_Platform C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�� / +/�Q �� d � WDMClassesOfDriver SystemConfig_V2_ProcGroup C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�� 0 +/�Q �� e � WDMClassesOfDriver SystemConfig_V2_ProcNumber C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�� ) +/�Q �� ^ � WDMClassesOfDriver SystemConfig_V2_DPI C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�� 3 +/�Q �� h � WDMClassesOfDriver SystemConfig_V2_CodeIntegrity C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�} % +/�Q �� Z � WDMClassesOfDriver SystemConfig_V3 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�} % +/�Q �� Z � WDMClassesOfDriver SystemConfig_V4 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�� ) +/�Q �� ^ � WDMClassesOfDriver SystemConfig_V3_CPU C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�� ) +/�Q �� ^ � WDMClassesOfDriver SystemConfig_V3_IRQ C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�� . +/�Q �� c � WDMClassesOfDriver SystemConfig_V3_Services C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�� ) +/�Q �� ^ � WDMClassesOfDriver SystemConfig_V3_PnP C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�� 4 +/�Q �� i � WDMClassesOfDriver SystemConfig_V3_MobilePlatform C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�� ) +/�Q �� ^ � WDMClassesOfDriver SystemConfig_V4_PnP C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�� 4 +/�Q �� i � WDMClassesOfDriver SystemConfig_V4_MobilePlatform C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�z " +/�Q �� W � WDMClassesOfDriver SystemConfig C:\Windows\system32\kernelbase.dll[MofResourceName] 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ~�b��5�
͝��C�� + Բ���5� j � WDMClassesOfDriver SystemConfig_V2_Power C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] :\Windows\system32\kernelbase.dll[MofResourceName] RWMI] e] J)��� �'-r� #��� NL��
�Q��) .�n�C �ޖ�Z X�P r ��#�
���� <�F"� ��
_�
6� zd)� �#t��
cH�P� �%N�� r�Mg� fQ ���% �Ԫ �>7�& 5d��4 E9Y< s�awL
w���Y
���:f G<=zr 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�~ & +/�Q �� [ � WDMClassesOfDriver SystemConfig_PnP C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�� 3 +/�Q �� h � WDMClassesOfDriver SystemConfig_V2_TelemetryInfo C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�� , +/�Q �� a � WDMClassesOfDriver SystemConfig_V2_Defrag C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�� 4 +/�Q �� i � WDMClassesOfDriver SystemConfig_V2_MobilePlatform C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�� 2 +/�Q �� g � WDMClassesOfDriver SystemConfig_V2_DeviceFamily C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�� / +/�Q �� d � WDMClassesOfDriver SystemConfig_V2_FlightIds C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�� 0 +/�Q �� e � WDMClassesOfDriver SystemConfig_V2_Processors C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�� 1 +/�Q �� f � WDMClassesOfDriver SystemConfig_Virtualization C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C� ' +/�Q �� \ � WDMClassesOfDriver SystemConfig_Boot C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�v +/�Q �� S � WDMClassesOfDriver Debugger C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�~ & +/�Q �� [ � WDMClassesOfDriver DebugPrint_Event C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�w +/�Q �� T � WDMClassesOfDriver PoolTrace C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�{ # +/�Q �� X � WDMClassesOfDriver PoolAllocFree C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�� * +/�Q �� _ � WDMClassesOfDriver SessionPoolAllocFree C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�z " +/�Q �� W � WDMClassesOfDriver PoolSnapshot C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�u +/�Q �� R � WDMClassesOfDriver ObTrace C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�{ # +/�Q �� X � WDMClassesOfDriver ObHandleEvent C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�� , +/�Q �� a � WDMClassesOfDriver ObHandleDuplicateEvent C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�y ! +/�Q �� V � WDMClassesOfDriver ObTypeEvent C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�� * +/�Q �� _ � WDMClassesOfDriver ObHandleRundownEvent C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�{ # +/�Q �� X � WDMClassesOfDriver ObObjectEvent C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�~ & +/�Q �� [ � WDMClassesOfDriver ObReferenceEvent C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�x +/�Q �� U � WDMClassesOfDriver ThreadPool C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�� ( +/�Q �� ] � WDMClassesOfDriver ThreadPoolTrace_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�} % +/�Q �� Z � WDMClassesOfDriver TP_V2_CBEnqueue C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�} % +/�Q �� Z � WDMClassesOfDriver TP_V2_CBDequeue C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�| $ +/�Q �� Y � WDMClassesOfDriver TP_V2_CBCancel C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�� + +/�Q �� ` � WDMClassesOfDriver TP_V2_PoolCreateClose C:\Windows\system32\kernelbase.dll[MofResourceName] n � WDMClassesOfDriver SystemConfig_V2_FlightIds C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] ��(��
R ��� ���� ��"�� ��0� �R� �ڦ�6 �K~I
v��V
�1r_ T9* g �7�p
e#Iv S ����� ���I� N�R� ��ڧ
�58b� ��7� _��� ��H��
A_t� �1�
�l��� �;� �i]
8�|J 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�} % +/�Q �� Z � WDMClassesOfDriver TP_V2_ThreadSet C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�� ( +/�Q �� ] � WDMClassesOfDriver TP_V2_WTNodeSwitch C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�| $ +/�Q �� Y � WDMClassesOfDriver TP_V2_TimerSet C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�� * +/�Q �� _ � WDMClassesOfDriver TP_V2_TimerCancelled C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�� + +/�Q �� ` � WDMClassesOfDriver TP_V2_TimerSetNtTimer C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�� 0 +/�Q �� e � WDMClassesOfDriver TP_V2_TimerExpirationGroup C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�� + +/�Q �� ` � WDMClassesOfDriver TP_V2_TimerExpiration C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�} % +/�Q �� Z � WDMClassesOfDriver ThreadPoolTrace C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�y ! +/�Q �� V � WDMClassesOfDriver TPCBDequeue C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�x +/�Q �� U � WDMClassesOfDriver TPCBCancel C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�y ! +/�Q �� V � WDMClassesOfDriver WnfProvider C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�v +/�Q �� S � WDMClassesOfDriver WNFTrace C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�y ! +/�Q �� V � WDMClassesOfDriver WNFSubUnsub C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�y ! +/�Q �� V � WDMClassesOfDriver WNFCallback C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�x +/�Q �� U � WDMClassesOfDriver WNFPublish C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C� ' +/�Q �� \ � WDMClassesOfDriver WNFNameSubRundown C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�x +/�Q �� U � WDMClassesOfDriver MMCSSTrace C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�} % +/�Q �� Z � WDMClassesOfDriver MMCSS_TypeGroup C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�x +/�Q �� U � WDMClassesOfDriver MMCSSEvent C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�y ! +/�Q �� V � WDMClassesOfDriver MMCSSWakeup C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �N����
͝��C�v +/�Q �� S � WDMClassesOfDriver MuiTrace C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 O����
͝��C�z " +/�Q �� W � WDMClassesOfDriver MuiTraceData C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 O����
͝��C�� ) +/�Q �� ^ � WDMClassesOfDriver MuiTraceData_String C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 O����
͝��C�z " +/�Q �� W � WDMClassesOfDriver HV_Hypercall C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 O����
͝��C�v +/�Q �� S � WDMClassesOfDriver UmsEvent C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 O����
͝��C�� , +/�Q �� a � WDMClassesOfDriver UmsDirectedSwitchStart C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 O����
͝��C�� * +/�Q �� _ � WDMClassesOfDriver UmsDirectedSwitchEnd C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 O����
͝��C�~ & +/�Q �� [ � WDMClassesOfDriver UmsScheduledPark C:\Windows\system32\kernelbase.dll[MofResourceName] ase.dll.mui[MofResourceName] fResourceName] ofResourceName] \en-US\kernelbase.dll.mui[MofResourceName] ��F� }�wF� ����
��Í ����
H��l! ;�/ ���\@ ���
P
����e �4�nw �g, �
, �ޚ �M��� |��_� ���k� _���� ��[� �e�] �]�z F-// ��F ��� ] � � v
��� 9�1 � �%�v� �GA�� 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ]L����
͝��C�� + +/�Q �� ` � WDMClassesOfDriver MSVerifierIrpLogEntry C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ^L����
͝��C�� 1 +/�Q �� f � WDMClassesOfDriver MSVerifierIrpLogInformation C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 O����
͝��C�} % +/�Q �� Z � WDMClassesOfDriver UmsDisassociate C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 O����
͝��C�~ & +/�Q �� [ � WDMClassesOfDriver UmsContextSwitch C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 O����
͝��C�z " +/�Q �� W � WDMClassesOfDriver MSTapeDriver C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4
O����
͝��C�~ & +/�Q �� [ � WDMClassesOfDriver MSTapeDriveParam C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 O����
͝��C�� ) +/�Q �� ^ � WDMClassesOfDriver MSTapeMediaCapacity C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 O����
͝��C�� ( +/�Q �� ] � WDMClassesOfDriver MSTapeSymbolicName C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4
O����
͝��C�� - +/�Q �� b � WDMClassesOfDriver MSTapeDriveProblemEvent C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 O����
͝��C�� * +/�Q �� _ � WDMClassesOfDriver MSTapeProblemIoError C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 O����
͝��C�� . +/�Q �� c � WDMClassesOfDriver MSTapeProblemDeviceError C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 O����
͝��C�} % +/�Q �� Z � WDMClassesOfDriver MSChangerDriver C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 O����
͝��C�� ) +/�Q �� ^ � WDMClassesOfDriver MSChangerParameters C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 O����
͝��C�� + +/�Q �� ` � WDMClassesOfDriver MSChangerProblemEvent C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 O����
͝��C�� 1 +/�Q �� f � WDMClassesOfDriver MSChangerProblemDeviceError C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 O����
͝��C�x +/�Q �� U � WDMClassesOfDriver MSDeviceUI C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 O����
͝��C�� 1 +/�Q �� f � WDMClassesOfDriver MSDeviceUI_FirmwareRevision C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 O����
͝��C�| $ +/�Q �� Y � WDMClassesOfDriver MSMonitorClass C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 O����
͝��C�� * +/�Q �� _ � WDMClassesOfDriver WmiMonitorBrightness C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 O����
͝��C�� 1 +/�Q �� f � WDMClassesOfDriver WmiMonitorBrightnessMethods C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 O����
͝��C�� / +/�Q �� d � WDMClassesOfDriver WmiMonitorBrightnessEvent C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 O����
͝��C�� / +/�Q �� d � WDMClassesOfDriver WmiMonitorRawEEdidV1Block C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 O����
͝��C�� 1 +/�Q �� f � WDMClassesOfDriver WmiMonitorDescriptorMethods C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 O����
͝��C�z " +/�Q �� W � WDMClassesOfDriver WmiMonitorID C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 O����
͝��C�� 8 +/�Q �� m � WDMClassesOfDriver WmiMonitorSupportedDisplayFeatures C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 O����
͝��C�� 2 +/�Q �� g � WDMClassesOfDriver WmiMonitorBasicDisplayParams C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 O����
͝��C�� 0 +/�Q �� e � WDMClassesOfDriver WmiMonitorConnectionParams C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 O����
͝��C�� 6 +/�Q �� k � WDMClassesOfDriver WmiMonitorAnalogVideoInputParams C:\Windows\system32\kernelbase.dll[MofResourceName] \`�` �b� v z j�N��
� ����� �V�� � - X e S q l P k g _ c o l u m n s t o r e _ c o l u m n _ s e g m e n t _ o p e r a t i o n %[��7 �� R 7 XeSqlPkg_columnstore_column_segment_operation / ) � ��& 1 ? K � J W � � & p z � � % �
T _ ! k � � � R _ � � � � �
WUUU�����������������������������������������������������������������������������M
� columnstore_column_segment_operation EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid column_id A )
� 7 ? � �� uint32 WmiDataId database_id )
� � � � �� uint16 WmiDataId FragmentId 6
� � � � �� uint32 WmiDataId Description FragmentId hobt_id " )
� ] e � �� uint64 WmiDataId index_id )
� � � � �� uint32 WmiDataId is_in_memory 2 )
� � �� uint8 WmiDataId lop_type = P
� � � � ��� � � � � � uint32 WmiDataId XEMapId ValueMap � � � � 0 3 2 1 Values � � � � ACTION LAST REDO UNDO object_id )
� A I � �� sint32 WmiDataId operation P
� � � � ��� � � � u } uint32 WmiDataId XEMapId ValueMap 3 7 ; ? C G K N Q U Y \ _ b e i l o r 12 14 13 15 17 16 7 9 11 10 8 0 2 1 18 5 6 3 4 Values � � / F ] o � � � � � � � � � � CSI_COLUMN_SEGMENT_ADD CSI_COLUMN_SEGMENT_DELETE CSI_COLUMN_SEGMENT_UPDATE CSI_DICTIONARY_ADD CSI_DICTIONARY_DELETE CSI_DICTIONARY_UPDATE CSI_ROWGROUP_ADD CSI_ROWGROUP_DELETE CSI_ROWGROUP_MERGE_END CSI_ROWGROUP_MERGE_START CSI_ROWGROUP_UPDATE ADD ALTER DROP LAST MARK_FOR_REFRESH RECOVERY SHARE UNSHARE partition_number
* )
� X `
� �� uint64 WmiDataId primary_dictionary_id E )
� � � � �� sint32 WmiDataId RemainingLength 6
� ! ) 4 A � �� uint32 WmiDataId Description RemainingLength rowgroup_id 9 )
� � � � �� uint32 WmiDataId secondary_dictionary_id I )
� � � �� sint32 WmiDataId SequenceNumber 6
� ` h s � � �� uint32 WmiDataId Description SequenceNumber transaction_id_high 3 )
� � � � �� uint16 WmiDataId transaction_id_low
5 )
� :
B
� �� uint32 WmiDataId � X e S q l P k g &[��7 �R XeSqlPkg
C � ��+ 8 t z � � � � c����� � XeSqlPkg_columnstore_dictionary_operation Description A metadata operation occurred on a columnstore dictionary. Guid {E0196CBA-E4E4-4DD3-A7E1-2331F2A4097F} locale MS\0x409 DisplayName columnstore_dictionary_operation �) X e S q l P k g _ c o l u m n s t o r e _ d i c t i o n a r y _ o p e r a t i o n '[��7 �� O 3 XeSqlPkg_columnstore_dictionary_operation + ) � ��" - ; G � � F S � � � r { � � ' p � � � � � � � 1 � � �
� � � � WUUU��������������������������������������������������������������������������>
� columnstore_dictionary_operation EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid column_id A )
� 3 ; � �� uint32 WmiDataId database_id )
� � � � �� uint16 WmiDataId dictionary_id F )
� � � � �� uint32 WmiDataId FragmentId 6
� F N Y f � �� uint32 WmiDataId Description FragmentId hobt_id " )
� � � � �� uint64 WmiDataId index_id )
� � �� uint32 WmiDataId is_in_memory 2 )
� ^ e � �� uint8 WmiDataId is_primary_dictionary E )
� � � � �� sint8 WmiDataId lop_type = P
� 8 @ � ��K � T ^ ~ � uint32 WmiDataId XEMapId ValueMap r u x { 0 3 2 1 Values � � � � ACTION LAST REDO UNDO object_id )
� � � � �� sint32 WmiDataId operation P
� r z � ��� � � � * 2 uint32 WmiDataId XEMapId ValueMap � � � � � �
! $ ' 12 14 13 15 17 16 7 9 11 10 8 0 2 1 18 5 6 3 4 Values � � � � � � $ 9 Q k � � � � � � � � CSI_COLUMN_SEGMENT_ADD CSI_COLUMN_SEGMENT_DELETE CSI_COLUMN_SEGMENT_UPDATE CSI_DICTIONARY_ADD CSI_DICTIONARY_DELETE CSI_DICTIONARY_UPDATE CSI_ROWGROUP_ADD CSI_ROWGROUP_DELETE CSI_ROWGROUP_MERGE_END CSI_ROWGROUP_MERGE_START CSI_ROWGROUP_UPDATE ADD ALTER DROP LAST MARK_FOR_REFRESH RECOVERY SHARE UNSHARE partition_number
* )
�
� �� uint64 WmiDataId RemainingLength 6
� u } � � � �� uint32 WmiDataId Description RemainingLength rowgroup_id 9 )
� � � � �� sint32 WmiDataId SequenceNumber 6
� Q Y d q � �� uint32 WmiDataId Description SequenceNumber transaction_id_high 3 )
� � � � �� uint16 WmiDataId transaction_id_low
5 )
� +
3
� �� uint32 WmiDataId � X e S q l P k g ([��7 �� XeSqlPkg
C � ��= J � � # - : c����n � XeSqlPkg_columnstore_compress_rowgroup_to_minimize_log_size Description Fired at the end of bulk loads by each worker thread when there have been row groups not flushed as delta store in an attempt to minimize the reserved log space. Guid {764434B7-BABE-4018-8B03-1CB4333A262F} locale MS\0x409 DisplayName columnstore_compress_rowgroup_to_minimize_log_size � X e S q l P k g *[��7 �[ XeSqlPkg
C � ��6 C r x � � � � c����� � XeSqlPkg_columnstore_test_rowgroup_ids_snapshot_done Description Rowgroup ids has been enumerated during scan. Guid {C7D21547-D12E-4DB0-83CC-C54BE1B7CC6C} locale MS\0x409 DisplayName columnstore_test_rowgroup_ids_snapshot_done �one �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�} % �\>�S}� Z � WDMClassesOfDriver MSChangerDriver C:\Windows\system32\kernelbase.dll[MofResourceName] ase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�} % �\>�S}� Z � WDMClassesOfDriver MSChangerDriver C:\Windows\system32\kernelbase.dll[MofResourceName] sourceName] eName] __ � �� +�T�� # ���� #d� n-M=/ �JaD? �� ] s�N�y �� ��
?<� ��!� �Q�=�
`�jU� ǂ� +��! h<@ k��\ ���x| �.� � ��� -W� # ����� ժ� # �on�# M=~C9 � �U # ��`�x 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/pl\}�
͝��C�� + ��
�S}� j � WDMClassesOfDriver MSVerifierIrpLogEntry C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/pl\}�
͝��C�� 1 ��
�S}� p � WDMClassesOfDriver MSVerifierIrpLogInformation C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 V2pl\}�
͝��C�� ) ��
�S}� h � WDMClassesOfDriver MuiTraceData_String C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 W2pl\}�
͝��C�� " ��
�S}� a � WDMClassesOfDriver HV_Hypercall C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 X2pl\}�
͝��C�� ��
�S}� ] � WDMClassesOfDriver UmsEvent C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 Y2pl\}�
͝��C�� , ��
�S}� k � WDMClassesOfDriver UmsDirectedSwitchStart C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 Z2pl\}�
͝��C�� * ��
�S}� i � WDMClassesOfDriver UmsDirectedSwitchEnd C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 [2pl\}�
͝��C�� & ��
�S}� e � WDMClassesOfDriver UmsScheduledPark C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 \2pl\}�
͝��C�� % ��
�S}� d � WDMClassesOfDriver UmsDisassociate C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ]2pl\}�
͝��C�� & ��
�S}� e � WDMClassesOfDriver UmsContextSwitch C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ^2pl\}�
͝��C�� " ��
�S}� a � WDMClassesOfDriver MSTapeDriver C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 _2pl\}�
͝��C�� & ��
�S}� e � WDMClassesOfDriver MSTapeDriveParam C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 `2pl\}�
͝��C�� ) ��
�S}� h � WDMClassesOfDriver MSTapeMediaCapacity C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 a2pl\}�
͝��C�� ( ��
�S}� g � WDMClassesOfDriver MSTapeSymbolicName C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 b2pl\}�
͝��C�� - ��
�S}� l � WDMClassesOfDriver MSTapeDriveProblemEvent C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 c2pl\}�
͝��C�� * ��
�S}� i � WDMClassesOfDriver MSTapeProblemIoError C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 d2pl\}�
͝��C�� . ��
�S}� m � WDMClassesOfDriver MSTapeProblemDeviceError C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 e2pl\}�
͝��C�� % ��
�S}� d � WDMClassesOfDriver MSChangerDriver C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 f2pl\}�
͝��C�� ) ��
�S}� h � WDMClassesOfDriver MSChangerParameters C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 g2pl\}�
͝��C�� + ��
�S}� j � WDMClassesOfDriver MSChangerProblemEvent C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 h2pl\}�
͝��C�� 1 ��
�S}� p � WDMClassesOfDriver MSChangerProblemDeviceError C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 i2pl\}�
͝��C�� ��
�S}� _ � WDMClassesOfDriver MSDeviceUI C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 j2pl\}�
͝��C�� 1 ��
�S}� p � WDMClassesOfDriver MSDeviceUI_FirmwareRevision C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 k2pl\}�
͝��C�� $ ��
�S}� c � WDMClassesOfDriver MSMonitorClass C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 l2pl\}�
͝��C�� * ��
�S}� i � WDMClassesOfDriver WmiMonitorBrightness C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 m2pl\}�
͝��C�� 1 ��
�S}� p � WDMClassesOfDriver WmiMonitorBrightnessMethods C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 6O����
͝��C�� / +/�Q �� d � WDMClassesOfDriver KernelThermalPolicyChange C:\Windows\system32\kernelbase.dll[MofResourceName] esourceName] se.dll.mui[MofResourceName] ms C:\Windows\system32\kernelbase.dll[MofResourceName] -�/�� �h��� J �� * �~� ���M7 7�0#S t��k K -�j�� 9�}�C�{ � $ 1 D � UserSettings UserSettingsProvider Description The user settings � Se sPr � The % � � j } � � �
� � n � � RestoreByTemplateId ' < ��I ��Q ^ Implemented Static Description Restore users' application and Windows settings back to the original settings state. Z a42c9160500003S ROOT\Microsoft\UEV ���� � �� �� > � * � ��������B � __PARAMETERS abstract TemplateId string
� 6 In
� 6 ] �� Template ID Description )
� 6 ] ��� � ID 6
� $ ] ��� � � string RestoreType uint32
� K In
� K r �� Restore Type Description )
� K r ��� � ID 6
� : r ��� � � uint32 __ � ExportPackage ' L ��Y ��a n Implemented Static Description Export a settings package file to a XML file listing all the settings in the package. a42c9160500003S ROOT\Microsoft\UEV ���� � �� �� *
����V � __PARAMETERS abstract AbsolutePathToPackage string
� A In
� A h �� Absolute path to the settings package file Description )
� A h ��� � ID 6
� N h ��� � string __ �� a42c9160500003S ROOT\Microsoft\UEV ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue string
� ^ string out
� ^ f �� __ � GetPackageVersion ' � ��� ��� � Implemented Static Description Get the version of a settings package. a42c9160500003S ROOT\Microsoft\UEV ���� � �� �� *
����V � __PARAMETERS abstract AbsolutePathToPackage string
� A In
� A h �� Absolute path to the settings package file Description )
� A h ��� � ID 6
� N h ��� � string __ �� a42c9160500003S ROOT\Microsoft\UEV ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � IsUserMsaConnected ' � ��� ��� � Implemented Static Description Check if the user live ID is connected. � a42c9160500003S ROOT\Microsoft\UEV ���� � �( �� * m ��� � __PARAMETERS abstract ReturnValue boolean
� _ Boolean out
� _ h �� __ � RestoreBackup ' � ��� ��� � Implemented static Description Restores the backup packages from another machine. Returns false if a restore is already pending, true otherwise a42c9160500003S ROOT\Microsoft\UEV ���� � �� �� * ����_ � __PARAMETERS abstract ComputerName string
� 8 In
� 8 _ �� Fully qualified computer name from which to restore packages Description )
� 8 _ ��� � ID 6
� W _ ��� � string __ �� a42c9160500003S ROOT\Microsoft\UEV ���� � �( �� * m ��� � __PARAMETERS abstract ReturnValue boolean
� _ Boolean out
� _ h �� __ �5 7 E 5 F 3 A D D 9 E 2 4 2 C 4 E 9 F 9 E D F 7 9 A A 9 7 F 7 9 E 7 9 1 1 C 5 A 8 B 9 0 2 E C 1 5 0 D 6 4 4 2 E 3 B 8 5 A 5 A A :�}�C�ȝ��C�� ���9 X � __Win32Provider {D4950C79-806D-4ECE-9DB1-11B34D33F514} ComputerConfigurationProvider E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C ;�}�C� ȝ��C�� �� ���� �� m � __InstanceProviderRegistration \\.\root\Microsoft\UEV:__Win32Provider.Name="ComputerConfigurationProvider" R O O T \ M i c r o s o f t \ U E V _ _ I n s t a n c e P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 5 9 4 1 1 6 5 5 A 8 F 9 5 E E 7 B E A B D F B 8 9 8 8 6 1 D F A 8 E 2 B F 2 3 2 9 3 A 8 A F E 9 6 B 2 E 5 B B 2 3 6 E 7 F E 0 1 \ K I _ E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C \ I _ 1 2 F 9 C 4 5 C 6 3 3 D 9 A 3 5 E A D 4 B 2 1 8 3 1 2 6 9 F 9 2 F 0 6 6 A 3 C 0 4 F A 0 0 0 6 0 4 B B F D B 6 7 F 8 7 B F 6 A C __ � R O O T \ M i c r o s o f t \ U E V _ _ I n s t a n c e P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 5 9 4 1 1 6 5 5 A 8 F 9 5 E E 7 B E A B D F B 8 9 8 8 6 1 D F A 8 E 2 B F 2 3 2 9 3 A 8 A F E 9 6 B 2 E 5 B B 2 3 6 E 7 F E 0 1 \ K I _ E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C \ I _ 6 A B 4 C 2 6 A 7 6 8 D B A D 9 7 2 0 2 3 0 7 5 B D 6 1 5 0 6 6 6 0 6 2 8 C C A 5 9 7 0 C 8 9 9 2 F 7 0 E F 5 A A 2 F 9 3 2 C 9 __ � R O O T \ M i c r o s o f t \ U E V _ _ M e t h o d P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 5 9 4 1 1 6 5 5 A 8 F 9 5 E E 7 B E A B D F B 8 9 8 8 6 1 D F A 8 E 2 B F 2 3 2 9 3 A 8 A F E 9 6 B 2 E 5 B B 2 3 6 E 7 F E 0 1 \ K I _ 7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D \ I _ F B F 5 0 E 9 B 0 5 7 9 9 D A 2 F 0 7 A 7 9 2 0 2 B 0 E 7 B 5 3 E 9 C 0 7 3 4 9 C E 7 F 1 C 4 1 4 4 8 3 2 6 1 C 3 3 3 3 3 9 0 9 `�{� I s a p i _ T r a n s >�4 �
Isapi_Trans
) � �� + 6 _������������� � W3ISAPIEnd EventType EventLevel ContextId
A
� � � � � � �� � �� object WmiDataId extension Guid ActivityID �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 U�n�^��
͝��C�� 4 J.3�� i � WDMClassesOfDriver MSNdis_FddiLongMaximumListSize C:\Windows\system32\kernelbase.dll[MofResourceName] � ��F�� f�~� � ���k6 � ^��E� r d�YP) � �#@� � Z|?q n > X e S q l P k g _ c o l u m n s t o r e _ o b j e c t _ r e a d _ f r o m _ a z u r e _ b l o c k _ b l o b _ f a i l u r e _[��7 �� K H XeSqlPkg_columnstore_object_read_from_azure_block_blob_failure @ ) � ��7 B
P \ | � � � ) 0 z � � � L U � � � K X > O � � WUU������������������������������������������������������������������������H � columnstore_object_read_from_azure_block_blob_failure EventType EventVersion ActivityId
N
� � � � � � �� � ��� object:guid WmiDataId Description ActivityId ActivityID Extension Guid blob_id
C 6
� S `
� ��k v object:guid WmiDataId Extension Guid column_id & )
� � � � �� uint64 WmiDataId container_id
6 )
�
� �� uint64 WmiDataId db_id )
� g o � �� uint16 WmiDataId error_code > )
� � � � �� uint32 WmiDataId FragmentId 6
� ( 3 @ � �� uint32 WmiDataId Description FragmentId hobt_id )
� � � � �� uint64 WmiDataId object_id )
� � � � �� uint64 WmiDataId object_size . )
� 8 @ � �� uint64 WmiDataId object_type B P
� � � � ��� e � � uint8 WmiDataId XEMapId ValueMap � 1 5 6 7 8 2 4 0 Values C S y � � � 3 COLUMN_SEGMENT COLUMN_SEGMENT_BULKINSERT_DICTIONARY COLUMN_SEGMENT_DELETE_BITMAP COLUMN_SEGMENT_EXTENDED_STRING_PAGE_RANGE COLUMN_SEGMENT_GLOBAL_STRING_DICTIONARY COLUMN_SEGMENT_PRIMARY_DICTIONARY COLUMN_SEGMENT_SECONDARY_DICTIONARY UNDEFINED RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� + 8 � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g `[��7 �y XeSqlPkg
C � ��2 ? � � � � � � c����
� XeSqlPkg_columnstore_object_xstore_size_mismatch Description Columnstore Object on disk size differs from size stored in remote blob properties. Guid {94CC460F-1BD7-4D39-AEDA-608991024054} locale MS\0x409 DisplayName columnstore_object_xstore_size_mismatch �0 X e S q l P k g _ c o l u m n s t o r e _ o b j e c t _ x s t o r e _ s i z e _ m i s m a t c h a[��7 � G : XeSqlPkg_columnstore_object_xstore_size_mismatch 2 ) � ��) 4 B N � n � � � ! ( r ~ � � A L � � � � � � f v WUU��������������������������������������������������������������������� � columnstore_object_xstore_size_mismatch EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid blob_id
? 6
� E R � ��] h object:guid WmiDataId Extension Guid blob_property_size
6 )
� � �
� �� uint64 WmiDataId column_id & )
� � �� uint64 WmiDataId db_id )
� _ g � �� uint16 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId hobt_id )
� . 6 � �� uint64 WmiDataId object_id )
� � � � �� uint64 WmiDataId object_size . )
� � � � �� uint64 WmiDataId object_type > P
� X _ � ��j e s } � � uint8 WmiDataId XEMapId ValueMap � � � � � � � � 1 5 6 7 8 2 4 0 Values � � 9 d � � � COLUMN_SEGMENT COLUMN_SEGMENT_BULKINSERT_DICTIONARY COLUMN_SEGMENT_DELETE_BITMAP COLUMN_SEGMENT_EXTENDED_STRING_PAGE_RANGE COLUMN_SEGMENT_GLOBAL_STRING_DICTIONARY COLUMN_SEGMENT_PRIMARY_DICTIONARY COLUMN_SEGMENT_SECONDARY_DICTIONARY UNDEFINED RemainingLength 6
� 5 = H U � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g b[��7 �J XeSqlPkg
C � ��& 3 q w � � � � c����� � XeSqlPkg_pesto_create_sbs_fcb_handle Description Created and opened SBS Handle in hobt creation for DW Pesto. Guid {E10E6A6D-13E4-4E91-BA57-CF504595A952} locale MS\0x409 DisplayName pesto_create_sbs_fcb_handle �$ X e S q l P k g _ p e s t o _ c r e a t e _ s b s _ f c b _ h a n d l e c[��7 �: + . XeSqlPkg_pesto_create_sbs_fcb_handle & ) � �� ( 6 B � � � � $ 0 � � Y j � � WU�����������������������������������������c � pesto_create_sbs_fcb_handle EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid db_name $ C
� F N � ��Y l | � string WmiDataId StringTermination NullTerminated Format w file_path C
� � � � ��� ! string WmiDataId StringTermination NullTerminated Format w FragmentId 6
� t | � � � �� uint32 WmiDataId Description FragmentId handle
4
� � � � ��� �� object WmiDataId Pointer hobt_id )
� F N � �� uint64 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� 3 ; F S � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g d[��7 �� XeSqlPkg
C � ��% 2 � � � � � � c���� � XeSqlPkg_pesto_close_sbs_fcb_handle Description Close SBS Handle during hobt drop, hobt eviction or CSBlobBPool shrink because there are no more references on the handle. Guid {4FBDD11A-06CE-48D7-81F3-26B19E46E262} locale MS\0x409 DisplayName pesto_close_sbs_fcb_handle � X e S q l P k g h[��7 �F XeSqlPkg
C � ��' 4 l r � � � � c����� � XeSqlPkg_temporal_ddl_data_check_fail Description Occurs when temporal ddl data consistency check fails. Guid {589198F5-72D7-4BFD-A1D8-A13DEC7FD2CA} locale MS\0x409 DisplayName temporal_ddl_data_check_fail �ail �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�| $ �\>�S}� Y � WDMClassesOfDriver MSMonitorClass C:\Windows\system32\kernelbase.dll[MofResourceName] ceName] rceName] � � � c����� � XeSqlPkg_metadata_agent_catalog_updated Description Metadata agent catalog updated Guid {8c5d28c3-c368-4fb6-8ce4-803c9fd73d1b} locale MS\0x409 DisplayName metadata_agent_catalog_updated � �D'� �P�϶ �ۖX� ���O� ��� % Z0�5 ���XP �h��p �I�
� ܪ ! �lU2� � �9�
% ]S� m�ۘ' � a��� I h��E ����S �� f TeaN �� _�R� �/j&� X�@|� R�1�� UQ x� 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 r=�4 �
͝��C�� ! 9� (D� c � WDMClassesOfDriver __namespace C:\Windows\System32\drivers\en-US\processr.sys.mui[PROCESSORWMI] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 =�4 �
͝��C�� + 9� (D� m � WDMClassesOfDriver ProcessorAcpiCstState C:\Windows\System32\drivers\en-US\processr.sys.mui[PROCESSORWMI] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �=�4 �
͝��C�� & 9� (D� h � WDMClassesOfDriver ProcessorAcpiCst C:\Windows\System32\drivers\en-US\processr.sys.mui[PROCESSORWMI] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �=�4 �
͝��C�� * 9� (D� l � WDMClassesOfDriver ProcessorBiosCStates C:\Windows\System32\drivers\en-US\processr.sys.mui[PROCESSORWMI] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �=�4 �
͝��C�� 0 9� (D� r � WDMClassesOfDriver ProcessorAcpiCsdDependency C:\Windows\System32\drivers\en-US\processr.sys.mui[PROCESSORWMI] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �=�4 �
͝��C�� & 9� (D� h � WDMClassesOfDriver ProcessorAcpiCsd C:\Windows\System32\drivers\en-US\processr.sys.mui[PROCESSORWMI] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �=�4 �
͝��C�� + 9� (D� m � WDMClassesOfDriver ProcessorAcpiTssState C:\Windows\System32\drivers\en-US\processr.sys.mui[PROCESSORWMI] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �=�4 �
͝��C�� & 9� (D� h � WDMClassesOfDriver ProcessorAcpiTss C:\Windows\System32\drivers\en-US\processr.sys.mui[PROCESSORWMI] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �=�4 �
͝��C�� * 9� (D� l � WDMClassesOfDriver ProcessorBiosTStates C:\Windows\System32\drivers\en-US\processr.sys.mui[PROCESSORWMI] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �=�4 �
͝��C�� , 9� (D� n � WDMClassesOfDriver ProcessorAcpiXpssState C:\Windows\System32\drivers\en-US\processr.sys.mui[PROCESSORWMI] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �=�4 �
͝��C�� ' 9� (D� i � WDMClassesOfDriver ProcessorAcpiXpss C:\Windows\System32\drivers\en-US\processr.sys.mui[PROCESSORWMI] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �=�4 �
͝��C�� 0 9� (D� r � WDMClassesOfDriver ProcessorAcpiTsdDependency C:\Windows\System32\drivers\en-US\processr.sys.mui[PROCESSORWMI] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �=�4 �
͝��C�� & 9� (D� h � WDMClassesOfDriver ProcessorAcpiTsd C:\Windows\System32\drivers\en-US\processr.sys.mui[PROCESSORWMI] I I S _ T r a n s �=�4 �� IIS_Trans ) � �� # / > � � � � g s � � _�������������������������� � W3GeneralEndNewRequest EventType EventLevel BytesReceived )
� u } � �� uint32 WmiDataId BytesSent )
� � � � �� uint32 WmiDataId ContextId
A
� 7 ? J U [ �� � �� object WmiDataId extension Guid ActivityID HttpStatus )
� � � � �� uint32 WmiDataId HttpSubStatus )
� � �� uint16 WmiDataId � I I S _ S t a r t u p _ T r a n s �?�4 � IIS_Startup_Trans 6 " / [ j � ��� /��������� � W3StartupCGIRestrictionListStart Description CGI restriction list initialization starts EventTypeName GLOBAL_CGI_RESTRICTION_LIST_START AMENDMENT LOCALE �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ,O����
͝��C�~ & +/�Q �� [ � WDMClassesOfDriver KernelIdleStates C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 -O����
͝��C�� + +/�Q �� ` � WDMClassesOfDriver KernelPerfStateChange C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 .O����
͝��C�� 1 +/�Q �� f � WDMClassesOfDriver KernelPerfStateDomainChange C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 /O����
͝��C�� + +/�Q �� ` � WDMClassesOfDriver KernelIdleStateChange C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 0O����
͝��C�� 3 +/�Q �� h � WDMClassesOfDriver KernelThermalConstraintChange C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 1O����
͝��C�� ) +/�Q �� ^ � WDMClassesOfDriver IdleStateAccounting C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 2O����
͝��C�| $ +/�Q �� Y � WDMClassesOfDriver IdleAccounting C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 3O����
͝��C� ' +/�Q �� \ � WDMClassesOfDriver IdleStateBucketEx C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 4O����
͝��C�� + +/�Q �� ` � WDMClassesOfDriver IdleStateAccountingEx C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 5O����
͝��C�~ & +/�Q �� [ � WDMClassesOfDriver IdleAccountingEx C:\Windows\system32\kernelbase.dll[MofResourceName] w � WDMClassesOfDriver WmiMonitorSupportedDisplayFeatures C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] �n xC���� M � WMIBinaryMofResource C:\Windows\system32\drivers\ndis.sys[MofResourceName] ResourceName] me] ���JR� p
Yo y *�ԣ� m d��?� �Ρ1 � ��
-� � ��O� � ���/� Q �@�� U�}�C��
� �� � ~ � � � � 7 J U������������� � UserConfiguredWindows8App Microsoft.Uev.ManagedAgentWmi, Version=10.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35 DisplayName
� � � �� string Enabled
� � � �� boolean Installed
� . � �� boolean PackageFamilyName '
� � �� � �� string { : _ c gur o � � � oft � & * Ve 4 c � � EnableApp % ��- �� static implemented ! a42c9160500003S ROOT\Microsoft\Uev ���� � �� �� * � ����� � __PARAMETERS abstract packageFamilyName string
� = ID
� = d in )
� � d � �� string __ � DisableApp � ��� �� static implemented ! a42c9160500003S ROOT\Microsoft\Uev ���� � �� �� * � ����� � __PARAMETERS abstract packageFamilyName string
� = ID
� = d in )
� � d � �� string __ � RemoveApp � ��� �� static implemented ! a42c9160500003S ROOT\Microsoft\Uev ���� � �� �� * � ����� � __PARAMETERS abstract packageFamilyName string
� = ID
� = d in )
� � d � �� string __ � CheckApp N ��V �� static implemented ! a42c9160500003S ROOT\Microsoft\Uev ���� � �� �� * � ����� � __PARAMETERS abstract packageFamilyName string
� = ID
� = d in )
� � d � �� string __ �� a42c9160500003S ROOT\Microsoft\Uev ���� � �( �� * m ��� � __PARAMETERS abstract ReturnValue boolean
� _ boolean out
� _ h �� __ � M S _ W m i I n t e r n a l ��jj��E MS_WmiInternal 4 � �� � �� # K S � � �
G M � � � � = F U��������������������������� � MSWmi_MofData WMIProv WMI guid {05901221-D566-11d1-B2F0-00A0C9062910} Active
� } � �� boolean BinaryMofData 6
� � � � � � �� uint8 WmiDataId WmiSizeIs Size InstanceName '
� ? � �� � �� string Size )
� � � � �� uint32 WmiDataId Unused1 )
� � � � �� uint32 WmiDataId Unused2
)
� * 2 � �� uint32 WmiDataId Unused4 )
� } � � �� uint32 WmiDataId � M S _ W m i I n t e r n a l ��jj��9 MS_WmiInternal 4 � �� � ��" ( P X � � � � : H � � � � 1 : U��������������������������� � MSWmi_ProviderInfo WMIProv WMI guid {C7BF35D0-AADB-11d1-BF4A-00A0C9062910} Active
� � � �� boolean Description
)
� � � � �� string WmiDataId FriendlyName )
� ' / � �� string WmiDataId InstanceName '
� } � �� � �� string Location )
� � � � �� string WmiDataId Manufacturer )
� & � �� string WmiDataId Service )
� q y � �� string WmiDataId � M S _ W m i I n t e r n a l ��jj��� MS_WmiInternal A � �� � ��! ' O Z t | � � � U����������Q � MSWmi_PnPDeviceId WMIProv WMI guid {C7BF35D2-AADB-11d1-BF4A-00A0C9062910} GuidName1 DATA_PROVIDER_PNPID_GUID Active
� � � �� boolean InstanceName '
� � � �� � �� string PnPDeviceId )
� > F � �� string WmiDataId id � M S _ W m i I n t e r n a l ��jj��w MS_WmiInternal A � �� � ! ��& , T _ � � � � " _ q U��������������� � MSWmi_PnPInstanceNames WMIProv WMI guid {C7BF35D3-AADB-11d1-BF4A-00A0C9062910} GuidName1 DATA_PROVIDER_PNPID_INSTANCE_NAMES_GUID Active
� � � �� boolean Count )
� � �� uint32 WmiDataId InstanceName '
� W � �� � �� string InstanceNameList
6
� � � � � � �� string WmiDataId WmiSizeIs Count GU � ��jj��� �� ? E =����� � MSWmi_Guid WMI guid {F8C60AED-EF8D-4f95-9EA8-F04318A00F30} Guid +
� ~ � � uint8 WmiDataId MAX � W M I E v e n t ��jj��� WMIEvent
4 � �� � % ��* 0 X ` � � � � T b � � _������������������������������ � MSWmi_GuidRegistrationInfo WMIProv WMI guid {B48D49A1-E777-11d0-A50C-00A0C9062910} Active
� � � �� boolean GuidCount
� � � uint32 WmiDataId GuidList
+
� 3 > I object:MSWmi_Guid WmiDataId WmiSizeIs GuidCount InstanceName '
� � � �� � �� string Operation +
� � � � uint32 WmiDataId ValueMap 1 2 4 �
I I S _ C g i _ T r a n s >�4 �
IIS_Cgi_Trans ) � �� + 6 _������������� � W3CGIStart EventType EventLevel ContextId
A
� � � � � � �� � �� object WmiDataId extension Guid ActivityID �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 V�n�^��
͝��C�� 6 J.3�� k � WDMClassesOfDriver MSNdis_FddiShortPermanentAddress C:\Windows\system32\kernelbase.dll[MofResourceName] e] ���� N
���'�
T �τW2 2 [�Rd � L���T � ��.WI � �!B-� � hv� C I M _ L o g i c a l P o r t MwR|�C�
� CIM_LogicalPort 6 � � � ��� . � � � � i y � � E [ A S � � � � �
�
����������UU�������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������| � CIM_NetworkPort Description NetworkPort is the logical representation of network communications hardware such as a physical connector and the setup or operation of the network chips, at the lowest layers of a network stack. Version 2.10.0 AMENDMENT LOCALE MS_409 ActiveMaximumTransmissionUnit 5 � +
� g o | � � uint64 Description The active or negotiated maximum transmission unit (MTU) that can be supported. Units Bytes AutoSense 3 �
� ( boolean Description A Boolean that indicates whether the NetworkPort is capable of automatically determining the speed or other communications characteristics of the attached network media. FullDuplex 2 �
� ! boolean Description Boolean that indicates that the port is operating in full duplex mode. LinkTechnology . � +
� � � � c k uint16 Description An enumeration of the types of links. When set to 1 ("Other"), the related property OtherLinkTechnology contains a string description of the type of link. Values � � � � � � � � � � � � Unknown Other Ethernet IB FC FDDI ATM Token Ring Frame Relay Infrared BlueTooth Wireless LAN NetworkAddresses 1 �
� F N [ string Description An array of strings that indicates the network addresses for the port. OtherLinkTechnology / �
� � � � string Description A string value that describes LinkTechnology when it is set to 1, "Other". OtherNetworkPortType , �
� � � � string Description Note: The use of this property is deprecated in lieu of CIM_LogicalPort.PortType.
Deprecated description: The type of module, when PortType is set to 1 ("Other".) PermanentAddress 0 �
� � � string Description PermanentAddress defines the network address that is hardcoded into a port. This \'hardcoded\' address can be changed using a firmware upgrade or a software configuration. When this change is made, the field should be updated at the same time. PermanentAddress should be left blank if no \'hardcoded\' address exists for the NetworkAdapter. PortNumber - �
� " * 7 uint16 Description NetworkPorts are often numbered relative to either a logical module or a network element. Speed @ & � +
� � � � �
�
uint64 Description The current bandwidth of the Port in Bits per Second. For ports that vary in bandwidth or for those where no accurate estimation can be made, this property should contain the nominal bandwidth. Units Bits per Second SupportedMaximumTransmissionUnit 4 � +
� % 2 n u uint64 Description The maximum transmission unit (MTU) that can be supported. Units Bytes � C I M _ E l e m e n t S e t t i n g D a t a OwR|�C� CIM_ElementSettingData ) # 0 h ��s { � � � ����������������� � MSFT_NetAdapterElementSettingData Description Associates a network port with its configuration data. AMENDMENT LOCALE MS_409 ManagedElement f@
� � � � ref:MSFT_NetAdapter Description The managed element. SettingData f@
� 0 P ] ref:MSFT_NetAdapterSettingData Description The SettingData object associated with the element. �! M S F T _ N e t A d a p t e r E l e m e n t S e t t i n g D a t a PwR|�C�� + MSFT_NetAdapterElementSettingData # ) / < � ��� � � � ����������������W � MSFT_NetAdapterAdvancedPropertyElementSetting Description Associates a network port with its advanced property configuration stored in the registry. AMENDMENT LOCALE MS_409 SettingData f@
� � ) ref:MSFT_NetAdapterAdvancedPropertySettingData Description Advanced properties for the network adapter. � M S F T _ N e t S e t t i n g D a t a QwR|�C�� " MSFT_NetSettingData ) ) b ��m u } � � � � � � � �U�������������������������������� � MSFT_NetAdapterSettingData Description Represents the base class for network adapter settings. AMENDMENT LOCALE MS_409 InterfaceDescription
� � � � string Description Interface Description, a.k.a. ifDescr or friendly name is a unique name assigned to the network adapter during installation. This name cannot be changed and is persisted as long as the network adapter is not uninstalled. Name
� � � � string Description Name, a.k.a. Connection Name, ifAlias, or InterfaceAlias, is a unique name assigned to the adapter during installation. The Name of the adapter can be changed by the administrator and is persisted across the boot or network adapter restart. Source +
� , 4 A c k uint32 Description The source of the setting data.
Values � � � Unknown Other Device Persistent storage SystemName
� � � � string Description The scoping System\'s Name. �* M S F T _ N e t A d a p t e r P o w e r M a n a g e m e n t _ W a k e P a t t e r n twR|�C�� 4 MSFT_NetAdapterPowerManagement_WakePattern , ) 3 @ � ��� � � � E V � � T ` �U����������������������������� � MSFT_NetAdapterPowerManagement_WakePattern_TcpSyn Description MSFT_NetAdapterPowerManagement_WakePattern_TcpSyn defines settings for a TCP SYN wake pattern. AMENDMENT LOCALE MS_409 DestinationAddress
� � string Description Supplies the destination address of the SYN packet. DestinationPort
� � � � uint16 Description Supplies the TCP destination port number of the SYN packet. SourceAddress
� $ string Description Supplies the source address of the SYN packet. SourcePort
� � � � uint16 Description Supplies the TCP source port number of the SYN packet. �* M S F T _ N e t A d a p t e r P o w e r M a n a g e m e n t _ W a k e P a t t e r n uwR|�C�@ 4 MSFT_NetAdapterPowerManagement_WakePattern , ) 5 B � ��� � ������������������ � MSFT_NetAdapterPowerManagement_WakePattern_WildCard Description MSFT_NetAdapterPowerManagement_WakePattern_WildCard defines settings for 'Wake on any Packet'. AMENDMENT LOCALE MS_409 �! M S F T _ N e t A d a p t e r E l e m e n t S e t t i n g D a t a vwR|�C�� + MSFT_NetAdapterElementSettingData # ) " / c ��n v ~ � ���������������� � MSFT_NetAdapterQosElementSetting Description Associates a network port with its QoS properties. AMENDMENT LOCALE MS_409 SettingData f@
� � � � ref:MSFT_NetAdapterQosSettingData Description The QoS properties for the network adapter. �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �L����
͝��C�� 0 +/�Q �� e � WDMClassesOfDriver MSWmi_GuidRegistrationInfo C:\Windows\system32\kernelbase.dll[MofResourceName] ��4� z �U� 8l& �K7A2 ! � ��S ! -N�t " �=a�
B a s e S t a t u s l��C�N � BaseStatus ) � �� � - ? 5 F x � � � � B T � � � � 9 m � � � �
? ^ � � � � * 6 s � � H i � � � 7 D v � � � � D ^ � � � � ! 8 k ~ � � �
y � �
<
N
�
�
�
�
% L g � � �
9
K
�
�
�
% Y t � � / b } � � � A M � � � � 6 D v � � � / a � � � � F e � � @P @ @� �� � � � ��� ����� ����� ������������ � ���� �������� � ��� �
� � ���� � � � MSFT_MpComputerStatus ProtectionManagement locale AMEngineVersion i
� p � �� string AMProductVersion
� � � �� string AMRunningMode
� � � �� string AMServiceEnabled m
� 9 � �� boolean AMServiceVersion
� ~ � �� string AntispywareEnabled % w
� � � �� boolean AntispywareSignatureAge
� � �� uint32 AntispywareSignatureLastUpdated e
$
� c � �� datetime AntispywareSignatureVersion
� � string AntivirusEnabled $ u
� � � �� boolean AntivirusSignatureAge ,
� 7 � �� uint32 AntivirusSignatureLastUpdated e
0
� � � �� datetime AntivirusSignatureVersion (
� � � �� string BehaviorMonitorEnabled # s
� ! � �� boolean ComputerID '
� k � �� � �� string ComputerState )
� � � � � �� uint32 BitMap � � � � � � 0 1 2 4 8 16 DefenderSignaturesOutOfDate
� ? � �� boolean DeviceControlDefaultEnforcement 2 �
� � � �� string DeviceControlPoliciesLastUpdated e 3 �
� � � �� datetime DeviceControlState 1 �
� / � �� string FullScanAge H
� n � �� uint32 FullScanEndTime e D
� � � �� datetime FullScanOverdue Q
� � � �� boolean FullScanRequired S
� ; � �� boolean FullScanSignatureVersion M
� � � �� string FullScanStartTime e @
� � � �� datetime InitializationProgress > �
� � �� string IoavProtectionEnabled " q
� b � �� boolean IsTamperProtected ' {
� � � �� boolean IsVirtualMachine & y
� � � �� boolean LastFullScanSource L )
� A H R � �� uint8 ValueMap j m p s v 0 1 2 3 4 LastQuickScanSource b )
� � � � � �� uint8 ValueMap � � � � � 0 1 2 3 4 NISEnabled + �
� 3
� �� boolean NISEngineVersion * �
� x
� �� string NISSignatureAge 8
� �
� �� uint32 NISSignatureLastUpdated e <
� � �� datetime NISSignatureVersion 4
� D string OnAccessProtectionEnabled ! o
� � � �� boolean ProductStatus
)
� � � � � �� uint32 BitMap \ _ b e h k o s w | � � � � � � � � � � � � � � � � 0 1 2 4 8 16 32 64 128 256 512 1024 2048 4096 8192 16384 32768 65536 131072 262144 524288 1048576 2097152 4194304 8388608 16777216 QuickScanAge ^
� 1
� �� uint32 QuickScanEndTime e Z
� u
� �� datetime QuickScanOverdue g
� �
� �� boolean QuickScanSignatureVersion c
� � �� string QuickScanStartTime e V
� O � �� datetime RealTimeProtectionEnabled ) �
� � � �� boolean RealTimeScanDirection U )
� � � � �� uint8 ValueMap 0 1 2 RebootRequired
� Y � �� boolean SmartAppControlExpiration = �
� � � �� string SmartAppControlState < �
� � � �� string TamperProtectionSource ( }
� 9 � �� string TDTCapable 0 �
� w � �� string TDTMode . �
� � � �� string TDTSiloType / �
� � � �� string TDTStatus , �
� . � �� string TDTTelemetry - �
� n � �� string TroubleShootingDailyMaxQuota : �
� � � �� string TroubleShootingDailyQuotaLeft 8 �
� � �� string TroubleShootingEndTime 6 �
� Y � �� string TroubleShootingExpirationLeft 7 �
� � � �� string TroubleShootingMode 4 �
� � � �� string TroubleShootingModeSource ; �
� > � �� string TroubleShootingQuotaResetTime 9 �
� � � �� string TroubleShootingStartTime 5 �
� � � �� string �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 !0pl\}�
͝��C�� - ��
�S}� l � WDMClassesOfDriver MSNdis_MaximumTotalSize C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 "0pl\}�
͝��C�� ' ��
�S}� f � WDMClassesOfDriver MSNdis_MacOptions C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 #0pl\}�
͝��C�� / ��
�S}� n � WDMClassesOfDriver MSNdis_MediaConnectStatus C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 $0pl\}�
͝��C�� / ��
�S}� n � WDMClassesOfDriver MSNdis_MaximumSendPackets C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 %0pl\}�
͝��C�� 0 ��
�S}� o � WDMClassesOfDriver MSNdis_VendorDriverVersion C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 &0pl\}�
͝��C�� + ��
�S}� j � WDMClassesOfDriver MSNdis_VlanIdentifier C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] ceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 &0pl\}�
͝��C�� + ��
�S}� j � WDMClassesOfDriver MSNdis_VlanIdentifier C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] ] ernelbase.dll.mui[MofResourceName] �@z�� � �j9u- � H�I� � �� J�3� v�� � ��Ie?
� ڝ��C��
) % 2 � �� � F W c � � � � U������������. � MDM_Policy_User_Result01_Printers02 InPartition : local-user DMWmiBridgeProv InstanceID
� � � �� string ParentID
� � � �� string PointAndPrintRestrictions_User '
� & � �� � string Pr � ڝ��C��
) $ 1 � �� � E V p � � � � U������������' � MDM_Policy_User_Result01_Privacy02 InPartition 9 local-user DMWmiBridgeProv DisablePrivacyExperience '
� � � �� � sint32 InstanceID
� � � �� string ParentID
� � �� string Pr � ڝ��C��
) % 2 � �� � F W c � � � � U������������1 � MDM_Policy_User_Result01_Security02 InPartition : local-user DMWmiBridgeProv InstanceID
� � � �� string ParentID
� � � �� string RecoveryEnvironmentAuthentication '
� ) � �� � sint32 Se � ڝ��C�� ) % 2 � �� � F W q � � � = G U����������������y � MDM_Policy_User_Result01_Settings02 InPartition : local-user DMWmiBridgeProv ConfigureTaskbarCalendar '
� � � �� � sint32 InstanceID
� � � �� string PageVisibilityList '
� 5 � �� � string ParentID
� q � �� string M � ڝ��C� + ) " / � �� � C
T i � � � = U � � � � 0 G � � � � � UU�����������������������������������������H � MDM_Policy_User_Result01_Start02 InPartition 7 local-user DMWmiBridgeProv DisableContextMenus '
� � � �� � sint32 ForceStartSize '
� � � �� � sint32 HideAppList '
� 5 � �� � sint32 HideFrequentlyUsedApps '
� � � �� � sint32 HidePeopleBar '
� � � �� � sint32 HideRecentJumplists '
� ( � �� � sint32 HideRecentlyAddedApps '
� | � �� � sint32 InstanceID
� � � �� string ParentID
� � � �� string StartLayout $ '
� @ � �� � string � ڝ��C��
) # 0 � �� � D U e � � � � U������������ � MDM_Policy_User_Result01_System02 InPartition 8 local-user DMWmiBridgeProv AllowTelemetry '
� � � �� � sint32 InstanceID
� � � �� string ParentID
� � �� string Sy � ڝ��C� ) � �� � 3 D P � � E��������� � MDM_RemoteWipe InPartition % local-system DMWmiBridgeProv InstanceID
� z � �� string ParentID
� � � �� string b lo * + � geP � � � z � � � 5 R n o
� � doWipeMethod �� implemented � ae442007200009F ROOT\cimv2\mdm\dmmap ���� � �� �� * � ����� � __PARAMETERS abstract param string
� 1 In
� 1 X �� ID )
� � X ��� string __ �� ae442007200009F ROOT\cimv2\mdm\dmmap ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � doWipePersistProvisionedDataMethod � �� implemented � ae442007200009F ROOT\cimv2\mdm\dmmap ���� � �� �� * � ����� � __PARAMETERS abstract param string
� 1 In
� 1 X �� ID )
� � X ��� string __ �� ae442007200009F ROOT\cimv2\mdm\dmmap ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � doWipeProtectedMethod � �� implemented � ae442007200009F ROOT\cimv2\mdm\dmmap ���� � �� �� * � ����� � __PARAMETERS abstract param string
� 1 In
� 1 X �� ID )
� � X ��� string __ �� ae442007200009F ROOT\cimv2\mdm\dmmap ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � doWipePersistUserDataMethod a �� implemented � ae442007200009F ROOT\cimv2\mdm\dmmap ���� � �� �� * � ����� � __PARAMETERS abstract param string
� 1 In
� 1 X �� ID )
� � X ��� string __ �� ae442007200009F ROOT\cimv2\mdm\dmmap ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � __ �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� 0 �\>�S}� e � WDMClassesOfDriver MSNdis_AtmMaxActiveVciBits C:\Windows\system32\kernelbase.dll[MofResourceName] ] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 C�����
͝��C�~ & ��8��� [ � WDMClassesOfDriver PortCls_PinState C:\Windows\System32\Drivers\portcls.SYS[PortclsMof] #��O� � ����8 � '4z� � �r
� jZ�O b 768�~ l GAV�� � װR� r �d?l- 8 + X e S q l P k g _ h a d r _ w s f c _ b r i n g _ a g _ l i s t e n e r _ o n l i n e �Y��7 �* " 5 XeSqlPkg_hadr_wsfc_bring_ag_listener_online - ) � ��$ / = I �
� � 8 D � � S d � � WU��������������������������������] � hadr_wsfc_bring_ag_listener_online EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid availability_group_id C
� [ c � ��n � � � string WmiDataId StringTermination NullTerminated Format w dns_name C
� � � � ��
- 5 string WmiDataId StringTermination NullTerminated Format w FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId listener_id C
� � ��% 8 H P string WmiDataId StringTermination NullTerminated Format w RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� - 5 @ M � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �Y��7 �n XeSqlPkg
C � ��0 = � � � � � � c����� � XeSqlPkg_hadr_wsfc_rollback_ag_listener_change Description HADR is about to rollback availability group listener WSFC resource changes. Guid {6AC02B3B-A78B-4908-8BE0-4DB6C72BE9EC} locale MS\0x409 DisplayName hadr_wsfc_rollback_ag_listener_change �. X e S q l P k g _ h a d r _ w s f c _ r o l l b a c k _ a g _ l i s t e n e r _ c h a n g e �Y��7 �0 " 8 XeSqlPkg_hadr_wsfc_rollback_ag_listener_change 0 ) � ��' 2 @ L �
� � ; G � � V g � � WU��������������������������������` � hadr_wsfc_rollback_ag_listener_change EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid availability_group_id C
� ^ f � ��q � � � string WmiDataId StringTermination NullTerminated Format w dns_name C
� � � ��
0 8 string WmiDataId StringTermination NullTerminated Format w FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId listener_id C
� � ��( ; K S string WmiDataId StringTermination NullTerminated Format w RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� 0 8 C P � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �Y��7 �� XeSqlPkg
C � ��2 ? � � � � � � c���� � XeSqlPkg_hadr_wsfc_update_ag_listener_dependency Description HADR set the WSFC dependency between an availability group and its listener resource object. Guid {51FD536D-F3A4-4F50-8A77-95DEF5D7EE6F} locale MS\0x409 DisplayName hadr_wsfc_update_ag_listener_dependency �0 X e S q l P k g _ h a d r _ w s f c _ u p d a t e _ a g _ l i s t e n e r _ d e p e n d e n c y �Y��7 �� ' : XeSqlPkg_hadr_wsfc_update_ag_listener_dependency 2 ) � ��) 4 B N � � � J T � � b o � � WU������������������������������������� � hadr_wsfc_update_ag_listener_dependency EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid availability_group_id C
� ` h � ��s � � � string WmiDataId StringTermination NullTerminated Format w dependency_expression C
� � �� / ? G string WmiDataId StringTermination NullTerminated Format w dns_name C
� � � � ��� � � � string WmiDataId StringTermination NullTerminated Format w FragmentId 6
� 6 > I V � �� uint32 WmiDataId Description FragmentId listener_id C
� � � � ��� � � � string WmiDataId StringTermination NullTerminated Format w RemainingLength 6
� V ^ i v � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �Y��7 �D XeSqlPkg
C � ��& 3 k q � � � � c����� � XeSqlPkg_hadr_cannot_create_listener Description Could not create a hadron availability group listener. Guid {10EEB60A-1F45-4E04-A723-277DE2C3CCD8} locale MS\0x409 DisplayName hadr_cannot_create_listener �$ X e S q l P k g _ h a d r _ c a n n o t _ c r e a t e _ l i s t e n e r �Y��7 �q . XeSqlPkg_hadr_cannot_create_listener & ) � �� ( 6 B � � � 1 = � � 3 C W����������������������������� � hadr_cannot_create_listener EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid availability_group_id C
� T \ � ��g z � � string WmiDataId StringTermination NullTerminated Format w dns_name C
� � � � �� & . string WmiDataId StringTermination NullTerminated Format w FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId RemainingLength 6
�
" � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �Y��7 �J XeSqlPkg
C � ��$ 1 s y � � � � c����� � XeSqlPkg_hadr_modify_listener_port Description The availability group listener TCP/IP port number was modified. Guid {52F56F8E-FB9B-4E82-AC6E-51A6890817AF} locale MS\0x409 DisplayName hadr_modify_listener_port � X e S q l P k g �[��7 � XeSqlPkg
C � �� * @ F n v � � c����� � XeSqlPkg_redo_single_record Description Redo on a log record Guid {8b4dc6aa-c655-4f19-a699-0613709c31f4} locale MS\0x409 DisplayName redo_single_record �ord �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�y ! �\>�S}� V � WDMClassesOfDriver WNFCallback C:\Windows\system32\kernelbase.dll[MofResourceName] ui[MofResourceName] E49FA193A77939E65868511053C7856CA375F94BE.2669.2928240190.272 ndows\system32\kernelbase.dll[MofResourceName] ٜz� � hH� Y �k�m � ���9 � VÓp�
� �m�0� � �� c S & X e S q l P k g _ b r o k e r _ t r a n s m i s s i o n _ e x c e p t i o n �R��7 �0 ( 0 XeSqlPkg_broker_transmission_exception ( ) � �� * 8 D � � l z � � + u � � � H Y � � WU��������������������������������������R � broker_transmission_exception EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid conversation_id
! 6
� C P � ��[ f object:guid WmiDataId Extension Guid error_number )
� � � � �� sint32 WmiDataId error_severity )
� � �� sint32 WmiDataId error_state )
� b j � �� sint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId is_initiator )
� 6 = � �� sint8 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� " * 5 B � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �R��7 �1 XeSqlPkg
C � �� - ^ d � � � � c����� � XeSqlPkg_broker_queue_disabled Description Occurs when a Service Broker queue is disabled. Guid {802d00c5-37a3-47d1-b0d2-1d38dfa44d4a} locale MS\0x409 DisplayName broker_queue_disabled � X e S q l P k g _ b r o k e r _ q u e u e _ d i s a b l e d �R��7 �x " ( XeSqlPkg_broker_queue_disabled ) � �� " 0 < � � = L � � Z d � � 4 D WU��������������������������������� � broker_queue_disabled EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� * 2 � �� uint32 WmiDataId database_name C
� � � � ��� � � � string WmiDataId StringTermination NullTerminated Format w FragmentId 6
� . 6 A N � �� uint32 WmiDataId Description FragmentId queue_id )
� � � � �� sint32 WmiDataId RemainingLength 6
� # � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �R��7 �� XeSqlPkg
C � ��. ; � � � � � � c����# � XeSqlPkg_broker_mirrored_route_state_changed Description Occurs every time Service Broker receives an open or close connection request from either of the mirrored instances. Guid {19a973b4-ce7b-4274-9042-d77671c6ecf7} locale MS\0x409 DisplayName broker_mirrored_route_state_changed �, X e S q l P k g _ b r o k e r _ m i r r o r e d _ r o u t e _ s t a t e _ c h a n g e d �R��7 �o 0 6 XeSqlPkg_broker_mirrored_route_state_changed . ) � ��% 0 > J � � � ; Q � � � � ! + � � i z � � WUU���������������������������������������������s � broker_mirrored_route_state_changed EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid address_mirror C
� U ] � ��h { � � string WmiDataId StringTermination NullTerminated Format w address_principal C
� � � ��
0 8 string WmiDataId StringTermination NullTerminated Format w error_message_mirror C
� � � � ��� � � � string WmiDataId StringTermination NullTerminated Format w error_message_prinicipal ! C
� N V � ��a t � � string WmiDataId StringTermination NullTerminated Format w FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId mirrored_route_state P
� � � ��� � � � � uint8 WmiDataId XEMapId ValueMap � � � 1 2 3 Values � � Operational Operational with principal only Not operational mirroring_role_mirror
% C
� | �
� ��� � � � string WmiDataId StringTermination NullTerminated Format w mirroring_role_principal ) C
� ( 0 � ��; N ^ f string WmiDataId StringTermination NullTerminated Format w RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� C K V c � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �R��7 �i XeSqlPkg
C � ��0 = � � � � � � c����� � XeSqlPkg_broker_remote_message_acknowledgement Description Occurs when Service Broker sends or receives a message acknowledgement. Guid {839ba147-249a-438b-b137-faa0dc1acaed} locale MS\0x409 DisplayName broker_remote_message_acknowledgement �* X e S q l P k g _ m a n a g e d _ d a t a b a s e _ r e s t o r e _ d d l _ i n f o �R��7 �� 8 4 XeSqlPkg_managed_database_restore_ddl_info , ) � ��# . < H � L Z � � � v � � � ( 9 � � 2 > � � WUU������������������������������������������������������ � managed_database_restore_ddl_info EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid backend_session 4 )
� : A � �� sint8 WmiDataId device_count $ )
� � � � �� uint32 WmiDataId file_count ( )
� � � � �� uint32 WmiDataId FragmentId 6
� J R ] j � �� uint32 WmiDataId Description FragmentId page_count , )
� � � � �� uint32 WmiDataId relocation_count
0 )
�
� �� uint32 WmiDataId RemainingLength 6
� } � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
�
" � �� uint32 WmiDataId Description SequenceNumber stats_mask )
� u } � �� uint64 WmiDataId value_option_mask )
� � � � �� uint64 WmiDataId �aId �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�{ # �\>�S}� X � WDMClassesOfDriver PoolAllocFree C:\Windows\system32\kernelbase.dll[MofResourceName] .dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� 1 �\>�S}� f � WDMClassesOfDriver MSNdis_HDSplitCurrentConfig C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� 8 �\>�S}� m � WDMClassesOfDriver MSNdis_QueryReceiveQueueParameters C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� 4 �\>�S}� i � WDMClassesOfDriver MSNdis_80211_ConfigurationInfo C:\Windows\system32\kernelbase.dll[MofResourceName] urceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� 4 �\>�S}� i � WDMClassesOfDriver MSNdis_80211_ConfigurationInfo C:\Windows\system32\kernelbase.dll[MofResourceName] base.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� 4 �\>�S}� i � WDMClassesOfDriver MSNdis_80211_ConfigurationInfo C:\Windows\system32\kernelbase.dll[MofResourceName] esourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� 4 �\>�S}� i � WDMClassesOfDriver MSNdis_80211_ConfigurationInfo C:\Windows\system32\kernelbase.dll[MofResourceName] ceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� 4 �\>�S}� i � WDMClassesOfDriver MSNdis_80211_ConfigurationInfo C:\Windows\system32\kernelbase.dll[MofResourceName] ernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� 4 �\>�S}� i � WDMClassesOfDriver MSNdis_80211_ConfigurationInfo C:\Windows\system32\kernelbase.dll[MofResourceName] dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� 4 �\>�S}� i � WDMClassesOfDriver MSNdis_80211_ConfigurationInfo C:\Windows\system32\kernelbase.dll[MofResourceName] ceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� 4 �\>�S}� i � WDMClassesOfDriver MSNdis_80211_ConfigurationInfo C:\Windows\system32\kernelbase.dll[MofResourceName] lbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� 4 �\>�S}� i � WDMClassesOfDriver MSNdis_80211_ConfigurationInfo C:\Windows\system32\kernelbase.dll[MofResourceName] rnelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� 4 �\>�S}� i � WDMClassesOfDriver MSNdis_80211_ConfigurationInfo C:\Windows\system32\kernelbase.dll[MofResourceName] lbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� 4 �\>�S}� i � WDMClassesOfDriver MSNdis_80211_ConfigurationInfo C:\Windows\system32\kernelbase.dll[MofResourceName] [MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� 4 �\>�S}� i � WDMClassesOfDriver MSNdis_80211_ConfigurationInfo C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� + �\>�S}� ` � WDMClassesOfDriver MSNdis_80211_BSSIList C:\Windows\system32\kernelbase.dll[MofResourceName] kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� + �\>�S}� ` � WDMClassesOfDriver MSNdis_80211_BSSIList C:\Windows\system32\kernelbase.dll[MofResourceName] se.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� + �\>�S}� ` � WDMClassesOfDriver MSNdis_80211_BSSIList C:\Windows\system32\kernelbase.dll[MofResourceName] ase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� + �\>�S}� ` � WDMClassesOfDriver MSNdis_80211_BSSIList C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� 5 �\>�S}� j � WDMClassesOfDriver MSNdis_80211_InfrastructureMode C:\Windows\system32\kernelbase.dll[MofResourceName] kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� 5 �\>�S}� j � WDMClassesOfDriver MSNdis_80211_InfrastructureMode C:\Windows\system32\kernelbase.dll[MofResourceName] l[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� 5 �\>�S}� j � WDMClassesOfDriver MSNdis_80211_InfrastructureMode C:\Windows\system32\kernelbase.dll[MofResourceName] l[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� 5 �\>�S}� j � WDMClassesOfDriver MSNdis_80211_InfrastructureMode C:\Windows\system32\kernelbase.dll[MofResourceName] ResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� 5 �\>�S}� j � WDMClassesOfDriver MSNdis_80211_InfrastructureMode C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� 5 �\>�S}� j � WDMClassesOfDriver MSNdis_80211_InfrastructureMode C:\Windows\system32\kernelbase.dll[MofResourceName] esourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� 5 �\>�S}� j � WDMClassesOfDriver MSNdis_80211_InfrastructureMode C:\Windows\system32\kernelbase.dll[MofResourceName] [MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� 5 �\>�S}� j � WDMClassesOfDriver MSNdis_80211_InfrastructureMode C:\Windows\system32\kernelbase.dll[MofResourceName] ll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� 5 �\>�S}� j � WDMClassesOfDriver MSNdis_80211_InfrastructureMode C:\Windows\system32\kernelbase.dll[MofResourceName] ���� � ��F
� � 0��� � <�ט M ��� W l&=�< � 1��
� E��i � Xj� � �O2j� � Ctv � �
B� � �,� � ,ٝ��C�� ) � �� � 5 F R � � � � U����������������W � MDM_DeviceStatus InPartition ' local-system DMWmiBridgeProv DomainName '
� � � �� � string InstanceID
� � � �� string ParentID
� � �� string SecureBootState '
� O � �� � sint32 M � -ٝ��C�� ) - � �� � C T ` � � � � $ U����������������a � MDM_DeviceStatus_Antispyware01 InPartition 5 local-system DMWmiBridgeProv InstanceID
� � � �� string ParentID
� � � �� string SignatureStatus '
� � �� � sint32 Status '
� Y � �� � sint32 M � .ٝ��C�� ) + � �� � A R ^ � � � � " U����������������_ � MDM_DeviceStatus_Antivirus01 InPartition 3 local-system DMWmiBridgeProv InstanceID
� � � �� string ParentID
� � � �� string SignatureStatus '
� � �� � sint32 Status '
� W � �� � sint32 M � /ٝ��C�5 ) ) � �� � ? P j � � � 4 > p x U���������������������� � MDM_DeviceStatus_Battery01 InPartition 1 local-system DMWmiBridgeProv EstimatedChargeRemaining '
� � � �� � sint32 EstimatedRuntime '
� � � �� � sint32 InstanceID
� , � �� string ParentID
� h � �� string Status '
� � � �� � sint32 � 0ٝ��C�? ) * 7 � �� � M ^ y � � � = I { � � � R a UU����������������������������� � MDM_DeviceStatus_CellularIdentities01_01 InPartition ? local-system DMWmiBridgeProv CommercializationOperator '
� � � �� � string ICCID '
� � � �� � string IMSI '
� 5 � �� � string InstanceID
� s � �� string ParentID
� � � �� string PhoneNumber '
� � � �� � string RoamingCompliance '
� I � �� � boolean RoamingStatus '
� � � �� � boolean � 1ٝ��C�� ) , � �� � B S i � � � � U����������! � MDM_DeviceStatus_Compliance01 InPartition 4 local-system DMWmiBridgeProv EncryptionCompliance '
� � � �� � boolean InstanceID
� � � �� string ParentID
� � �� string 01 � 3ٝ��C�w
) * � �� � @ Q ] � � � � U������������ � MDM_DeviceStatus_Firewall01 InPartition 2 local-system DMWmiBridgeProv InstanceID
� � � �� string ParentID
� � � �� string Status '
� � �� � sint32 01 � 4ٝ��C�� ) * 7 � �� � M ^ j � � � � 0 = { � � � U������������������������ � MDM_DeviceStatus_NetworkIdentifiers01_01 InPartition ? local-system DMWmiBridgeProv InstanceID
� � � �� string IPAddressV4 '
� � � �� � string IPAddressV6 '
� ( � �� � string IsConnected '
� r � �� � boolean ParentID
� � � �� string Type '
� � � �� � sint32 � 5ٝ��C�� ) $ � �� � : K T � � � � U����������������N � MDM_DeviceStatus_OS01 InPartition , local-system DMWmiBridgeProv Edition '
� � � �� � string InstanceID
� � � �� string Mode '
�
� �� � string ParentID
� F � �� string M � 6ٝ��C��
) % � �� � ; L X � � � � U������������ � MDM_DeviceStatus_TPM01 InPartition - local-system DMWmiBridgeProv InstanceID
� � � �� string ParentID
� � � �� string SpecificationVersion '
� � �� � string nP � 7ٝ��C�r
) % � �� � ; L X � � � � U������������ � MDM_DeviceStatus_UAC01 InPartition - local-system DMWmiBridgeProv InstanceID
� � � �� string ParentID
� � � �� string Status '
� � �� � sint32 nP � 8ٝ��C�� 2 ) # � �� � 9
J T � � � � ( e n � � � � . 6 s � � � � A J � � UUU������������������������������������������������ � MDM_EnterpriseAPN_01 InPartition + local-system DMWmiBridgeProv AlwaysOn
& '
� � � �� � �� boolean APNName '
� � � �� � �� string AuthType '
� � �� � �� string ClassId '
� ] � �� � �� string Enabled ( '
� � � �� � �� boolean IccId " '
� � � �� � �� string InstanceID
� & � �� string IPType '
� k � �� � �� string IsAttachAPN '
� � � �� � �� boolean ParentID
� � � �� string Password '
� 9 � �� � �� string Roaming * '
� � �� � �� string UserName '
� � � �� � �� string � �ٝ��C��
) % 2 � �� � H Y q � � � � U������������( � MDM_Policy_Config01_TaskScheduler02 InPartition : local-system DMWmiBridgeProv EnableXboxGameSaveTask '
� � � �� � �� sint32 InstanceID
� � � �� string ParentID
� � �� string ch �ing ch �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ]*pl\}�
͝��C�� , �\>�S}� a � WDMClassesOfDriver MSNdis_NdisEnumerateVc C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ^*pl\}�
͝��C�� , �\>�S}� a � WDMClassesOfDriver MSNdis_NotifyVcRemoval C:\Windows\system32\kernelbase.dll[MofResourceName] ame] ll.mui[MofResourceName] eName] � �� string ch � ��t? �s0 ( T�-"X
e � ���. : �QՄh � �E�g � �
�CS � ֯�4?
� L��z � F��� \ �l��0 8 ���yh U �u��� W �% � p㱓� � R O O T \ R s o p \ C o m p u t e r R S O P _ E x t e n s i o n E v e n t S o u r c e L i n k e v e n t S o u r c e � N S _ C C A 0 3 7 7 0 E 5 6 2 E 2 A 1 7 0 E D E D 2 0 A 5 8 9 C 0 6 9 A 2 0 4 5 A 9 B C D 7 4 1 2 B 7 7 D 0 6 8 8 4 6 D 9 0 5 4 E C 4 \ K I _ 2 7 2 E 5 7 5 3 D C 3 E E C D D 6 0 5 7 0 3 8 D B 6 F 2 6 1 7 0 E 7 D 1 C D 5 6 5 B 9 5 4 C 6 C 4 A 4 0 6 C B 1 B C 2 D 0 2 3 E \ I _ D 8 E B B 8 1 4 8 1 B 8 8 B C F 5 5 F C 8 9 2 9 C 4 C 8 8 2 A F 2 9 3 A 9 1 C 6 5 E C 4 D C C 5 3 7 5 8 3 8 8 7 C E 3 9 5 7 B D @ R O O T \ R s o p \ C o m p u t e r R S O P _ E x t e n s i o n E v e n t S o u r c e L i n k e x t e n s i o n S t a t u s � N S _ C C A 0 3 7 7 0 E 5 6 2 E 2 A 1 7 0 E D E D 2 0 A 5 8 9 C 0 6 9 A 2 0 4 5 A 9 B C D 7 4 1 2 B 7 7 D 0 6 8 8 4 6 D 9 0 5 4 E C 4 \ K I _ 2 7 2 E 5 7 5 3 D C 3 E E C D D 6 0 5 7 0 3 8 D B 6 F 2 6 1 7 0 E 7 D 1 C D 5 6 5 B 9 5 4 C 6 C 4 A 4 0 6 C B 1 B C 2 D 0 2 3 E \ I _ D 8 E B B 8 1 4 8 1 B 8 8 B C F 5 5 F C 8 9 2 9 C 4 C 8 8 2 A F 2 9 3 A 9 1 C 6 5 E C 4 D C C 5 3 7 5 8 3 8 8 7 C E 3 9 5 7 B D D 6 F 2 3 A C 5 C C B E B 4 7 E C C F 7 B F 1 2 9 5 2 3 2 5 8 8 7 9 F D E D 9 D 2 8 2 F 5 5 8 0 4 3 F F 8 0 2 4 9 A 7 E D 5 9 6 ۍ��j��ѝ��C�} 6 ( ^ � RSOP_ExtensionEventSource Application Group Policy {CA08E3CC-4A42-4D71-8947-6B57A75E1AC3} 0 4 5 4 D D D A 9 A B 9 9 9 B 5 E 0 5 A 2 F 4 6 8 B A 8 8 8 F 0 D 0 7 9 4 E 6 B A 1 E B D C C F 2 A 4 4 6 3 E C 0 3 2 5 8 C C 6 ݍ��j���Н��C�9
� RSOP_SOM Local E 7 0 6 F F 8 5 8 6 C 5 2 A 7 1 7 6 A C A 4 8 D 7 7 0 2 E C 2 A 6 5 5 0 5 6 4 F 0 E 4 2 B 0 C 0 9 A E 3 F D 1 C C E A 6 2 C D 4 ލ��j���Н��C�� M W 9 ��k 7 ��
o � RSOP_GPO C:\Windows\System32\GroupPolicy\Machine Local Group Policy LocalGPO Local Group Policy B 0 F E 4 3 D 7 F 9 B D B F B 5 8 0 A 0 C A 5 5 2 7 E F 2 5 F 6 B 3 6 E C 4 B 6 7 1 B A 1 4 3 B 3 3 8 B 3 8 0 B 1 F 4 5 C 2 7 D ߍ��j�� ѝ��C�o %
�� C � RSOP_GPLink RSOP_GPO.id="LocalGPO" RSOP_SOM.id="Local",reason=1 R O O T \ R s o p \ C o m p u t e r R S O P _ G P L i n k G P O � N S _ C C A 0 3 7 7 0 E 5 6 2 E 2 A 1 7 0 E D E D 2 0 A 5 8 9 C 0 6 9 A 2 0 4 5 A 9 B C D 7 4 1 2 B 7 7 D 0 6 8 8 4 6 D 9 0 5 4 E C 4 \ K I _ B 0 F E 4 3 D 7 F 9 B D B F B 5 8 0 A 0 C A 5 5 2 7 E F 2 5 F 6 B 3 6 E C 4 B 6 7 1 B A 1 4 3 B 3 3 8 B 3 8 0 B 1 F 4 5 C 2 7 D \ I _ 9 D B B 4 C 3 B F 3 B 3 0 B A E 5 D 6 C 9 2 6 F 4 0 F 2 D D 5 5 3 8 1 A 6 2 6 2 8 1 9 D B C 8 0 F 2 4 8 2 8 3 8 0 5 2 C 4 0 4 D R O O T \ R s o p \ C o m p u t e r R S O P _ G P L i n k S O M � N S _ C C A 0 3 7 7 0 E 5 6 2 E 2 A 1 7 0 E D E D 2 0 A 5 8 9 C 0 6 9 A 2 0 4 5 A 9 B C D 7 4 1 2 B 7 7 D 0 6 8 8 4 6 D 9 0 5 4 E C 4 \ K I _ B 0 F E 4 3 D 7 F 9 B D B F B 5 8 0 A 0 C A 5 5 2 7 E F 2 5 F 6 B 3 6 E C 4 B 6 7 1 B A 1 4 3 B 3 3 8 B 3 8 0 B 1 F 4 5 C 2 7 D \ I _ 9 D B B 4 C 3 B F 3 B 3 0 B A E 5 D 6 C 9 2 6 F 4 0 F 2 D D 5 5 3 8 1 A 6 2 6 2 8 1 9 D B C 8 0 F 2 4 8 2 8 3 8 0 5 2 C 4 0 4 D 6 4 6 5 9 A B 9 F 8 F 1 C 4 B 5 6 8 D B 6 4 3 8 B A E 1 1 B 2 6 E E 8 F 9 3 C B 5 F 8 1 9 5 E 2 1 E 8 C 3 8 3 D 6 C 4 4 C C 4 1 ��j��ȝ��C�Q
: � __NAMESPACE S_1_5_21_128080908_2238061424_149367449_500 F D 1 C 1 D 4 1 4 B 7 1 B 5 0 8 2 C 2 6 6 A 6 5 0 E 3 1 E F 6 D 5 0 1 9 3 8 2 7 2 4 2 4 4 B 6 8 5 F 2 1 7 C 0 A A E 0 0 A 9 2 1 ��j��Cȝ��C�$ � __SystemSecurity 4 1 C 5 3 E 6 D B 1 A C F 2 4 5 3 C E F D 4 1 3 9 8 1 9 8 E 6 1 3 F 1 0 D F F 4 7 7 0 9 E C A B 1 D 7 F 0 3 7 7 5 6 A C 8 C E 7 ��j��ȝ��C�� � � __thisNAMESPACE � �� � l ? ? ? $ # \�pf��*�� C I M _ I n d i c a t i o n ��j�� ) CIM_Indication 6 �� ( / ? K X + < �����������������������������������������p � CIM_ClassIndication Abstract Version 2.6.0 UMLPackagePath CIM::Event Description CIM_ClassIndication is an abstract superclass describing changes in the definition of the schema. Subclasses represent specific types of change notifications, such as class creation, deletion and modification. ClassDefinition
" )
� s { ��� � object Required Description The current definition of the class that is created, changed or deleted in the schema. In the case of a CIM_ClassDeletion Indication, the definition for the class just prior to deletion should be placed in this property. t � C I M _ C l a s s I n d i c a t i o n ��j�� ) CIM_ClassIndication + # 3 ? L ������������������������������������������ � CIM_ClassDeletion Version 2.6.0 UMLPackagePath CIM::Event Description CIM_ClassDeletion notifies when a class is deleted from the schema. th � C I M _ C l a s s I n d i c a t i o n ��j�� ) CIM_ClassIndication + # 3 ? L ������������������������������������������ � CIM_ClassCreation Version 2.6.0 UMLPackagePath CIM::Event Description CIM_ClassCreation notifies when a new class is defined in the schema. � C I M _ C l a s s I n d i c a t i o n ��j��� - CIM_ClassIndication + ' 7 C P � � ��������������������������������������������� � CIM_ClassModification Version 2.6.0 UMLPackagePath CIM::Event Description CIM_ClassModification notifies when a class definition in the schema is modified. PreviousClassDefinition
& )
� � � �� object Required Description A copy of the 'previous' class definition whose change generated the Indication. PreviousClassDefinition contains an 'older' copy of the class' information, as compared to what is found in the ClassDefinition property (inherited from ClassIndication). , � C I M _ I n d i c a t i o n ��j��^ 1 CIM_Indication 6 �� ' . > J W ) � � ^ w ������������������������������������������������� � CIM_InstIndication Abstract Version 2.9.0 UMLPackagePath CIM::Event Description CIM_InstIndication is an abstract superclass describing changes to instances. Subclasses represent specific types of change notifications, such as instance creation, deletion and modification. SourceInstance
" )
� ` h ��r object Required Description A copy of the instance that changed to generate the Indication. SourceInstance contains the current values of the properties selected by the Indication Filter's Query. In the case of CIM_InstDeletion, the property values are copied before the instance is deleted. SourceInstanceHost
* +
� � � � 3 string Description The host name or IP address of the SourceInstance. ModelCorrespondence ; CIM_InstIndication.SourceInstance SourceInstanceModelPath & +
� � � � r � string Description The Model Path of the SourceInstance. The following format MUST be used to encode the Model Path:
<NamespacePath>:<ClassName>.<Prop1>="<Value1>",
<Prop2>="<Value2>", ... ModelCorrespondence � CIM_InstIndication.SourceInstance . �nce . �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 S,pl\}�
͝��C�� ) �\>�S}� ^ � WDMClassesOfDriver SystemConfig_V1_CPU C:\Windows\system32\kernelbase.dll[MofResourceName] ResourceName] e � CIM_InstIndication.SourceInstance . � Q��` j �?�� � g�7�
e �Sk� t ꃔ�� 4 / X e S q l P k g _ p r o g r e s s _ r e p o r t _ o n l i n e _ i n d e x _ o p e r a t i o n )\��7 ��
b 9 XeSqlPkg_progress_report_online_index_operation 1 ) � ��( 3 A M � � � � � � M Y � � ) � � � � # m � � O ^ � � WUUU���������������������������������������������������������������������������������������������� � progress_report_online_index_operation EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid build_stage P
� b i � ��t } � � � uint8 WmiDataId XEMapId ValueMap
� � � � � � � � � � 1 2 3 4 5 6 7 8 9 10 Values
& = V m � � � � Start Stage 1 execution begin Stage 1 execution end Stage 2 execution begin Stage 2 execution end Inserted row count Done Query failed Deleted row Error database_id )
� � � � �� uint32 WmiDataId database_name Y C
� ` h � ��s � � � string WmiDataId StringTermination NullTerminated Format w duration - )
� � � � �� uint64 WmiDataId error_number M )
� : B � �� sint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId index_id )
�
� �� uint32 WmiDataId index_name Q C
� z � � ��� � � � string WmiDataId StringTermination NullTerminated Format w object_id )
� � � �� sint32 WmiDataId object_name U C
� n v � ��� � � � string WmiDataId StringTermination NullTerminated Format w parallel_process_thread_id E )
�
� �� uint64 WmiDataId partition_id
% )
� Z b
� �� uint64 WmiDataId partition_number ! )
� � � � �� uint32 WmiDataId RemainingLength 6
� & 1 > � �� uint32 WmiDataId Description RemainingLength rows_inserted 5 )
� � � � �� uint64 WmiDataId rows_inserted_batch
= )
� � �
� �� uint64 WmiDataId SequenceNumber 6
� [ c n { � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g *\��7 �� XeSqlPkg
C � ��6 C � � # c����P � XeSqlPkg_online_index_operation_row_event_test_point Description Occurs during an online index build process when something happens with a row during index population. This event is used for test purposes only. Guid {be854a36-0771-45df-bad2-407351d647eb} locale MS\0x409 DisplayName online_index_operation_row_event_test_point �4 X e S q l P k g _ o n l i n e _ i n d e x _ o p e r a t i o n _ r o w _ e v e n t _ t e s t _ p o i n t +\��7 �� 8 > XeSqlPkg_online_index_operation_row_event_test_point 6 ) � ��- 8 F R � S _ � � # . x � � � , = � � � U e WUU������������������������������������������������������ � online_index_operation_row_event_test_point EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� @ H � �� uint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId index_id )
� � �� uint32 WmiDataId object_id )
� e m � �� sint32 WmiDataId partition_id
% )
� � �
� �� uint64 WmiDataId partition_number ! )
� ! � �� uint32 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength row_event P
� " � ��- 6 @ Y a uint8 WmiDataId XEMapId ValueMap P S V 1 2 3 Values q � � Non-optimized insert in mapping index successful Non-optimized insert in build successful Non-optimized update mapping index successful rows_inserted - )
� B J � �� uint64 WmiDataId SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g ,\��7 �L XeSqlPkg
C � ��$ 1 u { � � � � c����� � XeSqlPkg_query_trace_column_values Description Trace output column values of each row on each query plan operator Guid {5f0ca64d-6f2d-4b9e-9149-b20bb3102bd3} locale MS\0x409 DisplayName query_trace_column_values �/ X e S q l P k g _ q u e r y _ m e m o r y _ g r a n t _ r e s o u r c e _ s e m a p h o r e s 7\��7 �� d 9 XeSqlPkg_query_memory_grant_resource_semaphores 1 ) � ��( 3 A M � V j � � 0 C � � � � F O � � / � � � ^ o � � ! WUUU������������������������������������������������������������������������������������������������k � query_memory_grant_resource_semaphores EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid available_memory_kb 0 )
� C K � �� uint64 WmiDataId forced_grant_count X )
� � � � �� uint64 WmiDataId FragmentId 6
� $ � �� uint32 WmiDataId Description FragmentId granted_memory_kb
8 )
� z �
� �� uint64 WmiDataId grantee_count H )
� � � � �� uint32 WmiDataId max_target_memory_kb )
� 3 ; � �� uint64 WmiDataId pool_id )
� � � � �� uint32 WmiDataId RemainingLength 6
� � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� s { � � � �� uint32 WmiDataId Description SequenceNumber target_memory_kb )
� � � � �� uint64 WmiDataId timeout_error_count P )
� K S � �� uint64 WmiDataId total_memory_kb ( )
� � � � �� uint64 WmiDataId used_memory_kb @ )
� � �� uint64 WmiDataId waiter_count
L )
� X `
� �� uint32 WmiDataId �aId �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�� + �\>�S}� ` � WDMClassesOfDriver KernelPerfStateChange C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] eName] 2eU�p � �-R � ^��5 9�SJ J�Ƞ_ ��Fo
GA�| E �� �ˀ�
_�2D� �iR�� X��� %��� "_��� �"1[ ���> �VX, }��3G 3�P X WK��n �S�~ V���� �֝��C�� 6 � �� � * 8 ; H L Z � � � � ! , ^ k � � � � U����������������������������% � MSFT_SmbServerNetworkInterface smbwmiv2 ClassVersion 7 Description 46 FriendlyName
� � � �� string InterfaceIndex '
� � � �� � �� uint32 IpAddress '
� � �� � �� string LinkSpeed
� V � �� uint64 RdmaCapable
� � � �� boolean RssCapable
� � � �� boolean ScopeName '
� � �� � �� string � �:Ͼlu�� 6 � �� � 4 > L O \ ` s � 4 @ r � U���������������������> � MSFT_SmbServerCertificateMappingAccessControlEntry smbwmiv2 ClassVersion 7 Description 76 AccessControlType 6
� � � � � � � �� uint32 ValueMap � � 0 1 Values � � 1 2 Description
� , � �� string Identifier
� j � �� string IdentifierType 6
� � � � � � � �� uint32 ValueMap � � 0 1 Values � 74 75 Name
� 6 � �� string �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �b��5�
͝��C�� ! �f3��5� b � WDMClassesOfDriver __namespace C:\Windows\System32\drivers\en-US\ACPI.sys.mui[ACPIMOFResource] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �b��5�
͝��C�� * �x! �5� b � WDMClassesOfDriver ProcessorCStateEvent C:\Windows\System32\drivers\processr.sys[PROCESSORWMI] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 0�b��5�
͝��C�� % �x! �5� ] � WDMClassesOfDriver ProcessorStatus C:\Windows\System32\drivers\processr.sys[PROCESSORWMI] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 1�b��5�
͝��C�} " �x! �5� Z � WDMClassesOfDriver AcpiPssState C:\Windows\System32\drivers\processr.sys[PROCESSORWMI] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 2�b��5�
͝��C�x �x! �5� U � WDMClassesOfDriver AcpiPss C:\Windows\System32\drivers\processr.sys[PROCESSORWMI] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 3�b��5�
͝��C�| ! �x! �5� Y � WDMClassesOfDriver AcpiGenAddr C:\Windows\System32\drivers\processr.sys[PROCESSORWMI] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 4�b��5�
͝��C�� ' �x! �5� _ � WDMClassesOfDriver AcpiControlStatus C:\Windows\System32\drivers\processr.sys[PROCESSORWMI] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 5�b��5�
͝��C�x �x! �5� U � WDMClassesOfDriver AcpiPct C:\Windows\System32\drivers\processr.sys[PROCESSORWMI] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 6�b��5�
͝��C�� ' �x! �5� _ � WDMClassesOfDriver ProcessorBiosInfo C:\Windows\System32\drivers\processr.sys[PROCESSORWMI] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 7�b��5�
͝��C�� - �x! �5� e � WDMClassesOfDriver ProcessorPerfStateEvent C:\Windows\System32\drivers\processr.sys[PROCESSORWMI] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 8�b��5�
͝��C�� 1 �x! �5� i � WDMClassesOfDriver ProcessorThrottleStateEvent C:\Windows\System32\drivers\processr.sys[PROCESSORWMI] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 9�b��5�
͝��C�� + �x! �5� c � WDMClassesOfDriver ProcessorAcpiCstState C:\Windows\System32\drivers\processr.sys[PROCESSORWMI] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 :�b��5�
͝��C�� & �x! �5� ^ � WDMClassesOfDriver ProcessorAcpiCst C:\Windows\System32\drivers\processr.sys[PROCESSORWMI] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ;�b��5�
͝��C�� * �x! �5� b � WDMClassesOfDriver ProcessorBiosCStates C:\Windows\System32\drivers\processr.sys[PROCESSORWMI] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 <�b��5�
͝��C�� 0 �x! �5� h � WDMClassesOfDriver ProcessorAcpiCsdDependency C:\Windows\System32\drivers\processr.sys[PROCESSORWMI] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 =�b��5�
͝��C�� & �x! �5� ^ � WDMClassesOfDriver ProcessorAcpiCsd C:\Windows\System32\drivers\processr.sys[PROCESSORWMI] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 >�b��5�
͝��C�� + �x! �5� c � WDMClassesOfDriver ProcessorAcpiTssState C:\Windows\System32\drivers\processr.sys[PROCESSORWMI] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ?�b��5�
͝��C�� & �x! �5� ^ � WDMClassesOfDriver ProcessorAcpiTss C:\Windows\System32\drivers\processr.sys[PROCESSORWMI] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 @�b��5�
͝��C�� * �x! �5� b � WDMClassesOfDriver ProcessorBiosTStates C:\Windows\System32\drivers\processr.sys[PROCESSORWMI] W i n 3 2 _ M S I R e s o u r c e �Н��C�� Win32_MSIResource ) ! ��! ) 1 : � � ���������������������U � Win32_PatchPackage Description The PatchPackage class describes all patch packages that have been applied to this product. For each patch package, the unique identifier for the patch is provided along with information about the media image the on which the patch is located. AMENDMENT LOCALE ms_409 PatchID )
� q � ��y � string Description The unique identifier for a patch package. ProductCode )
� � � ��� string Description The product code for the product to which this patch package is applied. � )
� q � ��y � string Description The unique identifier for a patch package. ProductCode )
� � � ��� string Description The product code for the product to which this patch package is applied. �tor.sys[MonitorWMI] dows\system32\kernelbase.dll[MofResourceName] ��9�` � �Z&Z � �f� � /���� l7� � W M I E v e n t �jj��� n WMIEvent
4 �� � �� � # ) Q Y � � � � 6 ? � � � K P � � R ` � � N ^ � � L U � � C J � �
V a >
I
�
�
! � � _UUUUU��������������������������������������������������������������������������������������������������������Q � MSMCAEvent_CPUError WMI WmiProv guid {5CE27CDE-D179-4c68-937F-A07B8CC2EA39} Active
� x boolean AdditionalErrors #
� � � uint32 WmiDataId BusSev C +
�
& ���� uint32 WmiDataId WmiMissingData BusType ? 8
� � � � � � ���� uint32 WmiDataId ValueMap � � � � � � � � � 0 1 2 3 4 5 6 7 8 WmiMissingData CacheMesi
7 8
� F N
Y c � ���� uint32 WmiDataId ValueMap w z } � 0 1 2 3 WmiMissingData CacheOp 3 8
� � � � � ; ���� uint32 WmiDataId ValueMap # & ) , / 2 5 8 0 1 2 3 4 5 6 7 WmiMissingData Cpu
� | � uint32 WmiDataId ErrorSeverity 8
� � � � � / 9 uint8 WmiDataId Values " Recoverable Fatal Correctable ValueMap I L O 0 1 2 InstanceName '
� � � �� � �� string Level / +
� � � � ���� uint32 WmiDataId WmiMissingData LogToEventlog '
� ; C uint32 WmiDataId MajorErrorType
+ E
� � � � � ! H V uint32 WmiDataId Values � � � � Cache TLB Bus Register File Microarchitecture ValueMap 9 < ? B E 0 1 2 3 4 DefineValues n � � � � MCACpuCacheError MCACpuTlbError MCACpuBusError MCACpuRegFileError MCACpuMSError MSArrayId W 8
� ' 1 < ���� uint32 WmiDataId ValueMap 9 0 WmiMissingData MSIndex [ +
� � � � ���� uint32 WmiDataId WmiMissingData MSOp S 8
� � 3 ���� uint32 WmiDataId ValueMap * - 0 0 1 2 WmiMissingData MSSid O +
� � � � ���� uint32 WmiDataId WmiMissingData RawRecord c +
� � � � uint8 WmiDataId WmiSizeIs Size RecordId
� C K uint64 WmiDataId RegFileId G 8
� � � � � .
���� uint32 WmiDataId ValueMap
"
&
*
0 1 2 3 4 5 6 7 8 9 10 11 12 13 WmiMissingData RegFileOp K 8
� �
�
�
�
�
���� uint32 WmiDataId ValueMap �
�
�
0 1 2 WmiMissingData Size _
� uint32 WmiDataId TLBOp ; 8
� g o z � � ���� uint32 WmiDataId ValueMap � � � � � � � � 0 1 2 3 4 5 6 7 WmiMissingData Type 8
� $ / 7 c m uint32 WmiDataId Values > 3
F
W
h
w
�
�
�
�
�
�
# 8 K b w � � � � � 3 U o � � � � 5 ] z � � � � - C W i � � � � � ' K n � � � � � � @ T MCA_WARNING_CACHE MCA_ERROR_CACHE MCA_WARNING_TLB MCA_ERROR_TLB MCA_WARNING_CPU_BUS MCA_ERROR_CPU_BUS MCA_WARNING_REGISTER_FILE MCA_ERROR_REGISTER_FILE MCA_WARNING_MAS MCA_ERROR_MAS MCA_WARNING_MEM_UNKNOWN MCA_ERROR_MEM_UNKNOWN MCA_WARNING_MEM_1_2 MCA_ERROR_MEM_1_2 MCA_WARNING_MEM_1_2_5 MCA_ERROR_MEM_1_2_5 MCA_WARNING_MEM_1_2_5_4 MCA_ERROR_MEM_1_2_5_4 MCA_WARNING_SYSTEM_EVENT MCA_ERROR_SYSTEM_EVENT MCA_WARNING_PCI_BUS_PARITY MCA_ERROR_PCI_BUS_PARITY MCA_WARNING_PCI_BUS_PARITY_NO_INFO MCA_ERROR_PCI_BUS_PARITY_NO_INFO MCA_WARNING_PCI_BUS_SERR MCA_ERROR_PCI_BUS_SERR MCA_WARNING_PCI_BUS_SERR_NO_INFO MCA_ERROR_PCI_BUS_SERR_NO_INFO MCA_WARNING_PCI_BUS_MASTER_ABORT MCA_ERROR_PCI_BUS_MASTER_ABORT MCA_WARNING_PCI_BUS_MASTER_ABORT_NO_INFO MCA_ERROR_PCI_BUS_MASTER_ABORT_NO_INFO MCA_WARNING_PCI_BUS_TIMEOUT MCA_ERROR_PCI_BUS_TIMEOUT MCA_WARNING_PCI_BUS_TIMEOUT_NO_INFO MCA_ERROR_PCI_BUS_TIMEOUT_NO_INFO MCA_WARNING_PCI_BUS_UNKNOWN MCA_ERROR_PCI_BUS_UNKNOWN MCA_WARNING_PCI_DEVICE MCA_ERROR_PCI_DEVICE MCA_WARNING_SMBIOS MCA_ERROR_SMBIOS MCA_WARNING_PLATFORM_SPECIFIC MCA_ERROR_PLATFORM_SPECIFIC MCA_WARNING_UNKNOWN MCA_ERROR_UNKNOWN MCA_WARNING_UNKNOWN_NO_CPU MCA_ERROR_UNKNOWN_NO_CPU MCA_WARNING_CMC_THRESHOLD_EXCEEDED MCA_WARNING_CPE_THRESHOLD_EXCEEDED MCA_WARNING_CPU_THERMAL_THROTTLED MCA_INFO_CPU_THERMAL_THROTTLING_REMOVED MCA_WARNING_CPU MCA_ERROR_CPU MCA_MEMORYHIERARCHY_ERROR MCA_TLB_ERROR MCA_BUS_ERROR MCA_BUS_TIMEOUT_ERROR MCA_INTERNALTIMER_ERROR MCA_MICROCODE_ROM_PARITY_ERROR MCA_EXTERNAL_ERROR MCA_FRC_ERROR ValueMap > i u � � � � � � � � � � � ) 5 A M Y e q } � � � � � � � � � �
% 1 = I U a m y � � � � � � � � � � � ! - 9 E 0x8005003C 0xC005003D 0x8005003E 0xC005003F 0x80050040 0xC0050041 0x80050042 0xC0050043 0x80050044 0xC0050045 0x80050046 0xC0050047 0x80050048 0xC0050049 0x8005004A 0xC005004B 0x8005004C 0xC005004D 0x8005004E 0xC005004F 0x80050050 0xC0050051 0x80050052 0xC0050053 0x80050054 0xC0050055 0x80050056 0xC0050057 0x80050058 0xC0050059 0x8005005A 0xC005005B 0x8005005C 0xC005005D 0x8005005E 0xC005005F 0x80050060 0xC0050061 0x80050062 0xC0050063 0x80050064 0xC0050065 0x80050066 0xC0050067 0x80050068 0xC0050069 0x8005006A 0xC005006B 0x8005006D 0x8005006E 0x8005006F 0x40050070 0x80050071 0xC0050072 0xC0050078 0xC0050079 0xC005007A 0xC005007B 0xC005007C 0xC005007D 0xC005007E 0xC005007F � W M I E v e n t
��jj��u WMIEvent
A �� � �� � ! * 0 X d l � � _������������������� � MSNdis_NotifyFilterRemoval WMI WMIProv guid {1f177cd9-5955-4721-9f6a-78ebdfaef889} WmiExpense Active
� � � �� boolean InstanceName '
� � � �� � �� string � W M I E v e n t ��jj��u WMIEvent
A �� � �� � ! * 0 X d l � � _������������������� � MSNdis_NotifyFilterArrival WMI WMIProv guid {0b6d3c89-5917-43ca-b578-d01a7967c41c} WmiExpense Active
� � � �� boolean InstanceName '
� � � �� � �� string � M S N d i s ��jj��� MSNdis A $ �� � �� � ) 2 8 ` l t � � ( U��������e � MSNdis_DeviceWakeOnMagicPacketOnly WMI WMIProv guid {a14f1c97-8839-4f8a-9996-a28996ebbf1d} WmiExpense Active
� � � �� boolean EnableWakeOnMagicPacketOnly 4
� � �� � �� boolean WmiDataId InstanceName '
� ] � �� � �� string �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 W�n�^��
͝��C�� 4 J.3�� i � WDMClassesOfDriver MSNdis_FddiShortCurrentAddress C:\Windows\system32\kernelbase.dll[MofResourceName] ] e] eName] � __thisNAMESPACE a-u� r �N�� � C�}�� � iH i�
{ �z�
q ��>{ � ��Ģ � ,��� y ��g�: T X e S q l P k g _ l o g _ c o n s u m e r _ a c t �[��7 �( & # XeSqlPkg_log_consumer_act ) � �� + 8 � 5 B � � � � _ p � � WU������������������������������������i � log_consumer_act EventType EventVersion activity_id P
� � � � ��� � � � & . uint32 WmiDataId XEMapId ValueMap � � �
# 8 0 9 7 4 5 12 13 3 1 11 2 10 6 Values j � � � � � � � ) ? W m ComputedNextLogBlock Constructed DerefedCurrentLogBlock GotNextBlock HasSetFutureInterest LockedLogBlock LogBlocksProcessed LogConsumerClosed LogConsumerEndedScan LogConsumerInited LogConsumerReadAhead LogConsumerStartedScan RefedCurrentLogBlock UnlockedLogBlock ActivityId
N
� � � � �� � ��$ / object:guid WmiDataId Description ActivityId ActivityID Extension Guid consumer_id )
� y � � �� uint64 WmiDataId database_id )
� � � � �� uint32 WmiDataId FragmentId 6
� 3 ; F S � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� 9 A L Y � �� uint32 WmiDataId Description SequenceNumber 13 � X e S q l P k g �[��7 �[ XeSqlPkg
C � �� + � � � � � � c����� � XeSqlPkg_log_pool_cache_miss Description Occurs when a log consumer attempts to lookup a block from the log pool but fails to find it. Guid {ed8f22eb-d958-43a3-ab12-9b232c1ff486} locale MS\0x409 DisplayName log_pool_cache_miss � X e S q l P k g _ l o g _ p o o l _ c a c h e _ m i s s �[��7 �� 3 & XeSqlPkg_log_pool_cache_miss ) � �� . : � � ; H � � f � � O _ WU�������������������������������������������������� � log_pool_cache_miss EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid consumer_id )
� ( 0 � �� uint64 WmiDataId database_id )
� � � �� uint32 WmiDataId FragmentId 6
� � � � � �� uint32 WmiDataId Description FragmentId log_block_id )
� S [ � �� uint64 WmiDataId pool_trunc_log_block_id ( )
� � � � �� uint64 WmiDataId RemainingLength 6
� & 1 > � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �[��7 �S XeSqlPkg
C � ��' 4 y � � � � c����� � XeSqlPkg_log_pool_push_no_free_buffer Description Occurs when log pool push fails to get a free buffer and bails out. Guid {078ccb6a-7332-4e4c-83ad-ac1e1c539a93} locale MS\0x409 DisplayName log_pool_push_no_free_buffer �% X e S q l P k g _ l o g _ p o o l _ p u s h _ n o _ f r e e _ b u f f e r �[��7 � ( / XeSqlPkg_log_pool_push_no_free_buffer ' ) � �� ) 7 C � � D Q � � * s � � } � WU��������������������������������������: � log_pool_push_no_free_buffer EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid consumer_id )
� 1 9 � �� uint64 WmiDataId database_id )
� � � � �� uint32 WmiDataId FragmentId 6
� � � � � �� uint32 WmiDataId Description FragmentId pushed_by_runtime $ )
� a h � �� sint8 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� M U ` m � �� uint32 WmiDataId Description SequenceNumber size_category P
� � � � ��� E L T uint32 WmiDataId XEMapId ValueMap 4 7 : = @ C F I 4 0 1 5 2 6 3 7 Values x � � � � � LOGBLOCKBUFFERSIZE_16K LOGBLOCKBUFFERSIZE_1K LOGBLOCKBUFFERSIZE_2K LOGBLOCKBUFFERSIZE_32K LOGBLOCKBUFFERSIZE_4K LOGBLOCKBUFFERSIZE_64K LOGBLOCKBUFFERSIZE_8K LOGBLOCKBUFFERSIZE_LASTENTRY � X e S q l P k g �[��7 �x XeSqlPkg
C � ��& 3 � � � � � � c���� � XeSqlPkg_log_block_persistence_reset Description Occurs along with the persistence status of a log block in a shared cache buffer being reset to persistent Guid {d079b8e4-1fe9-4936-befb-9367393707d3} locale MS\0x409 DisplayName log_block_persistence_reset �$ X e S q l P k g _ l o g _ b l o c k _ p e r s i s t e n c e _ r e s e t �[��7 �F * . XeSqlPkg_log_block_persistence_reset & ) � �� ( 6 B � � C P � � $ n � WU����������������������������������������x � log_block_persistence_reset EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid consumer_id )
� 0 8 � �� uint64 WmiDataId database_id )
� � � � �� uint32 WmiDataId FragmentId 6
� � � �
� �� uint32 WmiDataId Description FragmentId log_block_id )
� [ c � �� uint64 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� H P [ h � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �[��7 �Q XeSqlPkg
C � �� & � � � � � � c����� � XeSqlPkg_log_block_move Description Occurs along with a log block in a shared cache buffer being moved within the replacement set Guid {1345aea2-e395-411f-a2eb-1d8bfb1df199} locale MS\0x409 DisplayName log_block_move � X e S q l P k g j]��7 �, XeSqlPkg
C � ��' 4 R X � � � � c����� � XeSqlPkg_always_encrypted_query_count Description Query using Always Encrypted Guid {9dc67280-1f94-43b8-940f-653a51a92ced} locale MS\0x409 DisplayName always_encrypted_query_count �unt �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�� 5 �\>�S}� j � WDMClassesOfDriver WmiMonitorListedFrequencyRanges C:\Windows\system32\kernelbase.dll[MofResourceName] Name] DisplayName metadata_agent_catalog_updated � 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�y ! )ߝ�t � V � WDMClassesOfDriver MMCSSWakeup C:\Windows\system32\kernelbase.dll[MofResourceName] fResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�y ! )ߝ�t � V � WDMClassesOfDriver MMCSSWakeup C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�z " )ߝ�t � W � WDMClassesOfDriver HV_Hypercall C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� , )ߝ�t � a � WDMClassesOfDriver UmsDirectedSwitchStart C:\Windows\system32\kernelbase.dll[MofResourceName] me] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� , )ߝ�t � a � WDMClassesOfDriver UmsDirectedSwitchStart C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�} % )ߝ�t � Z � WDMClassesOfDriver UmsDisassociate C:\Windows\system32\kernelbase.dll[MofResourceName] ll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�} % )ߝ�t � Z � WDMClassesOfDriver UmsDisassociate C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�z " )ߝ�t � W � WDMClassesOfDriver MSTapeDriver C:\Windows\system32\kernelbase.dll[MofResourceName] dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�z " )ߝ�t � W � WDMClassesOfDriver MSTapeDriver C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�~ & )ߝ�t � [ � WDMClassesOfDriver MSTapeDriveParam C:\Windows\system32\kernelbase.dll[MofResourceName] fResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�~ & )ߝ�t � [ � WDMClassesOfDriver MSTapeDriveParam C:\Windows\system32\kernelbase.dll[MofResourceName] ceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�~ & )ߝ�t � [ � WDMClassesOfDriver MSTapeDriveParam C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�~ & )ߝ�t � [ � WDMClassesOfDriver MSTapeDriveParam C:\Windows\system32\kernelbase.dll[MofResourceName] urceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�~ & )ߝ�t � [ � WDMClassesOfDriver MSTapeDriveParam C:\Windows\system32\kernelbase.dll[MofResourceName] urceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�~ & )ߝ�t � [ � WDMClassesOfDriver MSTapeDriveParam C:\Windows\system32\kernelbase.dll[MofResourceName] fResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�~ & )ߝ�t � [ � WDMClassesOfDriver MSTapeDriveParam C:\Windows\system32\kernelbase.dll[MofResourceName] ll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�~ & )ߝ�t � [ � WDMClassesOfDriver MSTapeDriveParam C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� ) )ߝ�t � ^ � WDMClassesOfDriver MSTapeMediaCapacity C:\Windows\system32\kernelbase.dll[MofResourceName] ame] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� ) )ߝ�t � ^ � WDMClassesOfDriver MSTapeMediaCapacity C:\Windows\system32\kernelbase.dll[MofResourceName] ceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� ) )ߝ�t � ^ � WDMClassesOfDriver MSTapeMediaCapacity C:\Windows\system32\kernelbase.dll[MofResourceName] ceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� ) )ߝ�t � ^ � WDMClassesOfDriver MSTapeMediaCapacity C:\Windows\system32\kernelbase.dll[MofResourceName] ame] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� ) )ߝ�t � ^ � WDMClassesOfDriver MSTapeMediaCapacity C:\Windows\system32\kernelbase.dll[MofResourceName] esourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� ) )ߝ�t � ^ � WDMClassesOfDriver MSTapeMediaCapacity C:\Windows\system32\kernelbase.dll[MofResourceName] ceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� ) )ߝ�t � ^ � WDMClassesOfDriver MSTapeMediaCapacity C:\Windows\system32\kernelbase.dll[MofResourceName] rceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� ) )ߝ�t � ^ � WDMClassesOfDriver MSTapeMediaCapacity C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� - )ߝ�t � b � WDMClassesOfDriver MSTapeDriveProblemEvent C:\Windows\system32\kernelbase.dll[MofResourceName] ourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� - )ߝ�t � b � WDMClassesOfDriver MSTapeDriveProblemEvent C:\Windows\system32\kernelbase.dll[MofResourceName] me] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� - )ߝ�t � b � WDMClassesOfDriver MSTapeDriveProblemEvent C:\Windows\system32\kernelbase.dll[MofResourceName] string Description Source File Name Text
� 5 = J string Description Text � � �n ID � ��9�P � �Z&J � �f� � /���� W M I E v e n t �jj��� n WMIEvent
4 �� � �� � # ) Q Y � � � � 6 ? � � � K P � � R ` � � N ^ � � L U � � C J � �
V a >
I
�
�
! � � _UUUUU��������������������������������������������������������������������������������������������������������Q � MSMCAEvent_CPUError WMI WmiProv guid {5CE27CDE-D179-4c68-937F-A07B8CC2EA39} Active
� x boolean AdditionalErrors #
� � � uint32 WmiDataId BusSev C +
�
& ���� uint32 WmiDataId WmiMissingData BusType ? 8
� � � � � � ���� uint32 WmiDataId ValueMap � � � � � � � � � 0 1 2 3 4 5 6 7 8 WmiMissingData CacheMesi
7 8
� F N
Y c � ���� uint32 WmiDataId ValueMap w z } � 0 1 2 3 WmiMissingData CacheOp 3 8
� � � � � ; ���� uint32 WmiDataId ValueMap # & ) , / 2 5 8 0 1 2 3 4 5 6 7 WmiMissingData Cpu
� | � uint32 WmiDataId ErrorSeverity 8
� � � � � / 9 uint8 WmiDataId Values " Recoverable Fatal Correctable ValueMap I L O 0 1 2 InstanceName '
� � � �� � �� string Level / +
� � � � ���� uint32 WmiDataId WmiMissingData LogToEventlog '
� ; C uint32 WmiDataId MajorErrorType
+ E
� � � � � ! H V uint32 WmiDataId Values � � � � Cache TLB Bus Register File Microarchitecture ValueMap 9 < ? B E 0 1 2 3 4 DefineValues n � � � � MCACpuCacheError MCACpuTlbError MCACpuBusError MCACpuRegFileError MCACpuMSError MSArrayId W 8
� ' 1 < ���� uint32 WmiDataId ValueMap 9 0 WmiMissingData MSIndex [ +
� � � � ���� uint32 WmiDataId WmiMissingData MSOp S 8
� � 3 ���� uint32 WmiDataId ValueMap * - 0 0 1 2 WmiMissingData MSSid O +
� � � � ���� uint32 WmiDataId WmiMissingData RawRecord c +
� � � � uint8 WmiDataId WmiSizeIs Size RecordId
� C K uint64 WmiDataId RegFileId G 8
� � � � � .
���� uint32 WmiDataId ValueMap
"
&
*
0 1 2 3 4 5 6 7 8 9 10 11 12 13 WmiMissingData RegFileOp K 8
� �
�
�
�
�
���� uint32 WmiDataId ValueMap �
�
�
0 1 2 WmiMissingData Size _
� uint32 WmiDataId TLBOp ; 8
� g o z � � ���� uint32 WmiDataId ValueMap � � � � � � � � 0 1 2 3 4 5 6 7 WmiMissingData Type 8
� $ / 7 c m uint32 WmiDataId Values > 3
F
W
h
w
�
�
�
�
�
�
# 8 K b w � � � � � 3 U o � � � � 5 ] z � � � � - C W i � � � � � ' K n � � � � � � @ T MCA_WARNING_CACHE MCA_ERROR_CACHE MCA_WARNING_TLB MCA_ERROR_TLB MCA_WARNING_CPU_BUS MCA_ERROR_CPU_BUS MCA_WARNING_REGISTER_FILE MCA_ERROR_REGISTER_FILE MCA_WARNING_MAS MCA_ERROR_MAS MCA_WARNING_MEM_UNKNOWN MCA_ERROR_MEM_UNKNOWN MCA_WARNING_MEM_1_2 MCA_ERROR_MEM_1_2 MCA_WARNING_MEM_1_2_5 MCA_ERROR_MEM_1_2_5 MCA_WARNING_MEM_1_2_5_4 MCA_ERROR_MEM_1_2_5_4 MCA_WARNING_SYSTEM_EVENT MCA_ERROR_SYSTEM_EVENT MCA_WARNING_PCI_BUS_PARITY MCA_ERROR_PCI_BUS_PARITY MCA_WARNING_PCI_BUS_PARITY_NO_INFO MCA_ERROR_PCI_BUS_PARITY_NO_INFO MCA_WARNING_PCI_BUS_SERR MCA_ERROR_PCI_BUS_SERR MCA_WARNING_PCI_BUS_SERR_NO_INFO MCA_ERROR_PCI_BUS_SERR_NO_INFO MCA_WARNING_PCI_BUS_MASTER_ABORT MCA_ERROR_PCI_BUS_MASTER_ABORT MCA_WARNING_PCI_BUS_MASTER_ABORT_NO_INFO MCA_ERROR_PCI_BUS_MASTER_ABORT_NO_INFO MCA_WARNING_PCI_BUS_TIMEOUT MCA_ERROR_PCI_BUS_TIMEOUT MCA_WARNING_PCI_BUS_TIMEOUT_NO_INFO MCA_ERROR_PCI_BUS_TIMEOUT_NO_INFO MCA_WARNING_PCI_BUS_UNKNOWN MCA_ERROR_PCI_BUS_UNKNOWN MCA_WARNING_PCI_DEVICE MCA_ERROR_PCI_DEVICE MCA_WARNING_SMBIOS MCA_ERROR_SMBIOS MCA_WARNING_PLATFORM_SPECIFIC MCA_ERROR_PLATFORM_SPECIFIC MCA_WARNING_UNKNOWN MCA_ERROR_UNKNOWN MCA_WARNING_UNKNOWN_NO_CPU MCA_ERROR_UNKNOWN_NO_CPU MCA_WARNING_CMC_THRESHOLD_EXCEEDED MCA_WARNING_CPE_THRESHOLD_EXCEEDED MCA_WARNING_CPU_THERMAL_THROTTLED MCA_INFO_CPU_THERMAL_THROTTLING_REMOVED MCA_WARNING_CPU MCA_ERROR_CPU MCA_MEMORYHIERARCHY_ERROR MCA_TLB_ERROR MCA_BUS_ERROR MCA_BUS_TIMEOUT_ERROR MCA_INTERNALTIMER_ERROR MCA_MICROCODE_ROM_PARITY_ERROR MCA_EXTERNAL_ERROR MCA_FRC_ERROR ValueMap > i u � � � � � � � � � � � ) 5 A M Y e q } � � � � � � � � � �
% 1 = I U a m y � � � � � � � � � � � ! - 9 E 0x8005003C 0xC005003D 0x8005003E 0xC005003F 0x80050040 0xC0050041 0x80050042 0xC0050043 0x80050044 0xC0050045 0x80050046 0xC0050047 0x80050048 0xC0050049 0x8005004A 0xC005004B 0x8005004C 0xC005004D 0x8005004E 0xC005004F 0x80050050 0xC0050051 0x80050052 0xC0050053 0x80050054 0xC0050055 0x80050056 0xC0050057 0x80050058 0xC0050059 0x8005005A 0xC005005B 0x8005005C 0xC005005D 0x8005005E 0xC005005F 0x80050060 0xC0050061 0x80050062 0xC0050063 0x80050064 0xC0050065 0x80050066 0xC0050067 0x80050068 0xC0050069 0x8005006A 0xC005006B 0x8005006D 0x8005006E 0x8005006F 0x40050070 0x80050071 0xC0050072 0xC0050078 0xC0050079 0xC005007A 0xC005007B 0xC005007C 0xC005007D 0xC005007E 0xC005007F � W M I E v e n t
��jj��u WMIEvent
A �� � �� � ! * 0 X d l � � _������������������� � MSNdis_NotifyFilterRemoval WMI WMIProv guid {1f177cd9-5955-4721-9f6a-78ebdfaef889} WmiExpense Active
� � � �� boolean InstanceName '
� � � �� � �� string � W M I E v e n t ��jj��u WMIEvent
A �� � �� � ! * 0 X d l � � _������������������� � MSNdis_NotifyFilterArrival WMI WMIProv guid {0b6d3c89-5917-43ca-b578-d01a7967c41c} WmiExpense Active
� � � �� boolean InstanceName '
� � � �� � �� string � M S N d i s ��jj��� MSNdis A $ �� � �� � ) 2 8 ` l t � � ( U��������e � MSNdis_DeviceWakeOnMagicPacketOnly WMI WMIProv guid {a14f1c97-8839-4f8a-9996-a28996ebbf1d} WmiExpense Active
� � � �� boolean EnableWakeOnMagicPacketOnly 4
� � �� � �� boolean WmiDataId InstanceName '
� ] � �� � �� string �ing �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� 4 �\>�S}� i � WDMClassesOfDriver MSNdis_FddiLongMaximumListSize C:\Windows\system32\kernelbase.dll[MofResourceName] ] e] eName] � __thisNAMESPACE �M�ˠ � �J(9 � � ��� � �C+X � �]n�� u �z�@N � �%>S� ] 0+[�3 � ��n7� � 7 X e S q l P k g _ q u e r y _ n o _ c q s c a n _ c a c h e _ d u e _ t o _ m e m o r y _ l i m i t a t i o n �X��7 � " A XeSqlPkg_query_no_cqscan_cache_due_to_memory_limitation 9 ) � ��0 ; I U � ] i � � _ t � � W��������������������������������B � query_no_cqscan_cache_due_to_memory_limitation EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid cache_threshold_kb )
� J R � �� uint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� . 6 A N � �� uint32 WmiDataId Description RemainingLength requested_memory_kb )
� � � � �� uint64 WmiDataId SequenceNumber 6
� % 2 � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �X��7 �n XeSqlPkg
C � ��6 C � � � � � � c����� � XeSqlPkg_query_execution_get_batch_from_column_store Description Occurs when column store scan get one batch in batch processing. Guid {7ef7e15d-35aa-4049-b2d9-8f9925f8d88f} locale MS\0x409 DisplayName query_execution_get_batch_from_column_store �4 X e S q l P k g _ q u e r y _ e x e c u t i o n _ g e t _ b a t c h _ f r o m _ c o l u m n _ s t o r e �X��7 � > XeSqlPkg_query_execution_get_batch_from_column_store 6 ) � ��- 8 F R � x � � � 5 F � � W����������������������������? � query_execution_get_batch_from_column_store EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid FragmentId 6
� L T _ l � �� uint32 WmiDataId Description FragmentId query_operator_node_id )
� � � � �� sint32 WmiDataId query_thread_id )
� " * � �� sint32 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� " / � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �X��7 �Y XeSqlPkg
C � ��' 4 � � � � � c����� � XeSqlPkg_query_execution_batch_filter Description Occurs when batch processing filters one batch using expression services. Guid {1e70ed15-b99b-4d49-8f78-267f7b2e1f48} locale MS\0x409 DisplayName query_execution_batch_filter �% X e S q l P k g _ q u e r y _ e x e c u t i o n _ b a t c h _ f i l t e r �X��7 � ( / XeSqlPkg_query_execution_batch_filter ' ) � �� ) 7 C � � i u � � % o � � � , = � � WU��������������������������������������6 � query_execution_batch_filter EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid FragmentId 6
� = E P ] � �� uint32 WmiDataId Description FragmentId input_rows )
� � � � �� sint32 WmiDataId is_prefiltered $ )
�
� �� sint8 WmiDataId output_rows )
� \ d � �� sint32 WmiDataId query_operator_node_id )
� � � � �� sint32 WmiDataId query_thread_id )
� ! � �� sint32 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� & � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �X��7 �` XeSqlPkg
C � ��+ 8 � � � � � � c����� � XeSqlPkg_query_execution_switch_partition Description Occurs when column store scan does switch partition in batch processing. Guid {6753e24d-1db0-4f37-b2c7-398db758bf90} locale MS\0x409 DisplayName query_execution_switch_partition �) X e S q l P k g _ q u e r y _ e x e c u t i o n _ s w i t c h _ p a r t i t i o n �X��7 �� 3 XeSqlPkg_query_execution_switch_partition + ) � ��" - ; G � � m � � � * ; � � W����������������������������4 � query_execution_switch_partition EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid FragmentId 6
� A I T a � �� uint32 WmiDataId Description FragmentId query_operator_node_id )
� � � � �� sint32 WmiDataId query_thread_id )
� � �� sint32 WmiDataId RemainingLength 6
� � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� $ � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �X��7 �h XeSqlPkg
C � ��; H z � � � � � c����� � XeSqlPkg_query_execution_print_partition_elimination_info Description Occurs when partition elimination info is built. Guid {d1066366-778e-442f-b60f-00e0c6d6bf63} locale MS\0x409 DisplayName query_execution_print_partition_elimination_info �9 X e S q l P k g _ q u e r y _ e x e c u t i o n _ p r i n t _ p a r t i t i o n _ e l i m i n a t i o n _ i n f o �X��7 �N C XeSqlPkg_query_execution_print_partition_elimination_info ; ) � ��2 = K W
} � + u � � W���������������������������� � query_execution_print_partition_elimination_info EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid FragmentId 6
� Q Y d q � �� uint32 WmiDataId Description FragmentId partition_elimination_info 6
� � � � ��� string WmiDataId StringTermination NullTerminated query_operator_node_id )
� b j � �� sint32 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� O W b o � �� uint32 WmiDataId Description SequenceNumber �ber �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�� * �\>�S}� _ � WDMClassesOfDriver TP_V2_TimerCancelled C:\Windows\system32\kernelbase.dll[MofResourceName] sourceName] G��ޠ � !glwZ � A��T � P��)+ � (��h � ʙ�� � ��� f ���E � Q < u��jj��� ) � " @ ��K S [ n � } � � � U������������������������� � IdleStateAccounting Description Kernel Idle State Accounting AMENDMENT LOCALE ms_409 FailedTransitions +
� � � � � � � � uint32 DisplayName FailedTransitions Description FailedTransitions IdleTimeBuckets +
� 9 A � N _ � l uint32 DisplayName IdleTimeBuckets Description IdleTimeBuckets IdleTransitions +
� � � � � � � � uint32 DisplayName IdleTransitions Description IdleTransitions InvalidBucketIndex +
� X ` � m � � � uint32 DisplayName InvalidBucketIndex Description InvalidBucketIndex TotalTime +
� � � � � � uint64 DisplayName TotalTime Description TotalTime � W M I E v e n t v��jj��� & WMIEvent
) � 5 ��@ H P \ � � K R
� � _������������������������������������4 � IdleAccounting Description Kernel Idle Accounting AMENDMENT LOCALE ms_409 ResetCount +
� � � � � � � � uint32 DisplayName ResetCount Description ResetCount StartTime +
� � ( 3 � @ uint64 DisplayName StartTime Description StartTime State
+
� � � � � � � � object:IdleStateAccounting DisplayName Idle States Accounting Description Accounting Data for Kernel Idle States StateCount +
� F N � [ r � uint32 DisplayName Number of Idle States Description Total number of Kernel Idle States TotalTransitions +
� � � � � " uint32 DisplayName TotalTransitions Description TotalTransitions � w��jj��� ) � C ��N V ^ e � � J U � � U��������������������H � IdleStateBucketEx Description Kernel Idle State Bucket Extended AMENDMENT LOCALE ms_409 Count +
� � � � � � � � uint32 DisplayName Count Description Count MaxTimeUs +
� � ' 2 � ? uint32 DisplayName MaxTimeUs Description MaxTimeUs MinTimeUs +
� � � � � � � � uint32 DisplayName MinTimeUs Description MinTimeUs TotalTimeUs +
� � ! . � ; uint64 DisplayName TotalTimeUs Description TotalTimeUs � x��jj��� " ) � $ B ��M U ] p � � � 3 � � 2 = � � U��������������������������������* � IdleStateAccountingEx Description Kernel Idle State Accounting AMENDMENT LOCALE ms_409 FailedTransitions +
� � � � � � � � uint32 DisplayName FailedTransitions Description FailedTransitions IdleTimeBuckets
+
� ; U � b s � � object:IdleStateBucketEx DisplayName IdleTimeBuckets Description IdleTimeBuckets IdleTransitions +
� � � � � � uint32 DisplayName IdleTransitions Description IdleTransitions InvalidBucketIndex +
� l t � � � � � uint32 DisplayName InvalidBucketIndex Description InvalidBucketIndex MaxTimeUs +
� � � � ' uint32 DisplayName MaxTimeUs Description MaxTimeUs MinTimeUs +
� v ~ � � � � � uint32 DisplayName MinTimeUs Description MinTimeUs TotalTime +
� � � � � uint64 DisplayName TotalTime Description TotalTime � W M I E v e n t y��jj��� & WMIEvent
) � 7 ��B J R ^ � � M T � � _������������������������������������8 � IdleAccountingEx Description Kernel Idle Accounting AMENDMENT LOCALE ms_409 ResetCount +
� � � � � � � � uint32 DisplayName ResetCount Description ResetCount StartTime +
� � * 5 � B uint64 DisplayName StartTime Description StartTime State
+
� � � � � � � � object:IdleStateAccountingEx DisplayName Idle States Accounting Description Accounting Data for Kernel Idle States StateCount +
� J R � _ v � � uint32 DisplayName Number of Idle States Description Total number of Kernel Idle States TotalTransitions +
� � � � � & uint32 DisplayName TotalTransitions Description TotalTransitions � W M I E v e n t z��jj��� WMIEvent
��& . 6 C � � _���������������������G � KernelThermalPolicyChange AMENDMENT LOCALE ms_409 CoolingMode +
� | � � � � � � uint8 DisplayName Cooling Policy Description Current ACPI Cooling Mode Processors
+
�
� " . � ; uint64 DisplayName Processors Description Processors � W i n 3 2 _ P e r f R a w D a t a {��jj��,
Win32_PerfRawData 6 � # F � S j ��u } � � B N �������������� � ProcessorPerformance Description Processor Performance Information DisplayName Processor Performance AMENDMENT LOCALE ms_409 frequency +
� � � � � � � uint32 DisplayName Processor Frequency Description Processor Frequency is the frequency of the current processor in megahertz. Some processors are capable of regulating their frequency outside of the control of Windows. Processor Frequency will not accurately reflect actual processor frequency on these systems. Use Processor Information\% Processor Performance instead. percentage +
� � � � � � � � uint32 DisplayName % of Maximum Frequency Description % of Maximum Frequency is the percentage of the current processor's maximum frequency. Some processors are capable of regulating their frequency outside of the control of Windows. % of Maximum Frequency will not accurately reflect actual processor frequency on these systems. Use Processor Information\% Processor Performance instead. power +
� Q Y � f } � � uint32 DisplayName Processor State Flags Description Processor State Flags � T R C _ O B J E C T S jN��7 �� � TRC_OBJECTS
���������������������������������������������������������������������������������������������������������������������������������������������������������������� � OBJECT_CREATED �" R O O T \ M i c r o s o f t \ W i n d o w s \ D e v i c e G u a r d _ _ I n s t a n c e P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 9 4 5 D C C 5 B 6 4 9 B A 9 B D 8 0 D 7 3 7 3 0 1 9 A 6 9 9 C 2 6 D E 9 3 F 0 9 F 1 1 2 9 2 B C F C C C D 2 6 8 5 C 5 3 C A E E \ K I _ E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C \ I _ D 1 7 C 3 2 F 2 2 5 8 6 C 7 F F 6 8 3 7 7 F 9 A 8 2 D A 7 9 B F 8 D 5 4 B B 4 4 5 B 3 8 7 B 5 9 5 E 6 4 C 5 1 5 C C 0 3 4 A 7 D 4 A 7 D 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� / �\>�S}� d � WDMClassesOfDriver MSNdis_FddiAttachmentType C:\Windows\system32\kernelbase.dll[MofResourceName] Name] Name] Name] e] OBJECT_CREATED � � O�� u �Q � � ?/f� 8 ���% | ͚��
� u?��z q �ĭ�� � ��ɬ� h ��> [ X e S q l P k g _ m b r _ o u t c o m e _ r e s o l u t i o n X��7 � 0 ) XeSqlPkg_mbr_outcome_resolution ! ) � �� # 1 = � � < O � � � c o � � 6 G � � WU����������������������������������������������@ � mbr_outcome_resolution EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid age_value % )
� ) 1 � �� sint64 WmiDataId federated_xact_id )
� � � � �� sint64 WmiDataId federated_xact_node_id )
� � � � �� uint32 WmiDataId federated_xact_node_local_id )
� P X � �� sint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId is_committed $ )
� $ + � �� sint8 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� # 0 � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g X��7 �� XeSqlPkg
C � �� - � � * c����A � XeSqlPkg_mbr_resolution_counts Description Occurs when matrix restore recovery has completed. It may not occur if there are no in-doubt transactions with commit outcomes to be processed during matrix restore recovery. Guid {339D0774-F237-4331-847C-772366B785B2} locale MS\0x409 DisplayName mbr_resolution_counts � X e S q l P k g _ m b r _ r e s o l u t i o n _ c o u n t s X��7 �� ( XeSqlPkg_mbr_resolution_counts ) � �� " 0 < � � b s � � I b � � W����������������������������0 � mbr_resolution_counts EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid FragmentId 6
� 6 > I V � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength resolved_commit_count )
� 6 > � �� uint32 WmiDataId resolved_rollback_count )
� � � � �� uint32 WmiDataId SequenceNumber 6
� � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g X��7 �T XeSqlPkg
C � ��+ 8 v | � � � � c����� � XeSqlPkg_backup_restore_startlsn_recorded Description Occurs when a backup restore operation recorded the startLSN Guid {C47F5A38-E94D-496C-9029-A696740DE2E6} locale MS\0x409 DisplayName backup_restore_startlsn_recorded �) X e S q l P k g _ b a c k u p _ r e s t o r e _ s t a r t l s n _ r e c o r d e d X��7 �o 3 XeSqlPkg_backup_restore_startlsn_recorded + ) � ��" - ; G � � m ~ � w � W����������������������������� � backup_restore_startlsn_recorded EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid FragmentId 6
� A I T a � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� G O Z g � �� uint32 WmiDataId Description SequenceNumber serepllsn C
� � � � ��� � string WmiDataId StringTermination NullTerminated Format w startlsn C
� o w � ��� � � � string WmiDataId StringTermination NullTerminated Format w � X e S q l P k g
X��7 �I XeSqlPkg
C � ��+ 8 k q � � � � c����� � XeSqlPkg_backup_restore_before_filestream Description Occurs just before the file stream backup starts. Guid {E8B4A4BF-CAF1-4BCC-9493-9A0208B886CD} locale MS\0x409 DisplayName backup_restore_before_filestream �) X e S q l P k g _ b a c k u p _ r e s t o r e _ b e f o r e _ f i l e s t r e a m X��7 �� 3 XeSqlPkg_backup_restore_before_filestream + ) � ��" - ; G � � H T � � J Z W�������������������������� � backup_restore_before_filestream EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� 5 = � �� uint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� ! , 9 � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g X��7 �@ XeSqlPkg
C � ��, 9 a g � � � � c����� � XeSqlPkg_metadata_create_local_temp_object Description Metadata create local temporary object Guid {D671B7C7-EB71-4546-8E87-A5C524AF8DC7} locale MS\0x409 DisplayName metadata_create_local_temp_object �* X e S q l P k g _ m e t a d a t a _ c r e a t e _ l o c a l _ t e m p _ o b j e c t
X��7 �� ' 4 XeSqlPkg_metadata_create_local_temp_object , ) � ��# . < H � � F R � � $ � � < L � � WU������������������������������������� � metadata_create_local_temp_object EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid brick_id )
� 3 ; � �� uint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId object_id )
� � �� uint32 WmiDataId object_name C
� u } � ��� � � � string WmiDataId StringTermination NullTerminated Format w RemainingLength 6
� + � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber session_id )
� � �� uint32 WmiDataId �aId �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�� + �\>�S}� ` � WDMClassesOfDriver TP_V2_PoolCreateClose C:\Windows\system32\kernelbase.dll[MofResourceName] rceName] me] �vd�@ � � �� } >��M 9 $ X e S q l P k g _ h a d r _ t r a n s p o r t _ d u m p _ m e s s a g e Y��7 �0 L . XeSqlPkg_hadr_transport_dump_message & ) � �� ( 6 M � � M d � � U j � � S r � � \ j � � n � � � � � s � WUUU������������������������������������������������������������������������ � hadr_transport_dump_message EventType EventVersion acknowledgment_number $ )
� � � � �� uint64 WmiDataId ActivityId
N
� � $ 0 �� � ��< G object:guid WmiDataId Description ActivityId ActivityID Extension Guid availability_group_id
4 6
� � � � ��� � object:guid WmiDataId Extension Guid connection_session_id
@ 6
� , 9 � ��D O object:guid WmiDataId Extension Guid database_replica_id
D 6
� � � � ��� � object:guid WmiDataId Extension Guid FragmentId 6
� ' / : G � �� uint32 WmiDataId Description FragmentId local_availability_replica_id
8 6
� � � � ��� � object:guid WmiDataId Extension Guid message_log_id
0 6
� 3 @
� ��K V object:guid WmiDataId Extension Guid message_type , P
� � � � ��� j � � 8 @ uint32 WmiDataId XEMapId ValueMap * � � � � � � � � � � � � � � � � � � � � � � � � � � � �
$ ( , 0 4 25 24 3 4 1 2 41 19 36 8 28 27 16 15 20 21 23 22 0 9 18 17 11 38 14 13 39 6 30 35 12 32 29 7 31 5 34 33 26 40 37 10 Values * � 6 M c | � � � �
9 U x � � � � � / U p � � � � � � )
H
n
�
�
�
�
�
5 O m HadrMsgTypeBackupInfoMsg HadrMsgTypeBackupSyncMsg HadrMsgTypeConfigAck HadrMsgTypeConfigFail HadrMsgTypeConfigSyn HadrMsgTypeConfigSynAck HadrMsgTypeCount HadrMsgTypeDBReplicaStatusChange HadrMsgTypeDownloadAgConfigMsg HadrMsgTypeEstablishDB HadrMsgTypeExtendedRecoveryForksMsg HadrMsgTypeExtendedRecoveryForksRequestMsg HadrMsgTypeFileMetadataMsg HadrMsgTypeFileMetadataRequestMsg HadrMsgTypeFsBlockEndMsg HadrMsgTypeFsDirCreateMsg HadrMsgTypeFsFileDataMsg HadrMsgTypeFsFileRequestMsg HadrMsgTypeInvalid HadrMsgTypeLogBlockMsg HadrMsgTypeLogFileMetadataMsg HadrMsgTypeLogFileMetadataRequestMsg HadrMsgTypeLogProgressMsg HadrMsgTypeOfflinePrimaryAg HadrMsgTypePageCopyMsg HadrMsgTypePageRequestMsg HadrMsgTypePaxosMsg HadrMsgTypePing HadrMsgTypePreConfigMsg HadrMsgTypePreConfigReceivedAndConfigSyn HadrMsgTypePrimaryProgressMsg HadrMsgTypePrimaryReplicaFileListMsg HadrMsgTypePrimaryReplicaInfoMsg HadrMsgTypePrimarySync HadrMsgTypeReportFaultOnReplica HadrMsgTypeReset HadrMsgTypeSeedingCancelMsg HadrMsgTypeSeedingRequestMsg HadrMsgTypeSyncLogProgressMsg HadrMsgTypeTestConfigMsg HadrMsgTypeUpdateAgConfigMsg HadrMsgTypeVLFHeaderMsg operation P
� � � � �� h 5 = uint32 WmiDataId XEMapId ValueMap ) , / 2 2 1 0 3 Values Q W ] c Drop Recv Send TypeCount operation_reason P
� � � � ��� i �
� � uint32 WmiDataId XEMapId ValueMap 3 �
�
�
�
�
�
�
�
�
�
�
�
$ ( , 0 4 8 < @ D G K O R U Y ] ` c g k n r v z ~ � � � � � 27 5 43 45 41 17 42 48 46 20 10 40 15 24 35 9 8 39 21 7 16 28 49 22 50 47 38 37 11 0 18 19 6 4 26 25 1 3 30 12 2 23 13 14 31 29 33 32 36 34 44 Values 3 n � � � � � 2 B U g � � � � � � : K c � � � � � � , A T h y � � � � � � 6 M b r � � � � � � AckForUnsentMessage ArriveAtCaptureApplyLayer DeferringLogMessageToPendingList DuplicateLogMessageReceived DuplicatePrimaryConfigMessage FailedPartnerCreate FailedToProcessPrimaryConfigMsg FileStreamDrop InconsistentAckNo InvalidConfigDbr InvalidConfigStateChange InvalidDatabaseCopyOperation InvalidDbr InvalidMessageFormat InvalidMessageFormatPartner InvalidMessageType InvalidReplicaObject InvalidReplicaStateForProcessingPrimaryConfigMsg InvalidSynSeqNo InvalidTransportObject InvalidTransportPartnerCreate InvalidUnmarshallCall LogBlockSuccessfullyAddedToMap MemoryAllocationFailure MessageLogReasonCount MessageTooLarge MismatchedLocalArId MismatchedPrimaryGeneration MismatchedSessionId NoReasonSpecified NoSessionAvailable NullSessionGuid PingReceived QueuedToPartner ReplicaCannotReceiveMessages ReplicaDestructing ResendDueToUCSSendFailure RoutableMessage ScanVersionMismatch SeqNoOutOfOrder SuccessfullyUnmarshalled TaskSchedulingFailure TraceFlagRandomDrop TraceFlagReset UcsSendFailure UnableToAllocate UnableToRouteFsMsg UnableToRouteLogMsg UnsupportedMessageVersion UnsupportedPartnerMsgType VlfSuccessfullyAddedToMap RemainingLength 6
� c k v � � �� uint32 WmiDataId Description RemainingLength sequence_number )
� � � � �� uint64 WmiDataId SequenceNumber 6
� C K V c � �� uint32 WmiDataId Description SequenceNumber target_availability_replica_id
< 6
� � �
� ��� � object:guid WmiDataId Extension Guid � X e S q l P k g
Y��7 �U XeSqlPkg
C � ��- : u { � � � � c����� � XeSqlPkg_hadr_transport_dump_config_message Description Use this event to help trace HADR configuration messages. Guid {9E77198D-6F7E-49CA-8F22-D48FF62FA7D5} locale MS\0x409 DisplayName hadr_transport_dump_config_message �% X e S q l P k g _ h a d r _ t r a n s p o r t _ r e p l i c a _ r e s e t Y��7 �� " / XeSqlPkg_hadr_transport_replica_reset ' ) � �� ) 7 C � q } � y � � � � WU�������������������������������� � hadr_transport_replica_reset EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid availability_group_id
6
� H U � ��` k object:guid WmiDataId Extension Guid FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId local_availability_replica_id
6
� P ] � ��h s object:guid WmiDataId Extension Guid RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� S [ f s � �� uint32 WmiDataId Description SequenceNumber target_availability_replica_id
6
� � � � ���
object:guid WmiDataId Extension Guid �uid �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�� + �\>�S}� ` � WDMClassesOfDriver TP_V2_TimerExpiration C:\Windows\system32\kernelbase.dll[MofResourceName] ] ourceName] ofResourceName] ב$ݐ � ����F � I�� �[6�
� �|W�� � 1E�P � u6{*� ) ��( � 0 X e S q l P k g _ b l o b _ c o n t a i n e r _ a c c e s s o r _ r e f r e s h _ f a i l u r e 5[��7 �> " : XeSqlPkg_blob_container_accessor_refresh_failure 2 ) � ��) 4 B N � � I U � � j { � W��������������������������������t � blob_container_accessor_refresh_failure EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid db_id )
� 6 > � �� uint64 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId point_of_interest C
� ) 1 � ��< O _ g string WmiDataId StringTermination NullTerminated Format w RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� D L W d � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g 6[��7 �a XeSqlPkg
C � ��1 > } � � � � � c����� � XeSqlPkg_blob_container_accessor_create_failure Description Failed to create the table in the blob container accessor API Guid {cd558976-292e-45cb-bd56-bf3aac8423b0} locale MS\0x409 DisplayName blob_container_accessor_create_failure �/ X e S q l P k g _ b l o b _ c o n t a i n e r _ a c c e s s o r _ c r e a t e _ f a i l u r e 7[��7 �� 9 XeSqlPkg_blob_container_accessor_create_failure 1 ) � ��( 3 A M � � H T � � J Z W������������������������������ � blob_container_accessor_create_failure EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid db_id )
� 5 = � �� uint64 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� ! , 9 � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g 8[��7 �� XeSqlPkg
C � ��C P � � � � � � c���� � XeSqlPkg_columnstore_object_read_from_unaligned_sbs_cache_success Description Read columnstore object from unaligned SBS Cache DB was successful. Guid {413DC28E-EC87-470E-9F48-6F4A6EB37E3A} locale MS\0x409 DisplayName columnstore_object_read_from_unaligned_sbs_cache_success �A X e S q l P k g _ c o l u m n s t o r e _ o b j e c t _ r e a d _ f r o m _ u n a l i g n e d _ s b s _ c a c h e _ s u c c e s s 9[��7 �3 G K XeSqlPkg_columnstore_object_read_from_unaligned_sbs_cache_success C ) � ��: E S _ � � � % 1 � � � � I V � � � � ) � � WUU�������������������������������������������������������������������� � columnstore_object_read_from_unaligned_sbs_cache_success EventType EventVersion ActivityId
N
� � � � � � �� � ��� object:guid WmiDataId Description ActivityId ActivityID Extension Guid blob_id
? 6
� V c � ��n y object:guid WmiDataId Extension Guid column_id & )
� � � � �� uint64 WmiDataId db_id )
� � �� uint16 WmiDataId FragmentId 6
� u } � � � �� uint32 WmiDataId Description FragmentId hobt_id )
� � � � �� uint64 WmiDataId object_id )
� 6 > � �� uint64 WmiDataId object_size . )
� � � � �� uint64 WmiDataId object_type > P
� � �� e & 0 l t uint8 WmiDataId XEMapId ValueMap T W Z ] ` c f i 1 5 6 7 8 2 4 0 Values � � � � @ c � COLUMN_SEGMENT COLUMN_SEGMENT_BULKINSERT_DICTIONARY COLUMN_SEGMENT_DELETE_BITMAP COLUMN_SEGMENT_EXTENDED_STRING_PAGE_RANGE COLUMN_SEGMENT_GLOBAL_STRING_DICTIONARY COLUMN_SEGMENT_PRIMARY_DICTIONARY COLUMN_SEGMENT_SECONDARY_DICTIONARY UNDEFINED RemainingLength 6
� � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� m u � � � �� uint32 WmiDataId Description SequenceNumber time_read_from_cache_in_us
6 )
� � �
� �� uint64 WmiDataId � X e S q l P k g :[��7 �� XeSqlPkg
C � ��@ M � � � � � � c���� � XeSqlPkg_columnstore_object_read_from_unaligned_sbs_cache_fail Description Read columnstore object from unaligned SBS Cache DB was unsuccessful. Guid {f7ec9060-9189-460a-80ca-5edd2b749ccc} locale MS\0x409 DisplayName columnstore_object_read_from_unaligned_sbs_cache_fail �* X e S q l P k g _ c o l u m n s t o r e _ o b j e c t _ a s s i g n _ b l o b _ i d E[��7 �� ? 4 XeSqlPkg_columnstore_object_assign_blob_id , ) � ��# .
< H � � h v � � h q � � Z k � � d r WU������������������������������������������������������������� � columnstore_object_assign_blob_id EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid blob_id
8 6
� ? L
� ��W b object:guid WmiDataId Extension Guid container_id $ )
� � � � �� uint64 WmiDataId duration_ms )
� � �� uint64 WmiDataId epoch )
� U ] � �� sint64 WmiDataId fork_id
4 6
� � � � ��� � object:guid WmiDataId Extension Guid FragmentId 6
� . 6 A N � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� 4 < G T � �� uint32 WmiDataId Description SequenceNumber xdes_id_hash , )
� � � � �� sint64 WmiDataId � X e S q l P k g F[��7 �h XeSqlPkg
C � ��4 A � � � � � � c����� � XeSqlPkg_columnstore_object_update_size_in_catalog Description Statistics about updating Block Blob ID size in the catalog DB Guid {7fbea754-5a0c-42da-a14c-a8a3a9ff6a35} locale MS\0x409 DisplayName columnstore_object_update_size_in_catalog �log �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�� 1 �\>�S}� f � WDMClassesOfDriver MSChangerProblemDeviceError C:\Windows\system32\kernelbase.dll[MofResourceName] e] tSequence �e] �*` � `Sv$� l S�x(S C�tr . ��j.� W M I E v e n t ���jj��_ T WMIEvent
4 �� � �� � # , 2 Z b � � � � . � � - < { � � � ( J � � � G _ � � � T q � � m w � � � | � _UUUU������������������������������������������������������������������������������ � MSMCAEvent_PCIComponentError WMI WmiProv guid {805CAF4E-336C-4eb2-8C0C-02F351CBF13C} Active
� � boolean AdditionalErrors #
� � � uint32 WmiDataId Cpu
� uint32 WmiDataId ErrorSeverity 8
� t { � � � � uint8 WmiDataId Values � � � Recoverable Fatal Correctable ValueMap � � � 0 1 2 InstanceName '
� % � �� � �� string LogToEventlog '
� h p uint32 WmiDataId PCI_COMP_ERROR_STATUS 3
� � � uint64 WmiDataId PCI_COMP_INFO_BusNumber D
� uint8 WmiDataId PCI_COMP_INFO_ClassCodeBaseClass A
� v }
uint8 WmiDataId PCI_COMP_INFO_ClassCodeInterface ?
� � � uint8 WmiDataId PCI_COMP_INFO_ClassCodeSubClass @
� 5 < uint8 WmiDataId PCI_COMP_INFO_DeviceId
=
� � �
uint16 WmiDataId PCI_COMP_INFO_DeviceNumber C
� � � uint8 WmiDataId PCI_COMP_INFO_FunctionNumber B
� B I uint8 WmiDataId PCI_COMP_INFO_SegmentNumber E
� � � uint8 WmiDataId PCI_COMP_INFO_VendorId ;
� � � uint16 WmiDataId RawRecord J +
� J Q \ g uint8 WmiDataId WmiSizeIs Size RecordId
� � � uint64 WmiDataId Size F
� � � uint32 WmiDataId Type 8
� G O Z b � � uint32 WmiDataId Values > ^ q � � � � � � � 7 N c v � � � � �
:
^
�
�
�
�
�
6 ` � � � � % @ X n � � � � � �
.
R
v
�
�
�
�
�
2 K k MCA_WARNING_CACHE MCA_ERROR_CACHE MCA_WARNING_TLB MCA_ERROR_TLB MCA_WARNING_CPU_BUS MCA_ERROR_CPU_BUS MCA_WARNING_REGISTER_FILE MCA_ERROR_REGISTER_FILE MCA_WARNING_MAS MCA_ERROR_MAS MCA_WARNING_MEM_UNKNOWN MCA_ERROR_MEM_UNKNOWN MCA_WARNING_MEM_1_2 MCA_ERROR_MEM_1_2 MCA_WARNING_MEM_1_2_5 MCA_ERROR_MEM_1_2_5 MCA_WARNING_MEM_1_2_5_4 MCA_ERROR_MEM_1_2_5_4 MCA_WARNING_SYSTEM_EVENT MCA_ERROR_SYSTEM_EVENT MCA_WARNING_PCI_BUS_PARITY MCA_ERROR_PCI_BUS_PARITY MCA_WARNING_PCI_BUS_PARITY_NO_INFO MCA_ERROR_PCI_BUS_PARITY_NO_INFO MCA_WARNING_PCI_BUS_SERR MCA_ERROR_PCI_BUS_SERR MCA_WARNING_PCI_BUS_SERR_NO_INFO MCA_ERROR_PCI_BUS_SERR_NO_INFO MCA_WARNING_PCI_BUS_MASTER_ABORT MCA_ERROR_PCI_BUS_MASTER_ABORT MCA_WARNING_PCI_BUS_MASTER_ABORT_NO_INFO MCA_ERROR_PCI_BUS_MASTER_ABORT_NO_INFO MCA_WARNING_PCI_BUS_TIMEOUT MCA_ERROR_PCI_BUS_TIMEOUT MCA_WARNING_PCI_BUS_TIMEOUT_NO_INFO MCA_ERROR_PCI_BUS_TIMEOUT_NO_INFO MCA_WARNING_PCI_BUS_UNKNOWN MCA_ERROR_PCI_BUS_UNKNOWN MCA_WARNING_PCI_DEVICE MCA_ERROR_PCI_DEVICE MCA_WARNING_SMBIOS MCA_ERROR_SMBIOS MCA_WARNING_PLATFORM_SPECIFIC MCA_ERROR_PLATFORM_SPECIFIC MCA_WARNING_UNKNOWN MCA_ERROR_UNKNOWN MCA_WARNING_UNKNOWN_NO_CPU MCA_ERROR_UNKNOWN_NO_CPU MCA_WARNING_CMC_THRESHOLD_EXCEEDED MCA_WARNING_CPE_THRESHOLD_EXCEEDED MCA_WARNING_CPU_THERMAL_THROTTLED MCA_INFO_CPU_THERMAL_THROTTLING_REMOVED MCA_WARNING_CPU MCA_ERROR_CPU MCA_MEMORYHIERARCHY_ERROR MCA_TLB_ERROR MCA_BUS_ERROR MCA_BUS_TIMEOUT_ERROR MCA_INTERNALTIMER_ERROR MCA_MICROCODE_ROM_PARITY_ERROR MCA_EXTERNAL_ERROR MCA_FRC_ERROR ValueMap > � � � � � � � � � $ 0 < H T ` l x � � � � � � � � � � � , 8 D P \ h t � � � � � � � � � � � ( 4 @ L X d p 0x8005003C 0xC005003D 0x8005003E 0xC005003F 0x80050040 0xC0050041 0x80050042 0xC0050043 0x80050044 0xC0050045 0x80050046 0xC0050047 0x80050048 0xC0050049 0x8005004A 0xC005004B 0x8005004C 0xC005004D 0x8005004E 0xC005004F 0x80050050 0xC0050051 0x80050052 0xC0050053 0x80050054 0xC0050055 0x80050056 0xC0050057 0x80050058 0xC0050059 0x8005005A 0xC005005B 0x8005005C 0xC005005D 0x8005005E 0xC005005F 0x80050060 0xC0050061 0x80050062 0xC0050063 0x80050064 0xC0050065 0x80050066 0xC0050067 0x80050068 0xC0050069 0x8005006A 0xC005006B 0x8005006D 0x8005006E 0x8005006F 0x40050070 0x80050071 0xC0050072 0xC0050078 0xC0050079 0xC005007A 0xC005007B 0xC005007C 0xC005007D 0xC005007E 0xC005007F VALIDATION_BITS
+ +
� � � � � uint64 WmiDataId BitMap � � � 0 1 2 3 4 � M S N d i s ��jj��H / MSNdis ) ��. 4
\ h � � � F R � � � � 1 = | � � � ) UU���������������������������������������������� � MSNdis_NetworkDirectAdapterCapabilities WMI guid {64c71824-1bb8-47d2-b347-a8fbd95b9c07} MaxCqCount
� � � uint32 WmiDataId MaxInboundReadLimit
� � � uint32 WmiDataId MaxMrCount
� 3 ; uint32 WmiDataId MaxMwCount
� ~ � uint32 WmiDataId MaxOutboundReadLimit
� � � uint32 WmiDataId MaxPdCount
� & uint32 WmiDataId MaxQpCount
� i q uint32 WmiDataId MaxSrqCount
� � � uint32 WmiDataId MissingCounterMask +
� ( 0 uint64 WmiDataId BitMap � � � � � � � � � � � � � � � � � � � � � � � �
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 NdAdapterInfo
(
� U }
object:MSNdis_NetworkDirectAdapterInfo WmiDataId � M S N d i s ��jj��� MSNdis A " �� � �� � ' 0 6 ^ j r � � � U����������r � MSNdis_NetworkDirectCapabilities WMI WMIProv guid {7969ba4d-dd80-4bc7-b3e6-68043997e519} WmiExpense Active
� � � �� boolean InstanceName '
� � � �� � �� string NdCapabilities
)
� 7 � ��g object:MSNdis_NetworkDirectAdapterCapabilities WmiDataId eN � M S N d i s ��jj��
MSNdis A �� � �� � % + S _ g � � � � U����������� � MSNdis_HardwareStatus WMI WMIProv guid {5ec10354-a61a-11d0-8dd4-00c04fc3358c} WmiExpense Active
� � � �� boolean InstanceName '
� � � �� � �� string NdisHardwareStatus 6
� = � ��E O v uint32 ValueMap g j m p s 0 1 2 3 4 WmiDataId �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 X�n�^��
͝��C�� 3 J.3�� h � WDMClassesOfDriver MSNdis_FddiShortMulticastList C:\Windows\system32\kernelbase.dll[MofResourceName] e] ame] mf
N0 I ����y N ��_^� V���� �l�� �D�
� >1//� N i\d�� I �v � � ��Z! ���<. . ,�{�\ ) j�x � 6�P< � ��� = ��9&D V Q��� � �� �
C I M _ C o m p o n e n t p֝��C� CIM_Component C * C P � �� � U f t x � u��������� � MSFT_NetLbfoTeam_TeamNic UMLPackagePath CIM::Core::CoreElements Description 412 MsNetImPlatform ClassVersion 10 GroupComponent f@ +
� � � � � � ref:MSFT_NetLbfoTeam Description 410 Override GroupComponent PartComponent f@ +
� K d q v � ref:MSFT_NetLbfoTeamNic Description 411 Override PartComponent �5 7 E 5 F 3 A D D 9 E 2 4 2 C 4 E 9 F 9 E D F 7 9 A A 9 7 F 7 9 E 7 9 1 1 C 5 A 8 B 9 0 2 E C 1 5 0 D 6 4 4 2 E 3 B 8 5 A 5 A A q֝��C�ȝ��C�� �?����M 9 \ � __Win32Provider {F43E8166-162C-4B12-8C2B-510D21516082} NetworkServiceHost NetSwitchTeam 7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D r֝��C�
ȝ��C�r [ � __MethodProviderRegistration \\.\Root\StandardCimv2:__Win32Provider.Name="NetSwitchTeam" R O O T \ S t a n d a r d C i m v 2 _ _ M e t h o d P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ B 5 E C 8 A D F 9 6 E 5 E 6 0 6 4 A D 9 E B 0 B 1 3 7 0 F D B D 6 6 4 E 0 B 0 E 7 8 0 2 B 6 A 2 A 5 7 9 6 B 5 F A F 2 2 A F E E \ K I _ 7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D \ I _ F D F F 3 C 9 B 0 6 6 4 E 0 F A F 2 8 4 B F A 1 2 A E 8 B 9 7 8 2 E 6 E 9 9 E 4 B A E A 0 5 A B 7 8 5 1 7 3 0 A F E 4 0 F 0 9 2 �֝��C� � �� � " K s � � 4 � � � � 2 @ U�������������� � Win32_OfflineFilesBackgroundSync Win32_OfflineFilesConfigurationProvider BackgroundSyncWorkOfflineSharesEnabled
'
� � � �� � �� boolean BlockOutDurationMin 4
� � �� � �� � uint16 Max BlockOutStartTimeHoursMinutes 4
� v � �� � ��~ ` uint16 Max MaxTimeBetweenSyncs '
� � � �� � �� uint16 SyncInterval 4
� % � �� � ��- � uint16 Max SyncVariance 4
� � � �� � ��� uint16 Max �
C I M _ P o l i c y
ם��C�[ 6 CIM_Policy ) " / ��9 A T � � � � - J � � � H T �_U���������������������������������������������������� � CIM_PolicyAction UMLPackagePath CIM::Policy Abstract locale CreationClassName
( )
� � � ��� string MaxLen DoActionLogging 0
� � boolean PolicyActionName , )
� � ��% string MaxLen PolicyRuleCreationClassName )
� � � ��� string MaxLen PolicyRuleName $ )
� � � ��� string MaxLen SystemCreationClassName )
� 8 � ��@ string MaxLen SystemName )
� � � ��� string MaxLen � M S F T _ M T R e g i s t r y V a l u e �ڝ��C� MSFT_MTRegistryValue 6 & ? � �� � G P V �������������������������������} � MSFT_MTRegistryDword UMLPackagePath CIM::Core::CoreElements locale regprov Data
� u uint32 �5 7 E 5 F 3 A D D 9 E 2 4 2 C 4 E 9 F 9 E D F 7 9 A A 9 7 F 7 9 E 7 9 1 1 C 5 A 8 B 9 0 2 E C 1 5 0 D 6 4 4 2 E 3 B 8 5 A 5 A A �ڝ��C�ȝ��C�� �����M @ 9 W � __Win32Provider {59D95679-9799-458F-8B5B-FE00D8DA0AE4} NetworkServiceHost nettcpip 7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D �ڝ��C�
ȝ��C�m V � __MethodProviderRegistration \\.\root\standardcimv2:__Win32Provider.Name="nettcpip" R O O T \ s t a n d a r d c i m v 2 _ _ M e t h o d P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ B 5 E C 8 A D F 9 6 E 5 E 6 0 6 4 A D 9 E B 0 B 1 3 7 0 F D B D 6 6 4 E 0 B 0 E 7 8 0 2 B 6 A 2 A 5 7 9 6 B 5 F A F 2 2 A F E E \ K I _ 7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D \ I _ 3 F B 1 C C 9 8 7 2 5 8 F 8 0 8 7 B D 7 8 3 8 6 B 8 D D A 0 9 3 F 7 A 2 0 3 0 F 9 6 6 F A F 6 1 9 9 D 4 3 E F A 0 F 6 2 7 5 C C E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C ��C� ȝ��C�� � ��������X q � __InstanceProviderRegistration \\.\root\standardcimv2:__Win32Provider.Name="nettcpip" ` WQL:UnarySelect R O O T \ s t a n d a r d c i m v 2 _ _ I n s t a n c e P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ B 5 E C 8 A D F 9 6 E 5 E 6 0 6 4 A D 9 E B 0 B 1 3 7 0 F D B D 6 6 4 E 0 B 0 E 7 8 0 2 B 6 A 2 A 5 7 9 6 B 5 F A F 2 2 A F E E \ K I _ E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C \ I _ 3 F B 1 C C 9 8 7 2 5 8 F 8 0 8 7 B D 7 8 3 8 6 B 8 D D A 0 9 3 F 7 A 2 0 3 0 F 9 6 6 F A F 6 1 9 9 D 4 3 E F A 0 F 6 2 7 5 C C C I M _ D e p e n d e n c y ��C�� CIM_Dependency ) & : ��G O [ � � U��������! � CIM_SAPSAPDependency UMLPackagePath CIM::Core::Service Association locale Antecedent f@
� � � � ref:CIM_ServiceAccessPoint Override Antecedent Dependent f@
� � ref:CIM_ServiceAccessPoint Override Dependent � C I M _ S A P S A P D e p e n d e n c y ��C�� CIM_SAPSAPDependency )
1 ��> F R � � U�������� � CIM_BindsTo UMLPackagePath CIM::Core::Service Association locale Antecedent f@
� ~ � � ref:CIM_ProtocolEndpoint Override Antecedent Dependent f@
� � ref:CIM_ServiceAccessPoint Override Dependent D � C I M _ B i n d s T o ��C� CIM_BindsTo
) ( I ��V ^ j � � ) 4 U����������� � CIM_BindsToLANEndpoint UMLPackagePath CIM::Network::ProtocolEndpoints Association locale Antecedent f@
� � � � ref:CIM_LANEndpoint Override Antecedent Dependent f@
� � ref:CIM_ServiceAccessPoint Override Dependent FrameType
� ` h r uint16 ValueMap � � � � � 0 1 2 3 4 � k��C�> � BaseStatus locale as � M S N T _ S y s t e m T r a c e ���jj��� MSNT_SystemTrace 6 � �� 7 E M C����W � SplitIo Guid {d837ca92-12b9-44a5-ad6a-3a65b3578aa8} EventVersion locale MS\0x409 �9 A B 5 3 8 0 6 E 8 8 6 6 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0 �b��5� ͝��C�o �x! �5��� N � WMIBinaryMofResource C:\Windows\System32\drivers\processr.sys[PROCESSORWMI] MofResourceName] ion locale MS\0x409 � � uint16 Max �ng � d�.V� = \�w�� A W��K m ��\{ @ �[��� � �$��i P ��W� B c�ű� � X e S q l P k g _ s q l _ t r a n s a c t i o n \��7 �� 1 " XeSqlPkg_sql_transaction ) � ��
* 6 � � 4 @ � � O ` � � w � � U h K ] WU���������������������������������������������� � sql_transaction EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid duration )
� ! ) � �� uint64 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId object_name & C
� � ��! 4 D L string WmiDataId StringTermination NullTerminated Format w RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength savepoint_name
* C
� 6 >
� ��I \ l t string WmiDataId StringTermination NullTerminated Format w SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber transaction_id )
� B J � �� sint64 WmiDataId transaction_state P
� � � � ��� � � uint8 WmiDataId XEMapId ValueMap � 0 1 2 3 Values ' . 6 @ Begin Commit Rollback Savepoint transaction_type P
� � � � ��� � � � � uint8 WmiDataId XEMapId ValueMap � � 0 1 Values System User � X e S q l P k g \��7 � XeSqlPkg
C � �� $ O U } � � � c����� � XeSqlPkg_scan_started Description Occurs when a table or index scan starts. Guid {8b324833-6652-42cc-9bb7-466ad4b9b099} locale MS\0x409 DisplayName scan_started � X e S q l P k g _ s c a n _ s t a r t e d \��7 �+ / XeSqlPkg_scan_started ) � �� ' 3 � � 4 C � � Q Z � � � M ^ � � WU���������������������������������������������W � scan_started EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� ! ) � �� uint32 WmiDataId database_name ( C
� � � � ��� � � � string WmiDataId StringTermination NullTerminated Format w FragmentId 6
� % - 8 E � �� uint32 WmiDataId Description FragmentId hobt_id )
� � � � �� uint64 WmiDataId index_id )
� � � � �� uint32 WmiDataId object_id )
� : B � �� sint32 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� ' / : G � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g
\��7 � XeSqlPkg
C � �� $ N T | � � � c����� � XeSqlPkg_scan_stopped Description Occurs when a table or index scan stops. Guid {e1577ad4-1430-4b05-a47b-596763814836} locale MS\0x409 DisplayName scan_stopped � X e S q l P k g _ s c a n _ s t o p p e d \��7 �l H XeSqlPkg_scan_stopped ) � �� ' 3 � � 4 C � � Q Z � � � Q \ � � ] n � � WUU���������������������������������������������������������������������g � scan_stopped EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� ! ) � �� uint32 WmiDataId database_name @ C
� � � � ��� � � � string WmiDataId StringTermination NullTerminated Format w FragmentId 6
� % - 8 E � �� uint32 WmiDataId Description FragmentId hobt_id )
� � � � �� uint64 WmiDataId index_id )
� � � � �� uint32 WmiDataId logical_reads ( )
� > F � �� uint64 WmiDataId object_id )
� � � � �� sint32 WmiDataId page_server_reads 8 )
� � � � �� uint64 WmiDataId physical_reads
0 )
� J R
� �� uint64 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� 7 ? J W � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g \��7 �( XeSqlPkg
C � �� ' [ a � � � � c����� � XeSqlPkg_transaction_log Description Occurs when a record is added to the SQL Server transaction log. This is a very high volume event that will affect the performance of the server. Therefore, you should use appropriate filtering to reduce the number of events, and only use this event for targeted troubleshooting during a short time period. Guid {F985F9B5-ADE0-4328-A70D-0A0A631B2599} locale MS\0x409 DisplayName transaction_log � X e S q l P k g B\��7 � XeSqlPkg
C � ��% 2 B H p x � � c����� � XeSqlPkg_buffer_pool_page_allocated Description Page allocated Guid {29c4a861-b98d-4c5b-9bef-ab3f35f8fbf5} locale MS\0x409 DisplayName buffer_pool_page_allocated �8 X e S q l P k g _ m e t a d a t a _ p e r s i s t _ l a s t _ v a l u e _ f o r _ i d e n t i t y _ c o l u m n K\��7 �K B XeSqlPkg_metadata_persist_last_value_for_identity_column : ) � ��1 < J V | � 0 � � ) 3 W����������������������������} � metadata_persist_last_value_for_identity_column EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid FragmentId 6
� P X c p � �� uint32 WmiDataId Description FragmentId persisted_value C
� � � � ��� string WmiDataId StringTermination NullTerminated Format w RemainingLength 6
� t | � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � �� uint32 WmiDataId Description SequenceNumber table_id )
� j r � �� sint32 WmiDataId �aId �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�} % �\>�S}� Z � WDMClassesOfDriver KernelIdleState C:\Windows\system32\kernelbase.dll[MofResourceName] eName] sourceName] b�A�� � �k�C' � @Rv�� � " Y� � ��rM � ȭΟ+ � <X�+� � . X e S q l P k g _ c o l u m n _ s t o r e _ i n d e x _ b u i l d _ m e m o r y _ t r a c e �Z��7 �3 E 8 XeSqlPkg_column_store_index_build_memory_trace 0 ) � ��' 2 @ L � M Y � � @ � � � J \ � � ' � � WUU������������������������������������������������������������������ � column_store_index_build_memory_trace EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� : B � �� uint16 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId hobt_id )
� � �� uint64 WmiDataId max_used_memory_for_current_thread * )
� w � �� uint64 WmiDataId memory_limit_for_current_thread
2 )
� � �
� �� uint64 WmiDataId object_id )
� 7 ? � �� uint32 WmiDataId partition_number " )
� � � � �� uint64 WmiDataId prev_memory_limit_for_current_thread : )
� � �� uint64 WmiDataId RemainingLength 6
� k s ~ � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �Z��7 �� XeSqlPkg
C � ��3 @ � � � � � � c����% � XeSqlPkg_column_store_index_build_process_segment Description A rowgroup was processed. Indicates the number of rows in the rowgroup and the reason it was trimmed if any. Guid {3c40682e-9481-4c1e-a54e-8009b6c2ec5c} locale MS\0x409 DisplayName column_store_index_build_process_segment �1 X e S q l P k g _ c o l u m n _ s t o r e _ i n d e x _ b u i l d _ p r o c e s s _ s e g m e n t �Z��7 �\ R ; XeSqlPkg_column_store_index_build_process_segment 3 ) � ��* 5 C O � P \ � � ) s ~ � � $ 5 � � � V f � � WUU�������������������������������������������������������������������������������1 � column_store_index_build_process_segment EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� = E � �� uint16 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId hobt_id )
� � �� uint64 WmiDataId index_id > )
� ` h � �� uint64 WmiDataId object_id
6 )
� � �
� �� uint64 WmiDataId partition_number F )
� � �� uint64 WmiDataId RemainingLength 6
� y � � � � �� uint32 WmiDataId Description RemainingLength row_count & )
� � � � �� uint64 WmiDataId rowgroup_id )
� C K � �� uint64 WmiDataId SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber trim_reason . )
� & � �� uint64 WmiDataId � X e S q l P k g �Z��7 �l XeSqlPkg
C � ��B O w } � � � � c����� � XeSqlPkg_column_store_index_build_process_secondary_dictionaries Description Secondary dictionaries were processed. Guid {18DF3C3F-921B-4D24-A60D-EB3EEF93F05B} locale MS\0x409 DisplayName column_store_index_build_process_secondary_dictionaries �@ X e S q l P k g _ c o l u m n _ s t o r e _ i n d e x _ b u i l d _ p r o c e s s _ s e c o n d a r y _ d i c t i o n a r i e s �Z��7 �F 9 J XeSqlPkg_column_store_index_build_process_secondary_dictionaries B ) � ��9 D R ^ _ k � � . 8 � � � � 3 D � � WU�������������������������������������������������������= � column_store_index_build_process_secondary_dictionaries EventType EventVersion ActivityId
N
� � � � � � �� � ��� object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� L T � �� uint16 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId hobt_id )
� # � �� uint64 WmiDataId index_id & )
� o w � �� uint64 WmiDataId object_id )
� � � � �� uint64 WmiDataId partition_number . )
� ( � �� uint64 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
�
- � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �Z��7 �� XeSqlPkg
C � ��7 D � � � � � � c����) � XeSqlPkg_column_store_index_build_process_segment_lob Description Statistics and compression info on LOB columns for off-row and inlined (in secondary dictionary) values. Guid {91EAC36D-01A1-473A-9287-D53F7E221723} locale MS\0x409 DisplayName column_store_index_build_process_segment_lob �L X e S q l P k g _ c o l u m n s t o r e _ t u p l e _ m o v e r _ d e l e t e _ b u f f e r _ t r u n c a t e _ r e q u i r e m e n t s _ n o t _ m e t �Z��7 �� * V XeSqlPkg_columnstore_tuple_mover_delete_buffer_truncate_requirements_not_met N ) � ��E P ^ j ! k � � � H Q � � � x � WU����������������������������������������� � columnstore_tuple_mover_delete_buffer_truncate_requirements_not_met EventType EventVersion ActivityId
N
� � � � � � �� � �� object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� X ` � �� uint16 WmiDataId delete_buffer_hobt_id )
� � � � �� uint64 WmiDataId FragmentId 6
� $ / < � �� uint32 WmiDataId Description FragmentId hobt_id )
� � � � �� uint64 WmiDataId is_in_memory )
� � � � �� uint8 WmiDataId RemainingLength 6
� G O Z g � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber �ber �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�z " �\>�S}� W � WDMClassesOfDriver HV_Hypercall C:\Windows\system32\kernelbase.dll[MofResourceName] ceName] eName] esourceName] 34E1C8D99E55FFB8F4 n XactSequence �e] Q}�� � ��=g� �IY�� R�*�� K � n7C � PW C= � ]�7
�ɹ�I ,��W � ^5 �� #�$� ���- ���s � ���!� M S N d i s Z��jj��� MSNdis A �� � �� � # , 2 Z f n � � � U����������Q � MSNdis_TokenRingCurrentGroup WMI WMIProv guid {4479570a-a61b-11d0-8dd4-00c04fc3358c} WmiExpense Active
� � � �� boolean InstanceName '
� � � �� � �� string NdisTokenRingCurrentGroup )
� > � ��F uint32 WmiDataId iE � M S N d i s [��jj��� MSNdis A �� � �� � % . 4 \ h p � � � U����������U � MSNdis_TokenRingLastOpenStatus WMI WMIProv guid {4479570b-a61b-11d0-8dd4-00c04fc3358c} WmiExpense Active
� � � �� boolean InstanceName '
� � � �� � �� string NdisTokenRingLastOpenStatus )
� B � ��J uint32 WmiDataId Wm � M S N d i s \��jj��� MSNdis A # �� � �� � ( 1 7 _ k s � � � U����������[ � MSNdis_TokenRingCurrentRingStatus WMI WMIProv guid {890a36ec-a61c-11d0-8dd4-00c04fc3358c} WmiExpense Active
� � � �� boolean InstanceName '
� � � �� � �� string NdisTokenRingCurrentRingStatus )
� H � ��P uint32 WmiDataId } � M S N d i s ]��jj��' MSNdis A " �� � �� � ' 0 6 ^ j r � � � U����������� � MSNdis_TokenRingCurrentRingState WMI WMIProv guid {acf14032-a61c-11d0-8dd4-00c04fc3358c} WmiExpense Active
� � � �� boolean InstanceName '
� � � �� � �� string NdisTokenRingCurrentRingState 6
� S � ��[ e � uint32 ValueMap � � � � � � 1 2 3 4 5 6 WmiDataId � M S N d i s ^��jj��� MSNdis A �� � �� � ! * 0 X d l � � � U����������M � MSNdis_TokenRingLineErrors WMI WMIProv guid {acf14033-a61c-11d0-8dd4-00c04fc3358c} WmiExpense Active
� � � �� boolean InstanceName '
� � � �� � �� string NdisTokenRingLineErrors )
� : � ��B uint32 WmiDataId xp � M S N d i s _��jj��� MSNdis A �� � �� � ! * 0 X d l � � � U����������M � MSNdis_TokenRingLostFrames WMI WMIProv guid {acf14034-a61c-11d0-8dd4-00c04fc3358c} WmiExpense Active
� � � �� boolean InstanceName '
� � � �� � �� string NdisTokenRingLostFrames )
� : � ��B uint32 WmiDataId xp � M S N d i s `��jj��� MSNdis A ! �� � �� � & / 5 ] i q � � � U����������e � MSNdis_FddiLongPermanentAddress WMI WMIProv guid {acf14035-a61c-11d0-8dd4-00c04fc3358c} WmiExpense Active
� � � �� boolean InstanceName '
� � � �� � �� string NdisPermanentAddress
)
� < � ��Z object:MSNdis_NetworkAddress WmiDataId � M S N d i s a��jj��� MSNdis A �� � �� � $ - 3 [ g o � � � U����������a � MSNdis_FddiLongCurrentAddress WMI WMIProv guid {acf14036-a61c-11d0-8dd4-00c04fc3358c} WmiExpense Active
� � � �� boolean InstanceName '
� � � �� � �� string NdisCurrentAddress
)
� 8 � ��V object:MSNdis_NetworkAddress WmiDataId � � M S N d i s b��jj��v MSNdis A �� � �� � # , 2 Z f n � � � � � � U��������������� � MSNdis_FddiLongMulticastList WMI WMIProv guid {acf14037-a61c-11d0-8dd4-00c04fc3358c} WmiExpense Active
� � � �� boolean InstanceName '
� � � �� � �� string NdisMulticastList
6
� C � ��a l w object:MSNdis_NetworkAddress WmiDataId WmiSizeIs NumberElements NumberElements )
� � � ��� uint32 WmiDataId � M S N d i s c��jj��� MSNdis A �� � �� � % . 4 \ h p � � � U����������U � MSNdis_FddiLongMaximumListSize WMI WMIProv guid {acf14038-a61c-11d0-8dd4-00c04fc3358c} WmiExpense Active
� � � �� boolean InstanceName '
� � � �� � �� string NdisFddiLongMaximumListSize )
� B � ��J uint32 WmiDataId Wm � M S N d i s d��jj��� MSNdis A " �� � �� � ' 0 6 ^ j r � � � U����������k � MSNdis_FddiShortPermanentAddress WMI WMIProv guid {acf14039-a61c-11d0-8dd4-00c04fc3358c} WmiExpense Active
� � � �� boolean InstanceName '
� � � �� � �� string NdisPermanentAddress
)
� = � ��` object:MSNdis_NetworkShortAddress WmiDataId � � M S N d i s e��jj��� MSNdis A �� � �� � % . 4 \ h p � � � U����������g � MSNdis_FddiShortCurrentAddress WMI WMIProv guid {acf1403a-a61c-11d0-8dd4-00c04fc3358c} WmiExpense Active
� � � �� boolean InstanceName '
� � � �� � �� string NdisCurrentAddress
)
� 9 � ��\ object:MSNdis_NetworkShortAddress WmiDataId � M S N d i s f��jj��| MSNdis A �� � �� � $ - 3 [ g o � � � � � U��������������� � MSNdis_FddiShortMulticastList WMI WMIProv guid {acf1403b-a61c-11d0-8dd4-00c04fc3358c} WmiExpense Active
� � � �� boolean InstanceName '
� � � �� � �� string NdisMulticastList
6
� D � ��g r } object:MSNdis_NetworkShortAddress WmiDataId WmiSizeIs NumberElements NumberElements )
� � � ��� uint32 WmiDataId � M S N d i s g��jj��� MSNdis A ! �� � �� � & / 5 ] i q � � �
U����������W � MSNdis_FddiShortMaximumListSize WMI WMIProv guid {acf1403c-a61c-11d0-8dd4-00c04fc3358c} WmiExpense Active
� � � �� boolean InstanceName '
� � � �� � �� string NdisFddiShortMaximumListSize )
� D � ��L uint32 WmiDataId W �aId W �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� 4 �\>�S}� i � WDMClassesOfDriver MSNdis_FddiShortCurrentAddress C:\Windows\system32\kernelbase.dll[MofResourceName] ] ame] �(�I` K �V0Ϋ 5 "��� � �3��l � '���� � S Q L T r a c e E v e n t 1 6 8 jP��7 � � SQLTraceEvent168 6 � �� % K V e h y / ; � � r ~ � � � � + : � � # - � � Z d � � N Y � � < J �
�
�
2 > � � k v � � �
�
) � � Q ` � � UUUUUU����������������������������������������������������������������������������������������������������������������������������S � SQLTraceEvent168_TYPE0 Description Showplan XML For Query Compile Type0 EventType EventTypeName 0 ApplicationName ( P
� � �
� � & � �� string WmiDataId Description ApplicationName format w StringTermination Counted BinaryData P
� � � � � � � � � � �� string WmiDataId Description BinaryData format c StringTermination Counted ClientProcessID $ 6
� A I T a � �� sint32 WmiDataId Description ClientProcessID DatabaseID 6
� � � � � � �� sint32 WmiDataId Description DatabaseID DatabaseName T P
� Z b m z � � � � � �� string WmiDataId Description DatabaseName format w StringTermination Counted EventClass D 6
� � � �� sint32 WmiDataId Description EventClass EventSequence h 6
� ~ � � � � �� sint64 WmiDataId Description EventSequence GroupID x 6
� �
� �� sint32 WmiDataId Description GroupID HostName P
� � � � � � � � � � �� string WmiDataId Description HostName format w StringTermination Counted IntegerData @ 6
� - 5 @ M � �� sint32 WmiDataId Description IntegerData IsSystem p 6
� � � � � � �� sint32 WmiDataId Description IsSystem LineNumber 6
� " * 5 B � �� sint32 WmiDataId Description LineNumber LoginName
, P
� � � � � � � � � �� string WmiDataId Description LoginName format w StringTermination Counted LoginSid X P
� q y � � � � � � � �� string WmiDataId Description LoginSid format c StringTermination Counted NestLevel L 6
� $ 1 � �� sint32 WmiDataId Description NestLevel NTDomainName P
� � � � � � � � � � �� string WmiDataId Description NTDomainName format w StringTermination Counted NTUserName P
� g
o
z
�
�
�
�
�
� �� string WmiDataId Description NTUserName format w StringTermination Counted ObjectID
< 6
� ( � �� sint32 WmiDataId Description ObjectID ObjectName P P
� � � � � � � � � � �� string WmiDataId Description ObjectName format w StringTermination Counted ObjectType H 6
� ? G R _ � �� sint32 WmiDataId Description ObjectType RequestID \ 6
� � � � � � �� sint32 WmiDataId Description RequestID SessionLoginName t P
� U
]
h
u
�
�
�
�
� �� string WmiDataId Description SessionLoginName format w StringTermination Counted SPID 0 6
� �
� �� sint32 WmiDataId Description SPID StartTime 4 6
� m u
� � � �� uint64 WmiDataId Description StartTime TextData P
� * 2 5 H � �� string WmiDataId Description TextData format w StringTermination Counted TransactionID 6
� � � � � � �� sint64 WmiDataId Description TransactionID XactSequence ` 6
� % - 8 E � �� sint64 WmiDataId Description XactSequence � M S S Q L S E R V E R T r a c e kP��7 �� MSSQLSERVERTrace 6 � �� ? E k x � � SQLTraceEvent169 Description Showplan All For Query Compile Guid 84e993e6-00a9-4d70-97ef-3824ed2c4e93 DisplayName Showplan All For Query Compile 9 � X e S q l P k g _ f i l e s t r e a m _ f i l e _ i o _ d u m p UQ��7 �4 * XeSqlPkg_filestream_file_io_dump " ) � �� $ 2 > � � Y f � t � �
W����������������������������~ � filestream_file_io_dump EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid data
6
� 2 : � ��E P object WmiDataId Extension Variant description C
� � � � ��� � � � string WmiDataId StringTermination NullTerminated Format w FragmentId 6
� H P [ h � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� N V a n � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g VQ��7 �Y XeSqlPkg
C � ��+ 8 { � � � � � c����� � XeSqlPkg_filestream_file_write_completion Description Occurs when a write completion for a FILESTREAM file is received. Guid {C7512043-EDDB-4a06-B72D-2D4337D0325A} locale MS\0x409 DisplayName filestream_file_write_completion �) X e S q l P k g _ f i l e s t r e a m _ f i l e _ w r i t e _ c o m p l e t i o n WQ��7 �� 3 XeSqlPkg_filestream_file_write_completion + ) � ��" - ; G � M Y � � = N � � G N WU������������������������������� � filestream_file_write_completion EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid completion_count )
� : B � �� uint16 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId offsets
6
� � ��) 4 object WmiDataId Extension Variant RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� * 7 � �� uint32 WmiDataId Description SequenceNumber sizes
6
� � � � ��� � object WmiDataId Extension Variant �ant �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�v �\>�S}� S � WDMClassesOfDriver Debugger C:\Windows\system32\kernelbase.dll[MofResourceName] rceName] ame] ��)�� 6 eY�� � FgR� . �e��� � �ejB � G�u� � ���Ȯ H �N�� � H X e S q l P k g _ c o l u m n s t o r e _ t i e r e d _ s t o r a g e _ s c a n n e r _ s t a r t _ r o w g r o u p _ c o n s o l i d a t i o n [��7 �� - R XeSqlPkg_columnstore_tiered_storage_scanner_start_rowgroup_consolidation J ) � ��A L Z f � � & 1 { � X c � � WU�������������������������������������������� � columnstore_tiered_storage_scanner_start_rowgroup_consolidation EventType EventVersion ActivityId
N
� � � � � � �� � ���
object:guid WmiDataId Description ActivityId ActivityID Extension Guid dbName & C
� i q � ��| � � � string WmiDataId StringTermination NullTerminated Format w FragmentId 6
� �
� �� uint32 WmiDataId Description FragmentId object_id " )
� h p � �� uint32 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength rowgroup_id )
� E M � �� uint32 WmiDataId rowset_id )
� � � � �� uint64 WmiDataId scanner_type )
� � � � �� uint16 WmiDataId SequenceNumber 6
� Y a l y � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �[��7 �� XeSqlPkg
C � ��H U � � � � � � c����$ � XeSqlPkg_columnstore_tiered_storage_scanner_end_rowgroup_consolidation Description Columnstore tiered storage scanner ends a rowgroup consolidation. Guid {3988AF52-09EC-46D9-BAEC-820AB7F6A55E} locale MS\0x409 DisplayName columnstore_tiered_storage_scanner_end_rowgroup_consolidation �F X e S q l P k g _ c o l u m n s t o r e _ t i e r e d _ s t o r a g e _ s c a n n e r _ e n d _ r o w g r o u p _ c o n s o l i d a t i o n �[��7 �� - P XeSqlPkg_columnstore_tiered_storage_scanner_end_rowgroup_consolidation H ) � ��? J X d � � $ / y � � V a � � WU�������������������������������������������� � columnstore_tiered_storage_scanner_end_rowgroup_consolidation EventType EventVersion ActivityId
N
� � � � � � �� � ��� object:guid WmiDataId Description ActivityId ActivityID Extension Guid dbName & C
� g o � ��z � � � string WmiDataId StringTermination NullTerminated Format w FragmentId 6
� � � �� uint32 WmiDataId Description FragmentId object_id " )
� f n � �� uint32 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength rowgroup_id )
� C K � �� uint32 WmiDataId rowset_id )
� � � � �� uint64 WmiDataId scanner_type )
� � � � �� uint16 WmiDataId SequenceNumber 6
� W _ j w � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �[��7 �k XeSqlPkg
C � ��; H } � � � � � c����� � XeSqlPkg_columnstore_tiered_storage_migration_task_failed Description Columnstore tiered storage migration task finishes. Guid {16AAFB7A-E167-4359-A9E6-A44F6980CE37} locale MS\0x409 DisplayName columnstore_tiered_storage_migration_task_failed �9 X e S q l P k g _ c o l u m n s t o r e _ t i e r e d _ s t o r a g e _ m i g r a t i o n _ t a s k _ f a i l e d �[��7 �G C XeSqlPkg_columnstore_tiered_storage_migration_task_failed ; ) � ��2 = K W � � ( � � � W����������������������������x � columnstore_tiered_storage_migration_task_failed EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid dbName C
� Z b � ��m � � � string WmiDataId StringTermination NullTerminated Format w FragmentId 6
� � � � � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� l t � � �� uint32 WmiDataId Description RemainingLength retry_count )
� � � � �� uint32 WmiDataId SequenceNumber 6
� H P [ h � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �[��7 �s XeSqlPkg
C � ��> K � � � � � � c���� � XeSqlPkg_columnstore_tiered_storage_scanner_percent_complete Description Columnstore tiered storage scanner percent completed. Guid {E024AB8E-E7E3-4A7C-A749-6AB4A1FBE8A4} locale MS\0x409 DisplayName columnstore_tiered_storage_scanner_percent_complete �< X e S q l P k g _ c o l u m n s t o r e _ t i e r e d _ s t o r a g e _ s c a n n e r _ p e r c e n t _ c o m p l e t e �[��7 �� $ F XeSqlPkg_columnstore_tiered_storage_scanner_percent_complete > ) � ��5 @ N Z � � , v � �
T d WU����������������������������������� � columnstore_tiered_storage_scanner_percent_complete EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid dbName C
� ] e � ��p � � � string WmiDataId StringTermination NullTerminated Format w FragmentId 6
� � � � �� uint32 WmiDataId Description FragmentId percent_complete )
� c k � �� real64 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength scanner_type )
� A I � �� uint16 WmiDataId SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �[��7 �l XeSqlPkg
C � ��< I } � � � � � c����� � XeSqlPkg_columnstore_tiered_storage_scanner_start_database Description Columnstore tiered storage scanner start database. Guid {6F8D47D2-0F2B-4FE5-9BF6-016E75F84A0A} locale MS\0x409 DisplayName columnstore_tiered_storage_scanner_start_database �ase �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�� 8 �\>�S}� m � WDMClassesOfDriver WmiMonitorSupportedDisplayFeatures C:\Windows\system32\kernelbase.dll[MofResourceName] 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�� 8 �\>�S}� m � WDMClassesOfDriver WmiMonitorSupportedDisplayFeatures C:\Windows\system32\kernelbase.dll[MofResourceName] esourceName] sourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ,pl\}�
͝��C�u �\>�S}� R � WDMClassesOfDriver WDF_DPC C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ,pl\}�
͝��C�z " �\>�S}� W � WDMClassesOfDriver WDF_WorkItem C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ',pl\}�
͝��C�r �\>�S}� O � WDMClassesOfDriver ALPC C:\Windows\system32\kernelbase.dll[MofResourceName] kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ',pl\}�
͝��C�r �\>�S}� O � WDMClassesOfDriver ALPC C:\Windows\system32\kernelbase.dll[MofResourceName] dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ',pl\}�
͝��C�r �\>�S}� O � WDMClassesOfDriver ALPC C:\Windows\system32\kernelbase.dll[MofResourceName] em32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ',pl\}�
͝��C�r �\>�S}� O � WDMClassesOfDriver ALPC C:\Windows\system32\kernelbase.dll[MofResourceName] lbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ',pl\}�
͝��C�r �\>�S}� O � WDMClassesOfDriver ALPC C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 .,pl\}�
͝��C�z " �\>�S}� W � WDMClassesOfDriver HeapTrace_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] fResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 .,pl\}�
͝��C�z " �\>�S}� W � WDMClassesOfDriver HeapTrace_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] se.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 .,pl\}�
͝��C�z " �\>�S}� W � WDMClassesOfDriver HeapTrace_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 .,pl\}�
͝��C�z " �\>�S}� W � WDMClassesOfDriver HeapTrace_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] ourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 .,pl\}�
͝��C�z " �\>�S}� W � WDMClassesOfDriver HeapTrace_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 .,pl\}�
͝��C�z " �\>�S}� W � WDMClassesOfDriver HeapTrace_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] [MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 .,pl\}�
͝��C�z " �\>�S}� W � WDMClassesOfDriver HeapTrace_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] eName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 .,pl\}�
͝��C�z " �\>�S}� W � WDMClassesOfDriver HeapTrace_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] l[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 .,pl\}�
͝��C�z " �\>�S}� W � WDMClassesOfDriver HeapTrace_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 .,pl\}�
͝��C�z " �\>�S}� W � WDMClassesOfDriver HeapTrace_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 .,pl\}�
͝��C�z " �\>�S}� W � WDMClassesOfDriver HeapTrace_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] sourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 .,pl\}�
͝��C�z " �\>�S}� W � WDMClassesOfDriver HeapTrace_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] ourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 .,pl\}�
͝��C�z " �\>�S}� W � WDMClassesOfDriver HeapTrace_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] nelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 .,pl\}�
͝��C�z " �\>�S}� W � WDMClassesOfDriver HeapTrace_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] eName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 .,pl\}�
͝��C�z " �\>�S}� W � WDMClassesOfDriver HeapTrace_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] .dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 .,pl\}�
͝��C�z " �\>�S}� W � WDMClassesOfDriver HeapTrace_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] [MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 .,pl\}�
͝��C�z " �\>�S}� W � WDMClassesOfDriver HeapTrace_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] e.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 .,pl\}�
͝��C�z " �\>�S}� W � WDMClassesOfDriver HeapTrace_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 .,pl\}�
͝��C�z " �\>�S}� W � WDMClassesOfDriver HeapTrace_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] l[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 .,pl\}�
͝��C�z " �\>�S}� W � WDMClassesOfDriver HeapTrace_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 .,pl\}�
͝��C�z " �\>�S}� W � WDMClassesOfDriver HeapTrace_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] p � WDMClassesOfDriver HeapSubsegmentReuseThresholdActivated C:\Windows\system32\kernelbase.dll[MofResourceName] esourceName] SystemConfig_V2_Network C:\Windows\system32\kernelbase.dll[MofResourceName] ��Yp � �5Bre � �R6� � �� z� � �� 2 �yhyP � X e S q l P k g _ l o c k _ t i m e o u t �[��7 �� f XeSqlPkg_lock_timeout ) � �� ' 3 � � = J � � 5 ? � � b t � � 4 : B M � � 1 � � � R ^ � � P
_
r � �
WUUUU�������������������������������������������������������������������������������������������������P
� lock_timeout EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid associated_object_id H )
� * 2 � �� uint64 WmiDataId database_id ( )
� � � � �� uint32 WmiDataId database_name \ C
� � � � �� * 2 string WmiDataId StringTermination NullTerminated Format w duration P )
� v ~ � �� uint64 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId lockspace_nest_id 4 )
� O W � �� uint32 WmiDataId lockspace_sub_id 0 )
� � � � �� uint32 WmiDataId lockspace_workspace_id
, 4
�
� ��+ �� object WmiDataId Pointer mode P
� � � � ��� B � � h p uint32 WmiDataId XEMapId ValueMap ! $ ' + . 2 6 : > B F J N Q T W Z ^ a e 12 6 7 8 21 0 15 16 17 18 13 14 19 20 3 2 1 9 10 4 11 5 Values � � � � � � � � � �
& - 2 7 : ? BU IS IU IX LAST_MODE NL RI_NL RI_S RI_U RI_X RS_S RS_U RX_S RX_U S SCH_M SCH_S SIU SIX U UIX X object_id D )
� � � � �� sint32 WmiDataId owner_type P
� � �� > ' c k uint32 WmiDataId XEMapId ValueMap K N Q T W Z ] ` 2 5 8 6 7 3 4 1 Values � � � � � � � Cursor ExclusiveXactWorkspace LastLockInfoOwner LockConflictNotificationObject LockTableIterator Session SharedXactWorkspace Transaction RemainingLength 6
� u } � � � �� uint32 WmiDataId Description RemainingLength resource_0
8 )
� � �
� �� uint32 WmiDataId resource_1 < )
� ? G � �� uint32 WmiDataId resource_2 @ )
� � � � �� uint32 WmiDataId resource_description X C
�
� ��"
5
E
M
string WmiDataId StringTermination NullTerminated Format w resource_type P
� �
�
� ���
= �
�
m u uint32 WmiDataId XEMapId ValueMap / 3 7 : = @ D G K O R U Y \ _ c f i 13 10 2 8 3 12 7 17 11 1 5 14 6 9 15 0 4 16 Values � � � � � � � * 2 7 = B L c l ALLOCATION_UNIT APPLICATION DATABASE EXTENT FILE HOBT KEY LAST_RESOURCE METADATA NULL_RESOURCE OBJECT OIB PAGE RID ROWGROUP UNKNOWN_LOCK_RESOURCE UNUSED1 XACT SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber transaction_id )
� =
E
� �� sint64 WmiDataId � X e S q l P k g �[��7 �w XeSqlPkg
C � �� + � � � � � � c���� � XeSqlPkg_lock_deadlock_chain Description Occurs when an attempt to acquire a lock generates a deadlock. This event is raised for each participant in the deadlock. Guid {7ebe128e-fb90-4f2b-af4c-abc62336e478} locale MS\0x409 DisplayName lock_deadlock_chain � X e S q l P k g _ b i t m a p _ r u n t i m e _ t r a c e �[��7 �@ ' XeSqlPkg_bitmap_runtime_trace ) � �� ! / ; � � a z � � % W�������������������������� � bitmap_runtime_trace EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid FragmentId 6
� 5 = H U � �� uint32 WmiDataId Description FragmentId query_operation_node_id P
� � � � ��� P � � % - sint32 WmiDataId XEMapId ValueMap " 3 2 4 5 1 Values E O X h � Disabled Enabled InRowActivated InRowLowLevelActivated MostSelective RemainingLength 6
� � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� i q | � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �[��7 �` XeSqlPkg
C � �� ' � � � � � � c����� � XeSqlPkg_dtc_transaction Description Occurs when a SQL Server transaction is coordinated through Microsoft Distributed Transaction Coordinator. Guid {c8841a86-613d-456e-aeb1-ce7cf00941ba} locale MS\0x409 DisplayName dtc_transaction � X e S q l P k g _ d e g r e e _ o f _ p a r a l l e l i s m \��7 �� ( XeSqlPkg_degree_of_parallelism ) � �� " 0 < � � 5 A � � 7 G � � � � WU�����������������������������! � degree_of_parallelism EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid dop )
� " * � �� uint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� & � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber statement_type P
� ) 0 � ��; D N u } uint8 WmiDataId XEMapId ValueMap f i l o r 1 2 3 4 5 Values � � � � � Select Insert Update Delete Merge workspace_memory_grant_kb )
� � �� uint32 WmiDataId � X e S q l P k g \��7 �� XeSqlPkg
C � �� ' � � # + 5 B c����S � XeSqlPkg_sql_transaction Description Occurs when a SQL Server transaction begins, completes, rolls back or executes a savepoint. Use this event to monitor transaction behavior when troubleshooting applications, triggers or stored procedures. Guid {EAC6E752-960D-4966-B97D-CDCF6E05D786} locale MS\0x409 DisplayName sql_transaction �ion �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�} % �\>�S}� Z � WDMClassesOfDriver KernelPerfState C:\Windows\system32\kernelbase.dll[MofResourceName] ui[MofResourceName] 08BFC4A0C9846A8CBD054ACDF05BB8A137D5AFDEB625F91 C_4BEC7645E2863E66AB342FBA6288E3E94B92567D31F8ED34E1C8D99E55FFB8F4 n XactSequence �e] �\�o� ��߆ ` �� � p��Ђ � � 8 Ʒ`x? � b9(� � 5 X e S q l P k g _ c o l u m n s t o r e _ o b j e c t _ m a n a g e r _ s e r i a l i z e _ t o _ d i s k �Z��7 �� > ? XeSqlPkg_columnstore_object_manager_serialize_to_disk 7 ) � ��. 9 G S � R _ � � | � � � $ 1 ( � � ! ' WUU�����������������������������������������������������������q � columnstore_object_manager_serialize_to_disk EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid column_id )
� ? G � �� uint32 WmiDataId database_id )
� � � � �� uint16 WmiDataId duration_ms
+ )
� � �
� �� uint64 WmiDataId FragmentId 6
� P X c p � �� uint32 WmiDataId Description FragmentId hobt_id )
� � � � �� uint64 WmiDataId object_id " )
� � �� uint64 WmiDataId object_type * P
� � � � ��� e � � � � uint8 WmiDataId XEMapId ValueMap � � � � � � � � 1 5 6 7 8 2 4 0 Values , R p � � � COLUMN_SEGMENT COLUMN_SEGMENT_BULKINSERT_DICTIONARY COLUMN_SEGMENT_DELETE_BITMAP COLUMN_SEGMENT_EXTENDED_STRING_PAGE_RANGE COLUMN_SEGMENT_GLOBAL_STRING_DICTIONARY COLUMN_SEGMENT_PRIMARY_DICTIONARY COLUMN_SEGMENT_SECONDARY_DICTIONARY UNDEFINED RemainingLength 6
� l t � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � �� uint32 WmiDataId Description SequenceNumber size 3 )
� ^ f � �� uint64 WmiDataId � X e S q l P k g �Z��7 �8 XeSqlPkg
C � ��* 7 [ a � � � � c����� � XeSqlPkg_columnstore_rowgroup_compressed Description A compressed rowgroup was created. Guid {5CA255C4-9FAF-4AA8-8036-DE522991B909} locale MS\0x409 DisplayName columnstore_rowgroup_compressed �( X e S q l P k g _ c o l u m n s t o r e _ r o w g r o u p _ c o m p r e s s e d �Z��7 �4 o 2 XeSqlPkg_columnstore_rowgroup_compressed * ) � ��! , : F � � G V � � d m � � ` r � � B M � � � � r � � � - : � � WUUU������������������������������������������������������������������������������������������������������������ � columnstore_rowgroup_compressed EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� 4 < � �� uint16 WmiDataId database_name f C
� � � � ��� � � � string WmiDataId StringTermination NullTerminated Format w FragmentId 6
� 8 @ K X � �� uint32 WmiDataId Description FragmentId hobt_id & )
� � � � �� uint64 WmiDataId index_id )
� � � �� uint64 WmiDataId object_id )
� M U � �� uint64 WmiDataId partition_number . )
� � � � �� uint64 WmiDataId RemainingLength 6
� $ 1 � �� uint32 WmiDataId Description RemainingLength row_count V )
� � � � �� uint64 WmiDataId rowgroup_id F )
� � � � �� uint64 WmiDataId SequenceNumber 6
� B J U b � �� uint32 WmiDataId Description SequenceNumber source_rowgroup_id
N )
� � �
� �� uint64 WmiDataId transition_reason
6 )
� "
� �� uint64 WmiDataId trim_reason > )
� q y � �� uint64 WmiDataId tx_id ^ )
� � � � �� uint64 WmiDataId � X e S q l P k g �Z��7 �] XeSqlPkg
C � ��1 > y � � � � c����� � XeSqlPkg_columnstore_tuple_mover_begin_compress Description Columnstore tuple mover started compressing a deltastore. Guid {A81CCD79-F3DC-4060-816C-B1956DB61ECC} locale MS\0x409 DisplayName columnstore_tuple_mover_begin_compress �/ X e S q l P k g _ c o l u m n s t o r e _ t u p l e _ m o v e r _ b e g i n _ c o m p r e s s �Z��7 �� L 9 XeSqlPkg_columnstore_tuple_mover_begin_compress 1 ) � ��( 3
A M � N ^ � � $ - w � � � / > � � � � 8 I � � # WUU�������������������������������������������������������������������������� � columnstore_tuple_mover_begin_compress EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� ; C � �� uint16 WmiDataId delta_store_id )
� � � � �� uint64 WmiDataId FragmentId 6
� � � �� uint32 WmiDataId Description FragmentId hobt_id )
� d l � �� uint64 WmiDataId index_id . )
� � � � �� uint64 WmiDataId is_aggressive_compression F )
� $ � �� sint8 WmiDataId is_nci_on_cci
G )
� u |
� �� sint8 WmiDataId object_id & )
� � � � �� uint64 WmiDataId partition_number
6 )
� % -
� �� uint64 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength row_count > )
� � �� uint64 WmiDataId SequenceNumber 6
� g o z � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �Z��7 �[ XeSqlPkg
C � ��/ < y � � � � c����� � XeSqlPkg_columnstore_tuple_mover_end_compress Description Columnstore tuple mover completed compressing a deltastore. Guid {8538384F-E68D-4bd1-8BC5-71B5E3883EEC} locale MS\0x409 DisplayName columnstore_tuple_mover_end_compress � X e S q l P k g �Z��7 �f XeSqlPkg
C � ��: G y � � � � c����� � XeSqlPkg_columnstore_tuple_mover_delete_buffer_truncated Description Columnstore tuple mover truncated delete buffer. Guid {bc1cdbe6-b2c6-4082-b609-4a5f8856ed02} locale MS\0x409 DisplayName columnstore_tuple_mover_delete_buffer_truncated �ted �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�� , �\>�S}� a � WDMClassesOfDriver UmsDirectedSwitchStart C:\Windows\system32\kernelbase.dll[MofResourceName] ame] 8CBD054ACDF05BB8A137D5AFDEB625F91 C_4BEC7645E2863E66AB342FBA6288E3E94B92567D31F8ED34E1C8D99E55FFB8F4 n XactSequence �e] u�` � �H6
� �rI� � �p�6[ ^ ɋ��� 5 X e S q l P k g _ c o l u m n _ s t o r e _ i n d e x _ b u i l d _ p r o c e s s _ s e g m e n t _ l o b �Z��7 �& � ? XeSqlPkg_column_store_index_build_process_segment_lob 7 ) � ��. 9 G S � a l � �
� � � � 0 > � � � N i � � , v � � � . U � � ! k � � � . C � � � � o | � � WUUUUU�������������������������������������������������������������������������������������������������������������������������������������������������J
� column_store_index_build_process_segment_lob EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid approx_compression_ratio � )
� N V � �� real64 WmiDataId column_id
, )
� � �
� �� uint32 WmiDataId database_id )
� � � �� uint32 WmiDataId FragmentId 6
� ] e p } � �� uint32 WmiDataId Description FragmentId hobt_id $ )
� � � � �� uint64 WmiDataId index_id )
� % � �� uint32 WmiDataId inline_count D )
� u } � �� uint32 WmiDataId inline_original_total_size H )
� � � � �� uint64 WmiDataId inline_primary_count \ )
� ; C � �� uint32 WmiDataId inline_primary_total_size ` )
� � � � �� uint64 WmiDataId inline_unique_count P )
� � � �� uint32 WmiDataId inline_unique_total_size T )
� c k � �� uint64 WmiDataId object_id )
� � � � �� uint32 WmiDataId offrow_compressed_count h )
� # � �� uint32 WmiDataId offrow_compressed_original_total_size t )
� � � � �� uint64 WmiDataId offrow_compressed_total_size l )
� � � � �� uint64 WmiDataId offrow_passthrough_count | )
� X ` � �� uint32 WmiDataId offrow_passthrough_total_size � )
� � � � �� uint64 WmiDataId original_count 8 )
� # � �� uint32 WmiDataId original_total_size
< )
� z �
� �� uint64 WmiDataId partition_number )
� � � � �� uint32 WmiDataId RemainingLength 6
� > F Q ^ � �� uint32 WmiDataId Description RemainingLength rowgroup_id 0 )
� � � � �� uint64 WmiDataId SequenceNumber 6
�
"
-
:
� �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �Z��7 �g XeSqlPkg
C � ��8 E | � � � � � c����� � XeSqlPkg_column_store_index_build_bloom_filter_created Description A bloom filter has been created for a column segment. Guid {c6ef5da2-2446-4dd5-9c16-a4b81e1fbe39} locale MS\0x409 DisplayName column_store_index_build_bloom_filter_created �6 X e S q l P k g _ c o l u m n _ s t o r e _ i n d e x _ b u i l d _ b l o o m _ f i l t e r _ c r e a t e d �Z��7 �@ X @ XeSqlPkg_column_store_index_build_bloom_filter_created 8 ) � ��/ : H T � Z g � � - 6 � � � � 2 I � � � � D U � � , v � WUU������������������������������������������������������������������������������������� � column_store_index_build_bloom_filter_created EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid build_time_in_ms L )
� G O � �� uint64 WmiDataId database_id )
� � � � �� uint32 WmiDataId FragmentId 6
� ! � �� uint32 WmiDataId Description FragmentId hobt_id )
� m u � �� uint64 WmiDataId index_id $ )
� � � � �� uint32 WmiDataId max_memory_used_kb < )
� ' � �� uint64 WmiDataId most_expensive_column
D )
� � �
� �� uint64 WmiDataId object_id )
� � � � �� uint32 WmiDataId partition_number ( )
� 1 9 � �� uint32 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength row_count 4 )
� � �� uint64 WmiDataId rowgroup_id
, )
� c k
� �� uint64 WmiDataId SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �Z��7 �6 XeSqlPkg
C � ��, 9 W ] � � � � c����� � XeSqlPkg_columnstore_delta_rowgroup_closed Description A delta rowgroup was closed. Guid {3423781b-361e-4c94-a723-f8711ea7fa13} locale MS\0x409 DisplayName columnstore_delta_rowgroup_closed �* X e S q l P k g _ c o l u m n s t o r e _ d e l t a _ r o w g r o u p _ c l o s e d �Z��7 �� S 4 XeSqlPkg_columnstore_delta_rowgroup_closed , ) � ��# .
< H � � I Y � � ( r | � � - w � � T _ � � WUU��������������������������������������������������������������������������������� � columnstore_delta_rowgroup_closed EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� 6 > � �� uint16 WmiDataId delta_store_id
6 )
� � �
� �� uint64 WmiDataId FragmentId 6
� � � � �� uint32 WmiDataId Description FragmentId hobt_id & )
� _ g � �� uint64 WmiDataId index_id )
� � � � �� uint64 WmiDataId object_id )
� � �� uint64 WmiDataId partition_number . )
� d l � �� uint64 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength reorg_forced
N )
� B I
� �� sint8 WmiDataId row_count F )
� � � � �� uint64 WmiDataId rowgroup_id > )
� � � � �� uint64 WmiDataId SequenceNumber 6
� T \ g t � �� uint32 WmiDataId Description SequenceNumber �ber �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�v �\>�S}� S � WDMClassesOfDriver UmsEvent C:\Windows\system32\kernelbase.dll[MofResourceName] esourceName] e] X�[` - �;鞍 9 �mP�� _ �D{ % I ���n W S Q L T r a c e E v e n t 1 3 9 4P��7 �� � SQLTraceEvent139 6 � �� % J U d g x . ; � � 2 > � � k w � � i s " ( � � i r � � ] g " � � � � Q
[
�
�
� � E O �
�
�
7 B � � ' 8 � � � � UUUUUU����������������������������������������������������������������������������������������������������������������������������5 � SQLTraceEvent139_TYPE0 Description Broker:Forwarded Message Sent Type0 EventType EventTypeName 0 ApplicationName P
� � � � � % � �� string WmiDataId Description ApplicationName format w StringTermination Counted BigintData1 l 6
� � � � � �� sint64 WmiDataId Description BigintData1 ClientProcessID 6
� ! � �� sint32 WmiDataId Description ClientProcessID DatabaseID 6
� � � � � � �� sint32 WmiDataId Description DatabaseID DBUserName P P
� + 8 D L O b � �� string WmiDataId Description DBUserName format w StringTermination Counted EventClass
< 6
� � � � � � �� sint32 WmiDataId Description EventClass EventSequence d 6
� : B M Z � �� sint64 WmiDataId Description EventSequence FileName @ P
� � � � � � � �� string WmiDataId Description FileName format w StringTermination Counted GUID
t C
� y � � � � � � �� object WmiDataId Description GUID extension Guid HostName P
� + 8 B J M ` � �� string WmiDataId Description HostName format w StringTermination Counted IndexID 4 6
� � � � � � �� sint32 WmiDataId Description IndexID IntegerData 8 6
� 0 8
C P � �� sint32 WmiDataId Description IntegerData LoginSid T P
� � � � � � � �
� �� string WmiDataId Description LoginSid format c StringTermination Counted MethodName ` P
� � � � � � � � � � �� string WmiDataId Description MethodName format w StringTermination Counted NTDomainName P
� ? G R _ m u x � � �� string WmiDataId Description NTDomainName format w StringTermination Counted NTUserName P
� �
*
2
5
H
� �� string WmiDataId Description NTUserName format w StringTermination Counted ObjectID , 6
� �
�
�
�
� �� sint32 WmiDataId Description ObjectID OwnerName D P
� 2 : E R ] e h { � �� string WmiDataId Description OwnerName format w StringTermination Counted ProviderName \ P
� � � & ) < � �� string WmiDataId Description ProviderName format w StringTermination Counted RoleName H P
� � � � � � � � � � �� string WmiDataId Description RoleName format w StringTermination Counted SessionLoginName x P
� n
v
�
�
�
�
�
�
� �� string WmiDataId Description SessionLoginName format w StringTermination Counted SPID 6
� $ 1 � �� sint32 WmiDataId Description SPID StartTime $ 6
� � � � � � �� uint64 WmiDataId Description StartTime Success
0 6
� � � �� sint32 WmiDataId Description Success TargetLoginName X P
� � � � � � � � � � �� string WmiDataId Description TargetLoginName format w StringTermination Counted TargetUserName L P
� \ d o | � � � � � �� string WmiDataId Description TargetUserName format w StringTermination Counted TransactionID 6
� & � �� sint64 WmiDataId Description TransactionID � M S S Q L S E R V E R T r a c e 5P��7 � MSSQLSERVERTrace 6 � �� A G m z � � SQLTraceEvent140 Description Broker:Forwarded Message Dropped Guid 84e993e6-008c-4d70-97ef-3824ed2c4e93 DisplayName Broker:Forwarded Message Dropped D � X e S q l P k g _ r e s o u r c e n a m e _ w r i t t e n AQ��7 �
' XeSqlPkg_resourcename_written ) � �� ! / ; � � 9 E � � P a � � W����������������������������Z � resourcename_written EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid error_id )
� & . � �� sint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId message C
� � ��" 5 E M string WmiDataId StringTermination NullTerminated Format w RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� * 2 = J � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g BQ��7 �! XeSqlPkg
C � �� * Q W � � � c����� � XeSqlPkg_objectname_written Description ObjectName qualified errorlog written Guid {674ffc97-5e52-4e6c-a65b-9c7890669439} locale MS\0x409 DisplayName objectname_written � X e S q l P k g _ o b j e c t n a m e _ w r i t t e n CQ��7 � % XeSqlPkg_objectname_written ) � �� - 9 � � 7 C � � N _ � � W����������������������������X � objectname_written EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid error_id )
� $ , � �� sint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId message C
�
� �� 3 C K string WmiDataId StringTermination NullTerminated Format w RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� ( 0 ; H � �� uint32 WmiDataId Description SequenceNumber �ber �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C� ' �\>�S}� \ � WDMClassesOfDriver SystemConfig_Boot C:\Windows\system32\kernelbase.dll[MofResourceName] urceName] esourceName] ame] !. �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty .- �! � MSFT_CliFormat LIST FULL < v � � - � 6 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � h u � MSFT_CliProperty Description The Description property provides a textual description of the object. Description D 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier
� v � � MSFT_CliProperty InstallDate The InstallDate property is datetime value indicating when the object was installed. InstallDate � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier �
x ~ � � MSFT_CliProperty Name The Name property contains a character string specifying the name of an environment variable. Name � � � � � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING j , � MSFT_CliQualifier CIMTYPE $ string � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING f & � MSFT_CliQualifier key True � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING # � � MSFT_CliQualifier MappingStrings / 5 True Win32Registry|System\CurrentControlSet\Control\Session Manager\Environment � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING k + � MSFT_CliQualifier Override % Name � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING g ' � MSFT_CliQualifier read ! True � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING h ( � MSFT_CliQualifier write " True � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � i q � � MSFT_CliProperty Status The Status property is a string indicating the current status of the object. Status � � / � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 10 � � @ P ��������w � MSFT_CliQualifier NaK���p � )?C�n r ���
� W�~v { s��� � ďo� * , X e S q l P k g _ b u f f e r _ p o o l _ e x t e n s i o n _ p a g e s _ w r i t t e n �\��7 �� o 6 XeSqlPkg_buffer_pool_extension_pages_written . ) � ��% 0 > J � � F R � � � P Y � � � K Q � � � R ^ � � g t � � $ n | � � 0 z � � � ( 9 � � 2 E � � WUUUUU���������������������������������������������������������������������������������������������������������� � buffer_pool_extension_pages_written EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid caller
, )
� 3 ;
� �� uint16 WmiDataId cBufHashed J )
� � � � �� sint32 WmiDataId cBufSimulated R )
� � � � �� sint32 WmiDataId cBufWithoutPage N )
� = E � �� sint32 WmiDataId cL2Size W )
� � � � �� sint32 WmiDataId cutOffL1 : )
� � � � �� sint32 WmiDataId cutOffL2 > )
� 8 @ � �� sint32 WmiDataId dbId 2 )
� � � � �� sint32 WmiDataId first_page_file_id )
� � � � �� uint16 WmiDataId first_page_id )
� ? G � �� uint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId group d C
� & . � ��9 L \ d string WmiDataId StringTermination NullTerminated Format w keepL2Pages V )
� � � � �� sint8 WmiDataId l2bpoolpendingio . )
� � �� uint32 WmiDataId minCutOff F )
� [ c � �� sint32 WmiDataId numa_node_id * )
� � � � �� uint16 WmiDataId number_pages )
� � �� uint64 WmiDataId page_file_offset " )
� g o � �� uint64 WmiDataId poolsWithPressure [ )
� � � � �� uint64 WmiDataId pUse2
6 )
�
� �� sint32 WmiDataId RemainingLength 6
� } � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
�
" � �� uint32 WmiDataId Description SequenceNumber shrinkSpecificDbs c )
� | � � �� sint8 WmiDataId simCutOff B )
� � � � �� sint32 WmiDataId � X e S q l P k g �\��7 �J XeSqlPkg
C � ��+ 8 l r � � � � c����� � XeSqlPkg_buffer_pool_extension_pages_read Description Page is read from the buffer pool extension cache. Guid {7DCFB25F-7B89-4727-9F4D-7FE9A87A0861} locale MS\0x409 DisplayName buffer_pool_extension_pages_read �) X e S q l P k g _ b u f f e r _ p o o l _ e x t e n s i o n _ p a g e s _ r e a d �\��7 �, k 3 XeSqlPkg_buffer_pool_extension_pages_read + ) � ��" - ; G � � C O � � � M V � � � � H \ � � � { � ! j | � � ) s � � � ' : � � � � [ k � � ; F WUUUUU������������������������������������������������������������������������������������������������������ � buffer_pool_extension_pages_read EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid caller
, )
� 0 8
� �� uint16 WmiDataId cBufHashed F )
� � � � �� sint32 WmiDataId cBufSimulated N )
� � � � �� sint32 WmiDataId cBufWithoutPage J )
� : B � �� sint32 WmiDataId cL2Size S )
� � � � �� sint32 WmiDataId cutOffL1
6 )
� � �
� �� sint32 WmiDataId cutOffL2 : )
� 5 = � �� sint32 WmiDataId first_page_file_id )
� � � � �� uint16 WmiDataId first_page_id )
� � � � �� uint32 WmiDataId FragmentId 6
� O W b o � �� uint32 WmiDataId Description FragmentId group ` C
� � � � ��� � string WmiDataId StringTermination NullTerminated Format w keepL2Pages R )
� X _ � �� sint8 WmiDataId l2bpoolpendingio 2 )
� � � � �� uint32 WmiDataId minCutOff B )
� � �� sint32 WmiDataId numa_node_id * )
� ` h � �� uint16 WmiDataId number_pages )
� � � � �� uint64 WmiDataId page_file_offset " )
� � �� uint64 WmiDataId poolsWithPressure W )
� q y � �� uint64 WmiDataId pUse2 . )
� � � � �� sint32 WmiDataId RemainingLength 6
� * 2 = J � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber shrinkSpecificDbs _ )
� ) 0 � �� sint8 WmiDataId simCutOff > )
� } � � �� sint32 WmiDataId � X e S q l P k g �\��7 �S XeSqlPkg
C � ��. ; r x � � � � c����� � XeSqlPkg_buffer_pool_extension_pages_evicted Description Page is evicted from the buffer pool extension cache. Guid {166EB22D-BE79-4F49-A496-888EB6DE4751} locale MS\0x409 DisplayName buffer_pool_extension_pages_evicted � X e S q l P k g �\��7 �o XeSqlPkg
C � ��3 @ � � � � � � c���� � XeSqlPkg_xtp_offline_checkpoint_before_log_record Description Fired by XTP offline checkpoint before it process each host log record. Guid {AD6FAB05-5E00-4EE1-A942-7FCA9DEB52F0} locale MS\0x409 DisplayName xtp_offline_checkpoint_before_log_record �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 r2pl\}�
͝��C�� 8 ��
�S}� w � WDMClassesOfDriver WmiMonitorSupportedDisplayFeatures C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 r2pl\}�
͝��C�� 8 ��
�S}� w � WDMClassesOfDriver WmiMonitorSupportedDisplayFeatures C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 r2pl\}�
͝��C�� 8 ��
�S}� w � WDMClassesOfDriver WmiMonitorSupportedDisplayFeatures C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] urceName] �e] �0N�� � ��J � 8��z% � ��� jlգ� � })�� # ��&�
t �}�ց � ��+ � ��.e � vٝ��C�� " ) - � �� � C T l � � � O Y � � � � : V � � UU��������������������������������� � MDM_Policy_Config01_Kerberos02 InPartition 5 local-system DMWmiBridgeProv AllowForestSearchOrder '
� � � �� � �� string InstanceID
� � � �� string KerberosClientSupportsClaimsCompoundArmor '
� G � �� � �� string ParentID
� � � �� string RequireKerberosArmoring '
� � � �� � �� string RequireStrictKDCValidation '
� 2 � �� � �� string SetMaximumContextTokenSize '
� � � �� � �� string UPNNameHints '
� � � �� � �� string � wٝ��C�� ' ) $ 1 � �� � W h ~ � � N f � � � H T � � � � UU������������������������������������� � MDM_Policy_Config01_KioskBrowser02 InPartition = K local-system local-user DMWmiBridgeProv BlockedUrlExceptions '
� � � �� � �� string BlockedUrls '
� � � �� � �� string DefaultURL '
� F � �� � �� string EnableEndSessionButton '
� � � �� � �� sint32 EnableHomeButton '
� � � �� � �� sint32 EnableNavigationButtons '
� @ � �� � �� sint32 InstanceID
� ~ � �� string ParentID
� � � �� string RestartOnIdleTime '
�
� �� � �� sint32 � xٝ��C��
) ) 6 � �� � L ] x � � � � U������������/ � MDM_Policy_Config01_LanmanWorkstation02 InPartition > local-system DMWmiBridgeProv EnableInsecureGuestLogons '
� � � �� � �� sint32 InstanceID
� � � �� string ParentID
� ' � �� string nW � yٝ��C� ) ! . � �� � D U z � � & X b U����������������� � MDM_Policy_Config01_Licensing02 InPartition 6 local-system DMWmiBridgeProv AllowWindowsEntitlementReactivation '
� � � �� � �� sint32 DisallowKMSClientOnlineAVSValidation '
� � �� � �� sint32 InstanceID
� P � �� string ParentID
� � � �� string M � ~ٝ��C�� " ) ' 4 � �� � J [ � � � $ : w � � � ( 2 d � � � UU��������������������������������< � MDM_Policy_Config01_MSSecurityGuide02 InPartition < local-system DMWmiBridgeProv ApplyUACRestrictionsToLocalAccountsOnNetworkLogon '
� � � �� � �� string ConfigureSMBV1ClientDriver '
� � �� � �� string ConfigureSMBV1Server '
� o � �� � �� string EnableStructuredExceptionHandlingOverwriteProtection '
� � � �� � �� string InstanceID
� � �� string ParentID
� \ � �� string TurnOnWindowsDefenderProtectionAgainstPotentiallyUnwantedApplications '
� � � �� � �� string WDigestAuthentication '
� 4 � �� � �� string � ٝ��C� ) ! . � �� � D U � � I U � � � C M U������������������������� � MDM_Policy_Config01_MSSLegacy02 InPartition 6 local-system DMWmiBridgeProv AllowICMPRedirectsToOverrideOSPFGeneratedRoutes '
� � � �� � �� string AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers '
� A � �� � �� string InstanceID
� � �� string IPSourceRoutingProtectionLevel '
� � � �� � �� string IPv6SourceRoutingProtectionLevel '
� ; � �� � �� string ParentID
� w � �� string � �ٝ��C�\ + ) ( 5 � �� � K
\ v � � # ` � � � 4 q � � � & c m UU������������������������������������������ � MDM_Policy_Config01_NetworkIsolation02 InPartition = local-system DMWmiBridgeProv EnterpriseCloudResources '
� � � �� � �� string EnterpriseInternalProxyServers '
� � �� � �� string EnterpriseIPRange '
� X � �� � �� string EnterpriseIPRangesAreAuthoritative '
� � � �� � �� sint32 EnterpriseNetworkDomainNames '
� � �� � �� string EnterpriseProxyServers '
� i � �� � �� string EnterpriseProxyServersAreAuthoritative '
� � � �� � �� sint32 InstanceID
� � �� string NeutralResources $ '
� [ � �� � �� string ParentID
� � � �� string � �ٝ��C��
) % 2 � �� � H Y t � � � � U������������+ � MDM_Policy_Config01_Notifications02 InPartition : local-system DMWmiBridgeProv DisallowCloudNotification '
� � � �� � �� sint32 InstanceID
� � � �� string ParentID
� # � �� string ic � �ٝ��C�� ' ) # 0 � �� � F W o � � � � ; E w � � � , i � � � UU������������������������������������� � MDM_Policy_Config01_RemoteShell02 InPartition 8 local-system DMWmiBridgeProv AllowRemoteShellAccess '
� � � �� � �� string InstanceID
� � � �� string MaxConcurrentUsers '
� 3 � �� � �� string ParentID
� o � �� string SpecifyIdleTimeout '
� � � �� � �� string SpecifyMaxMemory '
� � �� � �� string SpecifyMaxProcesses '
� a � �� � �� string SpecifyMaxRemoteShells '
� � � �� � �� string SpecifyShellTimeout '
� � �� � �� string � �ٝ��C��
) ( 5 � �� � K \ v � � � � U������������- � MDM_Policy_Config01_RestrictedGroups02 InPartition = local-system DMWmiBridgeProv ConfigureGroupMembership '
� � � �� � �� string InstanceID
� � � �� string ParentID
� % � �� string ic �ing ic �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 i*pl\}�
͝��C� ' �\>�S}� \ � WDMClassesOfDriver MSNdis_MediaInUse C:\Windows\system32\kernelbase.dll[MofResourceName] me] sourceName] ] ceName] Q}� � ��=g� �IY� R�*� K � n7S � PW CM � ]�G
�ɹ�Y ,��g � ^5 � #�$ ���- ���s/ � ���!� l�� M S N d i s Z��jj��� MSNdis A �� � �� � # , 2 Z f n � � � U����������Q � MSNdis_TokenRingCurrentGroup WMI WMIProv guid {4479570a-a61b-11d0-8dd4-00c04fc3358c} WmiExpense Active
� � � �� boolean InstanceName '
� � � �� � �� string NdisTokenRingCurrentGroup )
� > � ��F uint32 WmiDataId iE � M S N d i s [��jj��� MSNdis A �� � �� � % . 4 \ h p � � � U����������U � MSNdis_TokenRingLastOpenStatus WMI WMIProv guid {4479570b-a61b-11d0-8dd4-00c04fc3358c} WmiExpense Active
� � � �� boolean InstanceName '
� � � �� � �� string NdisTokenRingLastOpenStatus )
� B � ��J uint32 WmiDataId Wm � M S N d i s \��jj��� MSNdis A # �� � �� � ( 1 7 _ k s � � � U����������[ � MSNdis_TokenRingCurrentRingStatus WMI WMIProv guid {890a36ec-a61c-11d0-8dd4-00c04fc3358c} WmiExpense Active
� � � �� boolean InstanceName '
� � � �� � �� string NdisTokenRingCurrentRingStatus )
� H � ��P uint32 WmiDataId } � M S N d i s ]��jj��' MSNdis A " �� � �� � ' 0 6 ^ j r � � � U����������� � MSNdis_TokenRingCurrentRingState WMI WMIProv guid {acf14032-a61c-11d0-8dd4-00c04fc3358c} WmiExpense Active
� � � �� boolean InstanceName '
� � � �� � �� string NdisTokenRingCurrentRingState 6
� S � ��[ e � uint32 ValueMap � � � � � � 1 2 3 4 5 6 WmiDataId � M S N d i s ^��jj��� MSNdis A �� � �� � ! * 0 X d l � � � U����������M � MSNdis_TokenRingLineErrors WMI WMIProv guid {acf14033-a61c-11d0-8dd4-00c04fc3358c} WmiExpense Active
� � � �� boolean InstanceName '
� � � �� � �� string NdisTokenRingLineErrors )
� : � ��B uint32 WmiDataId xp � M S N d i s _��jj��� MSNdis A �� � �� � ! * 0 X d l � � � U����������M � MSNdis_TokenRingLostFrames WMI WMIProv guid {acf14034-a61c-11d0-8dd4-00c04fc3358c} WmiExpense Active
� � � �� boolean InstanceName '
� � � �� � �� string NdisTokenRingLostFrames )
� : � ��B uint32 WmiDataId xp � M S N d i s `��jj��� MSNdis A ! �� � �� � & / 5 ] i q � � � U����������e � MSNdis_FddiLongPermanentAddress WMI WMIProv guid {acf14035-a61c-11d0-8dd4-00c04fc3358c} WmiExpense Active
� � � �� boolean InstanceName '
� � � �� � �� string NdisPermanentAddress
)
� < � ��Z object:MSNdis_NetworkAddress WmiDataId � M S N d i s a��jj��� MSNdis A �� � �� � $ - 3 [ g o � � � U����������a � MSNdis_FddiLongCurrentAddress WMI WMIProv guid {acf14036-a61c-11d0-8dd4-00c04fc3358c} WmiExpense Active
� � � �� boolean InstanceName '
� � � �� � �� string NdisCurrentAddress
)
� 8 � ��V object:MSNdis_NetworkAddress WmiDataId � � M S N d i s b��jj��v MSNdis A �� � �� � # , 2 Z f n � � � � � � U��������������� � MSNdis_FddiLongMulticastList WMI WMIProv guid {acf14037-a61c-11d0-8dd4-00c04fc3358c} WmiExpense Active
� � � �� boolean InstanceName '
� � � �� � �� string NdisMulticastList
6
� C � ��a l w object:MSNdis_NetworkAddress WmiDataId WmiSizeIs NumberElements NumberElements )
� � � ��� uint32 WmiDataId � M S N d i s c��jj��� MSNdis A �� � �� � % . 4 \ h p � � � U����������U � MSNdis_FddiLongMaximumListSize WMI WMIProv guid {acf14038-a61c-11d0-8dd4-00c04fc3358c} WmiExpense Active
� � � �� boolean InstanceName '
� � � �� � �� string NdisFddiLongMaximumListSize )
� B � ��J uint32 WmiDataId Wm � M S N d i s d��jj��� MSNdis A " �� � �� � ' 0 6 ^ j r � � � U����������k � MSNdis_FddiShortPermanentAddress WMI WMIProv guid {acf14039-a61c-11d0-8dd4-00c04fc3358c} WmiExpense Active
� � � �� boolean InstanceName '
� � � �� � �� string NdisPermanentAddress
)
� = � ��` object:MSNdis_NetworkShortAddress WmiDataId � � M S N d i s e��jj��� MSNdis A �� � �� � % . 4 \ h p � � � U����������g � MSNdis_FddiShortCurrentAddress WMI WMIProv guid {acf1403a-a61c-11d0-8dd4-00c04fc3358c} WmiExpense Active
� � � �� boolean InstanceName '
� � � �� � �� string NdisCurrentAddress
)
� 9 � ��\ object:MSNdis_NetworkShortAddress WmiDataId � M S N d i s f��jj��| MSNdis A �� � �� � $ - 3 [ g o � � � � � U��������������� � MSNdis_FddiShortMulticastList WMI WMIProv guid {acf1403b-a61c-11d0-8dd4-00c04fc3358c} WmiExpense Active
� � � �� boolean InstanceName '
� � � �� � �� string NdisMulticastList
6
� D � ��g r } object:MSNdis_NetworkShortAddress WmiDataId WmiSizeIs NumberElements NumberElements )
� � � ��� uint32 WmiDataId � M S N d i s g��jj��� MSNdis A ! �� � �� � & / 5 ] i q � � �
U����������W � MSNdis_FddiShortMaximumListSize WMI WMIProv guid {acf1403c-a61c-11d0-8dd4-00c04fc3358c} WmiExpense Active
� � � �� boolean InstanceName '
� � � �� � �� string NdisFddiShortMaximumListSize )
� D � ��L uint32 WmiDataId W �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 Y�n�^��
͝��C�� 5 J.3�� j � WDMClassesOfDriver MSNdis_FddiShortMaximumListSize C:\Windows\system32\kernelbase.dll[MofResourceName] ame] l
:sp � 1{l� � �B� � � �) �. � K��}� Ia�_ � > X e S q l P k g _ c o l u m n s t o r e _ o b j e c t _ r e a d _ f r o m _ u n a l i g n e d _ s b s _ c a c h e _ f a i l ;[��7 �� L H XeSqlPkg_columnstore_object_read_from_unaligned_sbs_cache_fail @ ) � ��7 B P \ | � � � " . x � � � G U � � � J W = N � � G c WUU������������������������������������������������������������������������� � columnstore_object_read_from_unaligned_sbs_cache_fail EventType EventVersion ActivityId
N
� � � � � � �� � ��� object:guid WmiDataId Description ActivityId ActivityID Extension Guid blob_id
D 6
� S ` � ��k v object:guid WmiDataId Extension Guid column_id & )
� � � � �� uint64 WmiDataId db_id )
� � �� uint16 WmiDataId error_code
6 )
� e m
� �� uint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId hobt_id )
� 4 < � �� uint64 WmiDataId is_readahead B )
� � � � �� sint8 WmiDataId object_id )
� � � � �� uint64 WmiDataId object_size . )
� 7 ? � �� uint64 WmiDataId object_type
C P
� � �
� ��� e � � uint8 WmiDataId XEMapId ValueMap �
1 5 6 7 8 2 4 0 Values B R x � � �
2 COLUMN_SEGMENT COLUMN_SEGMENT_BULKINSERT_DICTIONARY COLUMN_SEGMENT_DELETE_BITMAP COLUMN_SEGMENT_EXTENDED_STRING_PAGE_RANGE COLUMN_SEGMENT_GLOBAL_STRING_DICTIONARY COLUMN_SEGMENT_PRIMARY_DICTIONARY COLUMN_SEGMENT_SECONDARY_DICTIONARY UNDEFINED RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� * 7 � �� uint32 WmiDataId Description SequenceNumber time_read_from_cache_in_us : )
� � � � �� uint64 WmiDataId � X e S q l P k g <[��7 �~ XeSqlPkg
C � ��: G � � � � � � c���� � XeSqlPkg_columnstore_object_write_to_block_blobs_success Description Columnstore object was successfully write to block blobs on index build. Guid {D1447B9E-CF54-48F4-800F-26FB6BCE3C81} locale MS\0x409 DisplayName columnstore_object_write_to_block_blobs_success �8 X e S q l P k g _ c o l u m n s t o r e _ o b j e c t _ w r i t e _ t o _ b l o c k _ b l o b s _ s u c c e s s =[��7 �
A B XeSqlPkg_columnstore_object_write_to_block_blobs_success : ) � ��1 < J V v � � � # * t � � � G P � � � � � � h x WUU��������������������������������������������������������������� � columnstore_object_write_to_block_blobs_success EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid blob_id
9 6
� M Z � ��e p object:guid WmiDataId Extension Guid column_id & )
� � � � �� uint64 WmiDataId container_id
6 )
�
� �� uint16 WmiDataId db_id )
� a i � �� uint16 WmiDataId duration_ms . )
� � � � �� uint64 WmiDataId FragmentId 6
� # . ; � �� uint32 WmiDataId Description FragmentId hobt_id )
� � � � �� uint64 WmiDataId object_id )
� � � � �� uint64 WmiDataId object_type 8 P
� Z a � ��l e u � � uint8 WmiDataId XEMapId ValueMap � � � � � � � � 1 5 6 7 8 2 4 0 Values � � ; f � � � COLUMN_SEGMENT COLUMN_SEGMENT_BULKINSERT_DICTIONARY COLUMN_SEGMENT_DELETE_BITMAP COLUMN_SEGMENT_EXTENDED_STRING_PAGE_RANGE COLUMN_SEGMENT_GLOBAL_STRING_DICTIONARY COLUMN_SEGMENT_PRIMARY_DICTIONARY COLUMN_SEGMENT_SECONDARY_DICTIONARY UNDEFINED RemainingLength 6
� 7 ? J W � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g >[��7 �� XeSqlPkg
C � ��7 D � � � � � � c���� � XeSqlPkg_columnstore_object_write_to_block_blobs_fail Description Attempted to write a chunk of columnstore object to block blobs on index build and failed. Guid {273492E7-67C2-4415-B891-88DAB8D48CDE} locale MS\0x409 DisplayName columnstore_object_write_to_block_blobs_fail �2 X e S q l P k g _ c o l u m n s t o r e _ o b j e c t _ u p d a t e _ s i z e _ i n _ c a t a l o g G[��7 � / < XeSqlPkg_columnstore_object_update_size_in_catalog 4 ) � ��+ 6 D P � p } � � = I � � ! � � WU��������������������������������������������� � columnstore_object_update_size_in_catalog EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid blob_id
( 6
� G T � ��_ j object:guid WmiDataId Extension Guid duration_ms )
� � � � �� uint64 WmiDataId fork_id
$ 6
� ! � ��, 7 object:guid WmiDataId Extension Guid FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId object_size )
� � � �� uint64 WmiDataId RemainingLength 6
� e m x � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � �
� �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g H[��7 �Y XeSqlPkg
C � ��/ < w } � � � � c����� � XeSqlPkg_dw_catalog_communication_hub_failure Description Emits an event describing a catalog communication failure Guid {F6479B3D-E5C9-4711-9B39-3F81ADEF37FC} locale MS\0x409 DisplayName dw_catalog_communication_hub_failure �ure �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�� 1 �\>�S}� f � WDMClassesOfDriver MSDeviceUI_FirmwareRevision C:\Windows\system32\kernelbase.dll[MofResourceName] 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�� 1 �\>�S}� f � WDMClassesOfDriver MSDeviceUI_FirmwareRevision C:\Windows\system32\kernelbase.dll[MofResourceName] ResourceName] me] C9150CCD98DA7C521E94D1BD1604403DE2F CR_2B94E6C8800F3E60608BFC4A0C9846A8CBD054ACDF05BB8A137D5AFDEB625F91 C_4BEC7645E2863E66AB342FBA6288E3E94B92567D31F8ED34E1C8D99E55FFB8F4 n XactSequence �e] -8�5� η�۰ q 7�! �f��!
* �Gg�K $ w�o j �k�� � ͻ�Vf j X e S q l P k g _ r b i o _ e o l _ v e r i f i c a t i o n �\��7 �� D ( XeSqlPkg_rbio_eol_verification ) � �� " 0 < � � < Q � � ) s � � � � f w � � > N WUU������������������������������������������������������������������ � rbio_eol_verification EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid block_size , )
� ) 1 � �� uint32 WmiDataId first_invalid_block )
� � � � �� uint64 WmiDataId FragmentId 6
� � � � � �� uint32 WmiDataId Description FragmentId last_valid_block )
� ` h � �� uint64 WmiDataId logical_db_id
8 6
� � � � ��� � object:guid WmiDataId Extension Guid logical_db_name < C
� Q Y � ��d w � � string WmiDataId StringTermination NullTerminated Format w physical_db_id
4 6
� � �
� ��� object:guid WmiDataId Extension Guid read_offset $ )
� S [ � �� uint64 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength result 0 )
� + 3 � �� uint32 WmiDataId SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �\��7 �I XeSqlPkg
C � �� & } � � � � � c����� � XeSqlPkg_rbio_test_sync Description XEvent used for testing purposes to generate the proper synchronization for RbIo dbs. Guid {bb1d9ab2-1f3e-4482-8ce3-9161a210bbbd} locale MS\0x409 DisplayName rbio_test_sync � X e S q l P k g _ r b i o _ t e s t _ s y n c �\��7 �� ! XeSqlPkg_rbio_test_sync ) � �� ) 5 � � 6 B � � 8 H � � W����������������������������
� rbio_test_sync EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� # + � �� uint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� ' � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber state )
� � � �� uint32 WmiDataId � X e S q l P k g �\��7 � XeSqlPkg
C � �� - / 5 ] e o | c����� � XeSqlPkg_read_xlog_block_stats Description Guid {32f81259-ff8e-4bbd-b191-64211efe388f} locale MS\0x409 DisplayName read_xlog_block_stats � X e S q l P k g _ r e a d _ x l o g _ b l o c k _ s t a t s �\��7 �� E ( XeSqlPkg_read_xlog_block_stats ) � �� " 0 < � � b n � � 3 D � � S f � � b q � � A Q WUU������������������������������������������������������������������� � read_xlog_block_stats EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid FragmentId 6
� 6 > I V � �� uint32 WmiDataId Description FragmentId is_compute )
� � � � �� sint8 WmiDataId logical_db_id
9 6
�
� ��" - object:guid WmiDataId Extension Guid logical_db_name = C
� � � � ��� � � � string WmiDataId StringTermination NullTerminated Format w physical_db_id
5 6
� * 7
� ��B M object:guid WmiDataId Extension Guid reads_from_broker )
� � � � �� uint64 WmiDataId reads_from_lc % )
� � � � �� uint64 WmiDataId reads_from_lt - )
� O W � �� uint64 WmiDataId reads_from_lz )
� � � � �� uint64 WmiDataId RemainingLength 6
� # 0 � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �\��7 �B XeSqlPkg
C � ��0 = _ e � � � � c����� � XeSqlPkg_compute_request_transition_to_primary Description Request to transition to primary Guid {7C015350-3314-491A-95B1-26B01500E733} locale MS\0x409 DisplayName compute_request_transition_to_primary �. X e S q l P k g _ c o m p u t e _ r e q u e s t _ t r a n s i t i o n _ t o _ p r i m a r y �\��7 � 7 8 XeSqlPkg_compute_request_transition_to_primary 0 ) � ��' 2
@ L � M Z � � / � � ? K � � # � � WU���������������������������������������������������� � compute_request_transition_to_primary EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid current_bsn )
� : B � �� uint64 WmiDataId database_id )
� � � � �� uint32 WmiDataId FragmentId 6
� � � � �� uint32 WmiDataId Description FragmentId logical_db_id
, 6
� s � � ��� � object:guid WmiDataId Extension Guid logical_db_name
0 C
� �
� �� $ 4 < string WmiDataId StringTermination NullTerminated Format w next_block )
� � � � �� uint64 WmiDataId physical_db_id
( 6
� � � � �� object:guid WmiDataId Extension Guid RemainingLength 6
� g o z � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �\��7 �B XeSqlPkg
C � ��" / m s � � � � c����� � XeSqlPkg_xlog_read_block_timeout Description Counter indicating how long server is disconnected from xlog Guid {1FC05365-4F12-4CD5-8104-C3B2DEC06DBE} locale MS\0x409 DisplayName xlog_read_block_timeout �out �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 =|�X��
͝��C�� % ��� �� d � WDMClassesOfDriver KernelPerfState C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] eName] +?cy` 2 [��R� � "fs� G ��-K[ ^ ��� � % X e S q l P k g _ q u e r y v m _ c o n t e x t _ a c c e s s _ i n t 6 4 U\��7 �� 6 / XeSqlPkg_queryvm_context_access_int64 ' ) � �� )
7 C � � I ` � � ; G � � � � � Y i WU���������������������������������������������������� � queryvm_context_access_int64 EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid connect_brick_id )
� 6 > � �� uint64 WmiDataId context_accessed_name * P
� � � � ��� + � � - 5 uint8 WmiDataId XEMapId ValueMap
! $ ' * 0 1 2 3 4 5 6 7 8 9 Values
a o z � � � � � � � DbAndSetOpts SessionId IsSysAdmin IsDac DbCompatLevel SchidProcPcp ObjidProcPcp DbidProcPcp RetStat LastError context_accessed_value
+ )
� ( 0
� �� sint64 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId query_id " )
� � � �� uint64 WmiDataId RemainingLength 6
� ` h s � � �� uint32 WmiDataId Description RemainingLength remote_exchange_node_id )
� � � � �� sint32 WmiDataId remote_exchange_thread_id )
� F N � �� sint16 WmiDataId SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g V\��7 �Z XeSqlPkg
C � ��/ < x ~ � � � � c����� � XeSqlPkg_queryvm_context_access_cdbandsetopts Description Occurs whenever CDbAndSetOpts is accessed from within QVM. Guid {11486fbd-a345-45c4-8f2d-4d4a313d5f70} locale MS\0x409 DisplayName queryvm_context_access_cdbandsetopts �- X e S q l P k g _ q u e r y v m _ c o n t e x t _ a c c e s s _ c d b a n d s e t o p t s W\��7 �� � 7 XeSqlPkg_queryvm_context_access_cdbandsetopts / ) � ��& 1 ? K � Q h � � M h � � ' q � � � 9 W � � g | � � * @ � � � J a � � # m � � � 6
B
�
�
� � �
T d WUUUUUU������������������������������������������������������������������������������������������������������������������������������������������������������������������ � queryvm_context_access_cdbandsetopts EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid connect_brick_id )
� > F � �� uint64 WmiDataId context_accessed_name * P
� � � � ��� + � � 5 = uint8 WmiDataId XEMapId ValueMap
# & ) , / 2 0 1 2 3 4 5 6 7 8 9 Values
i w � � � � � � � � DbAndSetOpts SessionId IsSysAdmin IsDac DbCompatLevel SchidProcPcp ObjidProcPcp DbidProcPcp RetStat LastError context_dbso
+ 4
� 1 9
� ��D �� object WmiDataId Pointer context_dbso_daydatefirst ~ )
� � � � �� sint64 WmiDataId context_dbso_ddlckpri � )
� � �� sint64 WmiDataId context_dbso_dtfmt v )
� ^ f � �� sint64 WmiDataId context_dbso_fipsflag � )
� � � � �� sint64 WmiDataId context_dbso_idtinsert_dbid D )
� & . � �� uint16 WmiDataId context_dbso_idtinsert_objid ; )
� � � � �� sint64 WmiDataId context_dbso_idtinsert_state C )
� � � � �� sint8 WmiDataId context_dbso_isolvl � )
� T \ � �� sint64 WmiDataId context_dbso_langid � )
� � � � �� sint16 WmiDataId context_dbso_locktimeout f )
� � �� uint64 WmiDataId context_dbso_offsets ^ )
� w � �� sint64 WmiDataId context_dbso_querygov n )
� � � � �� uint64 WmiDataId context_dbso_rowcnt F )
� 7 ? � �� sint64 WmiDataId context_dbso_statlist N )
� � � � �� sint64 WmiDataId context_dbso_textsize V )
� � � �� sint64 WmiDataId context_dbso_useropt1 / )
� Z b � �� uint32 WmiDataId context_dbso_useropt1setmask
7 )
� � �
� �� uint32 WmiDataId context_dbso_useropt2 3 )
� #
+
� �� uint32 WmiDataId FragmentId 6
� �
�
�
�
� �� uint32 WmiDataId Description FragmentId query_id " )
� �
�
� �� uint64 WmiDataId RemainingLength 6
� [ c n { � �� uint32 WmiDataId Description RemainingLength remote_exchange_node_id )
� � � � �� sint32 WmiDataId remote_exchange_thread_id )
� A I � �� sint16 WmiDataId SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g X\��7 �6 XeSqlPkg
C � ��# 0 ` f � � � � c����� � XeSqlPkg_thread_cache_cache_event Description ThreadCache node was successfully checked out. Guid {088c0665-1a55-4d56-96ed-44b5f711c8ad} locale MS\0x409 DisplayName thread_cache_cache_event �! X e S q l P k g _ t h r e a d _ c a c h e _ c a c h e _ e v e n t Y\��7 �� # + XeSqlPkg_thread_cache_cache_event # ) � �� % 3 ? � � = I � � ! k | � u � WU���������������������������������� � thread_cache_cache_event EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid cpu_match )
� + 2 � �� sint8 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId last_session_id )
� � �� uint64 WmiDataId node_status )
� X ` � �� uint16 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� E M X e � �� uint32 WmiDataId Description SequenceNumber session_match )
� � � � �� sint8 WmiDataId �aId �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�| $ �\>�S}� Y � WDMClassesOfDriver IdleAccounting C:\Windows\system32\kernelbase.dll[MofResourceName] ame] MofResourceName] �
�F
4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 +O����
͝��C�} % +/�Q �� Z � WDMClassesOfDriver KernelIdleState C:\Windows\system32\kernelbase.dll[MofResourceName] .dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 +O����
͝��C�} % +/�Q �� Z � WDMClassesOfDriver KernelIdleState C:\Windows\system32\kernelbase.dll[MofResourceName] esourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 +O����
͝��C�} % +/�Q �� Z � WDMClassesOfDriver KernelIdleState C:\Windows\system32\kernelbase.dll[MofResourceName] eName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 +O����
͝��C�} % +/�Q �� Z � WDMClassesOfDriver KernelIdleState C:\Windows\system32\kernelbase.dll[MofResourceName] se.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 +O����
͝��C�} % +/�Q �� Z � WDMClassesOfDriver KernelIdleState C:\Windows\system32\kernelbase.dll[MofResourceName] Name] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 +O����
͝��C�} % +/�Q �� Z � WDMClassesOfDriver KernelIdleState C:\Windows\system32\kernelbase.dll[MofResourceName] ourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 +O����
͝��C�} % +/�Q �� Z � WDMClassesOfDriver KernelIdleState C:\Windows\system32\kernelbase.dll[MofResourceName] rnelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 +O����
͝��C�} % +/�Q �� Z � WDMClassesOfDriver KernelIdleState C:\Windows\system32\kernelbase.dll[MofResourceName] em32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 +O����
͝��C�} % +/�Q �� Z � WDMClassesOfDriver KernelIdleState C:\Windows\system32\kernelbase.dll[MofResourceName] stem32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 +O����
͝��C�} % +/�Q �� Z � WDMClassesOfDriver KernelIdleState C:\Windows\system32\kernelbase.dll[MofResourceName] ceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 +O����
͝��C�} % +/�Q �� Z � WDMClassesOfDriver KernelIdleState C:\Windows\system32\kernelbase.dll[MofResourceName] m32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 +O����
͝��C�} % +/�Q �� Z � WDMClassesOfDriver KernelIdleState C:\Windows\system32\kernelbase.dll[MofResourceName] elbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 +O����
͝��C�} % +/�Q �� Z � WDMClassesOfDriver KernelIdleState C:\Windows\system32\kernelbase.dll[MofResourceName] .dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 +O����
͝��C�} % +/�Q �� Z � WDMClassesOfDriver KernelIdleState C:\Windows\system32\kernelbase.dll[MofResourceName] em32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 +O����
͝��C�} % +/�Q �� Z � WDMClassesOfDriver KernelIdleState C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 +O����
͝��C�} % +/�Q �� Z � WDMClassesOfDriver KernelIdleState C:\Windows\system32\kernelbase.dll[MofResourceName] ernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 +O����
͝��C�} % +/�Q �� Z � WDMClassesOfDriver KernelIdleState C:\Windows\system32\kernelbase.dll[MofResourceName] \kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 +O����
͝��C�} % +/�Q �� Z � WDMClassesOfDriver KernelIdleState C:\Windows\system32\kernelbase.dll[MofResourceName] \kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 +O����
͝��C�} % +/�Q �� Z � WDMClassesOfDriver KernelIdleState C:\Windows\system32\kernelbase.dll[MofResourceName] lbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 +O����
͝��C�} % +/�Q �� Z � WDMClassesOfDriver KernelIdleState C:\Windows\system32\kernelbase.dll[MofResourceName] 32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 +O����
͝��C�} % +/�Q �� Z � WDMClassesOfDriver KernelIdleState C:\Windows\system32\kernelbase.dll[MofResourceName] ase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 +O����
͝��C�} % +/�Q �� Z � WDMClassesOfDriver KernelIdleState C:\Windows\system32\kernelbase.dll[MofResourceName] system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 +O����
͝��C�} % +/�Q �� Z � WDMClassesOfDriver KernelIdleState C:\Windows\system32\kernelbase.dll[MofResourceName] rnelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 +O����
͝��C�} % +/�Q �� Z � WDMClassesOfDriver KernelIdleState C:\Windows\system32\kernelbase.dll[MofResourceName] [MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 +O����
͝��C�} % +/�Q �� Z � WDMClassesOfDriver KernelIdleState C:\Windows\system32\kernelbase.dll[MofResourceName] nelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 +O����
͝��C�} % +/�Q �� Z � WDMClassesOfDriver KernelIdleState C:\Windows\system32\kernelbase.dll[MofResourceName] ase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 +O����
͝��C�} % +/�Q �� Z � WDMClassesOfDriver KernelIdleState C:\Windows\system32\kernelbase.dll[MofResourceName] .dll[MofResourceName] 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �%L�9�
͝��C�} % � � +� Z � WDMClassesOfDriver KernelIdleState C:\Windows\system32\kernelbase.dll[MofResourceName] �~> � m �ށ�� K �$mXH � 4� 4; W �
�
� ^e��M T ;�d�� � |1X N ' X e S q l P k g _ m e t a d a t a _ a g e n t _ c a t a l o g _ u p d a t e d _Z��7 � + 1 XeSqlPkg_metadata_agent_catalog_updated ) ) � �� + 9 E � � C P � � % o z � � J Z � � WU�����������������������������������������% � metadata_agent_catalog_updated EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid brick_id )
� 0 8 � �� uint32 WmiDataId database_id $ )
� � � � �� uint32 WmiDataId FragmentId 6
� � � �
� �� uint32 WmiDataId Description FragmentId from_brick_id )
� \ d � �� uint32 WmiDataId object_id )
� � � � �� sint32 WmiDataId RemainingLength 6
� ! , 9 � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber update_type )
� � �� uint32 WmiDataId � X e S q l P k g `Z��7 �# XeSqlPkg
C � ��$ 1 L R z � � � c����� � XeSqlPkg_metadata_cache_vlr_posted Description Metadata cache vlr posted Guid {f0c59884-17c9-4bec-8113-94667095a7f4} locale MS\0x409 DisplayName metadata_cache_vlr_posted �" X e S q l P k g _ m e t a d a t a _ c a c h e _ v l r _ p o s t e d aZ��7 �� ' , XeSqlPkg_metadata_cache_vlr_posted $ ) � �� & 4 @ � � > J � � � � g r � � B R WU�������������������������������������� � metadata_cache_vlr_posted EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid brick_id )
� + 3 � �� uint32 WmiDataId cache_type )
� � � � �� uint32 WmiDataId database_id )
� � � � �� uint32 WmiDataId FragmentId 6
� ; C N [ � �� uint32 WmiDataId Description FragmentId object_id )
� � � � �� sint32 WmiDataId RemainingLength 6
� $ 1 � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g bZ��7 �/ XeSqlPkg
C � ��( 5 T Z � � � � c����� � XeSqlPkg_metadata_initiate_lock_object Description Metadata initiate lock object Guid {1c5b1537-fd5d-4161-90ce-ba4e1f3cd4d5} locale MS\0x409 DisplayName metadata_initiate_lock_object �& X e S q l P k g _ m e t a d a t a _ i n i t i a t e _ l o c k _ o b j e c t cZ��7 �W ' 0 XeSqlPkg_metadata_initiate_lock_object ( ) � �� * 8 D � � B O � � # . x � � WU�������������������������������������� � metadata_initiate_lock_object EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid brick_id )
� / 7 � �� uint32 WmiDataId database_id )
� � � � �� uint32 WmiDataId FragmentId 6
� � � � � �� uint32 WmiDataId Description FragmentId mode P
� y � � ��� B � � I Q uint32 WmiDataId XEMapId ValueMap � � # ' + / 2 5 8 ; ? B F 12 6 7 8 21 0 15 16 17 18 13 14 19 20 3 2 1 9 10 4 11 5 Values � � � � � � � � � � � � � � � BU IS IU IX LAST_MODE NL RI_NL RI_S RI_U RI_X RS_S RS_U RX_S RX_U S SCH_M SCH_S SIU SIX U UIX X object_id )
� e m � �� sint32 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� R Z e r � �� uint32 WmiDataId Description SequenceNumber gm � X e S q l P k g dZ��7 �, XeSqlPkg
C � ��' 4 R X � � � � c����� � XeSqlPkg_metadata_manager_lock_object Description Metadata manager lock object Guid {75b3d0af-8551-4a0c-8ede-ab3d5d21c8a0} locale MS\0x409 DisplayName metadata_manager_lock_object �% X e S q l P k g _ m e t a d a t a _ m a n a g e r _ l o c k _ o b j e c t eZ��7 �U ' / XeSqlPkg_metadata_manager_lock_object ' ) � �� ) 7 C � � A N � � " - w � �
WU�������������������������������������� � metadata_manager_lock_object EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid brick_id )
� . 6 � �� uint32 WmiDataId database_id )
� � � � �� uint32 WmiDataId FragmentId 6
� � � � � �� uint32 WmiDataId Description FragmentId mode P
� x � � ��� B � � H P uint32 WmiDataId XEMapId ValueMap � � " & * . 1 4 7 : > A E 12 6 7 8 21 0 15 16 17 18 13 14 19 20 3 2 1 9 10 4 11 5 Values � � � � � � � � � � � � � � � �
BU IS IU IX LAST_MODE NL RI_NL RI_S RI_U RI_X RS_S RS_U RX_S RX_U S SCH_M SCH_S SIU SIX U UIX X object_id )
� d l � �� sint32 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� Q Y d q � �� uint32 WmiDataId Description SequenceNumber en � X e S q l P k g fZ��7 �& XeSqlPkg
C � ��% 2 N T | � � � c����� � XeSqlPkg_metadata_agent_lock_object Description Metadata agent lock object Guid {79f0bc46-a30f-4215-b393-666d320f9c96} locale MS\0x409 DisplayName metadata_agent_lock_object �ect �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�} % �\>�S}� Z � WDMClassesOfDriver MMCSS_TypeGroup C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�x �\>�S}� U � WDMClassesOfDriver MMCSSEvent C:\Windows\system32\kernelbase.dll[MofResourceName] kernelbase.dll.mui[MofResourceName] 9hp 5 ?�ե � �q�s ( �8z� �
�6 b ���Θ � 2 X e S q l P k g _ c o l u m n s t o r e _ t u p l e _ m o v e r _ c o m p r e s s i o n _ s t a t s �Z��7 �� o < XeSqlPkg_columnstore_tuple_mover_compression_stats 4 ) � ��+ 6 D P � U b � � M ] � � � w � � � 9 � � � � / A � � � � o z � � WUUU�����������������������������������������������������������������������������������������������������������H � columnstore_tuple_mover_compression_stats EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid compressed_size
< )
� B J
� �� uint64 WmiDataId database_id )
� � � � �� uint64 WmiDataId database_name f C
� � �� 2 B J string WmiDataId StringTermination NullTerminated Format w delta_store_id $ )
� � � � �� uint64 WmiDataId duration , )
� � � � �� uint64 WmiDataId FragmentId 6
� K S ^ k � �� uint32 WmiDataId Description FragmentId hobt_id )
� � � � �� uint64 WmiDataId index_id
T )
�
� �� uint64 WmiDataId is_aggressive_compression d )
� p w � �� sint8 WmiDataId is_nci_on_cci e )
� � � � �� sint8 WmiDataId object_id L )
� $ � �� uint64 WmiDataId partition_number \ )
� x � � �� uint64 WmiDataId precompressed_size 4 )
� � � � �� uint64 WmiDataId RemainingLength 6
� > F Q ^ � �� uint32 WmiDataId Description RemainingLength row_count D )
� � � � �� uint64 WmiDataId SequenceNumber 6
� + 8 � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �Z��7 �� XeSqlPkg
C � ��> K � � � � � c����7 � XeSqlPkg_columnstore_compression_delay_disqualified_rowgroup Description Generated when a rowgroup is not compressed because it does not satisfy the compression delay condition. Guid {0C54F52B-2585-4C2C-B36C-346BD1656D95} locale MS\0x409 DisplayName columnstore_compression_delay_disqualified_rowgroup �< X e S q l P k g _ c o l u m n s t o r e _ c o m p r e s s i o n _ d e l a y _ d i s q u a l i f i e d _ r o w g r o u p �Z��7 �� h F XeSqlPkg_columnstore_compression_delay_disqualified_rowgroup > ) � ��5 @ N Z i | � � - w � � � F P � � � K \ � � & < � � ) 9 � � WUUU����������������������������������������������������������������������������������������������������, � columnstore_compression_delay_disqualified_rowgroup EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid compress_all_row_groups_on b )
� W ^ � �� sint8 WmiDataId compression_delay F )
� � � � �� sint32 WmiDataId database_id )
�
� �� uint16 WmiDataId delta_store_id )
� d l � �� uint64 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId hobt_id )
� 3 ; � �� uint64 WmiDataId index_id . )
� � � � �� uint64 WmiDataId object_id & )
� � � � �� uint64 WmiDataId partition_number
6 )
� 8 @
� �� uint64 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength row_count > )
� � �� uint64 WmiDataId rowgroup_closed_time R 6
� � � � ��� � uint64 WmiDataId Extension WmiTime rowgroup_created_time
J 6
�
� �� uint64 WmiDataId Extension WmiTime SequenceNumber 6
� } � � � � �� uint32 WmiDataId Description SequenceNumber time_of_comparison Z 6
�
� �� # uint64 WmiDataId Extension WmiTime � X e S q l P k g �Z��7 �s XeSqlPkg
C � ��< I � � � � � � c���� � XeSqlPkg_columnstore_tuple_mover_begin_delete_buffer_flush Description Columnstore tuple mover started flushing a delete buffer. Guid {ddc4e101-3afc-4f37-b563-c01e05371897} locale MS\0x409 DisplayName columnstore_tuple_mover_begin_delete_buffer_flush �: X e S q l P k g _ c o l u m n s t o r e _ t u p l e _ m o v e r _ b e g i n _ d e l e t e _ b u f f e r _ f l u s h �Z��7 �� * D XeSqlPkg_columnstore_tuple_mover_begin_delete_buffer_flush < ) � ��3 > L X Y p � � 6 ? � � � � f v WU����������������������������������������� � columnstore_tuple_mover_begin_delete_buffer_flush EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� F N � �� uint16 WmiDataId delete_buffer_hobt_id )
� � � � �� uint64 WmiDataId FragmentId 6
�
* � �� uint32 WmiDataId Description FragmentId hobt_id )
� v ~ � �� uint64 WmiDataId is_in_memory )
� � � � �� uint8 WmiDataId RemainingLength 6
� 5 = H U � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �Z��7 �q XeSqlPkg
C � ��: G � � � � � � c���� � XeSqlPkg_columnstore_tuple_mover_end_delete_buffer_flush Description Columnstore tuple mover completed flushing a delete buffer. Guid {14735684-f14a-4095-9ae3-7c115d260ee4} locale MS\0x409 DisplayName columnstore_tuple_mover_end_delete_buffer_flush �ush �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�} % �\>�S}� Z � WDMClassesOfDriver UmsDisassociate C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�~ & �\>�S}� [ � WDMClassesOfDriver UmsContextSwitch C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] lbase.dll.mui[MofResourceName] C_4BEC7645E2863E66AB342FBA6288E3E94B92567D31F8ED34E1C8D99E55FFB8F4 n XactSequence �e] ��Y� � �J � 6�_1� � �1o�� y V��
� ��}�� � \��w Z V�$�� c z��)4 � ( X e S q l P k g _ d a t a b a s e _ d d l _ s t m t _ r u n t i m e _ c h e c k 5S��7 �B 2 XeSqlPkg_database_ddl_stmt_runtime_check * ) � ��! , : F � � G V � � d u � � n ~ WU�����������������������������{ � database_ddl_stmt_runtime_check EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� 4 < � �� uint32 WmiDataId database_name C
� � � � ��� � � � string WmiDataId StringTermination NullTerminated Format w FragmentId 6
� 8 @ K X � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� > F Q ^ � �� uint32 WmiDataId Description SequenceNumber statement_type P
� � � � ��� # � ! ) uint8 WmiDataId XEMapId ValueMap 1 2 3 4 Values = N ] k CREATE DATABASE DROP DATABASE USE DATABASE ALTER DATABASE � X e S q l P k g 6S��7 �X XeSqlPkg
C � ��0 = u { � � � � c����� � XeSqlPkg_database_segment_local_creation_begin Description Start to create a database segment at the local brick. Guid {4d19bf10-5958-4726-aa16-56575646565f} locale MS\0x409 DisplayName database_segment_local_creation_begin �. X e S q l P k g _ d a t a b a s e _ s e g m e n t _ l o c a l _ c r e a t i o n _ b e g i n 7S��7 �V " 8 XeSqlPkg_database_segment_local_creation_begin 0 ) � ��' 2 @ L � J W � � | � WU��������������������������������� � database_segment_local_creation_begin EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid brick_id )
� 7 ? � �� uint32 WmiDataId database_id )
� � � � �� uint32 WmiDataId database_segment_id )
� � � � �� uint32 WmiDataId FragmentId 6
� P X c p � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� V ^ i v � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g 8S��7 �Q XeSqlPkg
C � ��. ; p v � � � � c����� � XeSqlPkg_database_segment_local_creation_end Description One database segment is created at the local brick. Guid {edbdd3c7-c54b-4dcf-9d9a-7cf47eed3ba6} locale MS\0x409 DisplayName database_segment_local_creation_end �, X e S q l P k g _ d a t a b a s e _ s e g m e n t _ l o c a l _ c r e a t i o n _ e n d 9S��7 �R " 6 XeSqlPkg_database_segment_local_creation_end . ) � ��% 0 > J � � H U � � �
z � WU��������������������������������� � database_segment_local_creation_end EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid brick_id )
� 5 = � �� uint32 WmiDataId database_id )
� � � � �� uint32 WmiDataId database_segment_id )
� � � � �� uint32 WmiDataId FragmentId 6
� N V a n � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� T \ g t � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g :S��7 �� XeSqlPkg
C � ��, 9 � � � � � � c���� � XeSqlPkg_database_segment_all_files_create Description All files on one database segment are created, and primary file information is inserted into metadata. Guid {8bbf007c-835f-41cb-9998-f60c589e646d} locale MS\0x409 DisplayName database_segment_all_files_create �* X e S q l P k g _ d a t a b a s e _ s e g m e n t _ a l l _ f i l e s _ c r e a t e ;S��7 �� 4 XeSqlPkg_database_segment_all_files_create , ) � ��# . < H � � I ^ � � $ 5 � � W����������������������������. � database_segment_all_files_create EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� 6 > � �� uint32 WmiDataId database_segment_id )
� � � � �� uint32 WmiDataId FragmentId 6
� � � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� y � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g <S��7 �; XeSqlPkg
C � ��' 4 a g � � � � c����� � XeSqlPkg_all_database_segments_create Description All required database segments are created. Guid {5e85c44b-a5a1-41cc-89aa-86e93c674ae9} locale MS\0x409 DisplayName all_database_segments_create �% X e S q l P k g _ a l l _ d a t a b a s e _ s e g m e n t s _ c r e a t e =S��7 �G " / XeSqlPkg_all_database_segments_create ' ) � �� ) 7 C � � A N � � � v � � WU��������������������������������� � all_database_segments_create EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid brick_id )
� . 6 � �� uint32 WmiDataId database_id )
� � � � �� uint32 WmiDataId database_segment_count )
� � � � �� uint32 WmiDataId FragmentId 6
� J R ] j � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� P X c p � �� uint32 WmiDataId Description SequenceNumber �ber �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�� * �\>�S}� _ � WDMClassesOfDriver SessionPoolAllocFree C:\Windows\system32\kernelbase.dll[MofResourceName] ��
C� �
P� q 3G� Y F�zRh e w� A� [ d��:( h �*:� _ �o� � � ' X e S q l P k g _ h a d r _ a u t o m a t i c _ s e e d i n g _ f a i l u r e �Y��7 �� 0 1 XeSqlPkg_hadr_automatic_seeding_failure ) ) � �� + 9 E � � f m � � ] l � � \ h � � , : � � - = WUU���������������������������������������������� � hadr_automatic_seeding_failure EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid ag_db_id
! 6
� = J � ��U ` object:guid WmiDataId Extension Guid ag_id
6
� � � � ��� � object:guid WmiDataId Extension Guid ag_remote_replica_id
% 6
� 4 A
� ��L W object:guid WmiDataId Extension Guid failure_state )
� � � � �� sint32 WmiDataId failure_state_desc ) C
� # � ��. A Q Y string WmiDataId StringTermination NullTerminated Format w FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId is_source )
� ! � �� sint8 WmiDataId operation_id
6
� ~ � � ��� � object:guid WmiDataId Extension Guid RemainingLength 6
� � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �Y��7 �I XeSqlPkg
C � ��) 6 m s � � � � c����� � XeSqlPkg_hadr_automatic_seeding_timeout Description Occurs when an automatic seeding operation times out. Guid {7B2B912C-D92C-4498-AA6E-32985575114F} locale MS\0x409 DisplayName hadr_automatic_seeding_timeout �' X e S q l P k g _ h a d r _ a u t o m a t i c _ s e e d i n g _ t i m e o u t �Y��7 �� , 1 XeSqlPkg_hadr_automatic_seeding_timeout ) ) � �� +
9 E � � f m � � ] i � � - ; � � . > � � WU����������������������������������������� � hadr_automatic_seeding_timeout EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid ag_db_id
! 6
� = J � ��U ` object:guid WmiDataId Extension Guid ag_id
6
� � � � ��� � object:guid WmiDataId Extension Guid ag_remote_replica_id
% 6
� 4 A
� ��L W object:guid WmiDataId Extension Guid FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId is_source )
� " � �� sint8 WmiDataId operation_id
6
� � � ��� � object:guid WmiDataId Extension Guid RemainingLength 6
� � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber timeout_ms )
� � � � �� uint32 WmiDataId � X e S q l P k g �Y��7 �= XeSqlPkg
C � ��$ 1 f l � � � � c����� � XeSqlPkg_hadr_filestream_file_open Description Occurs when HADR FileStream transport opens a file. Guid {3620FA1D-853A-475a-BC37-BCF48EA06500} locale MS\0x409 DisplayName hadr_filestream_file_open �" X e S q l P k g _ h a d r _ f i l e s t r e a m _ f i l e _ o p e n �Y��7 �� " , XeSqlPkg_hadr_filestream_file_open $ ) � �� & 4 @ � � B M � � [ f 1 B � � WU��������������������������������; � hadr_filestream_file_open EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid error_number )
� / 7 � �� uint32 WmiDataId file_path C
� � � � ��� � � � string WmiDataId StringTermination NullTerminated Format w FragmentId 6
� / 7 B O � �� uint32 WmiDataId Description FragmentId open_mode P
� � � � ��� � � � uint32 WmiDataId XEMapId ValueMap � � 0 1 2 Values $ * INVALID READ WRITE RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� + � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �Y��7 �@ XeSqlPkg
C � ��% 2 h n � � � � c����� � XeSqlPkg_hadr_filestream_file_close Description Occurs when HADR FileStream transport closes a file. Guid {3620FA1D-853A-475a-BC37-BCF48EA06501} locale MS\0x409 DisplayName hadr_filestream_file_close �# X e S q l P k g _ h a d r _ f i l e s t r e a m _ f i l e _ c l o s e �Y��7 � " - XeSqlPkg_hadr_filestream_file_close % ) � �� ' 5 A � � C N � � \ g 2 C � � WU��������������������������������< � hadr_filestream_file_close EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid error_number )
� 0 8 � �� uint32 WmiDataId file_path C
� � � � ��� � � � string WmiDataId StringTermination NullTerminated Format w FragmentId 6
� 0 8 C P � �� uint32 WmiDataId Description FragmentId open_mode P
� � � � ��� � � � uint32 WmiDataId XEMapId ValueMap � � 0 1 2 Values % + INVALID READ WRITE RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� , � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �Y��7 �m XeSqlPkg
C � ��* 7 � � � � � � c����� � XeSqlPkg_hadr_filestream_log_interpreter Description Occurs when HADR FileStream transport finds relevant log records when interpreting log. Guid {3620FA1D-853A-475a-BC37-BCF48EA06502} locale MS\0x409 DisplayName hadr_filestream_log_interpreter �ter �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�y ! �\>�S}� V � WDMClassesOfDriver WNFSubUnsub C:\Windows\system32\kernelbase.dll[MofResourceName] esourceName] ResourceName] � sint32 WmiDataId �iption XactSequence �e] ���*� � ��
�� c {g� hD� * ��q�&
� � �� 2 ��e� Z � ��Q 8 ���ɉ � �դ4 A $ X e S q l P k g _ m e t a d a t a _ n a m e _ l o o k u p _ f a i l e d qZ��7 �� " . XeSqlPkg_metadata_name_lookup_failed & ) � �� ( 6 B � � C O � � ^ k � � ; K WU��������������������������������� � metadata_name_lookup_failed EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� 0 8 � �� uint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId object_name C
� % � ��0 C S [ string WmiDataId StringTermination NullTerminated Format w object_type )
� � � � �� uint32 WmiDataId RemainingLength 6
�
* � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g rZ��7 �; XeSqlPkg
C � ��- : [ a � � � � c����� � XeSqlPkg_metadata_remove_from_cache_tracing Description Tracing RemoveFromCache callers Guid {b5d4cb8e-273a-4543-ae57-f20298f3ce53} locale MS\0x409 DisplayName metadata_remove_from_cache_tracing �+ X e S q l P k g _ m e t a d a t a _ r e m o v e _ f r o m _ c a c h e _ t r a c i n g sZ��7 �� " 5 XeSqlPkg_metadata_remove_from_cache_tracing - ) � ��$ / = I � � � � � i u � � E U WU��������������������������������� � metadata_remove_from_cache_tracing EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid caller_function C
� U ] � ��h { � � string WmiDataId StringTermination NullTerminated Format w database_id )
� � � � �� uint32 WmiDataId FragmentId 6
� = E P ] � �� uint32 WmiDataId Description FragmentId primary_id )
� � � � �� uint32 WmiDataId RemainingLength 6
� ' 4 � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g tZ��7 � XeSqlPkg
C � �� & 6 < d l v � c����� � XeSqlPkg_failed_hresult Description Failed HRESULT Guid {d9eec9e7-a0e9-4948-a077-a96404f60134} locale MS\0x409 DisplayName failed_hresult � X e S q l P k g _ f a i l e d _ h r e s u l t uZ��7 �Y ! XeSqlPkg_failed_hresult ) � �� ) 5 � � [ d � � 4 D W�������������������������� � failed_hresult EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid FragmentId 6
� / 7 B O � �� uint32 WmiDataId Description FragmentId hresult )
� � � � �� sint32 WmiDataId RemainingLength 6
� # � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g vZ��7 �
XeSqlPkg
C � �� * : @ h p z � c����� � XeSqlPkg_failed_hresult_msg Description Failed HRESULT Guid {db4b8a86-ef93-409d-949e-d08be6b794f0} locale MS\0x409 DisplayName failed_hresult_msg � X e S q l P k g _ f a i l e d _ h r e s u l t _ m s g wZ��7 � % XeSqlPkg_failed_hresult_msg ) � �� - 9 � � � � � Q b � � W����������������������������[ � failed_hresult_msg EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid description C
� A I � ��T g w string WmiDataId StringTermination NullTerminated Format w FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId hresult )
� > F � �� sint32 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� + 3 > K � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g xZ��7 � XeSqlPkg
C � �� % E K s { � � c����� � XeSqlPkg_like_unittest Description Event used for LIKE tests only Guid {0c8e4395-4192-46d6-a1ba-5ecb92acfcdc} locale MS\0x409 DisplayName like_unittest � X e S q l P k g _ l i k e _ u n i t t e s t yZ��7 �g ' XeSqlPkg_like_unittest ) � �� ( 4 � � Z k � � d l � � k s WU�������������������������������������� � like_unittest EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid FragmentId 6
� . 6 A N � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� 4 < G T � �� uint32 WmiDataId Description SequenceNumber text_a 6
� � � � ��� � string WmiDataId StringTermination NullTerminated text_a_st 6
� 5 = � ��H [ string WmiDataId StringTermination NullTerminated text_w C
� � � � ��� � � string WmiDataId StringTermination NullTerminated Format w text_w_st C
� a i � ��t � � � string WmiDataId StringTermination NullTerminated Format w � X e S q l P k g zZ��7 � XeSqlPkg
C � �� * I O w � � c����� � XeSqlPkg_latch_acquire_time Description Time taken to acquire a latch Guid {3917182b-98d0-4452-b68f-a0fcff55fdeb} locale MS\0x409 DisplayName latch_acquire_time �ime �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�� ) �\>�S}� ^ � WDMClassesOfDriver MuiTraceData_String C:\Windows\system32\kernelbase.dll[MofResourceName] ] ceName] ceName] � ofResourceName] +�- p � ��@�� R �]mCI � �G��� X j���J \ 4��*� j X e S q l P k g _ r e d o _ s i n g l e _ r e c o r d �[��7 �9 / % XeSqlPkg_redo_single_record ) � �� - 9 � � : F � � c p � � WU���������������������������������������������_ � redo_single_record EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� ' / � �� uint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId log_block_id )
� � � �� uint64 WmiDataId log_op_id $ )
� P X � �� uint32 WmiDataId log_op_name ( C
� � � � ��� � � � string WmiDataId StringTermination NullTerminated Format w RemainingLength 6
� W _ j w � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber slot_id )
� L T � �� uint32 WmiDataId � X e S q l P k g �[��7 �* XeSqlPkg
C � �� , X ^ � � � � c����� � XeSqlPkg_failpoint_log_record Description Failpoint on a log record during creation. Guid {eb5a2cc0-5895-4f6d-b2d1-dc19bf88bd73} locale MS\0x409 DisplayName failpoint_log_record � X e S q l P k g _ f a i l p o i n t _ l o g _ r e c o r d �[��7 �W " ' XeSqlPkg_failpoint_log_record ) � �� ! / ; � � < H � � #
4
�
�
- : WU��������������������������������� � failpoint_log_record EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� ) 1 � �� uint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId log_record_type P
� ' / � ��: H C M W _ uint32 WmiDataId XEMapId ValueMap Y � � � � � � � � � � � � � � � � % * - 1 6 ; @ E J N S X ] a e j o t y | � � � � � � � � � � � � � � � � � � � � � � � � � � � � " & + 0 5 : ? D I N R 130 241 150 160 201 128 148 154 214 17 129 20 149 18 176 134 180 173 217 142 225 224 223 244 3 11 135 181 174 144 245 21 153 161 202 13 16 136 212 213 133 1 147 145 230 232 231 233 234 137 140 138 139 2 22 221 141 132 127 210 143 6 5 4 146 0 216 131 243 220 124 200 206 126 19 215 240 7 10 211 242 125 162 204 205 203 207 12 152 Values Y � � � � ( 6 E ^ r � � � � � � �
' > Y p � � � � � � � � % 7 G Y n { � � � � �
.
?
R
`
p
�
�
�
�
�
�
�
�
# 7 J Z u � � � � � � � ( 9 I W k | � � � � � � �
LOP_ABORT_XACT LOP_AUDIT LOP_BEGIN_CKPT LOP_BEGIN_RECOVERY LOP_BEGIN_UPDATE LOP_BEGIN_XACT LOP_BP_DBVER LOP_BUF_WRITE LOP_BULK_EXT_ALLOCATION LOP_CLEAR_GAM_BITS LOP_COMMIT_XACT LOP_COMPRESSION_INFO LOP_COPY_VERSION_INFO LOP_COUNT_DELTA LOP_CREATE_ALLOCCHAIN LOP_CREATE_FILE LOP_CREATE_FTCAT LOP_CREATE_INDEX LOP_CREATE_PHYSICAL_FILE LOP_CREATE_STREAMFILE LOP_CSI_DBMP_INVALIDATION LOP_CSI_DELETE_BUFFER LOP_CSI_ROWGROUP LOP_CTR_NEST_ABORT LOP_DELETE_ROWS LOP_DELETE_SPLIT LOP_DROP_FILE LOP_DROP_FTCAT LOP_DROP_INDEX LOP_DROP_STREAMFILE LOP_EE LOP_ENCRYPT_PAGE LOP_END_CKPT LOP_END_RECOVERY LOP_END_UPDATE LOP_EXPUNGE_ROWS LOP_FILE_HDR_MODIFY LOP_FILE_OP LOP_FILESTREAM_INFO_BEGIN LOP_FILESTREAM_INFO_END LOP_FORGET_XACT LOP_FORMAT_PAGE LOP_FS_CONTAINER_SIZE_DELTA LOP_FS_DOWNLEVEL_OP LOP_HK LOP_HK_CHAINED LOP_HK_CHECKPOINT LOP_HK_DEPLOYED LOP_HK_UNDEPLOYED LOP_HOBT_DDL LOP_HOBT_DELTA LOP_IDENT_NEWVAL LOP_IDENT_SENTVAL LOP_INSERT_ROWS LOP_INSYSXACT LOP_INVALIDATE_CACHE LOP_LOCK_XACT LOP_MARK_SAVEPOINT LOP_MAX_PAGE_OP LOP_MAX_REPL_OP LOP_MIGRATE_LOCKS LOP_MODIFY_COLUMNS LOP_MODIFY_HEADER LOP_MODIFY_ROW LOP_MODIFY_STREAMFILE_HDR LOP_NULL LOP_PAGE_REENCRYPT LOP_PREP_XACT LOP_PREPARE_REMOTE_FILE LOP_RANGE_INSERT LOP_RECONFIGURE LOP_REPL_COMMAND LOP_REPL_NOOP LOP_RESET_VERSION_INFO LOP_ROOT_CHANGE LOP_SECURITY_OP LOP_SEREPL_MSG LOP_SET_BITS LOP_SET_FREE_SPACE LOP_SHRINK_NOOP LOP_SLOG_CKPT LOP_STRIP_VERSION_INFO LOP_TENANT_LOG LOP_TEXT_INFO_BEGIN LOP_TEXT_INFO_END LOP_TEXT_POINTER LOP_TEXT_VALUE LOP_UNDO_DELETE_SPLIT LOP_XACT_CKPT RemainingLength 6
� x
�
�
�
� �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� �
� �� uint32 WmiDataId Description SequenceNumber should_fail
4
� | � � ��� �� object WmiDataId Pointer � X e S q l P k g �[��7 �0 XeSqlPkg
C � ��$ 1 Y _ � � � � c����� � XeSqlPkg_failpoint_log_redo_record Description Failpoint on a log record during redo. Guid {0a746392-691a-416c-8292-59c7741d9d9d} locale MS\0x409 DisplayName failpoint_log_redo_record �. X e S q l P k g _ r e c o v e r y _ t r a n s i t i o n _ l o g g i n g _ f a i l p o i n t �[��7 �� 8 XeSqlPkg_recovery_transition_logging_failpoint 0 ) � ��' 2 @ L � M Y � � O _ � � W����������������������������$ � recovery_transition_logging_failpoint EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� : B � �� uint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� & 1 > � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber state )
� � �� uint32 WmiDataId � X e S q l P k g �[��7 �B XeSqlPkg
C � ��& 3 i o � � � � c����� � XeSqlPkg_complete_recovery_failpoint Description Allow customizable failures during complete recovery Guid {a4812cb8-a1dc-4416-bf90-92b04823caed} locale MS\0x409 DisplayName complete_recovery_failpoint �int �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�� . �\>�S}� c � WDMClassesOfDriver FrequencyRangeDescriptor C:\Windows\system32\kernelbase.dll[MofResourceName] Name] C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] rceName] 41B524A3939652E49FA193A77939E65868511053C7856CA375F94BE.2669.2928240190.272 ndows\system32\kernelbase.dll[MofResourceName] %\�p � 1�aA N I��4�
(y�� * ���� E խ�L � X e S q l P k g _ h a s h _ w a r n i n g \��7 �� Q XeSqlPkg_hash_warning ) � �� ' 3 � � 9 > � � a t 1 J � � � u � � N ^ � � ' WUU�����������������������������������������������������������������������������q � hash_warning EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid actual_row_count E )
� & . � �� uint64 WmiDataId dop ! )
� u } � �� uint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId granted_memory_kb
% )
� N V
� �� uint64 WmiDataId hash_warning_type P
� � � � ��� � � uint8 WmiDataId XEMapId ValueMap 0 1 Values ( Recursion Bailout query_operation_node_id )
� � � � �� uint32 WmiDataId recursion_level )
� � � � �� uint32 WmiDataId RemainingLength 6
� D L W d � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber thread_id )
� ; C � �� uint32 WmiDataId used_memory_kb - )
� � � � �� uint64 WmiDataId workfile_physical_writes 5 )
� � � �� uint64 WmiDataId worktable_physical_writes
= )
� ^ f
� �� uint64 WmiDataId � X e S q l P k g \��7 �& XeSqlPkg
C � �� * V \ � � � � c����� � XeSqlPkg_hash_spill_details Description Occurs at the end of hash processing if there is insufficient memory to process the build input of a hash join. Use this event together with any of the query_pre_execution_showplan or query_post_execution_showplan events to determine which operation in the generated plan is causing the hash spill. Guid {089daf71-51b8-4bf2-a12d-6afcac67d06e} locale MS\0x409 DisplayName hash_spill_details � X e S q l P k g _ h a s h _ s p i l l _ d e t a i l s \��7 �� � % XeSqlPkg_hash_spill_details ) � �� - 9 � � ? D � �
g � � � P [ � � � O Z � � ( 3 } � � � @ Y � � ' q � � � WUUUU�����������������������������������������������������������������������������������������������������������������������������������������: � hash_spill_details EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid actual_row_count ` )
� , 4 � �� uint64 WmiDataId dop )
� { � � �� uint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId granted_memory_kb )
� T \ � �� uint64 WmiDataId query_operation_node_id )
� � � � �� uint32 WmiDataId RemainingLength 6
� ' 2 ? � �� uint32 WmiDataId Description RemainingLength reserved1 h )
� � � � �� uint64 WmiDataId reserved2 p )
� � � � �� uint64 WmiDataId reserved3 x )
� < D � �� uint64 WmiDataId reserved4 � )
� � � � �� uint64 WmiDataId SequenceNumber 6
� � � �� uint32 WmiDataId Description SequenceNumber thread_id )
� j r � �� uint32 WmiDataId used_memory_kb ( )
� � � � �� uint64 WmiDataId workfile_physical_read_aheads 8 )
� - 5 � �� uint64 WmiDataId workfile_physical_reads
0 )
� � �
� �� uint64 WmiDataId workfile_physical_writes @ )
� � � � �� uint64 WmiDataId worktable_physical_read_aheads P )
� ^ f � �� uint64 WmiDataId worktable_physical_reads
H )
� � �
� �� uint64 WmiDataId worktable_physical_writes X )
� ' / � �� uint64 WmiDataId � X e S q l P k g \��7 � XeSqlPkg
C � �� ) 3 9 a i s � c����� � XeSqlPkg_execution_warning Description Occurs when a T-SQL statement or stored procedure waits more than one second for a memory grant or when the initial attempt to get memory fails. Use this event in combination with events that identify waits to troubleshoot contention issues that impact performance Guid {a0efad9f-1ef5-4382-9991-f7fc4a73577d} locale MS\0x409 DisplayName execution_warning � X e S q l P k g _ e x e c u t i o n _ w a r n i n g \��7 �� # $ XeSqlPkg_execution_warning ) � �� , 8 � � 6 B � � 8 H � � d r WU���������������������������������< � execution_warning EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid duration )
� # + � �� uint64 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� ' � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber server_memory_grants C
� # + � ��6 I Y a string WmiDataId StringTermination NullTerminated Format w warning_type P
� � � � ��� O � � uint8 WmiDataId XEMapId ValueMap 2 1 Values - TIMEOUT_SUBCLASS WAIT_SUBCLASS � X e S q l P k g \��7 �� XeSqlPkg
C � �� $ � � c����- � XeSqlPkg_sort_warning Description Occurs when the sort operation on an executing query does not fit into memory. This event is not generated for sort operations caused by index creation, only for sort operations in a query. (For example, an Order By in a Select statement.) Use this event to identify queries that perform slowly because of the sort operation, particularly when the warning_type = 2, indicating multiple passes over the data were required to sort Guid {1d52af22-ca17-4680-a0cc-04e9bb6a13fe} locale MS\0x409 DisplayName sort_warning �ing �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�~ & �\>�S}� [ � WDMClassesOfDriver KernelIdleStates C:\Windows\system32\kernelbase.dll[MofResourceName] ame] �k��� A L��� w
_s�8 � ˑ�e! c �P� (
_�d�� d �7�� � ' X e S q l P k g _ h a d r _ t r a n s p o r t _ r e p l i c a _ t i m e o u t Y��7 �� " 1 XeSqlPkg_hadr_transport_replica_timeout ) ) � �� + 9 E � s � { � � � WU�������������������������������� � hadr_transport_replica_timeout EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid availability_group_id
6
� J W � ��b m object:guid WmiDataId Extension Guid FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId local_availability_replica_id
6
� R _ � ��j u object:guid WmiDataId Extension Guid RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� U ] h u � �� uint32 WmiDataId Description SequenceNumber target_availability_replica_id
6
� � � � �� object:guid WmiDataId Extension Guid � X e S q l P k g Y��7 �O XeSqlPkg
C � ��' 4 u { � � � � c����� � XeSqlPkg_hadr_transport_session_state Description This event occurs when a HADR transport session changes states. Guid {20a57777-6ae9-4cf2-871b-c3ca8564c31f} locale MS\0x409 DisplayName hadr_transport_session_state �% X e S q l P k g _ h a d r _ t r a n s p o r t _ s e s s i o n _ s t a t e Y��7 �� 0 / XeSqlPkg_hadr_transport_session_state ' ) � �� ) 7 C � q � � � I h � � [ k � � X a � � 7 E WUU���������������������������������������������� � hadr_transport_session_state EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid availability_group_id
6
� H U � ��` k object:guid WmiDataId Extension Guid current_state P
� � � � ��� k � @ H uint32 WmiDataId XEMapId ValueMap ( + . 1 4 7 : = 1 5 7 6 4 3 2 0 Values l y � � � � � � Configuring Connected Count Destructing Failure FailurePendingSend Timeout Uninitialized FragmentId 6
� % 0 = � �� uint32 WmiDataId Description FragmentId local_availability_replica_id
! 6
� � � � ��� � object:guid WmiDataId Extension Guid RemainingLength 6
� * 2 = J � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber session_id
) 6
� / < � ��G R object:guid WmiDataId Extension Guid success )
� � � � �� sint8 WmiDataId target_availability_replica_id
% 6
�
� ��& 1 object:guid WmiDataId Extension Guid target_state P
� � � � ��� k � �
uint32 WmiDataId XEMapId ValueMap � � � � � � � 1 5 7 6 4 3 2 0 Values 1 > I P ] f z � Configuring Connected Count Destructing Failure FailurePendingSend Timeout Uninitialized � X e S q l P k g Y��7 �; XeSqlPkg
C � ��- : [ a � � � � c����� � XeSqlPkg_hadr_transport_configuration_state Description Indicates session state changes Guid {e0ff8815-9ae8-4a9a-a05d-bac6a404a697} locale MS\0x409 DisplayName hadr_transport_configuration_state �+ X e S q l P k g _ h a d r _ t r a n s p o r t _ c o n f i g u r a t i o n _ s t a t e Y��7 �� 2 5 XeSqlPkg_hadr_transport_configuration_state - ) � ��$ / = I �
w � 7 C � � ? K � � * � � i � � WUU������������������������������������������������ � hadr_transport_configuration_state EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid availability_group_id
6
� N [ � ��f q object:guid WmiDataId Extension Guid current_state P
� � � � ��� l
\ d uint32 WmiDataId XEMapId ValueMap : = @ C F I L O R V Y 1 6 7 3 5 4 0 2 10 8 9 Values � � � � � � � � $ ConfigRequest Configured Failure LastInitState LastRecvState ReceivedSyn Unconfigured WaitingSynAck e_stateCount e_stateSendPreConfig e_stateWaitingSyn FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId local_availability_replica_id
" 6
� #
� ��. 9 object:guid WmiDataId Extension Guid registered )
� � � � �� sint8 WmiDataId RemainingLength 6
� � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� n v � � � �� uint32 WmiDataId Description SequenceNumber session_id
* 6
� � � � �� object:guid WmiDataId Extension Guid success )
� W ^ � �� sint8 WmiDataId target_availability_replica_id
& 6
� � � � ��� � object:guid WmiDataId Extension Guid target_state P
� b j � ��u l ~ � � � uint32 WmiDataId XEMapId ValueMap � � � � � � � � � � � 1 6 7 3 5 4 0 2 10 8 9 Values ! - 6 E T a o ~ � � ConfigRequest Configured Failure LastInitState LastRecvState ReceivedSyn Unconfigured WaitingSynAck e_stateCount e_stateSendPreConfig e_stateWaitingSyn � X e S q l P k g Y��7 �< XeSqlPkg
C � ��* 7 _ e � � � � c����� � XeSqlPkg_hadr_transport_ucs_registration Description Reports UCS registration state changes Guid {9351a49e-794b-4398-9db7-c71604c72f66} locale MS\0x409 DisplayName hadr_transport_ucs_registration � X e S o s P k g �^��7 �� XeSosPkg
C � ��C P � � � � � � _���� � XeSosPkg_scheduler_monitor_non_yielding_iocp_ring_buffer_recorded Description Nonyielding IOCP ring buffer recorded for scheduler monitor Guid {9b42d932-057a-44cd-aa50-85e6251b119d} locale MS\0x409 DisplayName scheduler_monitor_non_yielding_iocp_ring_buffer_recorded �ded �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�y ! �\>�S}� V � WDMClassesOfDriver TPCBDequeue C:\Windows\system32\kernelbase.dll[MofResourceName] rceName] ] e] urceName] $G*G 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 0pl\}�
͝��C� ��
�S}� \ � WDMClassesOfDriver MSPower C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] rnelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 0pl\}�
͝��C� ��
�S}� \ � WDMClassesOfDriver MSPower C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] elbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 0pl\}�
͝��C� ��
�S}� \ � WDMClassesOfDriver MSPower C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] tem32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 0pl\}�
͝��C� ��
�S}� \ � WDMClassesOfDriver MSPower C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] se.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 0pl\}�
͝��C� ��
�S}� \ � WDMClassesOfDriver MSPower C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] ase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 0pl\}�
͝��C� ��
�S}� \ � WDMClassesOfDriver MSPower C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] m32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 0pl\}�
͝��C� ��
�S}� \ � WDMClassesOfDriver MSPower C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] em32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 0pl\}�
͝��C� ��
�S}� \ � WDMClassesOfDriver MSPower C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] lbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 0pl\}�
͝��C� ��
�S}� \ � WDMClassesOfDriver MSPower C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 0pl\}�
͝��C� ��
�S}� \ � WDMClassesOfDriver MSPower C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 0pl\}�
͝��C� ��
�S}� \ � WDMClassesOfDriver MSPower C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] nelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 0pl\}�
͝��C� ��
�S}� \ � WDMClassesOfDriver MSPower C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 0pl\}�
͝��C� ��
�S}� \ � WDMClassesOfDriver MSPower C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 2\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 0pl\}�
͝��C� ��
�S}� \ � WDMClassesOfDriver MSPower C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] \kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 0pl\}�
͝��C� ��
�S}� \ � WDMClassesOfDriver MSPower C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 0pl\}�
͝��C� ��
�S}� \ � WDMClassesOfDriver MSPower C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] nelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 0pl\}�
͝��C� ��
�S}� \ � WDMClassesOfDriver MSPower C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] ase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 0pl\}�
͝��C� ��
�S}� \ � WDMClassesOfDriver MSPower C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] base.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 0pl\}�
͝��C� ��
�S}� \ � WDMClassesOfDriver MSPower C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 0pl\}�
͝��C� ��
�S}� \ � WDMClassesOfDriver MSPower C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] em32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 0pl\}�
͝��C� ��
�S}� \ � WDMClassesOfDriver MSPower C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] tem32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 0pl\}�
͝��C� ��
�S}� \ � WDMClassesOfDriver MSPower C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] base.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 0pl\}�
͝��C� ��
�S}� \ � WDMClassesOfDriver MSPower C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] elbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 0pl\}�
͝��C� ��
�S}� \ � WDMClassesOfDriver MSPower C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] nelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 0pl\}�
͝��C� ��
�S}� \ � WDMClassesOfDriver MSPower C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] lbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 0pl\}�
͝��C� ��
�S}� \ � WDMClassesOfDriver MSPower C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] ernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 0pl\}�
͝��C� ��
�S}� \ � WDMClassesOfDriver MSPower C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] rceName] base.dll.mui[MofResourceName] CPIMOFResource] ~��` � ���� $ ��_ 5 rnك; @ ~AI�{ Z - X e S o s P k g _ m e m o r y _ n o d e _ o o m _ r i n g _ b u f f e r _ r e c o r d e d �^��7 � � 7 XeSosPkg_memory_node_oom_ring_buffer_recorded / ) � ��& 1 % ? K � " l � � � 6 Z � � � � � � � � � * � � � � D d � � 5 ~ � �
M
n
�
�
h � � � 7 � � � � D
U
�
�
! , v � � Y d � � h | � � * J WUUUUUUUU����������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������� � memory_node_oom_ring_buffer_recorded EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid available_extended_virtual_address_space_kb T )
� Y a � �� uint64 WmiDataId available_page_file_kb < )
� � � � �� uint64 WmiDataId available_physical_memory_kb , )
� # + � �� uint64 WmiDataId available_virtual_address_space_kb
L )
� � �
� �� uint64 WmiDataId awe_kb � )
� � � � �� uint64 WmiDataId call_stack
% � C
� S [ % � ��f q z � object WmiDataId Extension Variant XEVLD callstack committed_kb p )
� � � � �� uint64 WmiDataId factor � P
� J R � ��] f p � � uint32 WmiDataId XEMapId ValueMap � � � � � � � � � � � � � � 1 2 9 6 3 4 11 12 5 13 10 8 0 7 Values 3 C Q e t ~ � � � � � � � AllocationPotential BlockAllocator BufAllocator EmergencyAllocator EscapeTimeout FailFast Fragment InitDescriptor MemoryPool MemoryPoolPressure QueryMemQueue Simulated Undefined VirtualAlloc failure � P
� R Z � ��e n x � � uint32 WmiDataId XEMapId ValueMap � � � � � 0 1 2 3 4 Values � � � � Virtual Reserve Virtual Commit Page Allocation Reserved Page Allocation Buffer Allocation FragmentId 6
� n v � � � �� uint32 WmiDataId Description FragmentId id )
� � � � �� uint32 WmiDataId is_process_in_job � )
� 2 9 � �� sint8 WmiDataId is_process_physical_memory_low # � )
� � � # � �� sint8 WmiDataId is_process_virtual_memory_low $ � )
�
$ � �� sint8 WmiDataId is_system_physical_memory_high ! � )
� l s ! � �� sint8 WmiDataId is_system_physical_memory_low " � )
� � � " � �� sint8 WmiDataId job_object_limit_job_mem_kb � )
� :
B
� �� uint64 WmiDataId job_object_limit_process_mem_kb � )
� �
�
� �� uint64 WmiDataId last_error � )
� �
� �� uint32 WmiDataId memory_node_id \ )
� U ] � �� sint32 WmiDataId memory_utilization_pct )
� � � � �� uint32 WmiDataId pages_kb � )
� � �� uint64 WmiDataId peak_job_memory_used_kb � )
� n v � �� uint64 WmiDataId peak_process_memory_used_kb � )
� � � � �� uint64 WmiDataId pool_metadata_id � )
� 1
9
� �� uint32 WmiDataId RemainingLength 6
� �
�
�
�
� �� uint32 WmiDataId Description RemainingLength reserved_kb h )
� � �� uint64 WmiDataId resources � )
� c k � �� uint64 WmiDataId SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber shared_committed_kb x )
� F N � �� uint64 WmiDataId target_kb ` )
� � � � �� uint64 WmiDataId task
� 4
� � � � �� �� object WmiDataId Pointer timestamp0 )
� U ] � �� uint64 WmiDataId total_page_file_kb
4 )
� � �
� �� uint64 WmiDataId total_physical_memory_kb $ )
� � �� uint64 WmiDataId total_virtual_address_space_kb D )
� � � � �� uint64 WmiDataId � X e S o s P k g �^��7 �� XeSosPkg
C � �� $ 2 8 ` h r _����� � XeSosPkg_assert_fired Description Assert fired Guid {7319278e-6e46-4fae-886e-c3105a627b48} locale MS\0x409 DisplayName assert_fired � X e S o s P k g _ a s s e r t _ f i r e d �^��7 �� + XeSosPkg_assert_fired ) � �� ' 3 � � � � ; G � � F R � � * � � WU�����������������������������������������# � assert_fired EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid assert_type P
� H P � ��[ d n � � uint32 WmiDataId XEMapId ValueMap ~ � � 0 1 2 Values � � � Debug Retail Soft description $ 6
�
� �� + string WmiDataId StringTermination NullTerminated expression 6
� � � � ��� � string WmiDataId StringTermination NullTerminated file_path 6
� � ��# 6 string WmiDataId StringTermination NullTerminated FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId line_number )
� � �� uint32 WmiDataId RemainingLength 6
� n v � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � �� uint32 WmiDataId Description SequenceNumber � X e S o s P k g �^��7 � XeSosPkg
C � �� & L R z � � � _����� � XeSosPkg_page_allocated Description Occurs when memory page is allocated Guid {bb128759-9c6a-4c37-9ad7-5fbef103992f} locale MS\0x409 DisplayName page_allocated � X e S o s P k g �^��7 �2 XeSosPkg
C � �� % g m � � � � _����� � XeSosPkg_quantum_thief Description Occurs when a task takes too long before yielding the scheduler. Guid {f1c87ab5-4d7b-4741-b54f-39c897a6479e} locale MS\0x409 DisplayName quantum_thief �ief �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ���t�
͝��C�� ) {B���� h � WDMClassesOfDriver VideoModeDescriptor C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] � Ԑ R �� � � e^o� ! =]�g� � �I\U % I�?z o p��� 3 T�S � , X e S q l P k g _ t i e r e d _ s t o r a g e _ c a c h e _ h i t _ m i s s _ s t a t s q[��7 �� H 6 XeSqlPkg_tiered_storage_cache_hit_miss_stats . ) � ��% 0 > J � J \ � � ( 9 � � � ^ v � � � � B R WUU���������������������������������������������������������������������� � tiered_storage_cache_hit_miss_stats EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid cache_hits )
� 7 ? � �� uint64 WmiDataId cache_read_in_kb )
� � � � �� uint64 WmiDataId collection_start_time 8 6
� � �� uint64 WmiDataId Extension WmiTime distribution_id )
� p x � �� uint16 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId logical_database_id )
� K S � �� uint16 WmiDataId physical_database_name @ C
� � � � ��� � � string WmiDataId StringTermination NullTerminated Format w RemainingLength 6
� ] e p } � �� uint32 WmiDataId Description RemainingLength remote_hits ( )
� � � � �� uint64 WmiDataId remote_read_in_kb
0 )
� / 7
� �� uint64 WmiDataId SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g r[��7 � XeSqlPkg
C � ��6 C � � � � � � c���� � XeSqlPkg_columnstore_migration_to_block_blob_started Description Occurs when migration columnstore object data to Azure block blob storage starts. Guid {15A450DB-9E4A-414F-A4E6-CA6D409CF6B5} locale MS\0x409 DisplayName columnstore_migration_to_block_blob_started �4 X e S q l P k g _ c o l u m n s t o r e _ m i g r a t i o n _ t o _ b l o c k _ b l o b _ s t a r t e d s[��7 �� $ > XeSqlPkg_columnstore_migration_to_block_blob_started 6 ) � ��- 8 F R � S _ � � j { � � E U WU����������������������������������� � columnstore_migration_to_block_blob_started EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� @ H � �� uint16 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId message C
� ) 1 � ��< O _ g string WmiDataId StringTermination NullTerminated Format w RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength rowset_id )
� 2 : � �� uint64 WmiDataId SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g t[��7 �� XeSqlPkg
C � ��7 D � � � � � � c���� � XeSqlPkg_columnstore_migration_to_block_blob_finished Description Occurs when migration columnstore object data to Azure block blob storage finishes. Guid {1279B4CE-7E58-4D11-9605-412BFCB2A3E8} locale MS\0x409 DisplayName columnstore_migration_to_block_blob_finished �5 X e S q l P k g _ c o l u m n s t o r e _ m i g r a t i o n _ t o _ b l o c k _ b l o b _ f i n i s h e d u[��7 �� $ ? XeSqlPkg_columnstore_migration_to_block_blob_finished 7 ) � ��. 9 G S �
T ` � � k | � � F V WU����������������������������������� � columnstore_migration_to_block_blob_finished EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� A I � �� uint16 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId message C
� * 2 � ��= P ` h string WmiDataId StringTermination NullTerminated Format w RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength rowset_id )
� 3 ; � �� uint64 WmiDataId SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g v[��7 �G XeSqlPkg
C � ��, 9 h n � � � � c����� � XeSqlPkg_columnstore_migration_debug_trace Description Columnstore object data migration debug trace Guid {96E539AA-4B26-4173-A480-D704D0FB985D} locale MS\0x409 DisplayName columnstore_migration_debug_trace �* X e S q l P k g _ c o l u m n s t o r e _ m i g r a t i o n _ d e b u g _ t r a c e w[��7 �� 4 XeSqlPkg_columnstore_migration_debug_trace , ) � ��# . < H � � n w � � W������������������������� � columnstore_migration_debug_trace EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid FragmentId 6
� B J U b � �� uint32 WmiDataId Description FragmentId message C
� � � � ��� � � string WmiDataId StringTermination NullTerminated Format w RemainingLength 6
� ^ f q ~ � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g x[��7 �c XeSqlPkg
C � ��9 F w } � � � � c����� � XeSqlPkg_columnstore_tiered_storage_scanner_trace_print Description Columnstore tiered storage tde scan debug trace Guid {BC0638EB-55A8-4FB5-847D-BA94C279D9E4} locale MS\0x409 DisplayName columnstore_tiered_storage_scanner_trace_print �int �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�� * �\>�S}� _ � WDMClassesOfDriver WmiMonitorBrightness C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�� 1 �\>�S}� f � WDMClassesOfDriver WmiMonitorBrightnessMethods C:\Windows\system32\kernelbase.dll[MofResourceName] ceName] E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 &�����
͝��C�~ & ��7��� [ � WDMClassesOfDriver KernelPerfStates C:\Windows\system32\kernelbase.dll[MofResourceName] ��g�� r 1P��b ��S�t <��ۊ � !$| � X�J0l S "G�{�
� �S�± � �+�A� ^ ��� � 2b=� -���� �t�� �7o� M S N d i s h��jj��N MSNdis A �� � �� � ) / W c k � � � U����������� � MSNdis_FddiAttachmentType WMI WMIProv guid {acf1403d-a61c-11d0-8dd4-00c04fc3358c} WmiExpense Active
� � � �� boolean InstanceName '
� � � �� � �� string NdisFddiAttachmentType 6
� E � ��M W � uint32 ValueMap
� � � � � � � � � � � � � 1 2 3 4 5 6 7 8 9 10 11 12 13 WmiDataId � M S N d i s i��jj��� MSNdis A �� � �� � " + 1 Y e m � � � U����������e � MSNdis_FddiUpstreamNodeLong WMI WMIProv guid {acf1403e-a61c-11d0-8dd4-00c04fc3358c} WmiExpense Active
� � � �� boolean InstanceName '
� � � �� � �� string NdisFddiUpstreamNodeLong
)
� < � ��Z object:MSNdis_NetworkAddress WmiDataId � M S N d i s j��jj��� MSNdis A �� � �� � $ - 3 [ g o � � � U����������i � MSNdis_FddiDownstreamNodeLong WMI WMIProv guid {acf1403f-a61c-11d0-8dd4-00c04fc3358c} WmiExpense Active
� � � �� boolean InstanceName '
� � � �� � �� string NdisFddiDownstreamNodeLong
)
� @ � ��^ object:MSNdis_NetworkAddress WmiDataId � � M S N d i s k��jj��� MSNdis A �� � �� � & , T ` h � � � � U����������E � MSNdis_FddiFrameErrors WMI WMIProv guid {acf14040-a61c-11d0-8dd4-00c04fc3358c} WmiExpense Active
� � � �� boolean InstanceName '
� � � �� � �� string NdisFddiFrameErrors )
� 2 � ��: uint32 WmiDataId se � M S N d i s l��jj��� MSNdis A �� � �� � % + S _ g � � � � U����������C � MSNdis_FddiFramesLost WMI WMIProv guid {acf14041-a61c-11d0-8dd4-00c04fc3358c} WmiExpense Active
� � � �� boolean InstanceName '
� � � �� � �� string NdisFddiFramesLost )
� 0 � ��8 uint32 WmiDataId e � M S N d i s m��jj��/ MSNdis A �� � �� � $ - 3 [ g o � � � U����������� � MSNdis_FddiRingManagmentState WMI WMIProv guid {acf14042-a61c-11d0-8dd4-00c04fc3358c} WmiExpense Active
� � � �� boolean InstanceName '
� � � �� � �� string NdisFddiRingManagmentState 6
� M � ��U _ � uint32 ValueMap � � � � � � � � 1 2 3 4 5 6 7 8 WmiDataId � M S N d i s n��jj��� MSNdis A �� � �� � & , T ` h � � � � U����������E � MSNdis_FddiLctFailures WMI WMIProv guid {acf14043-a61c-11d0-8dd4-00c04fc3358c} WmiExpense Active
� � � �� boolean InstanceName '
� � � �� � �� string NdisFddiLctFailures )
� 2 � ��: uint32 WmiDataId se � M S N d i s o��jj��� MSNdis A �� � �� � % + S _ g � � � � U����������C � MSNdis_FddiLemRejects WMI WMIProv guid {acf14044-a61c-11d0-8dd4-00c04fc3358c} WmiExpense Active
� � � �� boolean InstanceName '
� � � �� � �� string NdisFddiLemRejects )
� 0 � ��8 uint32 WmiDataId e � M S N d i s p��jj��: MSNdis A �� � �� � " + 1 Y e m � � � U����������� � MSNdis_FddiLConnectionState WMI WMIProv guid {acf14045-a61c-11d0-8dd4-00c04fc3358c} WmiExpense Active
� � � �� boolean InstanceName '
� � � �� � �� string NdisFddiLConnectionState 6
� I � ��Q [ � uint32 ValueMap
� � � � � � � � � � 1 2 3 4 5 6 7 8 9 10 WmiDataId ap � M S N d i s q��jj��� MSNdis �� H R � � � � U����: � MSNdis_ObjectHeader WMI guid {2b1831b2-2216-4ede-a469-9fe3dd6d5a7e} Revision )
� � � ��� uint8 WmiDataId Size )
� � � ��� uint16 WmiDataId Type )
� ( � ��/ uint8 WmiDataId ct � M S N d i s r��jj��� " MSNdis �� # K S � �
W c � � U���������������������������������U � MSNdis_WmiMethodHeader WMI guid {e3eac9dd-2fd3-4963-bffd-b4692888c0d4} Header
)
� � � ��� object:MSNdis_ObjectHeader WmiDataId NetLuid )
� � � ��� uint64 WmiDataId Padding )
� D � ��L uint32 WmiDataId PortNumber )
� � � ��� uint32 WmiDataId RequestId )
� � � ��� uint64 WmiDataId Timeout )
� B � ��J uint32 WmiDataId � M S N d i s s��jj��� " MSNdis �� H P � �
T ` � � � U���������������������������������R � MSNdis_WmiSetHeader WMI guid {3b5605d8-1aaf-4ff6-85b9-bc5fb973dc54} Header
)
� � � ��� object:MSNdis_ObjectHeader WmiDataId NetLuid )
� � � ��� uint64 WmiDataId Padding )
� A � ��I uint32 WmiDataId PortNumber )
� � � ��� uint32 WmiDataId RequestId )
� � � ��� uint64 WmiDataId Timeout )
� ? � ��G uint32 WmiDataId � M S N d i s t��jj��� MSNdis �� ! I U � � � � V ` � � � U�����������������Y � MSNdis_WmiOutputInfo WMI guid {7510bb9d-df70-4f7e-ba07-e29d330b3cc5} DataOffset )
� � � ��� uint32 WmiDataId Flags )
� � � ��� uint32 WmiDataId Header
)
� / � ��K object:MSNdis_ObjectHeader WmiDataId Padding1 )
� � � ��� uint8 WmiDataId Padding2
)
� � � ��� uint16 WmiDataId SupportedRevision )
� G � ��N uint8 WmiDataId �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 Z�n�^��
͝��C�� / J.3�� d � WDMClassesOfDriver MSNdis_FddiAttachmentType C:\Windows\system32\kernelbase.dll[MofResourceName] me] �B�P � z\ � R �6 &M
=�\ | ( X e S q l P k g _ h a d r _ d b _ m a n a g e r _ b a c k u p _ s y n c _ m s g �Y��7 �C " 2 XeSqlPkg_hadr_db_manager_backup_sync_msg * ) � ��! , : F � � l | � � E S o � �
WU��������������������������������y
� hadr_db_manager_backup_sync_msg EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid FragmentId 6
� @ H S ` � �� uint32 WmiDataId Description FragmentId message_log_id
6
� � � � ��� � object:guid WmiDataId Extension Guid message_sub_type )
� 2 : � �� uint32 WmiDataId message_type P
� � � � ��� j � � ! ) uint32 WmiDataId XEMapId ValueMap * � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � �
25 24 3 4 1 2 41 19 36 8 28 27 16 15 20 21 23 22 0 9 18 17 11 38 14 13 39 6 30 35 12 32 29 7 31 5 34 33 26 40 37 10 Values * � � 6 L e w � � � � " > a { � � � � � > Y v � � � � � 1 W y � � � � � 8 V HadrMsgTypeBackupInfoMsg HadrMsgTypeBackupSyncMsg HadrMsgTypeConfigAck HadrMsgTypeConfigFail HadrMsgTypeConfigSyn HadrMsgTypeConfigSynAck HadrMsgTypeCount HadrMsgTypeDBReplicaStatusChange HadrMsgTypeDownloadAgConfigMsg HadrMsgTypeEstablishDB HadrMsgTypeExtendedRecoveryForksMsg HadrMsgTypeExtendedRecoveryForksRequestMsg HadrMsgTypeFileMetadataMsg HadrMsgTypeFileMetadataRequestMsg HadrMsgTypeFsBlockEndMsg HadrMsgTypeFsDirCreateMsg HadrMsgTypeFsFileDataMsg HadrMsgTypeFsFileRequestMsg HadrMsgTypeInvalid HadrMsgTypeLogBlockMsg HadrMsgTypeLogFileMetadataMsg HadrMsgTypeLogFileMetadataRequestMsg HadrMsgTypeLogProgressMsg HadrMsgTypeOfflinePrimaryAg HadrMsgTypePageCopyMsg HadrMsgTypePageRequestMsg HadrMsgTypePaxosMsg HadrMsgTypePing HadrMsgTypePreConfigMsg HadrMsgTypePreConfigReceivedAndConfigSyn HadrMsgTypePrimaryProgressMsg HadrMsgTypePrimaryReplicaFileListMsg HadrMsgTypePrimaryReplicaInfoMsg HadrMsgTypePrimarySync HadrMsgTypeReportFaultOnReplica HadrMsgTypeReset HadrMsgTypeSeedingCancelMsg HadrMsgTypeSeedingRequestMsg HadrMsgTypeSyncLogProgressMsg HadrMsgTypeTestConfigMsg HadrMsgTypeUpdateAgConfigMsg HadrMsgTypeVLFHeaderMsg RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� I
Q
\
i
� �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �Y��7 �* XeSqlPkg
C � ��* 7 M S { � � � c����� � XeSqlPkg_hadr_db_manager_backup_info_msg Description Backup Info message. Guid {C7E933BF-A40E-4ED4-9527-D2D5C80E0054} locale MS\0x409 DisplayName hadr_db_manager_backup_info_msg �( X e S q l P k g _ h a d r _ d b _ m a n a g e r _ b a c k u p _ i n f o _ m s g �Y��7 ��
3 2 XeSqlPkg_hadr_db_manager_backup_info_msg * ) � ��! , : F � � � �
� � � �
�
�
P a � � Z b WUU������������������������������������������������� � hadr_db_manager_backup_info_msg EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid backup_lsn C
� M U � ��` s � � string WmiDataId StringTermination NullTerminated Format w FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId message_log_id
, 6
� ^ k � ��v � object:guid WmiDataId Extension Guid message_sub_type )
� � � � �� uint32 WmiDataId message_type P
� O W � ��b j k u � � uint32 WmiDataId XEMapId ValueMap * ! % ) , / 2 5 9 = A D H L P T X \ ` d g j n r v z ~ � � � � � � � � � � � � � � � � 25 24 3 4 1 2 41 19 36 8 28 27 16 15 20 21 23 22 0 9 18 17 11 38 14 13 39 6 30 35 12 32 29 7 31 5 34 33 26 40 37 10 Values * s � � � � � 7 W o � � � � 4 N k � � � � , G \ m � � � � / P b � � � � HadrMsgTypeBackupInfoMsg HadrMsgTypeBackupSyncMsg HadrMsgTypeConfigAck HadrMsgTypeConfigFail HadrMsgTypeConfigSyn HadrMsgTypeConfigSynAck HadrMsgTypeCount HadrMsgTypeDBReplicaStatusChange HadrMsgTypeDownloadAgConfigMsg HadrMsgTypeEstablishDB HadrMsgTypeExtendedRecoveryForksMsg HadrMsgTypeExtendedRecoveryForksRequestMsg HadrMsgTypeFileMetadataMsg HadrMsgTypeFileMetadataRequestMsg HadrMsgTypeFsBlockEndMsg HadrMsgTypeFsDirCreateMsg HadrMsgTypeFsFileDataMsg HadrMsgTypeFsFileRequestMsg HadrMsgTypeInvalid HadrMsgTypeLogBlockMsg HadrMsgTypeLogFileMetadataMsg HadrMsgTypeLogFileMetadataRequestMsg HadrMsgTypeLogProgressMsg HadrMsgTypeOfflinePrimaryAg HadrMsgTypePageCopyMsg HadrMsgTypePageRequestMsg HadrMsgTypePaxosMsg HadrMsgTypePing HadrMsgTypePreConfigMsg HadrMsgTypePreConfigReceivedAndConfigSyn HadrMsgTypePrimaryProgressMsg HadrMsgTypePrimaryReplicaFileListMsg HadrMsgTypePrimaryReplicaInfoMsg HadrMsgTypePrimarySync HadrMsgTypeReportFaultOnReplica HadrMsgTypeReset HadrMsgTypeSeedingCancelMsg HadrMsgTypeSeedingRequestMsg HadrMsgTypeSyncLogProgressMsg HadrMsgTypeTestConfigMsg HadrMsgTypeUpdateAgConfigMsg HadrMsgTypeVLFHeaderMsg min_skip_lsn
( C
� l
t
� ��
�
�
�
string WmiDataId StringTermination NullTerminated Format w oldest_xact_lsn $ C
� � ��" 5 E M string WmiDataId StringTermination NullTerminated Format w RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� * 2 = J � �� uint32 WmiDataId Description SequenceNumber status )
� � � � �� uint32 WmiDataId � X e S q l P k g �Y��7 �T XeSqlPkg
C � ��8 E i o � � � � c����� � XeSqlPkg_hadr_db_manager_primary_replica_file_list_msg Description Primary replica file list message. Guid {A6AC1557-0EAC-4DDF-B81A-FA704785E22D} locale MS\0x409 DisplayName hadr_db_manager_primary_replica_file_list_msg �msg �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�y ! �\>�S}� V � WDMClassesOfDriver WnfProvider C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�v �\>�S}� S � WDMClassesOfDriver WNFTrace C:\Windows\system32\kernelbase.dll[MofResourceName] lbase.dll.mui[MofResourceName] ame] Name] esourceName] ofResourceName] R�Ն` ^ OA � v �b� 4
qN�EO � ��o�� � 5 X e S q l P k g _ c o l u m n s t o r e _ o b j e c t _ w r i t e _ t o _ b l o c k _ b l o b s _ f a i l ?[��7 ��
_ ? XeSqlPkg_columnstore_object_write_to_block_blobs_fail 7 ) � ��. 9 G S � s � � � - w � � � , v � � � E P � � � � # � � � j | WUUU�������������������������������������������������������������������������������������������x � columnstore_object_write_to_block_blobs_fail EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid blob_id
V 6
� J W � ��b m object:guid WmiDataId Extension Guid chunk_index
0 )
� � �
� �� uint64 WmiDataId column_id & )
� � �� uint64 WmiDataId container_id . )
� d l � �� uint16 WmiDataId current_size 8 )
� � � � �� uint64 WmiDataId db_id )
�
� �� uint16 WmiDataId error_code @ )
� c k � �� uint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId hobt_id )
� 2 : � �� uint64 WmiDataId object_id )
� � � � �� uint64 WmiDataId object_type T P
� � �� e * f n uint8 WmiDataId XEMapId ValueMap N Q T W Z ] ` c 1 5 6 7 8 2 4 0 Values � � � � : ] � COLUMN_SEGMENT COLUMN_SEGMENT_BULKINSERT_DICTIONARY COLUMN_SEGMENT_DELETE_BITMAP COLUMN_SEGMENT_EXTENDED_STRING_PAGE_RANGE COLUMN_SEGMENT_GLOBAL_STRING_DICTIONARY COLUMN_SEGMENT_PRIMARY_DICTIONARY COLUMN_SEGMENT_SECONDARY_DICTIONARY UNDEFINED RemainingLength 6
� � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� g o z � � �� uint32 WmiDataId Description SequenceNumber time_waiting_for_latch_in_us L )
� � � � �� uint64 WmiDataId time_write_to_block_blobs_in_us
D )
� W _
� �� uint64 WmiDataId write_error_type U P
� � � � ��� " � � ' uint8 WmiDataId XEMapId ValueMap 0 1 2 3 Values ; B S c Write Write Immediate Write Eventual Write Latch Acquire � X e S q l P k g @[��7 �N XeSqlPkg
C � ��, 9 o u � � � � c����� � XeSqlPkg_columnstore_object_record_blob_id Description Statistics about recording Block Blob ID information Guid {1c11dc67-8b8b-402d-be43-3368dc22d7ab} locale MS\0x409 DisplayName columnstore_object_record_blob_id �* X e S q l P k g _ c o l u m n s t o r e _ o b j e c t _ r e c o r d _ b l o b _ i d A[��7 �� 9 4 XeSqlPkg_columnstore_object_record_blob_id , ) � ��# .
< H � � h o � � � � � � \ j WU������������������������������������������������������� � columnstore_object_record_blob_id EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid blob_id
2 6
� ? L
� ��W b object:guid WmiDataId Extension Guid db_id )
� � � � �� uint16 WmiDataId duration_ms )
� � � �� uint64 WmiDataId fork_id
. 6
� ] j � ��u � object:guid WmiDataId Extension Guid FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� W _ j w � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber size )
� I Q � �� uint64 WmiDataId xdes_id_hash & )
� � � � �� sint64 WmiDataId � X e S q l P k g B[��7 �m XeSqlPkg
C � ��7 D � � � � � � c����� � XeSqlPkg_tiered_storage_buffer_state_transition_stats Description Statistics about state transitions for tiered storage buffers Guid {26286558-0aec-449c-8929-8c2324424877} locale MS\0x409 DisplayName tiered_storage_buffer_state_transition_stats �5 X e S q l P k g _ t i e r e d _ s t o r a g e _ b u f f e r _ s t a t e _ t r a n s i t i o n _ s t a t s C[��7 �s ? XeSqlPkg_tiered_storage_buffer_state_transition_stats 7 ) � ��. 9 G S �
T ` � � � � � � * WU������������������������������� � tiered_storage_buffer_state_transition_stats EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid duration_ms )
� A I � �� uint64 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId next_state P
� : A � ��L f U _ � � uint8 WmiDataId XEMapId ValueMap � � � � � � � � � � � � � � � � � � 1 16 0 17 4 6 2 7 14 3 5 8 11 12 10 9 13 15 Values = M \ n z � � � � � � � , K g � � TSRB_Allocated TSRB_Complete TSRB_Constructed TSRB_Error TSRB_NotInSBS TSRB_ReadAheadBlockBlob TSRB_ReadAheadSBS TSRB_ReadBlockBlob TSRB_ReadComplete TSRB_ReadSBS TSRB_SkipSBS TSRB_WriteToBlockBlob TSRB_WriteToBlockBlobCommit TSRB_WriteToBlockBlobComplete TSRB_WriteToBlockBlobFlush TSRB_WriteToBlockBlobInProgress TSRB_WriteToSBS TSRB_WriteToSBSComplete prev_state P
� # � ��. f 7 A � � uint8 WmiDataId XEMapId ValueMap � � � � � � � � � � � � � � � � � � 1 16 0 17 4 6 2 7 14 3 5 8 11 12 10 9 13 15 Values / > P \ k � � � � � � � - I j { TSRB_Allocated TSRB_Complete TSRB_Constructed TSRB_Error TSRB_NotInSBS TSRB_ReadAheadBlockBlob TSRB_ReadAheadSBS TSRB_ReadBlockBlob TSRB_ReadComplete TSRB_ReadSBS TSRB_SkipSBS TSRB_WriteToBlockBlob TSRB_WriteToBlockBlobCommit TSRB_WriteToBlockBlobComplete TSRB_WriteToBlockBlobFlush TSRB_WriteToBlockBlobInProgress TSRB_WriteToSBS TSRB_WriteToSBSComplete RemainingLength 6
� � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� n v � � � �� uint32 WmiDataId Description SequenceNumber �ber �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 *pl\}�
͝��C�� + �\>�S}� ` � WDMClassesOfDriver MSVerifierIrpLogEntry C:\Windows\system32\kernelbase.dll[MofResourceName] e] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�| $ �\>�S}� Y � WDMClassesOfDriver ThreadPriority C:\Windows\system32\kernelbase.dll[MofResourceName] dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�| $ �\>�S}� Y � WDMClassesOfDriver ThreadPriority C:\Windows\system32\kernelbase.dll[MofResourceName] sourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�| $ �\>�S}� Y � WDMClassesOfDriver ThreadPriority C:\Windows\system32\kernelbase.dll[MofResourceName] .dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�| $ �\>�S}� Y � WDMClassesOfDriver ThreadPriority C:\Windows\system32\kernelbase.dll[MofResourceName] ll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�| $ �\>�S}� Y � WDMClassesOfDriver ThreadPriority C:\Windows\system32\kernelbase.dll[MofResourceName] ceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�| $ �\>�S}� Y � WDMClassesOfDriver ThreadPriority C:\Windows\system32\kernelbase.dll[MofResourceName] esourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�| $ �\>�S}� Y � WDMClassesOfDriver ThreadPriority C:\Windows\system32\kernelbase.dll[MofResourceName] .dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�| $ �\>�S}� Y � WDMClassesOfDriver ThreadPriority C:\Windows\system32\kernelbase.dll[MofResourceName] ourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�| $ �\>�S}� Y � WDMClassesOfDriver ThreadPriority C:\Windows\system32\kernelbase.dll[MofResourceName] l[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�| $ �\>�S}� Y � WDMClassesOfDriver ThreadPriority C:\Windows\system32\kernelbase.dll[MofResourceName] fResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�| $ �\>�S}� Y � WDMClassesOfDriver ThreadPriority C:\Windows\system32\kernelbase.dll[MofResourceName] .dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�| $ �\>�S}� Y � WDMClassesOfDriver ThreadPriority C:\Windows\system32\kernelbase.dll[MofResourceName] sourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�| $ �\>�S}� Y � WDMClassesOfDriver ThreadPriority C:\Windows\system32\kernelbase.dll[MofResourceName] .dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�| $ �\>�S}� Y � WDMClassesOfDriver ThreadPriority C:\Windows\system32\kernelbase.dll[MofResourceName] .dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�| $ �\>�S}� Y � WDMClassesOfDriver ThreadPriority C:\Windows\system32\kernelbase.dll[MofResourceName] urceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�| $ �\>�S}� Y � WDMClassesOfDriver ThreadPriority C:\Windows\system32\kernelbase.dll[MofResourceName] ResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�| $ �\>�S}� Y � WDMClassesOfDriver ThreadPriority C:\Windows\system32\kernelbase.dll[MofResourceName] base.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�| $ �\>�S}� Y � WDMClassesOfDriver ThreadPriority C:\Windows\system32\kernelbase.dll[MofResourceName] ll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�| $ �\>�S}� Y � WDMClassesOfDriver ThreadPriority C:\Windows\system32\kernelbase.dll[MofResourceName] MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�| $ �\>�S}� Y � WDMClassesOfDriver ThreadPriority C:\Windows\system32\kernelbase.dll[MofResourceName] MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�| $ �\>�S}� Y � WDMClassesOfDriver ThreadPriority C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�x �\>�S}� U � WDMClassesOfDriver CSwitch_V3 C:\Windows\system32\kernelbase.dll[MofResourceName] fResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�x �\>�S}� U � WDMClassesOfDriver CSwitch_V3 C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�w �\>�S}� T � WDMClassesOfDriver Thread_V4 C:\Windows\system32\kernelbase.dll[MofResourceName] base.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�w �\>�S}� T � WDMClassesOfDriver Thread_V4 C:\Windows\system32\kernelbase.dll[MofResourceName] kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�w �\>�S}� T � WDMClassesOfDriver Thread_V4 C:\Windows\system32\kernelbase.dll[MofResourceName] dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�w �\>�S}� T � WDMClassesOfDriver Thread_V4 C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�w �\>�S}� T � WDMClassesOfDriver Thread_V4 C:\Windows\system32\kernelbase.dll[MofResourceName] ourceName] Group1 C:\Windows\system32\kernelbase.dll[MofResourceName] rceName] MofResourceName] ] �� S�
�ޯ� h���� � �Ŗ$m � )Bf�T � )� % p�P? � L�_ � �JC� T c p I p _ V 1 ���jj��� ' TcpIp_V1
� �� % � � � � g l � � ' / y � � WU�������������������������������������8 � TcpIp_V1_Receive EventType connid 4
� g o z �� � �� uint32 WmiDataId PointerType daddr
6
� � � � � � �� object WmiDataId extension IPAddr dport
6
� C K V a � �� object WmiDataId extension Port PID )
� � � � �� uint32 WmiDataId saddr
6
� � �� object WmiDataId extension IPAddr seqnum )
� f n � �� uint32 WmiDataId size )
� � � � �� uint32 WmiDataId sport
6
� ' 2 � �� object WmiDataId extension Port � T c p I p _ V 1 ���jj��� ' TcpIp_V1
� �� 0 8 � � z � � : B � � � � WU�������������������������������������K � TcpIp_V1_TypeGroup1 EventType
connid 4
� z � � �� � �� uint32 WmiDataId PointerType daddr
6
� � � � � �� object WmiDataId extension IPAddr dport
6
� V ^ i t � �� object WmiDataId extension Port PID )
� � � � �� uint32 WmiDataId saddr
6
� ' 2 � �� object WmiDataId extension IPAddr seqnum )
� y � � �� uint32 WmiDataId size )
� � � � �� uint32 WmiDataId sport
6
� ' / : E � �� object WmiDataId extension Port � T c p I p _ V 1 ���jj��~ 8 TcpIp_V1
� �� , 4 � � v { � � f s � � � � � � # 0 z � � � : A WUUU����������������������������������������������������� � TcpIp_V1_TypeGroup2 EventType connid , 4
� v ~ � �� � �� uint32 WmiDataId PointerType daddr
6
� � � � � � �� object WmiDataId extension IPAddr dport
6
� R Z e p � �� object WmiDataId extension Port mss )
� � � � �� uint16 WmiDataId PID )
� � �� uint32 WmiDataId rcvwin $ )
� S [ � �� uint32 WmiDataId rcvwinscale ( )
� � � � �� sint16 WmiDataId sackopt )
� � � �� uint16 WmiDataId saddr
6
� [ c n y � �� object WmiDataId extension IPAddr seqnum 0 )
� � � � �� uint32 WmiDataId size )
� � �� uint32 WmiDataId sndwinscale
* )
� g o
� �� sint16 WmiDataId sport
6
� � � � � � �� object WmiDataId extension Port tsopt )
� ' / � �� uint16 WmiDataId wsopt
" )
� x �
� �� uint16 WmiDataId � T c p I p _ V 1 ���jj��� TcpIp_V1
� �� ! G��������k � TcpIp_V1_Fail EventType Proto )
� X ` � �� uint32 WmiDataId � T c p I p _ V 1 ���jj��� / TcpIp_V1
� ��
" � � � � d m � �
w � � � � WU��������������������������������������������� � TcpIp_V1_Send EventType connid $ 4
� d l w �� � �� uint32 WmiDataId PointerType daddr
6
� � � � � � �� object WmiDataId extension IPAddr dport
6
� @ H S ^ � �� object WmiDataId extension Port endtime )
� � � � �� uint32 WmiDataId PID )
� � � � �� uint32 WmiDataId saddr
6
� Q Y d o � �� object WmiDataId extension IPAddr seqnum
( )
� � �
� �� uint32 WmiDataId size )
� � �� uint32 WmiDataId sport
6
� d l w � � �� object WmiDataId extension Port startime )
� � � � �� uint32 WmiDataId � T c p I p _ V 1 ���jj��� ' TcpIp_V1
� �� 8 @ � � � � � � B J � � � � WU�������������������������������������S � TcpIp_V1_TypeGroup3 EventType connid 4
� � � � �� � �� uint32 WmiDataId PointerType daddr
6
� � � � �� object WmiDataId extension IPAddr dport
6
� ^ f q | � �� object WmiDataId extension Port PID )
� � � � �� uint32 WmiDataId saddr
6
� $ / : � �� object WmiDataId extension IPAddr seqnum )
� � � � �� uint32 WmiDataId size )
� � � � �� uint32 WmiDataId sport
6
� / 7 B M � �� object WmiDataId extension Port � M S N T _ S y s t e m T r a c e ���jj��� MSNT_SystemTrace ) � ��
5 C����C � TcpIp Guid {9a280ac0-c8e0-11d1-84e2-00c04fb998a2} EventVersion � T c p I p ���jj��� / TcpIp � ��
# � � � � g p � � | � � � % � � WU��������������������������������������������� � TcpIp_SendIPV4 EventType connid
( 4
� e m
x �� � �� uint32 WmiDataId PointerType daddr
6
� � � � � � �� object WmiDataId extension IPAddrV4 dport
6
� C K V a � �� object WmiDataId extension Port endtime )
� � � � �� uint32 WmiDataId PID )
� � � � �� uint32 WmiDataId saddr
6
� T \ g r � �� object WmiDataId extension IPAddrV4 seqnum $ )
� � � � �� uint32 WmiDataId size )
� � �� uint32 WmiDataId sport
6
� i q | � � �� object WmiDataId extension Port startime )
� � � � �� uint32 WmiDataId �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 [�n�^��
͝��C�� 1 J.3�� f � WDMClassesOfDriver MSNdis_FddiUpstreamNodeLong C:\Windows\system32\kernelbase.dll[MofResourceName] me] e] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�x �\>�S}� U � WDMClassesOfDriver CSwitch_V4 C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�� * �\>�S}� _ � WDMClassesOfDriver DiskIo_V0_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�� + �\>�S}� ` � WDMClassesOfDriver DriverCompleteRequest C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�t �\>�S}� Q � WDMClassesOfDriver DiskIo C:\Windows\system32\kernelbase.dll[MofResourceName] lbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�t �\>�S}� Q � WDMClassesOfDriver DiskIo C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�� , �\>�S}� a � WDMClassesOfDriver Registry_V0_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] l[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�� , �\>�S}� a � WDMClassesOfDriver Registry_V0_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] e] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�� , �\>�S}� a � WDMClassesOfDriver Registry_V0_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] ourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�� , �\>�S}� a � WDMClassesOfDriver Registry_V0_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] ResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�� , �\>�S}� a � WDMClassesOfDriver Registry_V0_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] ll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�� , �\>�S}� a � WDMClassesOfDriver Registry_V0_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] ourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�� , �\>�S}� a � WDMClassesOfDriver Registry_V0_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] ame] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�� , �\>�S}� a � WDMClassesOfDriver Registry_V0_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�� , �\>�S}� a � WDMClassesOfDriver Registry_V0_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] ourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�� , �\>�S}� a � WDMClassesOfDriver Registry_V0_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] ResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�� , �\>�S}� a � WDMClassesOfDriver Registry_V0_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] rceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�� , �\>�S}� a � WDMClassesOfDriver Registry_V0_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] ame] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�� , �\>�S}� a � WDMClassesOfDriver Registry_V0_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] ResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�� , �\>�S}� a � WDMClassesOfDriver Registry_V0_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] e] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�� , �\>�S}� a � WDMClassesOfDriver Registry_V0_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] .dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�� , �\>�S}� a � WDMClassesOfDriver Registry_V0_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�y ! �\>�S}� V � WDMClassesOfDriver Registry_V1 C:\Windows\system32\kernelbase.dll[MofResourceName] elbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�y ! �\>�S}� V � WDMClassesOfDriver Registry_V1 C:\Windows\system32\kernelbase.dll[MofResourceName] ase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�y ! �\>�S}� V � WDMClassesOfDriver Registry_V1 C:\Windows\system32\kernelbase.dll[MofResourceName] 32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�y ! �\>�S}� V � WDMClassesOfDriver Registry_V1 C:\Windows\system32\kernelbase.dll[MofResourceName] nelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�y ! �\>�S}� V � WDMClassesOfDriver Registry_V1 C:\Windows\system32\kernelbase.dll[MofResourceName] kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�y ! �\>�S}� V � WDMClassesOfDriver Registry_V1 C:\Windows\system32\kernelbase.dll[MofResourceName] ResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�y ! �\>�S}� V � WDMClassesOfDriver Registry_V1 C:\Windows\system32\kernelbase.dll[MofResourceName] ] ��a�P � ���� � �p � � ��(�{ > X e S q l P k g _ q u e r y _ p l a n _ p r o f i l e aX��7 �H v % XeSqlPkg_query_plan_profile ) � �� - 9 � � 7 F � � ' 1 { � � � / ; � � c o � � � � � � * ? � �
% o } # m } WUUUU������������������������������������������������������������������������������������������������������������������ � query_plan_profile EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid cpu_time )
� $ , � �� uint64 WmiDataId database_name l C
� � � � ��� � � � string WmiDataId StringTermination NullTerminated Format w dop ` )
� � �� uint32 WmiDataId duration
( )
� h p
� �� uint64 WmiDataId estimated_cost 4 )
� � � � �� sint32 WmiDataId estimated_rows 0 )
� $ � �� sint32 WmiDataId FragmentId 6
� � � � � �� uint32 WmiDataId Description FragmentId granted_memory_kb X )
� � � � �� uint64 WmiDataId ideal_memory_kb P )
� P X � �� uint64 WmiDataId nest_level )
� � � � �� uint16 WmiDataId object_id )
� � � �� sint32 WmiDataId object_name d C
� l t � �� � � � string WmiDataId StringTermination NullTerminated Format w object_type P
� � ��+ a 4 > �
uint16 WmiDataId XEMapId ValueMap p ! $ + 2 9 @ F M T [ b i p v } � � � � � � � � � � � � � � � � � � $ + 2 9 @ F M T [ b i p w ~ � � � � � � � � � � � � � � � � � � �
$
+
2
9
@
G
N
U
\
c
j
q
w
~
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
20801 17985 19521 21825 2 1 20545 21057 21313 19265 8257 18241 20034 19267 21059 19523 21827 8259 19779 21571 17475 20547 16964 21828 16708 21316 17220 20036 21060 21572 17732 8260 19268 17221 20549 20037 21061 17477 17989 19536 21840 16716 19525 19544 22597 21573 21848 8262 21318 21574 17222 19526 20038 21831 22601 17993 21321 21577 0 65536 22604 19277 21581 4 20047 19283 16975 18000 20816 21072 19280 8272 17232 20550 21328 131072 18002 18258 19538 21586 8274 17235 20563 20307 21075 22099 19539 21843 16723 20291 17491 18259 8276 17747 21587 20819 20051 8275 18004 16724 21076 22868 20821 21333 8277 8278 18263 19543 21847 22611 8280 21080 Values p � � � � � � � � �
%
.
3
9
D
N
U
Z
d
p
�
�
�
�
�
�
�
�
�
�
�
�
�
�
, 8 A I S ^ f o u � � � � � � � � � � � � � � % / 9 @ F O ] f n x | � � � � � � � � � � � � � � " + 3 < E N T [ a i o y � � � � ADHOC AGG AKEYLOGIN AKEYUSER ALL ANY APP APPROLE ASM ASYMKEY AUDIT AVAILABILITYGROUP BINDING CEK CERT CERTLOGIN CERTUSER CHECK CMK CONTRACT CREDENTIAL CRYPTOPROVIDER DATABASE DBAUDIT DBAUDITSPEC DBCONFIG DBCREDENTIAL DBEVTNOT DBRG DBTRIG DBXESES DEFAULT DEK EDGE ENDPOINT EVTNOTIF EXRP EXTDATASRC EXTFILEFMT EXTGRPLOGIN EXTGRPUSER EXTLANG EXTLIB EXTLOGIN EXTSCRIPT EXTTAB EXTUSER FKEY FNSCLASM FNTABASM FTCAT FTSTPLIST FUNCTION GROUPUSER INDEX INLFUNC INLSCLFN INTLTAB INVALID LOCAL LOGIN MASTERKEY MSGTYPE NOTADHOC OBEVTNOT OBFKEY OBJ PFUN PREPARED PRIORITY PRKEY PROC PROCASM PROPERTYLIST PSCHEME REMOTE REPLPROC RG ROLE ROUTE RULE SCHEMA SECPOLICY SEQUENCE SERVER SERVICE SQLLOGIN SQLUSER SRVAUDITSPEC SRVCONFIG SRVEVTNOT SRVROLE SRVTRIG SRVXESES STATISTICS SVCQ SYNONYM SYSTAB TABFUNC TRIGASM TRIGGER TYPE UQKEY USER USRTAB VIEW WINGROUP WINLOGIN WINUSER XMLSCHEMA XPROC XREL RemainingLength 6
� � � �� uint32 WmiDataId Description RemainingLength requested_memory_kb @ )
� v ~ � �� uint64 WmiDataId SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber serial_ideal_memory_kb
8 )
� \ d
� �� uint64 WmiDataId showplan_xml h C
� � � � ��� � string WmiDataId StringTermination NullTerminated Format w source_database_id )
� Z b � �� uint32 WmiDataId used_memory_kb H )
� � � � �� uint64 WmiDataId � X e S q l P k g bX��7 �� XeSqlPkg
C � ��, 9 � � # c����F � XeSqlPkg_query_post_execution_plan_profile Description Occurs after a SQL statement is executed. This event contains an XML representation of the actual query plan and uses lightweight profiling infrastructure. Guid {f68f5b0f-7b26-4c45-84be-4df646a7a539} locale MS\0x409 DisplayName query_post_execution_plan_profile �! X e S q l P k g _ q u e r y _ r x _ s e n d i n g _ b u f f e r s mX��7 �^ 0 + XeSqlPkg_query_rx_sending_buffers # ) � �� %
3 ? � � = M � � d n � � , � � � WU���������������������������������������������u � query_rx_sending_buffers EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid brick_id )
� * 2 � �� uint32 WmiDataId destination_id )
� � � � �� uint32 WmiDataId FragmentId 6
� � � � � �� uint32 WmiDataId Description FragmentId is_eos )
� R Y � �� sint8 WmiDataId query_id
% )
� � �
� �� uint64 WmiDataId query_operation_node_id )
� � �� uint32 WmiDataId RemainingLength 6
� p x � � � �� uint32 WmiDataId Description RemainingLength rows ! )
� � � � �� uint32 WmiDataId SequenceNumber 6
� E M X e � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g nX��7 � XeSqlPkg
C � �� - C I q y � � c����� � XeSqlPkg_query_rx_send_buffers Description RX sends row buffers Guid {3bc014fc-947e-4eb8-be70-dab84683ce7f} locale MS\0x409 DisplayName query_rx_send_buffers �ers �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�} % �\>�S}� Z � WDMClassesOfDriver TP_V2_ThreadSet C:\Windows\system32\kernelbase.dll[MofResourceName] eName] ceName] �e] ��#x` m ����� �t�� � ���W pR��k
[��C�r ) � �� � ( 0 � MSFT_MpHeartBeat ProtectionManagement locale � 5 9 � � Send ��- �� implemented static � ae442007200009F ROOT\Microsoft\Windows\Defender ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � ]��C�m ) � �� �
# + � MSFT_MpScan ProtectionManagement locale � 6 � f � Start ! ��. �� implemented static � ae442007200009F ROOT\Microsoft\Windows\Defender ���� � �2 �� � ? * � �����~ � __PARAMETERS abstract ScanType uint8
� 4 In
� 4 Z �� ID )
� � Z ��� uint8 ScanPath string
� � In
� �
�� ID )
� v
��; string __ �� ae442007200009F ROOT\Microsoft\Windows\Defender ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � ^��C�r ) � �� � ( 0 � MSFT_MpSignature ProtectionManagement locale 7 S � � Update " ��/ �� implemented static ae442007200009F ROOT\Microsoft\Windows\Defender ���� � �� �� * � �� � __PARAMETERS abstract UpdateSource uint8
� 8 In
� 8 ^ �� ID )
� � ^ ��� uint8 __ �� ae442007200009F ROOT\Microsoft\Windows\Defender ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � R O O T \ c i m v 2 \ m d m _ _ I n s t a n c e P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 3 9 0 E B 4 5 D 3 2 F 6 8 9 2 8 2 4 0 8 A D A 5 2 0 C E 6 3 9 3 A 4 1 E C 4 6 1 8 E E 2 0 4 A A 0 F B C 3 2 C F 2 D 7 4 6 9 E 3 \ K I _ E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C \ I _ 8 E C E B 1 8 F 5 D 5 9 5 6 A D B B 9 2 C 6 0 B 6 B B F 6 5 7 3 8 6 F 0 B E 5 9 6 C E C 9 4 3 5 A A B D 1 8 5 E A E 1 B 6 B 4 2 � Z��C�� " 4 �� � �� � 0 8 H z � � � � � V s � � U��������������������������������N � MSFT_MpEvent Indication ProtectionManagement locale AdditionalData
� r � �� sint64 CategoryDiscriminant 4
� � � � � �� � �� uint32 ValueMap � � � 1 2 4 8 ComputerNotificationsValue )
� W _ g � �� uint32 BitMap � � � � � � � 1 2 4 8 16 32 64 NotificationTime e
� � � �� datetime ScanNotificationsValue )
� 4 < D � �� uint32 BitMap P S 1 2 SignatureNotificationsValue )
� � � � � �� uint32 BitMap � 1 ThreatNotificationsValue )
� & � �� uint32 BitMap > A D G J 1 2 4 8 16 � 16 �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� 5 �\>�S}� j � WDMClassesOfDriver MSNdis_EthernetPermanentAddress C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� 2 �\>�S}� g � WDMClassesOfDriver MSNdis_EthernetMulticastList C:\Windows\system32\kernelbase.dll[MofResourceName] fResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� 2 �\>�S}� g � WDMClassesOfDriver MSNdis_EthernetMulticastList C:\Windows\system32\kernelbase.dll[MofResourceName] MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� 2 �\>�S}� g � WDMClassesOfDriver MSNdis_EthernetMulticastList C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� / �\>�S}� d � WDMClassesOfDriver MSNdis_EthernetMacOptions C:\Windows\system32\kernelbase.dll[MofResourceName] [MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� / �\>�S}� d � WDMClassesOfDriver MSNdis_EthernetMacOptions C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� / �\>�S}� d � WDMClassesOfDriver MSNdis_EthernetMacOptions C:\Windows\system32\kernelbase.dll[MofResourceName] l[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� / �\>�S}� d � WDMClassesOfDriver MSNdis_EthernetMacOptions C:\Windows\system32\kernelbase.dll[MofResourceName] fResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� / �\>�S}� d � WDMClassesOfDriver MSNdis_EthernetMacOptions C:\Windows\system32\kernelbase.dll[MofResourceName] ll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� / �\>�S}� d � WDMClassesOfDriver MSNdis_EthernetMacOptions C:\Windows\system32\kernelbase.dll[MofResourceName] rnelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� / �\>�S}� d � WDMClassesOfDriver MSNdis_EthernetMacOptions C:\Windows\system32\kernelbase.dll[MofResourceName] ] 4 ��� �� s � WDMClassesOfDriver MSNdis_TokenRingLastOpenStatus C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] \processr.sys[PROCESSORWMI] ��y@ � E2L( �:�< � �ٝ��C��
) 0 = � �� � S d p � � � , U������������i � MDM_Policy_Result01_WindowsConnectionManager02 InPartition E local-system DMWmiBridgeProv InstanceID
� � � �� string ParentID
� � � �� string ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork '
� a � �� � string ws � ڝ��C�� ) * 7 � �� � K \ { � � M W U����������������� � MDM_Policy_User_Config01_Notifications02 InPartition ? local-user DMWmiBridgeProv DisallowNotificationMirroring '
� � � �� � �� sint32 DisallowTileNotification '
� � �� � �� sint32 InstanceID
� E � �� string ParentID
� � � �� string M �7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D z��C�
ȝ��C�k T � __MethodProviderRegistration \\.\root\cimv2\mdm:__Win32Provider.Name="MDMAppProv" me="MDMAppProv" 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� / �\>�S}� d � WDMClassesOfDriver MSNdis_CoReceivePduErrors C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� 0 �\>�S}� e � WDMClassesOfDriver MSNdis_AtmSupportedVcRates C:\Windows\system32\kernelbase.dll[MofResourceName] esourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� 0 �\>�S}� e � WDMClassesOfDriver MSNdis_AtmSupportedVcRates C:\Windows\system32\kernelbase.dll[MofResourceName] [MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� 0 �\>�S}� e � WDMClassesOfDriver MSNdis_AtmSupportedVcRates C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� 6 �\>�S}� k � WDMClassesOfDriver MSNdis_AtmHardwareCurrentAddress C:\Windows\system32\kernelbase.dll[MofResourceName] eName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� 6 �\>�S}� k � WDMClassesOfDriver MSNdis_AtmHardwareCurrentAddress C:\Windows\system32\kernelbase.dll[MofResourceName] [MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� 6 �\>�S}� k � WDMClassesOfDriver MSNdis_AtmHardwareCurrentAddress C:\Windows\system32\kernelbase.dll[MofResourceName] ] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� 6 �\>�S}� k � WDMClassesOfDriver MSNdis_AtmHardwareCurrentAddress C:\Windows\system32\kernelbase.dll[MofResourceName] urceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� 6 �\>�S}� k � WDMClassesOfDriver MSNdis_AtmHardwareCurrentAddress C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� 6 �\>�S}� k � WDMClassesOfDriver MSNdis_AtmHardwareCurrentAddress C:\Windows\system32\kernelbase.dll[MofResourceName] urceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� 6 �\>�S}� k � WDMClassesOfDriver MSNdis_AtmHardwareCurrentAddress C:\Windows\system32\kernelbase.dll[MofResourceName] Name] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� 6 �\>�S}� k � WDMClassesOfDriver MSNdis_AtmHardwareCurrentAddress C:\Windows\system32\kernelbase.dll[MofResourceName] eName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� 6 �\>�S}� k � WDMClassesOfDriver MSNdis_AtmHardwareCurrentAddress C:\Windows\system32\kernelbase.dll[MofResourceName] ourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� 6 �\>�S}� k � WDMClassesOfDriver MSNdis_AtmHardwareCurrentAddress C:\Windows\system32\kernelbase.dll[MofResourceName] Name] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� 6 �\>�S}� k � WDMClassesOfDriver MSNdis_AtmHardwareCurrentAddress C:\Windows\system32\kernelbase.dll[MofResourceName] e] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� 6 �\>�S}� k � WDMClassesOfDriver MSNdis_AtmHardwareCurrentAddress C:\Windows\system32\kernelbase.dll[MofResourceName] e] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� 6 �\>�S}� k � WDMClassesOfDriver MSNdis_AtmHardwareCurrentAddress C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� , �\>�S}� a � WDMClassesOfDriver MSNdis_AtmMaxActiveVcs C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� , �\>�S}� a � WDMClassesOfDriver MSNdis_AtmMaxActiveVcs C:\Windows\system32\kernelbase.dll[MofResourceName] .dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� , �\>�S}� a � WDMClassesOfDriver MSNdis_AtmMaxActiveVcs C:\Windows\system32\kernelbase.dll[MofResourceName] dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� , �\>�S}� a � WDMClassesOfDriver MSNdis_AtmMaxActiveVcs C:\Windows\system32\kernelbase.dll[MofResourceName] esourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� , �\>�S}� a � WDMClassesOfDriver MSNdis_AtmMaxActiveVcs C:\Windows\system32\kernelbase.dll[MofResourceName] l[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� , �\>�S}� a � WDMClassesOfDriver MSNdis_AtmMaxActiveVcs C:\Windows\system32\kernelbase.dll[MofResourceName] er MSNdis_EthernetReceiveErrorAlignment C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� : )ߝ�t � o � WDMClassesOfDriver WmiMonitorListedSupportedSourceModes C:\Windows\system32\kernelbase.dll[MofResourceName] eName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� : )ߝ�t � o � WDMClassesOfDriver WmiMonitorListedSupportedSourceModes C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� : )ߝ�t � o � WDMClassesOfDriver WmiMonitorListedSupportedSourceModes C:\Windows\system32\kernelbase.dll[MofResourceName] ceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� : )ߝ�t � o � WDMClassesOfDriver WmiMonitorListedSupportedSourceModes C:\Windows\system32\kernelbase.dll[MofResourceName] F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� : )ߝ�t � o � WDMClassesOfDriver WmiMonitorListedSupportedSourceModes C:\Windows\system32\kernelbase.dll[MofResourceName] eName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� : )ߝ�t � o � WDMClassesOfDriver WmiMonitorListedSupportedSourceModes C:\Windows\system32\kernelbase.dll[MofResourceName] e] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� : )ߝ�t � o � WDMClassesOfDriver WmiMonitorListedSupportedSourceModes C:\Windows\system32\kernelbase.dll[MofResourceName] ResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� : )ߝ�t � o � WDMClassesOfDriver WmiMonitorListedSupportedSourceModes C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� : )ߝ�t � o � WDMClassesOfDriver WmiMonitorListedSupportedSourceModes C:\Windows\system32\kernelbase.dll[MofResourceName] Name] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� : )ߝ�t � o � WDMClassesOfDriver WmiMonitorListedSupportedSourceModes C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� . )ߝ�t � c � WDMClassesOfDriver FrequencyRangeDescriptor C:\Windows\system32\kernelbase.dll[MofResourceName] esourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� . )ߝ�t � c � WDMClassesOfDriver FrequencyRangeDescriptor C:\Windows\system32\kernelbase.dll[MofResourceName] eName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� . )ߝ�t � c � WDMClassesOfDriver FrequencyRangeDescriptor C:\Windows\system32\kernelbase.dll[MofResourceName] ase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� . )ߝ�t � c � WDMClassesOfDriver FrequencyRangeDescriptor C:\Windows\system32\kernelbase.dll[MofResourceName] l[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� . )ߝ�t � c � WDMClassesOfDriver FrequencyRangeDescriptor C:\Windows\system32\kernelbase.dll[MofResourceName] MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� . )ߝ�t � c � WDMClassesOfDriver FrequencyRangeDescriptor C:\Windows\system32\kernelbase.dll[MofResourceName] ourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� . )ߝ�t � c � WDMClassesOfDriver FrequencyRangeDescriptor C:\Windows\system32\kernelbase.dll[MofResourceName] MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� . )ߝ�t � c � WDMClassesOfDriver FrequencyRangeDescriptor C:\Windows\system32\kernelbase.dll[MofResourceName] ourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� . )ߝ�t � c � WDMClassesOfDriver FrequencyRangeDescriptor C:\Windows\system32\kernelbase.dll[MofResourceName] l[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� . )ߝ�t � c � WDMClassesOfDriver FrequencyRangeDescriptor C:\Windows\system32\kernelbase.dll[MofResourceName] Name] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� . )ߝ�t � c � WDMClassesOfDriver FrequencyRangeDescriptor C:\Windows\system32\kernelbase.dll[MofResourceName] me] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� . )ߝ�t � c � WDMClassesOfDriver FrequencyRangeDescriptor C:\Windows\system32\kernelbase.dll[MofResourceName] se.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� . )ߝ�t � c � WDMClassesOfDriver FrequencyRangeDescriptor C:\Windows\system32\kernelbase.dll[MofResourceName] esourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� . )ߝ�t � c � WDMClassesOfDriver FrequencyRangeDescriptor C:\Windows\system32\kernelbase.dll[MofResourceName] .dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� . )ߝ�t � c � WDMClassesOfDriver FrequencyRangeDescriptor C:\Windows\system32\kernelbase.dll[MofResourceName] l[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� . )ߝ�t � c � WDMClassesOfDriver FrequencyRangeDescriptor C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� . )ߝ�t � c � WDMClassesOfDriver FrequencyRangeDescriptor C:\Windows\system32\kernelbase.dll[MofResourceName] � string Description Source File Name Text
� 5 = J string Description Text � � �n ID � F}~_� U ���� � �Y��l V R�Ӹ� � &�}L � �-3� � -�ޚ � bS�. � " X e S q l P k g _ s t r e t c h _ t a b l e _ q u e r y _ e r r o r ST��7 �� ( , XeSqlPkg_stretch_table_query_error $ ) � �� & 4 @ � � A O � � � � l x � � G W � � WU�������������������������������������� � stretch_table_query_error EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� . 6 � �� uint32 WmiDataId error_number )
� � � � �� sint32 WmiDataId error_state ! )
� � � � �� sint32 WmiDataId FragmentId 6
� @ H S ` � �� uint32 WmiDataId Description FragmentId is_success )
� � � � �� sint8 WmiDataId RemainingLength 6
� ) 6 � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber table_id )
� � �� uint32 WmiDataId � X e S q l P k g TT��7 �_ XeSqlPkg
C � ��( 5 � � � � � � c����� � XeSqlPkg_remote_data_archive_telemetry Description Occurs whenever an on premise system transmits a telemetry event to Azure DB. Guid {2DED87B4-7DCD-43CF-AFD0-054FC8AFD11C} locale MS\0x409 DisplayName remote_data_archive_telemetry �& X e S q l P k g _ r e m o t e _ d a t a _ a r c h i v e _ t e l e m e t r y UT��7 �� R 0 XeSqlPkg_remote_data_archive_telemetry ( ) � �� * 8 D � � E S � � � p | � � A T � � B W � � ' � � ? E � � WUUU������������������������������������������������������������������������������� � remote_data_archive_telemetry EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid duration_ms )
� 2 : � �� sint64 WmiDataId error_number
- )
� � �
� �� sint32 WmiDataId error_state 1 )
� � � � �� sint32 WmiDataId event_timestamp 5 6
� I Q � ��\ g uint64 WmiDataId Extension WmiTime FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId is_success )
� / 6 � �� sint8 WmiDataId local_database_id )
� � � � �� sint32 WmiDataId local_event_name I C
� � �� ' 7 ? string WmiDataId StringTermination NullTerminated Format w local_instance_guid
= 6
� � �
� ��� � object:guid WmiDataId Extension Guid local_table_id )
� � �� sint32 WmiDataId message A C
� x � � ��� � � � string WmiDataId StringTermination NullTerminated Format w RemainingLength 6
� ! . � �� uint32 WmiDataId Description RemainingLength rows % )
� | � � �� sint64 WmiDataId SequenceNumber 6
� � � � � �� uint32 WmiDataId Description SequenceNumber server_name E C
� q y � ��� � � � string WmiDataId StringTermination NullTerminated Format w � X e S q l P k g VT��7 �b XeSqlPkg
C � ��1 > ~ � � � � � c����� � XeSqlPkg_remote_data_archive_telemetry_rejected Description Occurs whenever an AzureDB Stretch telemetry event is rejected Guid {D927AF2E-7CD6-483E-A6DA-80F0692EB0BB} locale MS\0x409 DisplayName remote_data_archive_telemetry_rejected �/ X e S q l P k g _ r e m o t e _ d a t a _ a r c h i v e _ t e l e m e t r y _ r e j e c t e d WT��7 �6 + 9 XeSqlPkg_remote_data_archive_telemetry_rejected 1 ) � ��( 3 A M � s � L ^ � J [ � � WU�����������������������������������������T � remote_data_archive_telemetry_rejected EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid event_timestamp 6
� L T � ��_ j uint64 WmiDataId Extension WmiTime FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId local_database_id )
� 9 A � �� sint32 WmiDataId local_event_name $ C
� � � � ��� � � � string WmiDataId StringTermination NullTerminated Format w local_table_id )
� 7 ? � �� sint32 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� $ , 7 D � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g XT��7 �z XeSqlPkg
C � ��. ; � � � � � � c���� � XeSqlPkg_data_purity_checks_for_dbcompat_130 Description Occurs when an operation that may require a data purity check for dbcompat level 130 occurs. Guid {bf4d2142-c7ca-4f81-8c07-de53ba9dfc64} locale MS\0x409 DisplayName data_purity_checks_for_dbcompat_130 �, X e S q l P k g _ d a t a _ p u r i t y _ c h e c k s _ f o r _ d b c o m p a t _ 1 3 0 YT��7 �$ 6 XeSqlPkg_data_purity_checks_for_dbcompat_130 . ) � ��% 0 > J � p � � W���������������������z � data_purity_checks_for_dbcompat_130 EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid FragmentId 6
� D L W d � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� J R ] j � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g ZT��7 �` XeSqlPkg
C � ��! . � � � � � � c����� � XeSqlPkg_unable_to_verify_trust Description Occurs when SQL Server is unable to perform Authenticode signature verification on binaries. Guid {D27A1483-E562-4863-8148-B81EEB158B58} locale MS\0x409 DisplayName unable_to_verify_trust �ust �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�{ # �\>�S}� X � WDMClassesOfDriver ObHandleEvent C:\Windows\system32\kernelbase.dll[MofResourceName] e.dll.mui[MofResourceName] ofResourceName] ��T� � ��/�, q 5q��� g .03` ] @�RGa � T�Jk T tV.] ^ X e S q l P k g _ h a d r _ c a p t u r e _ v l f h e a d e r Z��7 �V = ) XeSqlPkg_hadr_capture_vlfheader ! ) � �� # 1 = � � k � � s | � � B P � � � { � � WUU����������������������������������������������������������Z � hadr_capture_vlfheader EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid availability_group_id
. 6
� B O � ��Z e object:guid WmiDataId Extension Guid availability_replica_id
2 6
� � �
� ��� � object:guid WmiDataId Extension Guid database_replica_id
6 6
� J W � ��b m object:guid WmiDataId Extension Guid file_id , )
� � � � �� uint16 WmiDataId FragmentId 6
� ) 6 � �� uint32 WmiDataId Description FragmentId log_block_id $ )
� � � � �� uint64 WmiDataId processing_time )
� � � � �� uint64 WmiDataId RemainingLength 6
� J R ] j � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber start_timestamp )
� G O � �� uint64 WmiDataId � X e S q l P k g Z��7 �I XeSqlPkg
C � ��' 4 o u � � � � c����� � XeSqlPkg_hadr_capture_filestream_wait Description Occurs when primary is waiting for filestream to be sent. Guid {E167EF3D-AD68-4FE0-BF0F-4F85F03EB2E2} locale MS\0x409 DisplayName hadr_capture_filestream_wait �% X e S q l P k g _ h a d r _ c a p t u r e _ f i l e s t r e a m _ w a i t Z��7 � ; / XeSqlPkg_hadr_capture_filestream_wait ' ) � �� )
7 C � q � � y � � M ^ � � . > � � WU��������������������������������������������������������
� hadr_capture_filestream_wait EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid availability_group_id
, 6
� H U � ��` k object:guid WmiDataId Extension Guid availability_replica_id
0 6
� � � � ��� � object:guid WmiDataId Extension Guid database_replica_id
4 6
� P ]
� ��h s object:guid WmiDataId Extension Guid FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId log_block_id $ )
� : B � �� uint64 WmiDataId processing_time )
� � � � �� uint64 WmiDataId RemainingLength 6
� � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber start_timestamp )
� � � �� uint64 WmiDataId � X e S q l P k g Z��7 �5 XeSqlPkg
C � �� , c i � � � � c����� � XeSqlPkg_hadr_apply_vlfheader Description Occurs when secondary is going to apply a VLF header. Guid {A3E65B18-EC06-4546-9835-90B440EBC98F} locale MS\0x409 DisplayName hadr_apply_vlfheader � X e S q l P k g _ h a d r _ a p p l y _ v l f h e a d e r Z��7 �V $ ' XeSqlPkg_hadr_apply_vlfheader ) � �� ! / ; � � 8 D � � 3 A � � ! WU����������������������������������� � hadr_apply_vlfheader EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid file_id )
� % - � �� uint16 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId hadr_database_id
6
�
� ��" - object:guid WmiDataId Extension Guid log_block_id )
� x � � �� uint64 WmiDataId RemainingLength 6
� � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� e m x � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g Z��7 �, XeSqlPkg
C � �� ' _ e � � � � c����� � XeSqlPkg_hadr_scan_state Description Occurs when primary or secondary DBR is changing state Guid {97AC5E41-3A6E-4B2A-96AC-A9EBA66D5BB7} locale MS\0x409 DisplayName hadr_scan_state � X e S q l P k g _ h a d r _ s c a n _ s t a t e Z��7 � , " XeSqlPkg_hadr_scan_state ) � ��
* 6 � � � ' ~ � � y � � � � � � WU�����������������������������������������: � hadr_scan_state EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid availability_group_resource_id
% C
� Q Y
� ��d w � � string WmiDataId StringTermination NullTerminated Format w availability_replica_id
! 6
� � � � �� object:guid WmiDataId Extension Guid current_state P
� � � � ��� o � � � � uint32 WmiDataId XEMapId ValueMap � � � � � � � � 6 7 5 2 0 4 3 1 Values ! ( 4 C R _ l AcceptingLog Count SendingLog SendWatermark Uninitialized WaitForRedo WaitForUndo WaitForWatermark FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId hadr_database_id
6
� P ] � ��h s object:guid WmiDataId Extension Guid RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� S [ f s � �� uint32 WmiDataId Description SequenceNumber success )
� � � � �� sint8 WmiDataId target_state P
� A I � ��T o ] g � � uint32 WmiDataId XEMapId ValueMap � � � � � � � � 6 7 5 2 0 4 3 1 Values � � � � � ( AcceptingLog Count SendingLog SendWatermark Uninitialized WaitForRedo WaitForUndo WaitForWatermark �ark �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C� ' �\>�S}� \ � WDMClassesOfDriver WNFNameSubRundown C:\Windows\system32\kernelbase.dll[MofResourceName] ourceName] ] ceName] yz4�@ � ��� } ͧ�hR � $ X e S q l P k g _ d b _ l o c k _ a c q u i r e d _ f r o m _ c a c h e �U��7 �5 ' . XeSqlPkg_db_lock_acquired_from_cache & ) � �� ( 6 B � � C O � � $ � X i � � WU�������������������������������������b
� db_lock_acquired_from_cache EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� 0 8 � �� uint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId ref_count_total )
� � �� uint32 WmiDataId ref_type P
� � � � ��� � � � uint32 WmiDataId XEMapId ValueMap N � � � � � � � � " & * . 2 6 : > B F J N R V Z ^ b f i m q u x | � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � �
59 16 17 30 25 20 4 28 77 21 45 46 7 34 35 40 43 38 37 47 42 48 41 44 36 39 18 66 24 52 15 12 61 6 56 69 68 8 13 14 55 50 76 62 49 58 33 63 67 27 70 26 73 0 1 22 11 54 71 60 51 75 5 72 19 9 64 23 10 3 74 65 2 29 31 32 57 53 Values N V e r � � � � � � � � & 2 F ^ w � � � � � �
! 7 G _ s � � � � � � � * < M _ y � � � � � � �
.
B
Q
h
x
�
�
�
�
�
�
! 3 A N o � � � � � � edbrtAddBrick edbrtAutoDb edbrtAutoDbLock edbrtAutoEnlistXactForRPC edbrtAutoOpen edbrtBackup edbrtCheckPoint edbrtCloseall edbrtCount edbrtCreateDB edbrtDbccLock edbrtDbccRecover edbrtDBDeAlloc edbrtDbMgr edbrtDbMgrAttachDB edbrtDbMgrChangeDBName edbrtDbMgrChangeDBState edbrtDbMgrCreateFile edbrtDbMgrDetachDB edbrtDbMgrDropDB edbrtDbMgrProcessTskPkt edbrtDbMgrRebuildLog edbrtDbMgrRecollateDB edbrtDbMgrShutdown edbrtDbMgrSnapshot edbrtDbMgrStartTmpDB edbrtDbSetOpts edbrtDeletePartitionDB edbrtDownlevelFsGC edbrtDownlevelFsLogTrunc edbrtExecLevel edbrtFederatedAGEPersist edbrtFileTable edbrtGhost edbrtHadrDbMgr edbrtHkRefreshFile edbrtHkStorageCleanup edbrtHobStats edbrtLckMgr edbrtLoginLogout edbrtLogMgrTest edbrtLogshipping edbrtLookupPageSnapshots edbrtLPM edbrtMeddata edbrtMetadataDiscovery edbrtOpenUnstartedDB edbrtPairing edbrtPartitionDBRecovery edbrtProducer edbrtQdsDb edbrtQNTest edbrtRbpex edbrtReadOnlyXdes edbrtReadWriteXdes edbrtRecovery edbrtReencryptionScan edbrtReplaceDb edbrtReplacePartitionDb edbrtReserveId edbrtRestorFromReplica edbrtRollBackPageServer edbrtRPCRowset edbrtSbsStorage edbrtSecurity edbrtSEDDL edbrtSetPartition edbrtSqlSrcDbMgr edbrtStartup edbrtSystem edbrtTieredStorageMigrationScan edbrtTrackingTableCleanup edbrtTransfer edbrtTransientReplica edbrtVirtFileStats edbrtWorkfile edbrtXdesTsVerMgrUpdate eSSBQueueMonitor ref_type_count )
� E M � �� uint32 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� 2
:
E
R
� �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �U��7 �U XeSqlPkg
C � ��& 3 | � � � � � c����� � XeSqlPkg_db_lock_released_from_cache Description Occurs when a DB lock is released from the XactWorkspace DB lock cache. Guid {cf1638dd-ed1a-4c60-b18a-57740eb29d25} locale MS\0x409 DisplayName db_lock_released_from_cache �$ X e S q l P k g _ d b _ l o c k _ r e l e a s e d _ f r o m _ c a c h e �U��7 �5 ' . XeSqlPkg_db_lock_released_from_cache & ) � �� ( 6 B � � C O � � $ � X i � � WU�������������������������������������b
� db_lock_released_from_cache EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� 0 8 � �� uint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId ref_count_total )
� � �� uint32 WmiDataId ref_type P
� � � � ��� � � � uint32 WmiDataId XEMapId ValueMap N � � � � � � � � " & * . 2 6 : > B F J N R V Z ^ b f i m q u x | � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � �
59 16 17 30 25 20 4 28 77 21 45 46 7 34 35 40 43 38 37 47 42 48 41 44 36 39 18 66 24 52 15 12 61 6 56 69 68 8 13 14 55 50 76 62 49 58 33 63 67 27 70 26 73 0 1 22 11 54 71 60 51 75 5 72 19 9 64 23 10 3 74 65 2 29 31 32 57 53 Values N V e r � � � � � � � � & 2 F ^ w � � � � � �
! 7 G _ s � � � � � � � * < M _ y � � � � � � �
.
B
Q
h
x
�
�
�
�
�
�
! 3 A N o � � � � � � edbrtAddBrick edbrtAutoDb edbrtAutoDbLock edbrtAutoEnlistXactForRPC edbrtAutoOpen edbrtBackup edbrtCheckPoint edbrtCloseall edbrtCount edbrtCreateDB edbrtDbccLock edbrtDbccRecover edbrtDBDeAlloc edbrtDbMgr edbrtDbMgrAttachDB edbrtDbMgrChangeDBName edbrtDbMgrChangeDBState edbrtDbMgrCreateFile edbrtDbMgrDetachDB edbrtDbMgrDropDB edbrtDbMgrProcessTskPkt edbrtDbMgrRebuildLog edbrtDbMgrRecollateDB edbrtDbMgrShutdown edbrtDbMgrSnapshot edbrtDbMgrStartTmpDB edbrtDbSetOpts edbrtDeletePartitionDB edbrtDownlevelFsGC edbrtDownlevelFsLogTrunc edbrtExecLevel edbrtFederatedAGEPersist edbrtFileTable edbrtGhost edbrtHadrDbMgr edbrtHkRefreshFile edbrtHkStorageCleanup edbrtHobStats edbrtLckMgr edbrtLoginLogout edbrtLogMgrTest edbrtLogshipping edbrtLookupPageSnapshots edbrtLPM edbrtMeddata edbrtMetadataDiscovery edbrtOpenUnstartedDB edbrtPairing edbrtPartitionDBRecovery edbrtProducer edbrtQdsDb edbrtQNTest edbrtRbpex edbrtReadOnlyXdes edbrtReadWriteXdes edbrtRecovery edbrtReencryptionScan edbrtReplaceDb edbrtReplacePartitionDb edbrtReserveId edbrtRestorFromReplica edbrtRollBackPageServer edbrtRPCRowset edbrtSbsStorage edbrtSecurity edbrtSEDDL edbrtSetPartition edbrtSqlSrcDbMgr edbrtStartup edbrtSystem edbrtTieredStorageMigrationScan edbrtTrackingTableCleanup edbrtTransfer edbrtTransientReplica edbrtVirtFileStats edbrtWorkfile edbrtXdesTsVerMgrUpdate eSSBQueueMonitor ref_type_count )
� E M � �� uint32 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� 2
:
E
R
� �� uint32 WmiDataId Description SequenceNumber �ber �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ﴹ���
͝��C�y ! ��7��� V � WDMClassesOfDriver TPCBDequeue C:\Windows\system32\kernelbase.dll[MofResourceName] ��� f �W ���=/ R &cM� � �uC~ .��� y��� 6 u<�U� ) �N�� 9 )u��6 � X e S q l P k g �U��7 �> XeSqlPkg
C � �� ) o u � � � � c����� � XeSqlPkg_latch_suspend_end Description Occurs when the executing task is resumed after waiting for a latch. Guid {881a763a-0da3-4b79-a9ed-050f6efb0745} locale MS\0x409 DisplayName latch_suspend_end �# X e S q l P k g _ f l u s h _ f i l e _ b u f f e r s _ e n a b l e d �U��7 �� - XeSqlPkg_flush_file_buffers_enabled % ) � �� ' 5 A � � � � � � W������������������������� � flush_file_buffers_enabled EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid file_name C
� G O � ��Z m } � string WmiDataId StringTermination NullTerminated Format w FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� Y a l y � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �U��7 �* XeSqlPkg
C � �� + Y _ � � � � c����� � XeSqlPkg_make_writes_durable Description Making previous write request ACI(D) durable Guid {A2D2DF09-31B6-4B9D-A803-37715141F072} locale MS\0x409 DisplayName make_writes_durable � X e S q l P k g _ m a k e _ w r i t e s _ d u r a b l e �U��7 �� & XeSqlPkg_make_writes_durable ) � �� . : � � � � � � � W������������������������� � make_writes_durable EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid file_name C
� @ H � ��S f v ~ string WmiDataId StringTermination NullTerminated Format w FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� R Z e r � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �U��7 �� XeSqlPkg
C � �� ! , 2 Z b l y c����� � XeSqlPkg_file_read Description File read Guid {521d231a-85c1-4791-8c35-4c5c0f51d0c0} locale MS\0x409 DisplayName file_read � X e S q l P k g _ f i l e _ r e a d �U��7 �� < XeSqlPkg_file_read ) � �� $ 0 � � 1 > � � � � G S � � � � � � y � � � � WUU���������������������������������������������������������� � file_read EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id $ )
� & � �� uint32 WmiDataId file_handle
4
� � � � ��� �� object WmiDataId Pointer file_id ( )
� � � � �� uint16 WmiDataId filegroup_id
* )
� 4 <
� �� uint16 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId mode P
� ' / � ��: C M _ g uint32 WmiDataId XEMapId ValueMap Y \ 0 1 Values s Contiguous Scatter/Gather offset )
� � � � �� uint64 WmiDataId path 4 C
� 8 @ � ��K ^ n v string WmiDataId StringTermination NullTerminated Format w RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� S [ f s � �� uint32 WmiDataId Description SequenceNumber size , )
� � � � �� uint64 WmiDataId � X e S q l P k g �U��7 � XeSqlPkg
C � �� * > D l t ~ � c����� � XeSqlPkg_file_read_enqueued Description File read enqueued Guid {9785c953-b648-4d45-9ffa-47a99528d93d} locale MS\0x409 DisplayName file_read_enqueued � X e S q l P k g _ f i l e _ r e a d _ e n q u e u e d �U��7 �� < % XeSqlPkg_file_read_enqueued ) � �� - 9 � � : G � � � P \ � � � � � � � � � � WUU���������������������������������������������������������� � file_read_enqueued EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id $ )
� ' / � �� uint32 WmiDataId file_handle
4
� � � � ��� �� object WmiDataId Pointer file_id ( )
� � � � �� uint16 WmiDataId filegroup_id
* )
� = E
� �� uint16 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId mode P
� 0 8 � ��C L V h p uint32 WmiDataId XEMapId ValueMap b e 0 1 Values | � Contiguous Scatter/Gather offset )
� � � � �� uint64 WmiDataId path 4 C
� A I � ��T g w string WmiDataId StringTermination NullTerminated Format w RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� \ d o | � �� uint32 WmiDataId Description SequenceNumber size , )
� � � � �� uint64 WmiDataId � X e S q l P k g �U��7 � XeSqlPkg
C � �� + @ F n v � � c����� � XeSqlPkg_file_read_throttled Description File read throttled Guid {84d65c13-5a5e-4e6a-8717-7e07edf06796} locale MS\0x409 DisplayName file_read_throttled � X e S q l P k g [��7 �c XeSqlPkg
C � ��/ < � � � � � � c����� � XeSqlPkg_column_store_expression_filter_apply Description An expression bitmap filter was applied on a rowgroup column batch. Guid {3a076180-e6a9-4e1f-a173-de7d77876845} locale MS\0x409 DisplayName column_store_expression_filter_apply �ply �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�{ # �\>�S}� X � WDMClassesOfDriver ObObjectEvent C:\Windows\system32\kernelbase.dll[MofResourceName] ll.mui[MofResourceName] �s ,P , �a�| d :����
� �[Fq [ % X e S q l P k g _ x i o _ r e q u e s t _ o p e n e d _ s e n s i t i v e V��7 �� : / XeSqlPkg_xio_request_opened_sensitive ' ) � �� ) 7 C � � H Z � � A M � � C S � � * 8 � � ?
O
WUU��������������������������������������������������������
� xio_request_opened_sensitive EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid file_byte_count ! )
� 5 = � �� uint64 WmiDataId file_byte_offset )
� � � � �� uint64 WmiDataId file_path 2 C
� � �� & 6 > string WmiDataId StringTermination NullTerminated Format w FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� % 2 � �� uint32 WmiDataId Description RemainingLength request_handle
4
� � � � ��� �� object WmiDataId Pointer request_id
. 6
� � �� $ object:guid WmiDataId Extension Guid request_type P
� � � � ��� W � � u } uint8 WmiDataId XEMapId ValueMap # ' + . 1 5 9 < ? C G K O S V Z ^ a d h l o r 20 14 13 6 7 16 10 3 8 17 21 23 18 15 0 11 22 9 4 19 12 1 2 5 Values � � / B W l � � � � � � � � & 8 H c t � � XIOTypeCloseHandles XIOTypeCopyBlob XIOTypeCopySnapshot XIOTypeCreateFile XIOTypeDeleteFile XIOTypeGetBlockList XIOTypeGetPageRange XIOTypeGetProperties XIOTypeLease XIOTypeListBlobs XIOTypeListStatus XIOTypeMax XIOTypePutBlob XIOTypePutBlockList XIOTypeRead XIOTypeSetMetadata XIOTypeSetMetadataNonBlocking XIOTypeSetSeqNum XIOTypeSetSize XIOTypeSetStorageBlobTier XIOTypeSnapshot XIOTypeWrite XIOTypeWriteMultiple XIOTypeZeroFile retry_count ) )
� � � � �� sint32 WmiDataId retry_reason
- P
� l s
� ��~ [ � � � � uint8 WmiDataId XEMapId ValueMap � � � � � � � � � � � 10 6 7 9 8 0 5 4 2 3 1 Values 4 P k � � � � �
"
NoRetry_ConnectionError NoRetry_ExceededMaxRetries NoRetry_InfiniteLeaseLost NoRetry_NonRetriableHTTPError NoRetry_NonRetriableStorageError NotDetermined Retry_Default Retry_InvalidHttpAndAzureErrorCode Retry_LMTConditionNotMet Retry_PreconditionFailed Retry_RetriableStorageError SequenceNumber 6
� �
�
�
�
� �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �V��7 �< XeSqlPkg
C � ��" / g m � � � � c����� � XeSqlPkg_xio_winhttp_call_failed Description Failed immidiately while executing a winhttp function. Guid {8BF42865-62A6-42B6-8995-7304DB4580D8} locale MS\0x409 DisplayName xio_winhttp_call_failed � X e S q l P k g �V��7 �i XeSqlPkg
C � ��, 9 � � � � � � c����� � XeSqlPkg_xio_winhttp_call_failed_sensitive Description Failed immidiately while executing a winhttp function. Contains sensitive data. Guid {4839F385-0DA7-4746-A6CE-205C20121307} locale MS\0x409 DisplayName xio_winhttp_call_failed_sensitive � X e S q l P k g _ x i o _ w i n h t t p _ c a l l _ f a i l e d �V��7 � X * XeSqlPkg_xio_winhttp_call_failed " ) � �� $ 2 > � � C T � � � U ` � � n � � � P a � � - 9 � � � � � � & � � WUUU������������������������������������������������������������������������������������
� xio_winhttp_call_failed EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid callback_status
" )
� 0 8
� �� uint32 WmiDataId current_seq_num C )
� � � � �� uint64 WmiDataId file_byte_count 3 )
� � � � �� uint64 WmiDataId file_byte_offset
+ )
� B J
� �� uint64 WmiDataId file_path O C
� � � � ��� � � � string WmiDataId StringTermination NullTerminated Format w FragmentId 6
� B J U b � �� uint32 WmiDataId Description FragmentId mapped_errorcode )
� � � � �� sint32 WmiDataId RemainingLength 6
� ' 2 ? � �� uint32 WmiDataId Description RemainingLength request_context
4
� � � � ��� �� object WmiDataId Pointer request_handle
4
� � ��$ �� object WmiDataId Pointer request_id
K 6
� } � � ��� � object:guid WmiDataId Extension Guid request_seq_num ; )
� � � � �� uint64 WmiDataId request_type P
� m t � �� W � � L T uint8 WmiDataId XEMapId ValueMap � � � " & * - 1 5 8 ; ? C F I 20 14 13 6 7 16 10 3 8 17 21 23 18 15 0 11 22 9 4 19 12 1 2 5 Values � � � � . C Y g y � � � � � � � : K Y o XIOTypeCloseHandles XIOTypeCopyBlob XIOTypeCopySnapshot XIOTypeCreateFile XIOTypeDeleteFile XIOTypeGetBlockList XIOTypeGetPageRange XIOTypeGetProperties XIOTypeLease XIOTypeListBlobs XIOTypeListStatus XIOTypeMax XIOTypePutBlob XIOTypePutBlockList XIOTypeRead XIOTypeSetMetadata XIOTypeSetMetadataNonBlocking XIOTypeSetSeqNum XIOTypeSetSize XIOTypeSetStorageBlobTier XIOTypeSnapshot XIOTypeWrite XIOTypeWriteMultiple XIOTypeZeroFile retry_count & )
� � � � �� sint32 WmiDataId retry_reason * P
� C
J
� ��U
[ ^
h
�
�
uint8 WmiDataId XEMapId ValueMap �
�
�
�
�
�
�
�
�
�
�
10 6 7 9 8 0 5 4 2 3 1 Values �
' B a � � � � � � NoRetry_ConnectionError NoRetry_ExceededMaxRetries NoRetry_InfiniteLeaseLost NoRetry_NonRetriableHTTPError NoRetry_NonRetriableStorageError NotDetermined Retry_Default Retry_InvalidHttpAndAzureErrorCode Retry_LMTConditionNotMet Retry_PreconditionFailed Retry_RetriableStorageError SequenceNumber 6
� j r } � � �� uint32 WmiDataId Description SequenceNumber winhttp_call_type P
�
� ��
Z &
0
W
_
uint8 WmiDataId XEMapId ValueMap H
K
N
Q
T
4 0 2 1 3 Values w
�
�
�
�
CloseHandle OpenRequest ReadData SendRequest WriteData �ata �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�} % �\>�S}� Z � WDMClassesOfDriver TP_V2_CBEnqueue C:\Windows\system32\kernelbase.dll[MofResourceName] ourceName] eName] e] H��P y �>*� E �#� \ �+��j g
S Q L T r a c e E v e n t 1 2 8 P��7 �A { SQLTraceEvent128 6 � �� % L W f i z 0 < � � m y * 6 � � ( 7 � � c m � � � � O Z � � � � G S
�
�
; F � � ~ � � � h
q
�
�
� � ' UUUUUU���������������������������������������������������������������������������������������������������������������������� � SQLTraceEvent128_TYPE0 Description Audit Database Management Event Type0 EventType EventTypeName 0 ApplicationName P
� � � � � ' � �� string WmiDataId Description ApplicationName format w StringTermination Counted DatabaseID 6
� � � � � � �� sint32 WmiDataId Description DatabaseID DatabaseName H P
� + 8 F N Q d � �� string WmiDataId Description DatabaseName format w StringTermination Counted DBUserName P P
� � � � � ! � �� string WmiDataId Description DBUserName format w StringTermination Counted EventClass 8 6
� z �
� � � �� sint32 WmiDataId Description EventClass EventSequence d 6
� � � �� sint64 WmiDataId Description EventSequence EventSubClass
0 6
� { � � � � �� sint32 WmiDataId Description EventSubClass HostName P
� % 2 < D G Z � �� string WmiDataId Description HostName format w StringTermination Counted IsSystem l 6
� � � � � � �� sint32 WmiDataId Description IsSystem LoginName P
� D L W d o w z � � �� string WmiDataId Description LoginName format w StringTermination Counted LoginSid T P
� � ( 0 3 F � �� string WmiDataId Description LoginSid format c StringTermination Counted NestLevel @ 6
� � � � � � �� sint32 WmiDataId Description NestLevel NTDomainName P
� 5 = H U c k n � � �� string WmiDataId Description NTDomainName format w StringTermination Counted NTUserName P
� � � ( + > � �� string WmiDataId Description NTUserName format w StringTermination Counted ObjectName D P
� � � � � � � � � � �� string WmiDataId Description ObjectName format w StringTermination Counted ObjectType
< 6
� T
\
g
t
� �� sint32 WmiDataId Description ObjectType OwnerName L P
� �
�
�
2 � �� string WmiDataId Description OwnerName format w StringTermination Counted RequestID X 6
� � � � � � �� sint32 WmiDataId Description RequestID SessionLoginName p P
� % - 8 E W _ b u � �� string WmiDataId Description SessionLoginName format w StringTermination Counted SPID $ 6
� � � � � � �� sint32 WmiDataId Description SPID StartTime ( 6
� =
E
P
]
� �� uint64 WmiDataId Description StartTime Success 4 6
� �
�
�
�
� �� sint32 WmiDataId Description Success TextData P
� F N Y f p x { � � �� string WmiDataId Description TextData format w StringTermination Counted TransactionID 6
� � � �
� �� sint64 WmiDataId Description TransactionID XactSequence \ 6
� k s ~ � � �� sint64 WmiDataId Description XactSequence � M S S Q L S E R V E R T r a c e P��7 �
MSSQLSERVERTrace 6 � �� G M s � � � SQLTraceEvent129 Description Audit Database Object Management Event Guid 84e993e6-0081-4d70-97ef-3824ed2c4e93 DisplayName Audit Database Object Management Event ip � X e S q l P k g 0Q��7 �4 XeSqlPkg
C � ��* 7 W ] � � � � c����� � XeSqlPkg_app_domain_ring_buffer_recorded Description AppDomain ring buffer recorded Guid {F498523F-4677-4C4F-8608-133DAD124CA8} locale MS\0x409 DisplayName app_domain_ring_buffer_recorded �( X e S q l P k g _ a p p _ d o m a i n _ r i n g _ b u f f e r _ r e c o r d e d 1Q��7 �� U 2 XeSqlPkg_app_domain_ring_buffer_recorded * ) � ��! , : B � � � � � � � � � � � Z ^ � � � R c � � \ c � a m � � O ` WUUU��������������������������������������������������������������������������������� � app_domain_ring_buffer_recorded EventType EventVersion action < C
� � � � ��� � � � string WmiDataId StringTermination NullTerminated Format w ActivityId
N
� < I T a m �� � ��y � object:guid WmiDataId Description ActivityId ActivityID Extension Guid app_domain_address
4
� � � � ��� �� object WmiDataId Pointer call_stack
L C
� Y a � ��l w � � object WmiDataId Extension Variant XEVLD callstack database_id $ )
� � � � �� uint32 WmiDataId doom_reason H C
� G O � ��Z m } � string WmiDataId StringTermination NullTerminated Format w FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId generation
, )
� G O
� �� sint32 WmiDataId id )
� � � � �� uint32 WmiDataId owner_id ( )
� � � � �� uint32 WmiDataId references 0 )
� ? G � �� uint32 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� , 4 ? L � �� uint32 WmiDataId Description SequenceNumber state D C
� � � � ��� � � � string WmiDataId StringTermination NullTerminated Format w task_address
8 4
� E M
� ��X �� object WmiDataId Pointer timestamp0 )
� � � � �� uint64 WmiDataId type @ C
� � ��! 4 D L string WmiDataId StringTermination NullTerminated Format w weak_references 4 )
� � � � �� uint32 WmiDataId �aId �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�� 1 �\>�S}� f � WDMClassesOfDriver SystemConfig_Virtualization C:\Windows\system32\kernelbase.dll[MofResourceName] ] me] �,P W��T 3 �Næ� � Ylg�� ] S Q L T r a c e E v e n t 1 7 0 nP��7 �� � SQLTraceEvent170 6 � �� % I T c f w - 9 � � p | � � � � j v � � h w � � � � & � � � � � � �
�
D P � � { � �
s
�
< B � � & / � � c s ( 2 � � c q UUUUUUU���������������������������������������������������������������������������������������������������������������������������������������������� � SQLTraceEvent170_TYPE0 Description Audit Server Scope GDR Event Type0 EventType EventTypeName 0 ApplicationName $ P
� � � � � $ � �� string WmiDataId Description ApplicationName format w StringTermination Counted BinaryData P
� � � � � � � � � � �� string WmiDataId Description BinaryData format c StringTermination Counted ClientProcessID 6
� ? G R _ � �� sint32 WmiDataId Description ClientProcessID DatabaseID 6
� � � � � � �� sint32 WmiDataId Description DatabaseID DatabaseName X P
� X ` k x � � � � � �� string WmiDataId Description DatabaseName format w StringTermination Counted DBUserName ` P
� * 7 C K N a � �� string WmiDataId Description DBUserName format w StringTermination Counted EventClass H 6
� � � � � � �� sint32 WmiDataId Description EventClass EventSequence | 6
� 9 A L Y � �� sint64 WmiDataId Description EventSequence EventSubClass
@ 6
� � � � � � �� sint32 WmiDataId Description EventSubClass HostName P
� R Z e r | � � � � �� string WmiDataId Description HostName format w StringTermination Counted IsSystem � 6
� � � � �� sint32 WmiDataId Description IsSystem LoginName ( P
� � �
� � � � � � � �� string WmiDataId Description LoginName format w StringTermination Counted LoginSid d P
� > F Q ^ h p s � � �� string WmiDataId Description LoginSid format c StringTermination Counted NestLevel P 6
� � � � � � �� sint32 WmiDataId Description NestLevel NTDomainName P
� u } � � � � � � � �� string WmiDataId Description NTDomainName format w StringTermination Counted NTUserName P
� 4
<
G
T
`
h
k
~
� �� string WmiDataId Description NTUserName format w StringTermination Counted ObjectName T P
� �
�
% ( ; � �� string WmiDataId Description ObjectName format w StringTermination Counted ObjectType L 6
� � � � � � �� sint32 WmiDataId Description ObjectType OwnerName \ P
� ) 1 < I T \ _ r � �� string WmiDataId Description OwnerName format w StringTermination Counted Permissions 8 6
� � �
� � � �� sint64 WmiDataId Description Permissions RequestID p 6
� H
P
[
h
� �� sint32 WmiDataId Description RequestID SessionLoginName � P
� �
�
�
3 � �� string WmiDataId Description SessionLoginName format w StringTermination Counted SPID
, 6
� � � � � � �� sint32 WmiDataId Description SPID StartTime 0 6
� � � �� uint64 WmiDataId Description StartTime Success D 6
� s { � � � �� sint32 WmiDataId Description Success TargetLoginName h P
� + < D G Z � �� string WmiDataId Description TargetLoginName format w StringTermination Counted TargetLoginSid l P
� � � � � � �� string WmiDataId Description TargetLoginSid format c StringTermination Counted TextData P
� � � � � � � � � � �� string WmiDataId Description TextData format w StringTermination Counted TransactionID 6
� 4 < G T � �� sint64 WmiDataId Description TransactionID XactSequence t 6
� � � � � � �� sint64 WmiDataId Description XactSequence � M S S Q L S E R V E R T r a c e oP��7 �� MSSQLSERVERTrace 6 � �� > D j w � � SQLTraceEvent171 Description Audit Server Object GDR Event Guid 84e993e6-00ab-4d70-97ef-3824ed2c4e93 DisplayName Audit Server Object GDR Event 71 �& X e S q l P k g _ b r o k e r _ t r a n s m i s s i o n _ t i m e r _ s e t [Q��7 �� 8 0 XeSqlPkg_broker_transmission_timer_set ( ) � �� * 8 D � � @ M � � b n � � 7 H � � A H H S WUU������������������������������������������������������ � broker_transmission_timer_set EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid asb_id )
� - 5 � �� uint64 WmiDataId database_id )
� � � � �� uint32 WmiDataId dialog_id
1 6
� � � � ��� object:guid WmiDataId Extension Guid expires
- )
� O W
� �� uint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId initiator_flag )
� % , � �� sint8 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� $ 1 � �� uint32 WmiDataId Description SequenceNumber timer ) P
� � � � ��� : � � � � sint32 WmiDataId XEMapId ValueMap � � � � 2 1 0 3 Values 0 Delivery OutgoingAck OutOfOrderWatch x_NumTransmissionTimer unique_id ! )
� � � � �� uint64 WmiDataId � X e S q l P k g \Q��7 �5 XeSqlPkg
C � ��* 7 X ^ � � � � c����� � XeSqlPkg_broker_transmission_timer_reset Description Broker transmission timer reset Guid {723A69C4-BA2A-4d3a-918B-C197FE8CCF8D} locale MS\0x409 DisplayName broker_transmission_timer_reset �set �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �b��5�
͝��C�v =T^Y�5� S � WDMClassesOfDriver Debugger C:\Windows\system32\kernelbase.dll[MofResourceName] Name]
X�� � l 31 � � � ����� � o�3�� Z Mp��� � ��zJa � �� D � - X e S q l P k g _ d w _ c a t a l o g _ c o m m u n i c a t i o n _ h u b _ f a i l u r e I[��7 �/ 7 XeSqlPkg_dw_catalog_communication_hub_failure / ) � ��& 1 ? K � K W � � b s � � W����������������������������l � dw_catalog_communication_hub_failure EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid error_code )
� 8 @ � �� uint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId message C
� ! ) � ��4 G W _ string WmiDataId StringTermination NullTerminated Format w RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� < D O \ � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g J[��7 �� XeSqlPkg
C � ��@ M � � � � � � c���� � XeSqlPkg_columnstore_object_read_from_azure_block_blob_success Description ColumnStore object was successfully read from Azure Block Blobs Guid {76F1A0FE-4820-499F-9F66-0758D69D2A94} locale MS\0x409 DisplayName columnstore_object_read_from_azure_block_blob_success �> X e S q l P k g _ c o l u m n s t o r e _ o b j e c t _ r e a d _ f r o m _ a z u r e _ b l o c k _ b l o b _ s u c c e s s K[��7 �� O H XeSqlPkg_columnstore_object_read_from_azure_block_blob_success @ ) � ��7 B
P \ | � � � ) 0 z � � � M V � � � L Y ? P � � WUU����������������������������������������������������������������������������I � columnstore_object_read_from_azure_block_blob_success EventType EventVersion ActivityId
N
� � � � � � �� � ��� object:guid WmiDataId Description ActivityId ActivityID Extension Guid blob_id
G 6
� S `
� ��k v object:guid WmiDataId Extension Guid column_id & )
� � � � �� uint64 WmiDataId container_id > )
� � �� uint64 WmiDataId db_id )
� g o � �� uint16 WmiDataId duration_ms
6 )
� � �
� �� uint64 WmiDataId FragmentId 6
� ! ) 4 A � �� uint32 WmiDataId Description FragmentId hobt_id )
� � � � �� uint64 WmiDataId object_id )
� � � � �� uint64 WmiDataId object_size . )
� 9 A � �� uint64 WmiDataId object_type F P
� � � � ��� e � � uint8 WmiDataId XEMapId ValueMap 1 5 6 7 8 2 4 0 Values D T z � � � 4 COLUMN_SEGMENT COLUMN_SEGMENT_BULKINSERT_DICTIONARY COLUMN_SEGMENT_DELETE_BITMAP COLUMN_SEGMENT_EXTENDED_STRING_PAGE_RANGE COLUMN_SEGMENT_GLOBAL_STRING_DICTIONARY COLUMN_SEGMENT_PRIMARY_DICTIONARY COLUMN_SEGMENT_SECONDARY_DICTIONARY UNDEFINED RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� ! , 9 � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g L[��7 �d XeSqlPkg
C � ��/ < � � � � � � c����� � XeSqlPkg_columnstore_object_write_to_sbs_fail Description Write columnstore object to unaligned SBS Cache DB was unsuccessful. Guid {7FABA609-36BB-431D-A474-FE36FDBA9423} locale MS\0x409 DisplayName columnstore_object_write_to_sbs_fail �- X e S q l P k g _ c o l u m n s t o r e _ o b j e c t _ w r i t e _ t o _ s b s _ f a i l M[��7 �� / 7 XeSqlPkg_columnstore_object_write_to_sbs_fail / ) � ��& 1 ? K � � k w � � = J � � * � � WU��������������������������������������������� � columnstore_object_write_to_sbs_fail EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid blob_id
( 6
� B O � ��Z e object:guid WmiDataId Extension Guid error_code $ )
� � � � �� uint32 WmiDataId FragmentId 6
� $ 1 � �� uint32 WmiDataId Description FragmentId object_size )
� � � � �� uint64 WmiDataId RemainingLength 6
� � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� n v � � � �� uint32 WmiDataId Description SequenceNumber time_read_from_cache_in_us )
� � � � �� uint64 WmiDataId � X e S q l P k g N[��7 �_ XeSqlPkg
C � ��/ < } � � � � � c����� � XeSqlPkg_columnstore_object_write_to_sbs_skip Description Write columnstore object to unaligned SBS Cache DB was skipped. Guid {892C94A2-11FA-4829-83AC-F12F4A5E53CF} locale MS\0x409 DisplayName columnstore_object_write_to_sbs_skip �- X e S q l P k g _ c o l u m n s t o r e _ o b j e c t _ w r i t e _ t o _ s b s _ s k i p O[��7 �q & 7 XeSqlPkg_columnstore_object_write_to_sbs_skip / ) � ��& 1 ? K � � k w � � = J � � * WU������������������������������������� � columnstore_object_write_to_sbs_skip EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid blob_id
6
� B O � ��Z e object:guid WmiDataId Extension Guid error_code )
� � � � �� uint32 WmiDataId FragmentId 6
� $ 1 � �� uint32 WmiDataId Description FragmentId object_size )
� � � � �� uint64 WmiDataId RemainingLength 6
� � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� n v � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g P[��7 �h XeSqlPkg
C � ��2 ? � � � � � � c����� � XeSqlPkg_columnstore_object_write_to_sbs_success Description Write columnstore object to unaligned SBS Cache DB was successful. Guid {d97962b6-423e-42cb-a6f0-f49cdb278c68} locale MS\0x409 DisplayName columnstore_object_write_to_sbs_success �ess �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 *pl\}�
͝��C�� 1 �\>�S}� f � WDMClassesOfDriver MSVerifierIrpLogInformation C:\Windows\system32\kernelbase.dll[MofResourceName] e] ���p H `��� v �$�. � �؝� � ��v� x �{m�O T X e S q l P k g _ v d w _ b a c k e n d _ e x e c u t i o n 1U��7 �� � ( XeSqlPkg_vdw_backend_execution ) � �� " 0 < � � : D � � : R � � � ? Y � � � D _ � � @ J � � 9 I � � W e � � +
;
�
�
�
�
> U � � � ] n � � 7
G
�
�
+ u � � � j ~ WUUUUUUU����������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������� � vdw_backend_execution EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid clr_time
< )
� ' /
� �� uint64 WmiDataId cpu_time )
� { � � �� uint64 WmiDataId distributed_execution_id � C
� � � �� / 7 string WmiDataId StringTermination NullTerminated Format w distributed_query_hash � C
� � � � ��� � � � string WmiDataId StringTermination NullTerminated Format w distributed_query_operator_id � C
� T \ � ��g z � � string WmiDataId StringTermination NullTerminated Format w distributed_request_id � C
� � � �� $ 4 < string WmiDataId StringTermination NullTerminated Format w distributed_scheduler_id � C
� � � � ��� � � � string WmiDataId StringTermination NullTerminated Format w distributed_statement_id � C
� V ^ � ��i | � � string WmiDataId StringTermination NullTerminated Format w distributed_submission_id � C
� � �� ) 9 A string WmiDataId StringTermination NullTerminated Format w distributed_task_group_id � C
� � � � ��� � � � string WmiDataId StringTermination NullTerminated Format w dop D )
� - 5 � �� uint64 WmiDataId duration )
� � � � �� uint64 WmiDataId exception_message � C
� � � �� . 6 string WmiDataId StringTermination NullTerminated Format w exception_type � C
� � � � ��� � � � string WmiDataId StringTermination NullTerminated Format w FragmentId 6
� + 3 > K � �� uint32 WmiDataId Description FragmentId is_recompile t )
� � � � �� sint8 WmiDataId local_query_hash
� 6
�
� ��
"
object WmiDataId Extension Variant log_bytes_used \ )
� r
z
� �� uint64 WmiDataId logical_io_reads $ )
� �
�
� �� uint64 WmiDataId logical_io_writes , )
� + 3 � �� uint64 WmiDataId num_physical_io_reads d )
� � � � �� uint64 WmiDataId physical_io_reads 4 )
� � � � �� uint64 WmiDataId query_max_used_memory L )
� J R � �� uint64 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength rowcount
T )
� $
,
� �� uint64 WmiDataId SequenceNumber 6
� �
�
�
�
� �� uint32 WmiDataId Description SequenceNumber sql_error_number u )
� � �� uint64 WmiDataId sql_error_severity � )
� b j � �� uint64 WmiDataId sql_error_state } )
� � � � �� uint64 WmiDataId status � C
� ) 1 � ��< O _ g string WmiDataId StringTermination NullTerminated Format w temp_db_space_used l )
� � � � �� uint64 WmiDataId � X e S q l P k g 2U��7 �N XeSqlPkg
C � �� ( � � � � � � c����� � XeSqlPkg_vdw_query_phy_op Description Optimizer fires this event when PhyOp tree for the query on VDW frontend is available. Guid {2f5c1a47-ead7-2895-a3a7-3a6ca0130338} locale MS\0x409 DisplayName vdw_query_phy_op � X e S q l P k g _ v d w _ q u e r y _ p h y _ o p 3U��7 �� # XeSqlPkg_vdw_query_phy_op ) � �� + 7 � � ] i � � � W������������������������� � vdw_query_phy_op EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid FragmentId 6
� 1 9 D Q � �� uint32 WmiDataId Description FragmentId phy_op_xml C
� � � � ��� � � � string WmiDataId StringTermination NullTerminated Format w RemainingLength 6
� P X c p � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g 4U��7 �� XeSqlPkg
C � ��' 4 � � � � � c���� � XeSqlPkg_login_request_to_page_server Description Fires when login request is routed to a page server instead of compute. This is fired only for unexpected frontend connections. Guid {f4ce6d74-9c1b-4f4d-a94a-3b1fa0eab402} locale MS\0x409 DisplayName login_request_to_page_server �% X e S q l P k g _ l o g i n _ r e q u e s t _ t o _ p a g e _ s e r v e r 5U��7 � / XeSqlPkg_login_request_to_page_server ' ) � �� ) 7 C � � i z � � W���������������������s � login_request_to_page_server EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid FragmentId 6
� = E P ] � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� C K V c � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g *X��7 �, XeSqlPkg
C � �� + [ a � � � � c����� � XeSqlPkg_calculate_dop_begin Description Degree of Parallelism (DOP) calculation begins Guid {81d5eb0b-acbd-4b23-9abe-bc93d6e3d0f4} locale MS\0x409 DisplayName calculate_dop_begin �gin �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�� * �\>�S}� _ � WDMClassesOfDriver ObHandleRundownEvent C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] ication_auditing_traffic � �J�@p � <�>�j V }B� �L�� � 8�cA�
� ��+�q X e S q l P k g _ d i s k _ l o g _ r e a d _ i g n o r e �[��7 �� , ' XeSqlPkg_disk_log_read_ignore ) � �� ! / ; � � < H � � % o � � y � WU������������������������������������������� � disk_log_read_ignore EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� ) 1 � �� uint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId is_read_ahead )
� � � �� sint8 WmiDataId private_consumer_id ! )
� \ d � �� uint64 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� I Q \ i � �� uint32 WmiDataId Description SequenceNumber start_log_block_id )
� � � � �� uint64 WmiDataId � X e S q l P k g �[��7 �. XeSqlPkg
C � �� ) _ e � � � � c����� � XeSqlPkg_log_consumer_life Description Occurs when a log consumer is initialized or closed. Guid {c518c77a-de42-40f6-b5e8-f34447709152} locale MS\0x409 DisplayName log_consumer_life � X e S q l P k g _ l o g _ c o n s u m e r _ l i f e �[��7 �� ( $ XeSqlPkg_log_consumer_life ) � �� , 8 � � 9 H � � 1 = � � � � WU��������������������������������������
� log_consumer_life EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid consumer_id )
� & . � �� uint64 WmiDataId consumer_name ! C
� � � � ��� � � � string WmiDataId StringTermination NullTerminated Format w database_id )
� & � �� uint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId is_alive )
� � � � �� sint8 WmiDataId RemainingLength 6
� U ] h u � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �[��7 �x XeSqlPkg
C � �� # � � � � � � c���� � XeSqlPkg_lock_cancel Description Occurs when the request for a lock was canceled, such as when the query requesting the lock was canceled. Use this event to monitor locks. Guid {8c797226-12f0-4dff-8f4a-acc719a619a0} locale MS\0x409 DisplayName lock_cancel � X e S q l P k g _ l o c k _ c a n c e l �[��7 �� f XeSqlPkg_lock_cancel ) � ��
& 2 � � < I � � 4 > � � a s � � 3 9 A L � � 0 � � � Q ] � � O
^
q � �
WUUUU�������������������������������������������������������������������������������������������������O
� lock_cancel EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid associated_object_id H )
� ) 1 � �� uint64 WmiDataId database_id ( )
� � � � �� uint32 WmiDataId database_name \ C
� � � � �� ) 1 string WmiDataId StringTermination NullTerminated Format w duration P )
� u } � �� uint64 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId lockspace_nest_id 4 )
� N V � �� uint32 WmiDataId lockspace_sub_id 0 )
� � � � �� uint32 WmiDataId lockspace_workspace_id
, 4
�
� ��* �� object WmiDataId Pointer mode P
� � � � ��� B � � g o uint32 WmiDataId XEMapId ValueMap # & * - 1 5 9 = A E I M P S V Y ] ` d 12 6 7 8 21 0 15 16 17 18 13 14 19 20 3 2 1 9 10 4 11 5 Values � � � � � � � � � � % , 1 6 9 > BU IS IU IX LAST_MODE NL RI_NL RI_S RI_U RI_X RS_S RS_U RX_S RX_U S SCH_M SCH_S SIU SIX U UIX X object_id D )
� � � � �� sint32 WmiDataId owner_type P
� � �� > & b j uint32 WmiDataId XEMapId ValueMap J M P S V Y \ _ 2 5 8 6 7 3 4 1 Values � � � � � � � Cursor ExclusiveXactWorkspace LastLockInfoOwner LockConflictNotificationObject LockTableIterator Session SharedXactWorkspace Transaction RemainingLength 6
� t | � � � �� uint32 WmiDataId Description RemainingLength resource_0
8 )
� � �
� �� uint32 WmiDataId resource_1 < )
� > F � �� uint32 WmiDataId resource_2 @ )
� � � � �� uint32 WmiDataId resource_description X C
�
� ��!
4
D
L
string WmiDataId StringTermination NullTerminated Format w resource_type P
� �
�
� ���
= �
�
l t uint32 WmiDataId XEMapId ValueMap . 2 6 9 < ? C F J N Q T X [ ^ b e h 13 10 2 8 3 12 7 17 11 1 5 14 6 9 15 0 4 16 Values � � � � � � � ) 1 6 < A K b k ALLOCATION_UNIT APPLICATION DATABASE EXTENT FILE HOBT KEY LAST_RESOURCE METADATA NULL_RESOURCE OBJECT OIB PAGE RID ROWGROUP UNKNOWN_LOCK_RESOURCE UNUSED1 XACT SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber transaction_id )
� <
D
� �� sint64 WmiDataId � X e S q l P k g �[��7 �� XeSqlPkg
C � �� $ " J R \ i c����w � XeSqlPkg_lock_timeout Description Occurs when a request for a lock times out because another transaction holds a blocking lock on the required resource. The time-out duration is determined by the @@LOCK_TIMEOUT system function. Use this event to help troubleshoot blocking issues. Guid {f7927951-e117-4b1a-a741-c1d047b76912} locale MS\0x409 DisplayName lock_timeout �out �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�~ & �\>�S}� [ � WDMClassesOfDriver MSKernelPpmClass C:\Windows\system32\kernelbase.dll[MofResourceName] mui[MofResourceName] ale MS\0x409 DisplayName metadata_agent_catalog_updated � ��C�� X �q3 � O�*� � i�}� � Bs+Mo � q;��G z iMI�
� �$ųI � W��5 � ���� I I S _ T r a c e �5h�b �. IIS_Trace [ � ��
/ 5 ] k x ~ ��� � o��������� � ANCM_Events Description ANCM runtime events Guid {82ADEAD7-12B2-4781-BDCA-5A4B6C757191} EventVersion DisplayName ANCM EventANCMRuntime locale MS\0x409 � A N C M _ E v e n t s �5h�b �� ANCM_Events
C � �� 6 A M \ | � Q \ _���������������� � ANCMAppStart Description Start application success EventType EventLevel EventTypeName ANCM_START_APPLICATION_SUCCESS AppDescription P
� � � �
# 6 F N � �� string WmiDataId Description Application Description StringTermination NullTerminated format w ContextId
N
� � � � � � � � �� � �� object WmiDataId Description Context ID extension Guid ActivityID � A N C M _ E v e n t s �5h�b �� ANCM_Events
C � �� 9 D P _ | � , @ _���������������� � ANCMAppStartFail Description Start application failed EventType EventLevel EventTypeName ANCM_START_APPLICATION_FAIL ContextId
N
� � � � �� � �� object WmiDataId Description Context ID extension Guid ActivityID FailureDescription P
� � � � � � � � �� string WmiDataId Description Application Start Failure Description StringTermination NullTerminated format w � A N C M _ E v e n t s �5h�b ��
ANCM_Events
C � �� 9 D P _ { � _������������+ � ANCMForwardStart Description Start forwarding request EventType EventLevel EventTypeName ANCM_REQUEST_FORWARD_START ContextId
N
� � � � �� � �� object WmiDataId Description Context ID extension Guid ActivityID � A N C M _ E v e n t s �5h�b ��
ANCM_Events
C � �� 8 C O ^ x � _������������( � ANCMForwardEnd Description Finish forwarding request EventType EventLevel EventTypeName ANCM_REQUEST_FORWARD_END ContextId
N
� � � � � �� � �� object WmiDataId Description Context ID extension Guid ActivityID � A N C M _ E v e n t s �5h�b �L ANCM_Events
C � �� : E Q ` { � + 6 _����������������� � ANCMForwardFail Description Forwarding request failure EventType EventLevel EventTypeName ANCM_REQUEST_FORWARD_FAIL ContextId
N
� � � � �� � �� object WmiDataId Description Context ID extension Guid ActivityID ErrorCode C
� � � � � � � � �� uint32 WmiDataId Description Error code format x � A N C M _ E v e n t s �5h�b �Z ANCM_Events
C � �� " C N Z i � � 0 @ _����������������� � ANCMWinHttpCallBack Description Receiving callback from WinHttp EventType EventLevel EventTypeName ANCM_WINHTTP_CALLBACK ContextId
N
� � � � $ �� � �� object WmiDataId Description Context ID extension Guid ActivityID InternetStatus C
� � � � � � � � �� uint32 WmiDataId Description InternetStatus format x � A N C M _ E v e n t s �5h�b ��
ANCM_Events
C � �� C N Z i � � _������������< � ANCMExecuteStart Description Starting inprocess execute request EventType EventLevel EventTypeName ANCM_INPROC_EXECUTE_REQUEST_START ContextId
N
� � � * 0 �� � �� object WmiDataId Description Context ID extension Guid ActivityID � A N C M _ E v e n t s �5h�b �k ANCM_Events
C � �� ? J V e � � = L _����������������� � ANCMExecuteEnd Description Ending inprocess execute request EventType EventLevel EventTypeName ANCM_INPROC_EXECUTE_REQUEST_COMPLETION ContextId
N
� � � + 1 �� � �� object WmiDataId Description Context ID extension Guid ActivityID requestStatus C
� � � � � � � � �� uint32 WmiDataId Description Notification status format d �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 0pl\}�
͝��C�� * ��
�S}� i � WDMClassesOfDriver MSPower_DeviceEnable C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] rceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 0pl\}�
͝��C�� * ��
�S}� i � WDMClassesOfDriver MSPower_DeviceEnable C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] eName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 0pl\}�
͝��C�� * ��
�S}� i � WDMClassesOfDriver MSPower_DeviceEnable C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] eName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 0pl\}�
͝��C�� * ��
�S}� i � WDMClassesOfDriver MSPower_DeviceEnable C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] ame] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 0pl\}�
͝��C�� * ��
�S}� i � WDMClassesOfDriver MSPower_DeviceEnable C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] urceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 0pl\}�
͝��C�� * ��
�S}� i � WDMClassesOfDriver MSPower_DeviceEnable C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] ame] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 0pl\}�
͝��C�� * ��
�S}� i � WDMClassesOfDriver MSPower_DeviceEnable C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 0pl\}�
͝��C�� * ��
�S}� i � WDMClassesOfDriver MSPower_DeviceEnable C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] ame] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 0pl\}�
͝��C�� * ��
�S}� i � WDMClassesOfDriver MSPower_DeviceEnable C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] esourceName] ase.dll.mui[MofResourceName] ourceName] s\system32\kernelbase.dll[MofResourceName] 5 F 4 q�jj��
͝��C�� 3���� ] � WDMClassesOfDriver Debugger C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] esourceName] (o$P l �嚼 r =�Y. � &w � & X e S q l P k g _ q u e r y _ m e m o r y _ g r a n t _ w a i t _ b e g i n 3\��7 � � 0 XeSqlPkg_query_memory_grant_wait_begin ( ) � �� * 8 D � N Z � � / y � � � / K � � _ k � � # m � � � U j � � " � �
d � � , A � � � � WUUUUU������������������������������������������������������������������������������������������������������������������������������������������������<
� query_memory_grant_wait_begin EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid adjusted_timeout_sec )
� ; C � �� uint64 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId group_id ] )
� � �� uint32 WmiDataId ideal_memory_kb L )
� f n � �� uint64 WmiDataId is_big_query \ )
� � � � �� sint8 WmiDataId is_columnstore_build } )
� $ � �� sint8 WmiDataId is_columnstore_bulk_insert ~ )
� � � � �� sint8 WmiDataId plan_handle
� 6
� � � � ��� object WmiDataId Extension Variant pool_id a )
� L T � �� uint32 WmiDataId query_hash )
� � � � �� uint64 WmiDataId query_hash_signed )
� � � �� sint64 WmiDataId query_plan_hash $ )
� Z b � �� uint64 WmiDataId query_plan_hash_signed , )
� � � � �� sint64 WmiDataId RemainingLength 6
� $ , 7 D � �� uint32 WmiDataId Description RemainingLength requested_memory_kb
< )
� � �
� �� uint64 WmiDataId required_memory_kb D )
� � � �� uint64 WmiDataId SequenceNumber 6
� f n y � � �� uint32 WmiDataId Description SequenceNumber sql_handle
� 6
� � � � ��� object WmiDataId Extension Variant timeout_sec
T )
� Q Y
� �� uint64 WmiDataId total_available_memory_kb m )
� � � � �� uint64 WmiDataId total_granted_memory_kb u )
� ! � �� uint64 WmiDataId total_grantee_count i )
� x � � �� uint32 WmiDataId total_waiter_count e )
� � � � �� uint32 WmiDataId wait_id 4 )
� )
1
� �� uint64 WmiDataId � X e S q l P k g 4\��7 �J XeSqlPkg
C � ��& 3 q w � � � � c����� � XeSqlPkg_query_memory_grant_wait_end Description Occurs when a query is exiting a wait queue for memory grant Guid {eca5cebf-5756-4e90-a721-83c1e785a8fd} locale MS\0x409 DisplayName query_memory_grant_wait_end �$ X e S q l P k g _ q u e r y _ m e m o r y _ g r a n t _ w a i t _ e n d 5\��7 �x � . XeSqlPkg_query_memory_grant_wait_end & ) � �� ( 6 B � L X � � Y l � �
e s � � 7 � � � K W � � � Y q � � A V � � � � � �
P
k
�
�
- w � � � ( 7 WUUUUUU��������������������������������������������������������������������������������������������������������������������������������������������������������������������� � query_memory_grant_wait_end EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid adjusted_timeout_sec � )
� 9 A � �� uint64 WmiDataId exit_cause e P
� � � � ��� � � � uint32 WmiDataId XEMapId ValueMap � � 2 3 5 6 0 4 1 Values 9 O d x � � � QUERY_EXIT_CANCELLED QUERY_EXIT_DEADLOCK QUERY_EXIT_GRANTED QUERY_EXIT_GRANTED_REQUIRED_ONLY QUERY_EXIT_NOT_TRIED QUERY_EXIT_OTHER_ERROR QUERY_EXIT_TIMEDOUT FragmentId 6
� - 5 @ M � �� uint32 WmiDataId Description FragmentId granted_memory_kb i )
� � � � �� uint64 WmiDataId group_id q )
� � � � �� uint32 WmiDataId ideal_memory_kb L )
� R Z � �� uint64 WmiDataId is_big_query \ )
� � � � �� sint8 WmiDataId is_columnstore_build � )
� � �� sint8 WmiDataId is_columnstore_bulk_insert � )
� n u � �� sint8 WmiDataId plan_handle
� 6
� � � � ��� � object WmiDataId Extension Variant pool_id u )
� 8 @ � �� uint32 WmiDataId query_hash )
� � � � �� uint64 WmiDataId query_hash_signed )
� � � � �� sint64 WmiDataId query_plan_hash $ )
� F N � �� uint64 WmiDataId query_plan_hash_signed , )
� � � � �� sint64 WmiDataId RemainingLength 6
� # 0 � �� uint32 WmiDataId Description RemainingLength requested_memory_kb
< )
� � �
� �� uint64 WmiDataId required_memory_kb D )
� � � � �� uint64 WmiDataId SequenceNumber 6
� R Z e r � �� uint32 WmiDataId Description SequenceNumber sql_handle
� 6
� � � � ��� � object WmiDataId Extension Variant timeout_sec
T )
� =
E
� �� uint64 WmiDataId total_available_memory_kb � )
� �
�
� �� uint64 WmiDataId total_granted_memory_kb � )
�
� �� uint64 WmiDataId total_grantee_count } )
� d l � �� uint32 WmiDataId total_waiter_count y )
� � � � �� uint32 WmiDataId wait_id 4 )
� � �� uint64 WmiDataId wait_time_sec ] )
� n v � �� uint64 WmiDataId � X e S q l P k g 6\��7 �o XeSqlPkg
C � ��1 > � � � � � � c���� � XeSqlPkg_query_memory_grant_resource_semaphores Description Occurs at every 5 minute intervals for each resource governor resource pool Guid {f3e7f7ff-53c0-472c-9892-84d6b9b64b3f} locale MS\0x409 DisplayName query_memory_grant_resource_semaphores �res �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�� 1 �\>�S}� f � WDMClassesOfDriver KernelPerfStateDomainChange C:\Windows\system32\kernelbase.dll[MofResourceName] ourceName] � � g�� �d�� � $]~� C ��6 � = =re�6 � ��=� v g��U � 4F��F x � z �`��8 t <�db� � ���~� � 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 =�4 �
͝��C�� * M�� D� a � WDMClassesOfDriver MS_SystemInformation C:\Windows\System32\drivers\mssmbios.sys[MofResource] I I S _ T r a n s �=�4 �� IIS_Trans ) � �� 9 ( 4 ? � � D Q � � _����������������������� � W3GeneralSetResponseTrailer EventType EventLevel ContextId
A
� � � � � � �� � �� object WmiDataId extension Guid ActivityID HeaderName 6
� ! 4 � �� string WmiDataId StringTermination NullTerminated HeaderValue 6
� � � � � � �� string WmiDataId StringTermination NullTerminated Replace )
� � �� boolean WmiDataId � I I S _ T r a c e �=�4 � IIS_Trace N � �� H V c v ��� � o��������� � IIS_Authentication_Trans Guid {c33bbe8f-985b-4080-81e6-005f1a06b9e2} EventVersion DisplayName IISAuthentication EventHttpRequest locale MS\0x409 � I I S _ A u t h e n t i c a t i o n _ T r a n s �=�4 �� " IIS_Authentication_Trans ) � ��
$ 7 � � _����������������t � W3AuthStart EventType EventLevel AuthTypeSupported ]
� � � � � @ H � � � � � �� uint32 WmiDataId DefineValues � �
, MD_AUTH_ANONYMOUS MD_AUTH_BASIC MD_AUTH_NT MD_AUTH_MD5 MD_AUTH_PASSPORT MD_ACCESS_MAP_CERT Values d o v z � � Anonymous Basic NT Digest Passport MapCliCert ValueMap � � � � � � 0x1 0x2 0x4 0x10 0x40 0x80 format x ContextId
A
� D L W b h �� � �� object WmiDataId extension Guid ActivityID � I I S _ A u t h e n t i c a t i o n _ T r a n s �=�4 �a " IIS_Authentication_Trans ) � �� ( 2 � � � � a q _U������������������������������� � W3AuthSucceeded EventType EventLevel AuthType ]
� � � � � ; C � � � � � �� uint32 WmiDataId DefineValues � � � ' MD_AUTH_ANONYMOUS MD_AUTH_BASIC MD_AUTH_NT MD_AUTH_MD5 MD_AUTH_PASSPORT MD_ACCESS_MAP_CERT Values _ j q u } � Anonymous Basic NT Digest Passport CertMap ValueMap � � � � � � 0x1 0x2 0x4 0x10 0x40 0x80 format x AuthUserName C
� A I T g w � �� string WmiDataId StringTermination NullTerminated format w ContextId
A
� � � � � �� � �� object WmiDataId extension Guid ActivityID NTLMUsed )
� M V � �� boolean WmiDataId RemoteUserName C
� � � � � � � �� string WmiDataId StringTermination NullTerminated format w TokenImpersonationLevel ]
� � � � � Y c � � � � � �� uint32 WmiDataId DefineValues � � � < IMPERSONATION_LEVEL_ANONYMOUS IMPERSONATION_LEVEL_IDENTIFY IMPERSONATION_LEVEL_IMPERSONATE IMPERSONATION_LEVEL_DELEGATE IMPERSONATION_LEVEL_UNKNOWN ValueMap { � � � � 0x0 0x1 0x2 0x3 0x4 ValueType index format x � I I S _ A u t h e n t i c a t i o n _ T r a n s �=�4 �.
" IIS_Authentication_Trans ) � �� # / : _������������� � W3AuthTypeNotSupported EventType EventLevel ContextId
A
� � � � � � �� � �� object WmiDataId extension Guid ActivityID � I I S _ A u t h e n t i c a t i o n _ T r a n s �=�4 �� " IIS_Authentication_Trans ) � ��
% 1 < � � _����������������( � W3AuthInvalidAnonAccount EventType EventLevel ContextId
A
� � � � � � �� � �� object WmiDataId extension Guid ActivityID ErrorCode 6
�
% � �� uint32 WmiDataId format x � I I S _ A u t h e n t i c a t i o n _ T r a n s �=�4 �0
" IIS_Authentication_Trans ) � �� % 1 < _������������� � W3AuthPasswdChangeNeeded EventType EventLevel ContextId
A
� � � � � � �� � �� object WmiDataId extension Guid ActivityID � I I S _ A u t h e n t i c a t i o n _ T r a n s �=�4 �2
" IIS_Authentication_Trans ) � �� ' 3 > _������������� � W3AuthPasswdChangeDisabled EventType EventLevel ContextId
A
� � � � � � �� � �� object WmiDataId extension Guid ActivityID � I I S _ A u t h e n t i c a t i o n _ T r a n s �=�4 �,
" IIS_Authentication_Trans ) � �� ! - 8 _������������� � W3AuthBadBasicHeader EventType EventLevel ContextId
A
� � � � � � �� � �� object WmiDataId extension Guid ActivityID � I I S _ R e w r i t e _ T r a n s �5h�b �� IIS_Rewrite_Trans ] � �� ( C P m x � � � � � � r � _����������������� � ConditionsEvaluationStart DisplayName ConditionsEvaluationStart Description Condition evaluation starts EventType EventTypeName CONDITIONS_EVALUATION_START EventLevel locale MS\0x409 ContextId
N
� ) 1 < I U ` f �� � �� object WmiDataId Description Context ID extension Guid ActivityID LogicalGrouping j
� � 7 J � � � � � � � �� uint32 WmiDataId Description Logical condition grouping ValueDescriptions V } Must match all conditions to succeed. Match any condition to succeed. ValueMap � � 0 1 Values � � MatchAll MatchAny ValueType index ce � I I S _ R e w r i t e _ T r a n s �5h�b �� IIS_Rewrite_Trans ] � �� & ? L h s � � � � � � k v _�������������� � ConditionsEvaluationEnd DisplayName ConditionsEvaluationEnd Description Conditions evaluation ends EventType EventTypeName CONDITIONS_EVALUATION_END EventLevel locale MS\0x409 ContextId
N
� " * 5 B N Y _ �� � �� object WmiDataId Description Context ID extension Guid ActivityID Succeeded 6
� � � � � � �� boolean WmiDataId Description True if the conditions evaluation succeeded �ded �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 k,pl\}�
͝��C�� / �\>�S}� d � WDMClassesOfDriver SystemConfig_V2_ProcGroup C:\Windows\system32\kernelbase.dll[MofResourceName] MofResourceName] fResourceName] �/t�� � bS�m| o �5}�
| 553g W gEd� X ,[� � vW(� � ���bB � X e S q l P k g _ f r o n t e n d _ m e m o r y _ u s a g e U��7 �� b ( XeSqlPkg_frontend_memory_usage ) � �� " 0 < � � < L � � � � [ h � � f n � � � � � M ] � � WUUU����������������������������������������������������������������������������������������������P � frontend_memory_usage EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid batch_size = )
� ) 1 � �� uint64 WmiDataId batch_sql_hash
Y 6
� � � � ��� � object WmiDataId Extension Variant database_id )
� � � �� uint32 WmiDataId FragmentId 6
� ^ f q ~ � �� uint32 WmiDataId Description FragmentId frontend_component , P
� � � �� s ! 3 ; uint8 WmiDataId XEMapId ValueMap - 0 1 0 Values G S Algebrizer Parser line_number )
� � � � �� uint64 WmiDataId memory_allocated_kb $ )
� � � �� uint64 WmiDataId object_id )
� S [ � �� sint32 WmiDataId offset
- )
� � �
� �� sint64 WmiDataId offset_end 5 )
� � � �� sint64 WmiDataId RemainingLength 6
� c k v � � �� uint32 WmiDataId Description RemainingLength resource_group_id M )
� � � � �� sint64 WmiDataId resource_pool_id
E )
� : B
� �� sint64 WmiDataId SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber statement_sql_hash
U 6
� ) 1 � ��< G object WmiDataId Extension Variant � X e S q l P k g
U��7 �G XeSqlPkg
C � ��) 6 k q � � � � c����� � XeSqlPkg_failover_proc_execution_status Description XEvent used to indicate execution of failover proc. Guid {9aef8bd4-7af2-4b42-9b48-c539002f95af} locale MS\0x409 DisplayName failover_proc_execution_status �' X e S q l P k g _ f a i l o v e r _ p r o c _ e x e c u t i o n _ s t a t u s U��7 � + 1 XeSqlPkg_failover_proc_execution_status ) ) � �� + 9 E � � G W � � � t � � L Y � � WU�����������������������������������������4 � failover_proc_execution_status EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid error_number )
� 4 < � �� sint32 WmiDataId error_severity )
� � � � �� sint32 WmiDataId error_state $ )
� � � � �� sint32 WmiDataId FragmentId 6
� H P [ h � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength result )
� 9 A � �� sint32 WmiDataId result_desc P
� � � � ��� t � � sint32 WmiDataId XEMapId ValueMap � � � 3 2 4 5 0 1 Values / C U j � � CREATE_PROC_FAILED DROP_PROC_FAILED EXECUTE_PROC_FAILED EXECUTE_PROC_SUCCESS FAILED_TO_GET_SECRET_BLOCK PROPERTY_NOT_FOUND SequenceNumber 6
� $ � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g U��7 �/ XeSqlPkg
C � ��# 0 Y _ � � � � c����� � XeSqlPkg_distinct_query_completed Description Fires when a unique query is completed. Guid {26749f51-d6e4-40b2-ba3c-e9b5976bcf32} locale MS\0x409 DisplayName distinct_query_completed �! X e S q l P k g _ d i s t i n c t _ q u e r y _ c o m p l e t e d
U��7 �� 3 + XeSqlPkg_distinct_query_completed # ) � �� % 3 ? � � � � 2 ? � � * : � � � � ` n � � WUU������������������������������������������������
� distinct_query_completed EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid batch C
� A I � ��T g w string WmiDataId StringTermination NullTerminated Format w data_sensitivity_information , C
� � � � �� ' / string WmiDataId StringTermination NullTerminated Format w database_id )
� v ~ � �� uint32 WmiDataId error_message
( C
� � �
� ��� ' string WmiDataId StringTermination NullTerminated Format w error_severity )
� q y � �� uint32 WmiDataId execution_error_code )
� � � � �� uint32 WmiDataId FragmentId 6
� 4 < G T � �� uint32 WmiDataId Description FragmentId peer_address $ C
� � � � ��� � � � string WmiDataId StringTermination NullTerminated Format w RemainingLength 6
� U ] h u � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g U��7 �q XeSqlPkg
C � ��6 C � � � � � � c���� � XeSqlPkg_bdc_create_external_table_request_completed Description Fires when a request to create external table request is completed. Guid {15C05EBD-3661-45A6-927D-0F0BF4DE1D01} locale MS\0x409 DisplayName bdc_create_external_table_request_completed � X e S q l P k g U��7 �k XeSqlPkg
C � ��4 A � � � � � � c����� � XeSqlPkg_bdc_drop_external_table_request_completed Description Fires when a request to drop external table request is completed. Guid {BB2F56F1-FFC7-4278-9A01-E724CBBA5605} locale MS\0x409 DisplayName bdc_drop_external_table_request_completed � X e S q l P k g �Y��7 �b XeSqlPkg
C � ��/ < � � � � � � c����� � XeSqlPkg_hadr_filestream_message_file_request Description Occurs when HADR FileStream transport traces a file write message. Guid {3620FA1D-853A-475a-BC37-BCF48EA0650C} locale MS\0x409 DisplayName hadr_filestream_message_file_request �est �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�y ! �\>�S}� V � WDMClassesOfDriver ObTypeEvent C:\Windows\system32\kernelbase.dll[MofResourceName] ll.mui[MofResourceName] ] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 K/h�b �
͝��C�� . )ߝ�t � c � WDMClassesOfDriver HeapSubsegmentInitialize C:\Windows\system32\kernelbase.dll[MofResourceName] eName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 K/h�b �
͝��C�� . )ߝ�t � c � WDMClassesOfDriver HeapSubsegmentInitialize C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 W/h�b �
͝��C�z " )ߝ�t � W � WDMClassesOfDriver CritSecTrace C:\Windows\system32\kernelbase.dll[MofResourceName] nelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 W/h�b �
͝��C�z " )ߝ�t � W � WDMClassesOfDriver CritSecTrace C:\Windows\system32\kernelbase.dll[MofResourceName] elbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 W/h�b �
͝��C�z " )ߝ�t � W � WDMClassesOfDriver CritSecTrace C:\Windows\system32\kernelbase.dll[MofResourceName] se.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 W/h�b �
͝��C�z " )ߝ�t � W � WDMClassesOfDriver CritSecTrace C:\Windows\system32\kernelbase.dll[MofResourceName] ResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 W/h�b �
͝��C�z " )ߝ�t � W � WDMClassesOfDriver CritSecTrace C:\Windows\system32\kernelbase.dll[MofResourceName] e.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 W/h�b �
͝��C�z " )ߝ�t � W � WDMClassesOfDriver CritSecTrace C:\Windows\system32\kernelbase.dll[MofResourceName] fResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 W/h�b �
͝��C�z " )ߝ�t � W � WDMClassesOfDriver CritSecTrace C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 X/h�b �
͝��C�~ & )ߝ�t � [ � WDMClassesOfDriver CritSecCollision C:\Windows\system32\kernelbase.dll[MofResourceName] MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 X/h�b �
͝��C�~ & )ߝ�t � [ � WDMClassesOfDriver CritSecCollision C:\Windows\system32\kernelbase.dll[MofResourceName] ll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 X/h�b �
͝��C�~ & )ߝ�t � [ � WDMClassesOfDriver CritSecCollision C:\Windows\system32\kernelbase.dll[MofResourceName] sourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 X/h�b �
͝��C�~ & )ߝ�t � [ � WDMClassesOfDriver CritSecCollision C:\Windows\system32\kernelbase.dll[MofResourceName] esourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 X/h�b �
͝��C�~ & )ߝ�t � [ � WDMClassesOfDriver CritSecCollision C:\Windows\system32\kernelbase.dll[MofResourceName] rceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 X/h�b �
͝��C�~ & )ߝ�t � [ � WDMClassesOfDriver CritSecCollision C:\Windows\system32\kernelbase.dll[MofResourceName] em32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 X/h�b �
͝��C�~ & )ߝ�t � [ � WDMClassesOfDriver CritSecCollision C:\Windows\system32\kernelbase.dll[MofResourceName] ll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 X/h�b �
͝��C�~ & )ߝ�t � [ � WDMClassesOfDriver CritSecCollision C:\Windows\system32\kernelbase.dll[MofResourceName] ceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 X/h�b �
͝��C�~ & )ߝ�t � [ � WDMClassesOfDriver CritSecCollision C:\Windows\system32\kernelbase.dll[MofResourceName] sourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 X/h�b �
͝��C�~ & )ߝ�t � [ � WDMClassesOfDriver CritSecCollision C:\Windows\system32\kernelbase.dll[MofResourceName] e.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 X/h�b �
͝��C�~ & )ߝ�t � [ � WDMClassesOfDriver CritSecCollision C:\Windows\system32\kernelbase.dll[MofResourceName] urceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 X/h�b �
͝��C�~ & )ߝ�t � [ � WDMClassesOfDriver CritSecCollision C:\Windows\system32\kernelbase.dll[MofResourceName] ase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 X/h�b �
͝��C�~ & )ߝ�t � [ � WDMClassesOfDriver CritSecCollision C:\Windows\system32\kernelbase.dll[MofResourceName] [MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 X/h�b �
͝��C�~ & )ߝ�t � [ � WDMClassesOfDriver CritSecCollision C:\Windows\system32\kernelbase.dll[MofResourceName] e.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 X/h�b �
͝��C�~ & )ߝ�t � [ � WDMClassesOfDriver CritSecCollision C:\Windows\system32\kernelbase.dll[MofResourceName] sourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 X/h�b �
͝��C�~ & )ߝ�t � [ � WDMClassesOfDriver CritSecCollision C:\Windows\system32\kernelbase.dll[MofResourceName] fResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 X/h�b �
͝��C�~ & )ߝ�t � [ � WDMClassesOfDriver CritSecCollision C:\Windows\system32\kernelbase.dll[MofResourceName] ourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 X/h�b �
͝��C�~ & )ߝ�t � [ � WDMClassesOfDriver CritSecCollision C:\Windows\system32\kernelbase.dll[MofResourceName] rceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 X/h�b �
͝��C�~ & )ߝ�t � [ � WDMClassesOfDriver CritSecCollision C:\Windows\system32\kernelbase.dll[MofResourceName] J string Description Text � � �n ID � ��JR� p
Yo y *�ԣy m d��?� �Ρ1� � ��
-� � ��O� � ���/z Q U�}�C��
� �� � ~ � � � � 7 J U������������� � UserConfiguredWindows8App Microsoft.Uev.ManagedAgentWmi, Version=10.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35 DisplayName
� � � �� string Enabled
� � � �� boolean Installed
� . � �� boolean PackageFamilyName '
� � �� � �� string { : _ c gur o � � � oft � & * Ve 4 c � � EnableApp % ��- �� static implemented ! a42c9160500003S ROOT\Microsoft\Uev ���� � �� �� * � ����� � __PARAMETERS abstract packageFamilyName string
� = ID
� = d in )
� � d � �� string __ � DisableApp � ��� �� static implemented ! a42c9160500003S ROOT\Microsoft\Uev ���� � �� �� * � ����� � __PARAMETERS abstract packageFamilyName string
� = ID
� = d in )
� � d � �� string __ � RemoveApp � ��� �� static implemented ! a42c9160500003S ROOT\Microsoft\Uev ���� � �� �� * � ����� � __PARAMETERS abstract packageFamilyName string
� = ID
� = d in )
� � d � �� string __ � CheckApp N ��V �� static implemented ! a42c9160500003S ROOT\Microsoft\Uev ���� � �� �� * � ����� � __PARAMETERS abstract packageFamilyName string
� = ID
� = d in )
� � d � �� string __ �� a42c9160500003S ROOT\Microsoft\Uev ���� � �( �� * m ��� � __PARAMETERS abstract ReturnValue boolean
� _ boolean out
� _ h �� __ � M S _ W m i I n t e r n a l ��jj��E MS_WmiInternal 4 � �� � �� # K S � � �
G M � � � � = F U��������������������������� � MSWmi_MofData WMIProv WMI guid {05901221-D566-11d1-B2F0-00A0C9062910} Active
� } � �� boolean BinaryMofData 6
� � � � � � �� uint8 WmiDataId WmiSizeIs Size InstanceName '
� ? � �� � �� string Size )
� � � � �� uint32 WmiDataId Unused1 )
� � � � �� uint32 WmiDataId Unused2
)
� * 2 � �� uint32 WmiDataId Unused4 )
� } � � �� uint32 WmiDataId � M S _ W m i I n t e r n a l ��jj��9 MS_WmiInternal 4 � �� � ��" ( P X � � � � : H � � � � 1 : U��������������������������� � MSWmi_ProviderInfo WMIProv WMI guid {C7BF35D0-AADB-11d1-BF4A-00A0C9062910} Active
� � � �� boolean Description
)
� � � � �� string WmiDataId FriendlyName )
� ' / � �� string WmiDataId InstanceName '
� } � �� � �� string Location )
� � � � �� string WmiDataId Manufacturer )
� & � �� string WmiDataId Service )
� q y � �� string WmiDataId � M S _ W m i I n t e r n a l ��jj��� MS_WmiInternal A � �� � ��! ' O Z t | � � � U����������Q � MSWmi_PnPDeviceId WMIProv WMI guid {C7BF35D2-AADB-11d1-BF4A-00A0C9062910} GuidName1 DATA_PROVIDER_PNPID_GUID Active
� � � �� boolean InstanceName '
� � � �� � �� string PnPDeviceId )
� > F � �� string WmiDataId id � M S _ W m i I n t e r n a l ��jj��w MS_WmiInternal A � �� � ! ��& , T _ � � � � " _ q U��������������� � MSWmi_PnPInstanceNames WMIProv WMI guid {C7BF35D3-AADB-11d1-BF4A-00A0C9062910} GuidName1 DATA_PROVIDER_PNPID_INSTANCE_NAMES_GUID Active
� � � �� boolean Count )
� � �� uint32 WmiDataId InstanceName '
� W � �� � �� string InstanceNameList
6
� � � � � � �� string WmiDataId WmiSizeIs Count GU � ��jj��� �� ? E =����� � MSWmi_Guid WMI guid {F8C60AED-EF8D-4f95-9EA8-F04318A00F30} Guid +
� ~ � � uint8 WmiDataId MAX � W M I E v e n t ��jj��� WMIEvent
4 � �� � % ��* 0 X ` � � � � T b � � _������������������������������ � MSWmi_GuidRegistrationInfo WMIProv WMI guid {B48D49A1-E777-11d0-A50C-00A0C9062910} Active
� � � �� boolean GuidCount
� � � uint32 WmiDataId GuidList
+
� 3 > I object:MSWmi_Guid WmiDataId WmiSizeIs GuidCount InstanceName '
� � � �� � �� string Operation +
� � � � uint32 WmiDataId ValueMap 1 2 4 �
I I S _ C g i _ T r a n s >�4 �
IIS_Cgi_Trans ) � �� + 6 _������������� � W3CGIStart EventType EventLevel ContextId
A
� � � � � � �� � �� object WmiDataId extension Guid ActivityID �yID �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� 2 �\>�S}� g � WDMClassesOfDriver MSNdis_FddiLongMulticastList C:\Windows\system32\kernelbase.dll[MofResourceName] Name] r��x� t �#�T� � �u� � >v��p � ?
�
� �
�� � M��E � 8 X e S q l P k g _ s t r e t c h _ t a b l e _ d a t a _ r e c o n c i l i a t i o n _ r e s u l t s _ e v e n t KT��7 �� 8 B XeSqlPkg_stretch_table_data_reconciliation_results_event : ) � ��1 < J V
W d � � ] i � � . ? � � � � WUU������������������������������������������������������ � stretch_table_data_reconciliation_results_event EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� D L � �� uint32 WmiDataId duration_ms )
� � � � �� sint64 WmiDataId error_number % )
� � � � �� sint32 WmiDataId error_state
) )
� J R
� �� sint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId is_success )
� # � �� sint8 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength rows - )
� � � � �� sint64 WmiDataId SequenceNumber 6
� X ` k x � �� uint32 WmiDataId Description SequenceNumber table_id )
� � � � �� uint32 WmiDataId � X e S q l P k g LT��7 �p XeSqlPkg
C � ��. ; � � � � � � c���� � XeSqlPkg_stretch_table_unprovision_completed Description Reports the completion removal of local resources for a table that was unstretched Guid {CB571559-1CF8-4CD9-B269-3109BC829C22} locale MS\0x409 DisplayName stretch_table_unprovision_completed �, X e S q l P k g _ s t r e t c h _ t a b l e _ u n p r o v i s i o n _ c o m p l e t e d MT��7 �t 0 6 XeSqlPkg_stretch_table_unprovision_completed . ) � ��% 0
> J � K X � � � Q ] � � " 3 � � , 6 WU���������������������������������������������� � stretch_table_unprovision_completed EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� 8 @ � �� uint32 WmiDataId duration_ms )
� � � � �� sint64 WmiDataId error_number % )
� � � � �� sint32 WmiDataId error_state
) )
� > F
� �� sint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId is_success )
� � �� sint8 WmiDataId RemainingLength 6
� w � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � �� uint32 WmiDataId Description SequenceNumber table_id )
� m u � �� uint32 WmiDataId � X e S q l P k g NT��7 �u XeSqlPkg
C � ��2 ? � � � � � � c���� � XeSqlPkg_stretch_table_hinted_admin_update_event Description Reports the execution of a Stretch update DML operation that uses an admin hint Guid {EC369788-59D7-45EA-B9AB-A40403F48BE6} locale MS\0x409 DisplayName stretch_table_hinted_admin_update_event �0 X e S q l P k g _ s t r e t c h _ t a b l e _ h i n t e d _ a d m i n _ u p d a t e _ e v e n t OT��7 �# 4 : XeSqlPkg_stretch_table_hinted_admin_update_event 2 ) � ��) 4 B N � O \ � � � U a � � & / � � G W � � WUU������������������������������������������������� � stretch_table_hinted_admin_update_event EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� < D � �� uint32 WmiDataId duration_ms )
� � � � �� sint64 WmiDataId error_number % )
� � � � �� sint32 WmiDataId error_state
) )
� B J
� �� sint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId is_success )
� � �� sint8 WmiDataId message - C
� � � � ��� � � � string WmiDataId StringTermination NullTerminated Format w RemainingLength 6
� ) 6 � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber table_id )
� � �� uint32 WmiDataId � X e S q l P k g PT��7 �u XeSqlPkg
C � ��2 ? � � � � � � c���� � XeSqlPkg_stretch_table_hinted_admin_delete_event Description Reports the execution of a Stretch delete DML operation that uses an admin hint Guid {E456A9E0-3951-46FB-8357-34F72D2A6020} locale MS\0x409 DisplayName stretch_table_hinted_admin_delete_event �0 X e S q l P k g _ s t r e t c h _ t a b l e _ h i n t e d _ a d m i n _ d e l e t e _ e v e n t QT��7 �# 4 : XeSqlPkg_stretch_table_hinted_admin_delete_event 2 ) � ��) 4 B N � O \ � � � U a � � & / � � G W � � WUU������������������������������������������������� � stretch_table_hinted_admin_delete_event EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� < D � �� uint32 WmiDataId duration_ms )
� � � � �� sint64 WmiDataId error_number % )
� � � � �� sint32 WmiDataId error_state
) )
� B J
� �� sint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId is_success )
� � �� sint8 WmiDataId message - C
� � � � ��� � � � string WmiDataId StringTermination NullTerminated Format w RemainingLength 6
� ) 6 � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber table_id )
� � �� uint32 WmiDataId �aId �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�u �\>�S}� R � WDMClassesOfDriver ObTrace C:\Windows\system32\kernelbase.dll[MofResourceName] e] ] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� , �\>�S}� a � WDMClassesOfDriver MSNdis_80211_WEPStatus C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� - �\>�S}� b � WDMClassesOfDriver MSNdis_StatusResetStart C:\Windows\system32\kernelbase.dll[MofResourceName] MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� - �\>�S}� b � WDMClassesOfDriver MSNdis_StatusResetStart C:\Windows\system32\kernelbase.dll[MofResourceName] [MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� - �\>�S}� b � WDMClassesOfDriver MSNdis_StatusResetStart C:\Windows\system32\kernelbase.dll[MofResourceName] sourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� - �\>�S}� b � WDMClassesOfDriver MSNdis_StatusResetStart C:\Windows\system32\kernelbase.dll[MofResourceName] elbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� - �\>�S}� b � WDMClassesOfDriver MSNdis_StatusResetStart C:\Windows\system32\kernelbase.dll[MofResourceName] fResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� - �\>�S}� b � WDMClassesOfDriver MSNdis_StatusResetStart C:\Windows\system32\kernelbase.dll[MofResourceName] se.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� - �\>�S}� b � WDMClassesOfDriver MSNdis_StatusResetStart C:\Windows\system32\kernelbase.dll[MofResourceName] .dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� - �\>�S}� b � WDMClassesOfDriver MSNdis_StatusResetStart C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� - �\>�S}� b � WDMClassesOfDriver MSNdis_StatusResetStart C:\Windows\system32\kernelbase.dll[MofResourceName] [MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� - �\>�S}� b � WDMClassesOfDriver MSNdis_StatusResetStart C:\Windows\system32\kernelbase.dll[MofResourceName] esourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� - �\>�S}� b � WDMClassesOfDriver MSNdis_StatusResetStart C:\Windows\system32\kernelbase.dll[MofResourceName] l[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� - �\>�S}� b � WDMClassesOfDriver MSNdis_StatusResetStart C:\Windows\system32\kernelbase.dll[MofResourceName] fResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� - �\>�S}� b � WDMClassesOfDriver MSNdis_StatusResetStart C:\Windows\system32\kernelbase.dll[MofResourceName] [MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� - �\>�S}� b � WDMClassesOfDriver MSNdis_StatusResetStart C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� + �\>�S}� ` � WDMClassesOfDriver MSNdis_StatusResetEnd C:\Windows\system32\kernelbase.dll[MofResourceName] se.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� + �\>�S}� ` � WDMClassesOfDriver MSNdis_StatusResetEnd C:\Windows\system32\kernelbase.dll[MofResourceName] dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� + �\>�S}� ` � WDMClassesOfDriver MSNdis_StatusResetEnd C:\Windows\system32\kernelbase.dll[MofResourceName] dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� + �\>�S}� ` � WDMClassesOfDriver MSNdis_StatusResetEnd C:\Windows\system32\kernelbase.dll[MofResourceName] .dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� + �\>�S}� ` � WDMClassesOfDriver MSNdis_StatusResetEnd C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� + �\>�S}� ` � WDMClassesOfDriver MSNdis_StatusResetEnd C:\Windows\system32\kernelbase.dll[MofResourceName] rnelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� + �\>�S}� ` � WDMClassesOfDriver MSNdis_StatusResetEnd C:\Windows\system32\kernelbase.dll[MofResourceName] dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� + �\>�S}� ` � WDMClassesOfDriver MSNdis_StatusResetEnd C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� 2 �\>�S}� g � WDMClassesOfDriver MSNdis_StatusMediaDisconnect C:\Windows\system32\kernelbase.dll[MofResourceName] se.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� 2 �\>�S}� g � WDMClassesOfDriver MSNdis_StatusMediaDisconnect C:\Windows\system32\kernelbase.dll[MofResourceName] esourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� 2 �\>�S}� g � WDMClassesOfDriver MSNdis_StatusMediaDisconnect C:\Windows\system32\kernelbase.dll[MofResourceName] esourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� 2 �\>�S}� g � WDMClassesOfDriver MSNdis_StatusMediaDisconnect C:\Windows\system32\kernelbase.dll[MofResourceName] e] i � WDMClassesOfDriver MSNdis_StatusDot11RoamingStart C:\Windows\system32\kernelbase.dll[MofResourceName] ase.dll[MofResourceName] ѵ��� � Gzd � �`�� � |�8 � t �s_7
W �8� � <ۣ� g � :w � : X e S q l P k g _ c o l u m n s t o r e _ t i e r e d _ s t o r a g e _ s c a n n e r _ s t a r t _ d a t a b a s e �[��7 �H D XeSqlPkg_columnstore_tiered_storage_scanner_start_database < ) � ��3 > L X
� � ) � � � W��������������������������z � columnstore_tiered_storage_scanner_start_database EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid dbName C
� [ c � ��n � � � string WmiDataId StringTermination NullTerminated Format w FragmentId 6
� � � � � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� m u � � � �� uint32 WmiDataId Description RemainingLength scanner_type )
� � � � �� uint16 WmiDataId SequenceNumber 6
� J R ] j � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �[��7 �k XeSqlPkg
C � ��: G ~ � � � � � c����� � XeSqlPkg_columnstore_tiered_storage_scanner_end_database Description Columnstore tiered storage scanner finishes database. Guid {4002F1AC-98ED-4696-969B-6BDB0D5DB878} locale MS\0x409 DisplayName columnstore_tiered_storage_scanner_end_database �8 X e S q l P k g _ c o l u m n s t o r e _ t i e r e d _ s t o r a g e _ s c a n n e r _ e n d _ d a t a b a s e �[��7 �D B XeSqlPkg_columnstore_tiered_storage_scanner_end_database : ) � ��1 < J V � � ' � � � W��������������������������x � columnstore_tiered_storage_scanner_end_database EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid dbName C
� Y a � ��l � � string WmiDataId StringTermination NullTerminated Format w FragmentId 6
� � � �
� �� uint32 WmiDataId Description FragmentId RemainingLength 6
� k s ~ � � �� uint32 WmiDataId Description RemainingLength scanner_type )
� � � � �� uint16 WmiDataId SequenceNumber 6
� H P [ h � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �[��7 �L XeSqlPkg
C � ��/ < j p � � � � c����� � XeSqlPkg_remote_cs_garbage_collection_failure Description Remote CS Garbage Collection Failure XEvents Guid {09eab14f-25d0-49f4-b01b-3ad4f79dabc3} locale MS\0x409 DisplayName remote_cs_garbage_collection_failure �- X e S q l P k g _ r e m o t e _ c s _ g a r b a g e _ c o l l e c t i o n _ f a i l u r e �[��7 �� $ 7 XeSqlPkg_remote_cs_garbage_collection_failure / ) � ��& 1 ? K � � � � � � � � � � WU���������������������������������� � remote_cs_garbage_collection_failure EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid dbName C
� N V � ��a t � � string WmiDataId StringTermination NullTerminated Format w FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId level P
� p w � ��� g � � � � uint8 WmiDataId XEMapId ValueMap � � � � 2 1 3 0 Values � � � � BATCH DB ROW TASK message C
� A I � ��T g w string WmiDataId StringTermination NullTerminated Format w RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� \ d o | � �� uint32 WmiDataId Description SequenceNumber targetLogicalDbId
6
� � � � ��� object:guid WmiDataId Extension Guid � X e S q l P k g �[��7 �Z XeSqlPkg
C � ��3 @ t z � � � � c����� � XeSqlPkg_remote_cs_garbage_collection_information Description Remote CS Garbage Collection Informational XEvents Guid {21625926-d01c-40da-b046-b89c31bd2810} locale MS\0x409 DisplayName remote_cs_garbage_collection_information �1 X e S q l P k g _ r e m o t e _ c s _ g a r b a g e _ c o l l e c t i o n _ i n f o r m a t i o n �[��7 �� $ ; XeSqlPkg_remote_cs_garbage_collection_information 3 ) � ��* 5 C O � � � � � � � � � WU���������������������������������� � remote_cs_garbage_collection_information EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid dbName C
� R Z � ��e x � � string WmiDataId StringTermination NullTerminated Format w FragmentId 6
� � � � � �� uint32 WmiDataId Description FragmentId level P
� t { � ��� g � � � � uint8 WmiDataId XEMapId ValueMap � � � � 2 1 3 0 Values � � � � BATCH DB ROW TASK message C
� E M � ��X k { � string WmiDataId StringTermination NullTerminated Format w RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� ` h s � � �� uint32 WmiDataId Description SequenceNumber targetLogicalDbId
6
� � � � ���
object:guid WmiDataId Extension Guid � X e S q l P k g �[��7 �g XeSqlPkg
C � ��8 E | � � � � � c����� � XeSqlPkg_remote_cs_garbage_collection_batch_completion Description Remote CS Garbage Collection Batch Completion XEvents Guid {d463f7ad-509f-48c5-9f23-bf5c46e9c39d} locale MS\0x409 DisplayName remote_cs_garbage_collection_batch_completion �ion �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�� 2 �\>�S}� g � WDMClassesOfDriver WmiMonitorBasicDisplayParams C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�� 0 �\>�S}� e � WDMClassesOfDriver WmiMonitorConnectionParams C:\Windows\system32\kernelbase.dll[MofResourceName] Name] ] �8v� D u�W� � �k�xk A ��� z ı��& �˷$( � � �<� � ��CR � 4 X e S q l P k g _ c o l u m n s t o r e _ t e s t _ r o w g r o u p _ i d s _ s n a p s h o t _ d o n e +[��7 �� & > XeSqlPkg_columnstore_test_rowgroup_ids_snapshot_done 6 ) � ��- 8 F R � S _ � � " : � � � � ^ n WU������������������������������������� � columnstore_test_rowgroup_ids_snapshot_done EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� @ H � �� uint16 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId hobt_id )
� � �� uint64 WmiDataId is_in_index_reorganize " )
� q x � �� sint8 WmiDataId object_id )
� � � � �� sint32 WmiDataId RemainingLength 6
� - 5 @ M � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g ,[��7 �o XeSqlPkg
C � ��7 D � � � � � � c���� � XeSqlPkg_columnstore_skip_removing_tombtsone_rowgroup Description Skip removing tombstone rowgroup as active scaner might need it Guid {49D12AA3-F92A-48AA-B468-A5896700F9B8} locale MS\0x409 DisplayName columnstore_skip_removing_tombtsone_rowgroup �5 X e S q l P k g _ c o l u m n s t o r e _ s k i p _ r e m o v i n g _ t o m b t s o n e _ r o w g r o u p -[��7 �� ) ? XeSqlPkg_columnstore_skip_removing_tombtsone_rowgroup 7 ) � ��. 9 G S �
T ` � � # . x � � U e WU���������������������������������������� � columnstore_skip_removing_tombtsone_rowgroup EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� A I � �� uint16 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId hobt_id )
� � �� uint64 WmiDataId object_id )
� e m � �� sint32 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength rowgroup_id " )
� B J � �� sint32 WmiDataId SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g .[��7 �R XeSqlPkg
C � ��+ 8 t z � � � � c����� � XeSqlPkg_compute_rowset_type_and_log_mode Description Compute the rowset type and log mode when opening a rowset Guid {1D2268AE-5D18-4FF1-8EBC-405CD0DF8112} locale MS\0x409 DisplayName compute_rowset_type_and_log_mode �) X e S q l P k g _ c o m p u t e _ r o w s e t _ t y p e _ a n d _ l o g _ m o d e /[��7 �� ) 3 XeSqlPkg_compute_rowset_type_and_log_mode + ) � ��" - ; G � � m | � � ( 1 � � � 2 B WU���������������������������������������� � compute_rowset_type_and_log_mode EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid FragmentId 6
� A I T a � �� uint32 WmiDataId Description FragmentId is_bulkrowset )
� � � � �� sint8 WmiDataId is_columnstore )
� � �� sint8 WmiDataId log_mode " P
� � � � ��� � � � � � uint32 WmiDataId XEMapId ValueMap � � � � � 2 4 3 0 1 Values � ALLOCATIONS_ONLY BULK FULL INVALID NONE RemainingLength 6
� u } � � � �� uint32 WmiDataId Description RemainingLength rowset_id )
� � � � �� uint64 WmiDataId rowset_type P
� f n � ��y � � � � � uint32 WmiDataId XEMapId ValueMap � � � � � � 0 2 4 5 1 3 Values � � � " Bulk ColumnsetAdapter ColumnsetBulk ColumnsetLobOrphan Regular ReplicatedBulk SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g 0[��7 �X XeSqlPkg
C � ��/ < v | � � � � c����� � XeSqlPkg_blob_container_accessor_lock_failure Description Failed to grab a lock in the blob container accessor API Guid {187b10ef-f1c2-4fa9-9fc0-8fc4b29bc21c} locale MS\0x409 DisplayName blob_container_accessor_lock_failure �- X e S q l P k g _ b l o b _ c o n t a i n e r _ a c c e s s o r _ l o c k _ f a i l u r e 1[��7 �8 " 7 XeSqlPkg_blob_container_accessor_lock_failure / ) � ��& 1 ? K � � F R � � g x � � W��������������������������������q � blob_container_accessor_lock_failure EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid db_id )
� 3 ; � �� uint64 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId point_of_interest C
� & . � ��9 L \ d string WmiDataId StringTermination NullTerminated Format w RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� A I T a � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g 2[��7 �[ XeSqlPkg
C � ��/ < y � � � � c����� � XeSqlPkg_blob_container_accessor_open_failure Description Failed to open the table in the blob container accessor API Guid {fe7abda9-e0ad-4708-957c-e7874d037cce} locale MS\0x409 DisplayName blob_container_accessor_open_failure �ure �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�� ) �\>�S}� ^ � WDMClassesOfDriver MSChangerParameters C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�� + �\>�S}� ` � WDMClassesOfDriver MSChangerProblemEvent C:\Windows\system32\kernelbase.dll[MofResourceName] urceName] Name] Name] 162-323f72efc6b2} locale MS\0x409 DisplayName recovery_unit_new_dbsegment_id_set � �� sint32 WmiDataId � ofResourceName] v�P� � 1�:Xd Z p�� � `���
� �ڧ � ���� ~ �� � }DA� b �f�i � ~U�� � =�%d� �w��� ڝ��C�| ' ) � �� � 1 B L � � � � $ / l w � � � � : D v � � �
] v UUU������������������������������������� � MDM_VPNv2_01 InPartition # local-system DMWmiBridgeProv AlwaysOn '
� � � �� � �� boolean ByPassForLocal '
� � � �� � �� boolean DeviceTunnel '
� � �� � �� boolean DnsSuffix '
� d � �� � �� string EdpModeId '
� � � �� � �� string InstanceID
� � � �� string LockDown '
� 1 � �� � �� boolean ParentID
� n � �� string ProfileXML '
� � � �� � �� string RegisterDNS '
� � �� � �� boolean RememberCredentials '
� T � �� � �� boolean TrustedNetworkDetection
'
� � � �� � �� string � ڝ��C�B ) % � �� � K \ m � � � 9 O � � � � Y c UU������������������������������� � MDM_VPNv2_APNBinding02 InPartition 1 ? local-system local-user DMWmiBridgeProv AccessPointName '
� � � �� � �� string AuthenticationType '
� � � �� � �� string InstanceID
� 1 � �� string IsCompressionEnabled '
� � � �� � �� boolean ParentID
� � � �� string Password '
� � �� � �� string ProviderId '
� Q � �� � �� string UserName '
� � � �� � �� string � ڝ��C�� ) " / � �� � U f j � � � � ! ' U����������������d � MDM_VPNv2_AppTriggerList02_App04 InPartition ; I local-system local-user DMWmiBridgeProv Id '
� � � �� � �� string InstanceID
� � � �� string ParentID
� � �� string Type '
� \ � �� � string M � ڝ��C�� ) ) � �� � O ` l � � � � & 2 U����������������o � MDM_VPNv2_Authentication03 InPartition 5 C local-system local-user DMWmiBridgeProv InstanceID
� � � �� string MachineMethod '
� � � �� � �� string ParentID
� � �� string UserMethod '
� g � �� � �� string M � ڝ��C�� ) & � �� � L ] b � � � � " , U����������������^ � MDM_VPNv2_Certificate04 InPartition 2 @ local-system local-user DMWmiBridgeProv Eku '
� � � �� � �� string InstanceID
� � � �� string Issuer '
� � �� � �� string ParentID
� V � �� string M � !ڝ��C�f " ) , � �� � R c � � � " _ q � � � ? I { � UU��������������������������������� � MDM_VPNv2_CryptographySuite03 InPartition 8 F local-system local-user DMWmiBridgeProv AuthenticationTransformConstants '
� � � �� � �� string CipherTransformConstants '
� � �� � �� string DHGroup '
� W � �� � �� string EncryptionMethod '
� � � �� � �� string InstanceID
� � � �� string IntegrityCheckMethod '
� 7 � �� � �� string ParentID
� s � �� string PfsGroup '
� � � �� � �� string � "ڝ��C�� ) + � �� � Q b k � � � � U����������# � MDM_VPNv2_DeviceCompliance02 InPartition 7 E local-system local-user DMWmiBridgeProv Enabled '
� � � �� � �� boolean InstanceID
� � � �� string ParentID
� � �� string 2 � #ڝ��C�J ) * 7 � �� � ] n { � � K [ � � � � \ m UU����������������������������� � MDM_VPNv2_DomainNameInformationList02_01 InPartition C Q local-system local-user DMWmiBridgeProv AutoTrigger '
� � � �� � �� boolean DnsServers '
� � � �� � �� string DomainName '
� C � �� � �� string DomainNameType '
� � � �� � string InstanceID
� � � �� string ParentID
�
� �� string Persistent '
� S � �� � �� boolean WebProxyServers '
� � � �� � �� string � $ڝ��C�� ) � �� � D U d � � � � ! U����������������^ � MDM_VPNv2_Eap04 InPartition * 8 local-system local-user DMWmiBridgeProv Configuration '
� � � �� � �� string InstanceID
� � � �� string ParentID
� � �� string Type '
� V � �� � �� sint32 M � %ڝ��C�~
) ! � �� � G X d � � � � U������������ � MDM_VPNv2_Manual03 InPartition - ; local-system local-user DMWmiBridgeProv InstanceID
� � � �� string ParentID
� � � �� string Server '
� � �� � �� string ti � &ڝ��C�� ) ( � �� � N _ ~ � � � @ T � � � � & U��������������������������c � MDM_VPNv2_NativeProfile02 InPartition 4 B local-system local-user DMWmiBridgeProv DisableClassBasedDefaultRoute '
� � � �� � �� boolean InstanceID
� � � �� string L2tpPsk '
� 8 � �� � �� string NativeProtocolType '
� � � �� � �� string ParentID
� � � �� string RoutingPolicyType '
� � �� � �� string Servers '
� [ � �� � �� string � E n u m T r u s t e d D o m s Qܝ��C�� EnumTrustedDoms C � �� $ = H W ^ f p � EnumTrustedDoms_Start Description EnumerateTrustedDomains EventType EventTypeName Start locale MS\0x409 �409 �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� 0 �\>�S}� e � WDMClassesOfDriver MSNdis_AtmMaxActiveVpiBits C:\Windows\system32\kernelbase.dll[MofResourceName] fResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �'pl\}�
͝��C�� + �\>�S}� ` � WDMClassesOfDriver MSNdis_StatisticsInfo C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �'pl\}�
͝��C�� 8 �\>�S}� m � WDMClassesOfDriver MSNdis_WmiIPSecOffloadV1_Supported C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �'pl\}�
͝��C� ' �\>�S}� \ � WDMClassesOfDriver MSNdis_WmiOffload C:\Windows\system32\kernelbase.dll[MofResourceName] e.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �'pl\}�
͝��C� ' �\>�S}� \ � WDMClassesOfDriver MSNdis_WmiOffload C:\Windows\system32\kernelbase.dll[MofResourceName] 32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �'pl\}�
͝��C� ' �\>�S}� \ � WDMClassesOfDriver MSNdis_WmiOffload C:\Windows\system32\kernelbase.dll[MofResourceName] nelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �'pl\}�
͝��C� ' �\>�S}� \ � WDMClassesOfDriver MSNdis_WmiOffload C:\Windows\system32\kernelbase.dll[MofResourceName] Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �'pl\}�
͝��C� ' �\>�S}� \ � WDMClassesOfDriver MSNdis_WmiOffload C:\Windows\system32\kernelbase.dll[MofResourceName] 32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �'pl\}�
͝��C� ' �\>�S}� \ � WDMClassesOfDriver MSNdis_WmiOffload C:\Windows\system32\kernelbase.dll[MofResourceName] fResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �'pl\}�
͝��C� ' �\>�S}� \ � WDMClassesOfDriver MSNdis_WmiOffload C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �'pl\}�
͝��C�� 8 �\>�S}� m � WDMClassesOfDriver MSNdis_WmiReceiveScaleCapabilities C:\Windows\system32\kernelbase.dll[MofResourceName] [MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �'pl\}�
͝��C�� 8 �\>�S}� m � WDMClassesOfDriver MSNdis_WmiReceiveScaleCapabilities C:\Windows\system32\kernelbase.dll[MofResourceName] esourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �'pl\}�
͝��C�� 8 �\>�S}� m � WDMClassesOfDriver MSNdis_WmiReceiveScaleCapabilities C:\Windows\system32\kernelbase.dll[MofResourceName] kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �'pl\}�
͝��C�� 8 �\>�S}� m � WDMClassesOfDriver MSNdis_WmiReceiveScaleCapabilities C:\Windows\system32\kernelbase.dll[MofResourceName] [MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �'pl\}�
͝��C�� 8 �\>�S}� m � WDMClassesOfDriver MSNdis_WmiReceiveScaleCapabilities C:\Windows\system32\kernelbase.dll[MofResourceName] ] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �'pl\}�
͝��C�� 8 �\>�S}� m � WDMClassesOfDriver MSNdis_WmiReceiveScaleCapabilities C:\Windows\system32\kernelbase.dll[MofResourceName] eName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �'pl\}�
͝��C�� 8 �\>�S}� m � WDMClassesOfDriver MSNdis_WmiReceiveScaleCapabilities C:\Windows\system32\kernelbase.dll[MofResourceName] Name] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �'pl\}�
͝��C�� 8 �\>�S}� m � WDMClassesOfDriver MSNdis_WmiReceiveScaleCapabilities C:\Windows\system32\kernelbase.dll[MofResourceName] sourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �'pl\}�
͝��C�� 8 �\>�S}� m � WDMClassesOfDriver MSNdis_WmiReceiveScaleCapabilities C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �'pl\}�
͝��C�� : �\>�S}� o � WDMClassesOfDriver MSNdis_ReceiveFilterGlobalParameters C:\Windows\system32\kernelbase.dll[MofResourceName] sourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �'pl\}�
͝��C�� : �\>�S}� o � WDMClassesOfDriver MSNdis_ReceiveFilterGlobalParameters C:\Windows\system32\kernelbase.dll[MofResourceName] eName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �'pl\}�
͝��C�� : �\>�S}� o � WDMClassesOfDriver MSNdis_ReceiveFilterGlobalParameters C:\Windows\system32\kernelbase.dll[MofResourceName] sourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �'pl\}�
͝��C�� : �\>�S}� o � WDMClassesOfDriver MSNdis_ReceiveFilterGlobalParameters C:\Windows\system32\kernelbase.dll[MofResourceName] ourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �'pl\}�
͝��C�� : �\>�S}� o � WDMClassesOfDriver MSNdis_ReceiveFilterGlobalParameters C:\Windows\system32\kernelbase.dll[MofResourceName] 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �'pl\}�
͝��C�� : �\>�S}� o � WDMClassesOfDriver MSNdis_ReceiveFilterGlobalParameters C:\Windows\system32\kernelbase.dll[MofResourceName] ourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �'pl\}�
͝��C�� : �\>�S}� o � WDMClassesOfDriver MSNdis_ReceiveFilterGlobalParameters C:\Windows\system32\kernelbase.dll[MofResourceName] me] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �'pl\}�
͝��C�� : �\>�S}� o � WDMClassesOfDriver MSNdis_ReceiveFilterGlobalParameters C:\Windows\system32\kernelbase.dll[MofResourceName] urceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �'pl\}�
͝��C�� : �\>�S}� o � WDMClassesOfDriver MSNdis_ReceiveFilterGlobalParameters C:\Windows\system32\kernelbase.dll[MofResourceName] _NetworkType C:\Windows\system32\kernelbase.dll[MofResourceName] ���ր � 垰� w �z � F��> Y �)��
=�n� k ǰ� � & X e S q l P k g _ h a d r _ d b _ r e m o t e _ h a r d e n _ f a i l u r e EZ��7 � ; 0 XeSqlPkg_hadr_db_remote_harden_failure ( ) � �� * 8 D � � � � � � - = � � \ n � � WUU�������������������������������������������������������� � hadr_db_remote_harden_failure EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_name 4 C
� N V � ��a t � � string WmiDataId StringTermination NullTerminated Format w FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId last_lsn , C
� f n � ��y � � � string WmiDataId StringTermination NullTerminated Format w RemainingLength 6
� � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber state )
� � � � �� uint32 WmiDataId transaction_id )
� I Q � �� sint64 WmiDataId transaction_name
0 C
� � �
� ��� � � � string WmiDataId StringTermination NullTerminated Format w transaction_start_time 6
� \ d � ��o z uint64 WmiDataId Extension WmiTime xdes_id ( C
� � � � ��� string WmiDataId StringTermination NullTerminated Format w � X e S q l P k g FZ��7 �O XeSqlPkg
C � ��+ 8 q w � � � � c����� � XeSqlPkg_hadr_partner_log_send_transition Description Log send transition between log writer and log capture. Guid {0C9C200C-A64A-4C12-BE85-526B72BCE189} locale MS\0x409 DisplayName hadr_partner_log_send_transition �) X e S q l P k g _ h a d r _ p a r t n e r _ l o g _ s e n d _ t r a n s i t i o n GZ��7 �Z D 3 XeSqlPkg_hadr_partner_log_send_transition + ) � ��" -
; G � n u � � � � �
W h � � V f � � 6 I � v | WUU�����������������������������������������������������������������= � hadr_partner_log_send_transition EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid ag_database_id
< 6
� E R
� ��] h object:guid WmiDataId Extension Guid ag_id
4 6
� � � � ��� � object:guid WmiDataId Extension Guid database_name
0 C
� B J
� ��U h x � string WmiDataId StringTermination NullTerminated Format w FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId log_block_id ( )
� D L � �� uint64 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength replica_id
8 6
� - : � ��E P object:guid WmiDataId Extension Guid SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber transition_count )
� # + � �� uint32 WmiDataId transition_reason $ P
� � � � ��� � � � uint32 WmiDataId XEMapId ValueMap
� � � 7 5 6 4 3 9 0 2 8 1 Values
K g u � � � � � � � ContainsMustCatchupReplica FailedToSend FailPoint FeatureDisabled FileStreamProcessing None ReachEOL ScanGenerationChange UnableToGetPartnerLock UnableToGetScanLock transition_time 6
� O W � ��b m uint64 WmiDataId Extension WmiTime type P
� � � � ��� � � uint32 WmiDataId XEMapId ValueMap 1 0 Values & 2 LogCapture LogWriter � X e S q l P k g HZ��7 �1 XeSqlPkg
C � ��$ 1 Z ` � � � � c����� � XeSqlPkg_hadr_partner_restart_scan Description Restart partner scans for this partner. Guid {CDBD2B48-6753-480A-B435-EC78C8872D68} locale MS\0x409 DisplayName hadr_partner_restart_scan �" X e S q l P k g _ h a d r _ p a r t n e r _ r e s t a r t _ s c a n IZ��7 �� + , XeSqlPkg_hadr_partner_restart_scan $ ) � �� & 4 @ � � g n � � | � � ~ � � F V WU������������������������������������������ � hadr_partner_restart_scan EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid ag_database_id
$ 6
� > K � ��V a object:guid WmiDataId Extension Guid ag_id
6
� � � � ��� � object:guid WmiDataId Extension Guid database_name C
� ; C � ��N a q y string WmiDataId StringTermination NullTerminated Format w FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� M U ` m � �� uint32 WmiDataId Description RemainingLength replica_id
6
� � � � ��� � object:guid WmiDataId Extension Guid restart_reason P
� e m � ��x � � � � � uint32 WmiDataId XEMapId ValueMap � � � � � � 2 4 5 1 0 3 Values � � � " 5 FeatureSwitchModified MapFull MapTooBigWithGap MissedAckSequence RestartReasonNone TimeoutDetected SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g JZ��7 �C XeSqlPkg
C � ��+ 8 e k � � � � c����� � XeSqlPkg_hadr_transport_sync_send_failure Description Synchronous send failure in hadr transport. Guid {23A19244-CB46-4A45-BFD5-D96D34DB9FB9} locale MS\0x409 DisplayName hadr_transport_sync_send_failure � X e S q l P k g [��7 �i XeSqlPkg
C � ��3 @ � � � � � � c����� � XeSqlPkg_column_store_rowgroup_skip_delete_buffer Description A column store row group skips delete buffer check during a scan. Guid {3EE4306F-D8FF-42B4-B446-59A1F1352711} locale MS\0x409 DisplayName column_store_rowgroup_skip_delete_buffer �fer �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�x �\>�S}� U � WDMClassesOfDriver MMCSSTrace C:\Windows\system32\kernelbase.dll[MofResourceName] ResourceName] eName] me] ofResourceName] ��� � �^� u -��m� 8 iZ�j2 � ���5� � e]T�~ V ��� � HPX� l ̈�{ P z�?7a p ! X e S q l P k g _ s t r e t c h _ c o d e g e n _ e r r o r l o g T��7 �{ " + XeSqlPkg_stretch_codegen_errorlog # ) � �� % 3 ? � � @ K � � Y d � � 4 D WU��������������������������������� � stretch_codegen_errorlog EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� - 5 � �� uint32 WmiDataId error_log C
� � � � ��� � � � string WmiDataId StringTermination NullTerminated Format w FragmentId 6
� - 5 @ M � �� uint32 WmiDataId Description FragmentId object_id )
� � � � �� uint32 WmiDataId RemainingLength 6
� # � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g T��7 �M XeSqlPkg
C � ��& 3 t z � � � � c����� � XeSqlPkg_stretch_sync_metadata_start Description Reports the start of metadata checks during the migration task. Guid {C12AFABF-D72E-49C9-833B-D40F35610FE8} locale MS\0x409 DisplayName stretch_sync_metadata_start �$ X e S q l P k g _ s t r e t c h _ s y n c _ m e t a d a t a _ s t a r t T��7 �� . XeSqlPkg_stretch_sync_metadata_start & ) � �� ( 6 B � � C O � � % � � W���������������������������� � stretch_sync_metadata_start EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� 0 8 � �� uint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId object_id )
� � �� uint32 WmiDataId RemainingLength 6
� i q | � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g T��7 �o XeSqlPkg
C � ��- : � � � � � � c���� � XeSqlPkg_stretch_migration_batch_generation Description Reports the start or completion of the T-SQL batch generation for stretch migration Guid {a254f7fb-2e39-419e-8dfb-77f51e99ca29} locale MS\0x409 DisplayName stretch_migration_batch_generation �+ X e S q l P k g _ s t r e t c h _ m i g r a t i o n _ b a t c h _ g e n e r a t i o n T��7 �G " 5 XeSqlPkg_stretch_migration_batch_generation - ) � ��$ / = I � J U � � & p � � WU��������������������������������z � stretch_migration_batch_generation EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� 7 ? � �� uint32 WmiDataId direction )
� � � � �� sint32 WmiDataId FragmentId 6
� � � � �� uint32 WmiDataId Description FragmentId object_id )
� ] e � �� uint32 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� J R ] j � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g T��7 �. XeSqlPkg
C � �� - [ a � � � � c����� � XeSqlPkg_stretch_codegen_start Description Reports the start of stretch code generation Guid {5D50C7C5-906E-4CE3-BB5A-F49E98FB126D} locale MS\0x409 DisplayName stretch_codegen_start � X e S q l P k g _ s t r e t c h _ c o d e g e n _ s t a r t T��7 �} " ( XeSqlPkg_stretch_codegen_start ) � �� " 0 < � � = I � � ^ i � � 9 I WU��������������������������������� � stretch_codegen_start EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� * 2 � �� uint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId message_file_path C
� % � ��0 C S [ string WmiDataId StringTermination NullTerminated Format w object_id )
� � � � �� uint32 WmiDataId RemainingLength 6
� ( � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g
T��7 �D XeSqlPkg
C � ��, 9 e k � � � � c����� � XeSqlPkg_stretch_create_remote_table_start Description Reports the start of remote table creation Guid {421200F6-EDA9-4EF8-A532-CB5CB5B7A638} locale MS\0x409 DisplayName stretch_create_remote_table_start �* X e S q l P k g _ s t r e t c h _ c r e a t e _ r e m o t e _ t a b l e _ s t a r t T��7 �� 4 XeSqlPkg_stretch_create_remote_table_start , ) � ��# . < H � � I U � � + � � W����������������������������$ � stretch_create_remote_table_start EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� 6 > � �� uint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId object_id )
� � �� uint32 WmiDataId RemainingLength 6
� o w � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g T��7 �H XeSqlPkg
C � ��* 7 k q � � � � c����� � XeSqlPkg_stretch_unprovision_table_start Description Reports the start of stretch table un-provisioning Guid {C22573FC-F62F-4B01-8225-825C6CF72C72} locale MS\0x409 DisplayName stretch_unprovision_table_start �art �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�z " �\>�S}� W � WDMClassesOfDriver PoolSnapshot C:\Windows\system32\kernelbase.dll[MofResourceName] ui[MofResourceName] G��G� � �1�h� � �["�* � ˦�>� 7 Н�� � �� s�
� �" �� � ���QN � �8�c. � J珴� � ��ۥ� A �� � � 'ڝ��C�� ) ( � �� � N _ t � � �
< F x � � � U������������������������� � MDM_VPNv2_PluginProfile02 InPartition 4 B local-system local-user DMWmiBridgeProv CustomConfiguration '
� � � �� � �� string CustomStoreUrl '
� � � �� � �� string InstanceID
� 4 � �� string ParentID
� p � �� string PluginPackageFamilyName '
� � � �� � �� string ServerUrlList '
� � �� � �� string � (ڝ��C��
) � �� � F W f � � � � U������������ � MDM_VPNv2_Proxy02 InPartition , : local-system local-user DMWmiBridgeProv AutoConfigUrl '
� � � �� � �� string InstanceID
� � � �� string ParentID
� � �� string it � )ڝ��C�� ) ' � �� � M ^ g � � � � 0 8 u � � U������������������������ � MDM_VPNv2_RouteList02_01 InPartition 3 A local-system local-user DMWmiBridgeProv Address '
� � � �� � �� string ExclusionRoute '
� � � �� � �� boolean InstanceID
� ( � �� string Metric '
� m � �� � �� sint32 ParentID
� � � �� string PrefixSize '
� � � �� � �� sint32 � *ڝ��C� ) � �� � D U Z � � � � ( e o U�������������������� � MDM_VPNv2_Sso03 InPartition * 8 local-system local-user DMWmiBridgeProv Eku '
� � � �� � �� string Enabled '
� � � �� � �� boolean InstanceID
� � �� string IssuerHash
'
� ] � �� � �� string ParentID
� � � �� string � +ڝ��C�� ' ) " / � �� � U f n � � � � : K � � � � ] o � � UU�������������������������������������� � MDM_VPNv2_TrafficFilterList02_01 InPartition ; I local-system local-user DMWmiBridgeProv Claims '
� � � �� � �� string InstanceID
� � � �� string LocalAddressRanges '
� 2 � �� � �� string LocalPortRanges '
� � � �� � �� string ParentID
� � � �� string Protocol '
� � �� � �� sint32 RemoteAddressRanges '
� U � �� � �� string RemotePortRanges '
� � � �� � �� string RoutingPolicyType '
� � � �� � �� string � ,ڝ��C�� ) % 2 � �� � X i m � � � � $ * U����������������g � MDM_VPNv2_TrafficFilterList02_App04 InPartition > L local-system local-user DMWmiBridgeProv Id '
� � � �� � �� string InstanceID
� � � �� string ParentID
� � �� string Type '
� _ � �� � string M � -ڝ��C�� ! ) � �� � 4 E O � � � � # . k w � � � � . C � � UU�������������������������������� � MDM_VPNv2_User_01 InPartition ( local-user DMWmiBridgeProv AlwaysOn '
� � � �� � �� boolean ByPassForLocal '
� � � �� � �� boolean DnsSuffix '
� � �� � �� string EdpModeId '
� c � �� � �� string InstanceID
� � � �� string ParentID
� � � �� string ProfileXML '
� & � �� � �� string RememberCredentials '
� x � �� � �� boolean TrustedNetworkDetection '
� � � �� � �� string � 5ڝ��C�� ) % � �� � ; M W � � � � U����������������U � MDM_ApplicationControl InPartition - local-system DMWmiBridgeProv1 DeviceID '
� � � �� � string InstanceID
� � � �� string ParentID
� � �� string TenantID '
� M � �� � string M � 6ڝ��C��
) & 3 � �� � I [ g � � � � U������������2 � MDM_ApplicationControl_Policies01_01 InPartition ; local-system DMWmiBridgeProv1 InstanceID
� � � �� string ParentID
� � � �� string Policy 2
� % �� � �� � �� string Octetstring � 7ڝ��C�� ) $ 1 � �� � G Y e � � � � U��������������O � MDM_ApplicationControl_PolicyIDs03 InPartition 9 local-system DMWmiBridgeProv1 InstanceID
� � � �� string IsVariableLeaf
� � boolean ParentID
� � �� string Value '
� G � �� � string � 8ڝ��C�) ) % 2 � �� � H Z h � � � � / ; y � � � E N UU��������������������������� � MDM_ApplicationControl_PolicyInfo03 InPartition : local-system DMWmiBridgeProv1 FriendlyName '
� � � �� � string InstanceID
� � � �� string IsAuthorized '
� & � �� � boolean IsDeployed '
� p � �� � boolean IsEffective '
� � � �� � boolean ParentID
� � � �� string Status '
� = � �� � sint32 Version '
� � � �� � string � 9ڝ��C�� ) - � �� � C U a � � � � U��������������K � MDM_ApplicationControl_Token03 InPartition 5 local-system DMWmiBridgeProv1 InstanceID
� � � �� string IsVariableLeaf
� � boolean ParentID
� � � �� string Value '
� C � �� � string �ing �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� 1 �\>�S}� f � WDMClassesOfDriver MSNdis_AtmMaxAal0PacketSize C:\Windows\system32\kernelbase.dll[MofResourceName] sourceName] 8 0 6 E 8 8 6 6 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0 3� n� ͝��C�n xC���� M � WMIBinaryMofResource C:\Windows\system32\drivers\ndis.sys[MofResourceName] � C�P � �� � d�{�� <
w�=P, t X e S q l P k g _ l o c k _ d e a d l o c k _ c h a i n �[��7 �q h & XeSqlPkg_lock_deadlock_chain ) � �� . : � � D Q � � < I � � " l ~ � � > D L W � � * ; � � \ h � � Z
o
� � �
�
E Q � � WUUUU��������������������������������������������������������������������������������������������������� � lock_deadlock_chain EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid associated_object_id L )
� 1 9 � �� uint64 WmiDataId database_id ( )
� � � � �� uint32 WmiDataId database_name ^ C
� � � �� ! 1 9 string WmiDataId StringTermination NullTerminated Format w deadlock_id D )
� � � � �� uint32 WmiDataId FragmentId 6
� � � � � �� uint32 WmiDataId Description FragmentId lockspace_nest_id 4 )
� Y a � �� uint32 WmiDataId lockspace_sub_id 0 )
� � � � �� uint32 WmiDataId lockspace_workspace_id
, 4
� " *
� ��5 �� object WmiDataId Pointer mode P
� � � � ��� B � � r z uint32 WmiDataId XEMapId ValueMap $ ( + . 1 5 8 < @ D H L P T X [ ^ a d h k o 12 6 7 8 21 0 15 16 17 18 13 14 19 20 3 2 1 9 10 4 11 5 Values � � � � � � � � & ) 0 7 < A D I BU IS IU IX LAST_MODE NL RI_NL RI_S RI_U RI_X RS_S RS_U RX_S RX_U S SCH_M SCH_S SIU SIX U UIX X object_id H )
� � � � �� sint32 WmiDataId owner_type P
� � �� > ' 1 m u uint32 WmiDataId XEMapId ValueMap U X [ ^ a d g j 2 5 8 6 7 3 4 1 Values � � � � � � Cursor ExclusiveXactWorkspace LastLockInfoOwner LockConflictNotificationObject LockTableIterator Session SharedXactWorkspace Transaction RemainingLength 6
� � � � � �� uint32 WmiDataId Description RemainingLength resource_0
8 )
� � �
� �� uint32 WmiDataId resource_1 < )
� I Q � �� uint32 WmiDataId resource_2 @ )
� � � � �� uint32 WmiDataId resource_description Z C
�
!
� ��,
?
O
W
string WmiDataId StringTermination NullTerminated Format w resource_owner_type V P
� �
�
� ���
� �
�
) 4 uint32 WmiDataId XEMapId BitMap " % 4 16 8 1 64 2 32 BitValues T ^ h q w � � EXCHANGE EXTERNAL GENERIC LOCK MATRIX_PARALLEL_QUERY THREAD WAITFOR resource_type P
� � �� = ( 2 � � uint32 WmiDataId XEMapId ValueMap ~ � � � � � � � � � � � � � � � � � 13 10 2 8 3 12 7 17 11 1 5 14 6 9 15 0 4 16 Values
!
.
8
@
F
L
Q
`
j
y
�
�
�
�
�
�
�
ALLOCATION_UNIT APPLICATION DATABASE EXTENT FILE HOBT KEY LAST_RESOURCE METADATA NULL_RESOURCE OBJECT OIB PAGE RID ROWGROUP UNKNOWN_LOCK_RESOURCE UNUSED1 XACT SequenceNumber 6
� ( 5 � �� uint32 WmiDataId Description SequenceNumber session_id T )
� � � � �� sint16 WmiDataId transaction_id )
� � � � �� sint64 WmiDataId � X e S q l P k g �[��7 �� XeSqlPkg
C � �� ' � � * 7 c����H � XeSqlPkg_lock_escalation Description Occurs when a fine-grain lock is converted into a coarser-grain lock, such as when a row lock is converted into an object lock. Use this event to monitor how locks are being used on the server. Guid {cf7f0653-e16c-46b8-bdf4-5420bd5568a1} locale MS\0x409 DisplayName lock_escalation � X e S q l P k g _ d t c _ t r a n s a c t i o n �[��7 �� , " XeSqlPkg_dtc_transaction ) � �� * 6 � � \ m } � � � c v � � WU������������������������������������������ � dtc_transaction EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid FragmentId 6
� 0 8 C P � �� uint32 WmiDataId Description FragmentId isolation_level P
� � � � ��� � � ( uint32 WmiDataId XEMapId ValueMap
256 4096 65536 1048576 Values < N ^ o Read Uncommitted Read Committed Repeatable Read Serializable RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength resource_manager_id
% 6
� \ i � ��t object:guid WmiDataId Extension Guid SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber transaction_id )
� P X � �� sint64 WmiDataId transaction_state P
� � � � ��� � � � � uint8 WmiDataId XEMapId ValueMap e h k n q t w z } � � � � � � � � � � � � � � � � � 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 Values 7 D [ d v � � � � ( E b v � � � � � + N t � Get address Propagate Transaction Do Work Close connection Session has not participated in a DTC transaction IDLE Creating a new DTC transaction Enlisting in a DTC transaction DTC Transaction active Internal commit Internal abort Internal asynchronous abort Imported Transaction Active Prepare Initialize Preparing Transaction Transaction is prepared Transaction is aborting Transaction is committing Asynchronous Abort Disaster Detected Abort Drain Asynchronous Abort Complete TM failed while in prepared state Recovery failed due to RMID mismatch Recovered all in-doubt transactions Unknown unit_of_work_id
! 6
� � � �� object:guid WmiDataId Extension Guid � X e S q l P k g �[��7 �L XeSqlPkg
C � ��) 6 p v � � � � c����� � XeSqlPkg_marked_transaction_latch_trace Description Debugging diagnostics about the marked transaction latch Guid {60a21868-61d2-4bfa-a49b-05e7b6c6df91} locale MS\0x409 DisplayName marked_transaction_latch_trace �ace �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�~ & �\>�S}� [ � WDMClassesOfDriver KernelPerfStates C:\Windows\system32\kernelbase.dll[MofResourceName] i[MofResourceName] ] ata_agent_catalog_updated � }J�M� � ��� ���� �#!� � G�f�� L-�� /�&� �Q��
3��z� �L���
� ��!� ɡP�� J�
u U � ��Dd/ �3F " �V�h t��zy a�3� �� � 4��
�3�~� ��=�� 4 3 C 8 6 C 3 E 5 B 2 B 7 F 1 D D 0 4 4 3 A 6 D A 4 E 1 7 A A 9 5 D 6 5 F 5 6 E E 0 C 1 9 C F 4 F D 3 B 5 D 9 A 5 F 6 3 C 5 2 2 �"�U�T�u͝��C�o 0 9 �� N � HNet_Connection {047525BC-A893-436A-91E8-557852561637} Ethernet Instance 0 A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 �"�U�T�v͝��C�| �� Z � HNet_ConnectionProperties HNet_Connection.Guid="{047525BC-A893-436A-91E8-557852561637}" R O O T \ M i c r o s o f t \ H o m e N e t H N e t _ C o n n e c t i o n P r o p e r t i e s
C o n n e c t i o n � N S _ 5 1 1 6 2 6 F A E 4 F 5 7 D B D 2 0 D F 5 C D 4 4 A 4 1 D A E C E D 2 8 C F 7 B 3 F D 8 B 1 2 0 1 2 C 7 F 4 B 5 8 F 4 4 E 6 6 5 \ K I _ A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 \ I _ 5 A B E 0 A 3 C 0 3 A 4 B D C 6 C E 5 A C 2 2 6 1 4 4 B A 9 8 A B D 8 1 F C 1 9 0 5 8 9 D 6 1 F 4 F B 6 7 A 3 4 2 5 2 F 7 4 F D X 4 3 C 8 6 C 3 E 5 B 2 B 7 F 1 D D 0 4 4 3 A 6 D A 4 E 1 7 A A 9 5 D 6 5 F 5 6 E E 0 C 1 9 C F 4 F D 3 B 5 D 9 A 5 F 6 3 C 5 2 2 �"�U�T�u͝��C�f 0 9 �� E � HNet_Connection {D12DED2F-AEFC-4788-A733-FAA9E04B44C7} Ethernet 2 A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 �"�U�T�v͝��C�| �� Z � HNet_ConnectionProperties HNet_Connection.Guid="{D12DED2F-AEFC-4788-A733-FAA9E04B44C7}" R O O T \ M i c r o s o f t \ H o m e N e t H N e t _ C o n n e c t i o n P r o p e r t i e s
C o n n e c t i o n � N S _ 5 1 1 6 2 6 F A E 4 F 5 7 D B D 2 0 D F 5 C D 4 4 A 4 1 D A E C E D 2 8 C F 7 B 3 F D 8 B 1 2 0 1 2 C 7 F 4 B 5 8 F 4 4 E 6 6 5 \ K I _ A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 \ I _ 5 A 8 2 1 8 7 B A D F D 0 5 C B F 9 0 D D A D A B 6 2 8 3 3 2 B F 3 B 6 4 F E A B C 1 C 8 9 9 9 5 4 6 5 9 A 9 4 C F 1 2 8 C 8 1 ��4 3 C 8 6 C 3 E 5 B 2 B 7 F 1 D D 0 4 4 3 A 6 D A 4 E 1 7 A A 9 5 D 6 5 F 5 6 E E 0 C 1 9 C F 4 F D 3 B 5 D 9 A 5 F 6 3 C 5 2 2 �"�U�T�u͝��C�q 0 9 �� P � HNet_Connection {0A645F4E-68C0-4C76-B4A3-0921C9718BDD} Local Area Connection A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 �"�U�T�v͝��C�| �� Z � HNet_ConnectionProperties HNet_Connection.Guid="{0A645F4E-68C0-4C76-B4A3-0921C9718BDD}" R O O T \ M i c r o s o f t \ H o m e N e t H N e t _ C o n n e c t i o n P r o p e r t i e s
C o n n e c t i o n � N S _ 5 1 1 6 2 6 F A E 4 F 5 7 D B D 2 0 D F 5 C D 4 4 A 4 1 D A E C E D 2 8 C F 7 B 3 F D 8 B 1 2 0 1 2 C 7 F 4 B 5 8 F 4 4 E 6 6 5 \ K I _ A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 \ I _ 4 1 F 4 0 B 0 A E D 8 0 D A 6 4 6 B B 3 A 5 4 C 3 4 C B D A F 7 2 A D B 4 E 6 4 1 4 1 4 1 6 C 5 4 3 4 8 9 2 B 2 4 E B 7 F 4 2 9 ��4 3 C 8 6 C 3 E 5 B 2 B 7 F 1 D D 0 4 4 3 A 6 D A 4 E 1 7 A A 9 5 D 6 5 F 5 6 E E 0 C 1 9 C F 4 F D 3 B 5 D 9 A 5 F 6 3 C 5 2 2 �"�U�T�u͝��C�f 0 9 �� E � HNet_Connection {2DBE1C3C-12E7-4095-90AF-AC78BF10DD42} Ethernet 2 A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 �"�U�T�v͝��C�| �� Z � HNet_ConnectionProperties HNet_Connection.Guid="{2DBE1C3C-12E7-4095-90AF-AC78BF10DD42}" R O O T \ M i c r o s o f t \ H o m e N e t H N e t _ C o n n e c t i o n P r o p e r t i e s
C o n n e c t i o n � N S _ 5 1 1 6 2 6 F A E 4 F 5 7 D B D 2 0 D F 5 C D 4 4 A 4 1 D A E C E D 2 8 C F 7 B 3 F D 8 B 1 2 0 1 2 C 7 F 4 B 5 8 F 4 4 E 6 6 5 \ K I _ A 0 1 0 8 C E 2 6 1 D 6 C D 7 0 D 3 5 0 F 5 B 7 2 F 2 E 9 8 7 4 A E 6 E 0 0 4 D 3 0 2 9 0 1 5 B 0 9 1 9 B 1 B D 3 2 6 B B 6 4 9 \ I _ 6 3 1 0 7 F 0 6 1 0 D 2 0 6 9 9 8 9 5 2 C 3 8 8 A 6 8 4 3 8 6 1 6 0 A 4 D C D E F 3 7 F A 7 5 D A 7 E 7 E 7 9 4 B 0 0 5 E 0 3 5 9 A B 5 3 8 0 6 E 8 8 6 6 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0 �b��5� ͝��C�x �f3��5��� W � WMIBinaryMofResource C:\Windows\System32\drivers\en-US\ACPI.sys.mui[ACPIMOFResource] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �b��5�
͝��C�� �f3��5� ` � WDMClassesOfDriver ACPITrace C:\Windows\System32\drivers\en-US\ACPI.sys.mui[ACPIMOFResource] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4
�b��5�
͝��C�� # �f3��5� d � WDMClassesOfDriver AMLIEvalData1 C:\Windows\System32\drivers\en-US\ACPI.sys.mui[ACPIMOFResource] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �b��5�
͝��C�� . �f3��5� o � WDMClassesOfDriver AMLIEvalData1_TypeGroup1 C:\Windows\System32\drivers\en-US\ACPI.sys.mui[ACPIMOFResource] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 -�b��5�
͝��C�� & �x! �5� ^ � WDMClassesOfDriver MSProcessorClass C:\Windows\System32\drivers\processr.sys[PROCESSORWMI] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 .�b��5�
͝��C�� & �x! �5� ^ � WDMClassesOfDriver PerformanceState C:\Windows\System32\drivers\processr.sys[PROCESSORWMI] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 /�b��5�
͝��C�� ' �x! �5� _ � WDMClassesOfDriver PerformanceStates C:\Windows\System32\drivers\processr.sys[PROCESSORWMI] 9 A B 5 3 8 0 6 E 8 8 6 6 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0 F�b��5� ͝��C�q �F �5��� P � WMIBinaryMofResource C:\Windows\System32\drivers\HDAudBus.sys[HDAudioMofName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ^�b��5�
͝��C�z " -e3 �5� W � WDMClassesOfDriver PortClsEvent C:\Windows\System32\Drivers\portcls.SYS[PortclsMof] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/pl\}�
͝��C�� ��
�S}� ] � WDMClassesOfDriver WMIEvent C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/pl\}�
͝��C�� $ ��
�S}� c � WDMClassesOfDriver MS_WmiInternal C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/pl\}�
͝��C�� $ ��
�S}� c � WDMClassesOfDriver MS_WmiInternal C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] ofResourceName] 9 A B 5 3 8 0 6 E 8 8 6 6 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0 K���`�� ͝��C�n �q�"=g� M � WMIBinaryMofResource C:\Windows\system32\drivers\ndis.sys[MofResourceName] ourceName] e] i��&� � \�Y$ t }�-Ș � �P� ,
l ��� � ��Sc, � Q,� � ��Хh � YsQZ� � & X e S q l P k g _ r e m o t e _ d m v _ s t r e a m _ o p e n _ s e r v e r �X��7 � + 0 XeSqlPkg_remote_dmv_stream_open_server ( ) � �� * 8 D � � I [ � � ! 3 } � � � � � WU�����������������������������������������? � remote_dmv_stream_open_server EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid client_brick_id )
� 6 > � �� uint32 WmiDataId client_stream_id )
� � � � �� uint32 WmiDataId FragmentId 6
� � � � �� uint32 WmiDataId Description FragmentId internal_stvf_id )
� j r � �� uint32 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� W _ j w � �� uint32 WmiDataId Description SequenceNumber server_brick_id )
� � � � �� uint32 WmiDataId server_session_id $ )
� , 4 � �� uint32 WmiDataId � X e S q l P k g �X��7 �L XeSqlPkg
C � ��, 9 m s � � � � c����� � XeSqlPkg_remote_dmv_stream_get_rows_client Description Remote DMV stream get_row client side call is made Guid {2EA3354C-748D-4aec-9656-157F84994C1A} locale MS\0x409 DisplayName remote_dmv_stream_get_rows_client �* X e S q l P k g _ r e m o t e _ d m v _ s t r e a m _ g e t _ r o w s _ c l i e n t �X��7 �( + 4 XeSqlPkg_remote_dmv_stream_get_rows_client , ) � ��# . < H � M _ � � % 7 � � � � � � WU�����������������������������������������C � remote_dmv_stream_get_rows_client EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid client_brick_id )
� : B � �� uint32 WmiDataId client_stream_id )
� � � � �� uint32 WmiDataId FragmentId 6
� � � �� uint32 WmiDataId Description FragmentId internal_stvf_id )
� n v � �� uint32 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� [ c n { � �� uint32 WmiDataId Description SequenceNumber server_brick_id )
� � � � �� uint32 WmiDataId server_session_id $ )
� 0 8 � �� uint32 WmiDataId � X e S q l P k g �X��7 �D XeSqlPkg
C � ��, 9 e k � � � � c����� � XeSqlPkg_remote_dmv_stream_get_rows_server Description Remote DMV stream get_row call is serviced Guid {58945AC1-FDFD-4f70-BB35-9AF55E39D620} locale MS\0x409 DisplayName remote_dmv_stream_get_rows_server �* X e S q l P k g _ r e m o t e _ d m v _ s t r e a m _ g e t _ r o w s _ s e r v e r �X��7 �( + 4 XeSqlPkg_remote_dmv_stream_get_rows_server , ) � ��# . < H � M _ � � % 7 � � � � � � WU�����������������������������������������C � remote_dmv_stream_get_rows_server EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid client_brick_id )
� : B � �� uint32 WmiDataId client_stream_id )
� � � � �� uint32 WmiDataId FragmentId 6
� � � �� uint32 WmiDataId Description FragmentId internal_stvf_id )
� n v � �� uint32 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� [ c n { � �� uint32 WmiDataId Description SequenceNumber server_brick_id )
� � � � �� uint32 WmiDataId server_session_id $ )
� 0 8 � �� uint32 WmiDataId � X e S q l P k g �X��7 �\ XeSqlPkg
C � ��5 B t z � � � � c����� � XeSqlPkg_remote_dmv_stream_release_resources_client Description Remote DMV stream release resources call is made Guid {73648C0C-5F42-4e67-A388-51AB9041D38D} locale MS\0x409 DisplayName remote_dmv_stream_release_resources_client �3 X e S q l P k g _ r e m o t e _ d m v _ s t r e a m _ r e l e a s e _ r e s o u r c e s _ c l i e n t �X��7 �: + = XeSqlPkg_remote_dmv_stream_release_resources_client 5 ) � ��, 7 E Q � V h � � . @ � � � � � WU�����������������������������������������L � remote_dmv_stream_release_resources_client EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid client_brick_id )
� C K � �� uint32 WmiDataId client_stream_id )
� � � � �� uint32 WmiDataId FragmentId 6
�
" � �� uint32 WmiDataId Description FragmentId internal_stvf_id )
� w � �� uint32 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� d l w � � �� uint32 WmiDataId Description SequenceNumber server_brick_id )
� � � � �� uint32 WmiDataId server_session_id $ )
� 9 A � �� uint32 WmiDataId � X e S q l P k g �X��7 �` XeSqlPkg
C � ��5 B x ~ � � � � c����� � XeSqlPkg_remote_dmv_stream_release_resources_server Description Remote DMV stream release resources call is serviced Guid {56C2FE1B-D6A7-4928-BAB5-7581872D8E1A} locale MS\0x409 DisplayName remote_dmv_stream_release_resources_server � X e S o s P k g �^��7 �t XeSosPkg
C � ��> K � � � � � � _���� � XeSosPkg_scheduler_monitor_non_yielding_ring_buffer_recorded Description Nonyielding ring buffer recorded for scheduler monitor Guid {7aae9df9-93e7-40bf-a16a-398a8f3240d7} locale MS\0x409 DisplayName scheduler_monitor_non_yielding_ring_buffer_recorded �ded �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�� 0 �\>�S}� e � WDMClassesOfDriver TP_V2_TimerExpirationGroup C:\Windows\system32\kernelbase.dll[MofResourceName] me] Name] me] WmiDataId �iption XactSequence �e] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�� ) �\>�S}� ^ � WDMClassesOfDriver UdpIp_V1_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�x �\>�S}� U � WDMClassesOfDriver Image_Load C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�� , �\>�S}� a � WDMClassesOfDriver LoaderDllSearchResults C:\Windows\system32\kernelbase.dll[MofResourceName] ResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�� , �\>�S}� a � WDMClassesOfDriver LoaderDllSearchResults C:\Windows\system32\kernelbase.dll[MofResourceName] esourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�� , �\>�S}� a � WDMClassesOfDriver LoaderDllSearchResults C:\Windows\system32\kernelbase.dll[MofResourceName] rceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�� , �\>�S}� a � WDMClassesOfDriver LoaderDllSearchResults C:\Windows\system32\kernelbase.dll[MofResourceName] eName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�� , �\>�S}� a � WDMClassesOfDriver LoaderDllSearchResults C:\Windows\system32\kernelbase.dll[MofResourceName] eName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�� , �\>�S}� a � WDMClassesOfDriver LoaderDllSearchResults C:\Windows\system32\kernelbase.dll[MofResourceName] urceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�� , �\>�S}� a � WDMClassesOfDriver LoaderDllSearchResults C:\Windows\system32\kernelbase.dll[MofResourceName] rceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�� , �\>�S}� a � WDMClassesOfDriver LoaderDllSearchResults C:\Windows\system32\kernelbase.dll[MofResourceName] ] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�� , �\>�S}� a � WDMClassesOfDriver LoaderDllSearchResults C:\Windows\system32\kernelbase.dll[MofResourceName] 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�� , �\>�S}� a � WDMClassesOfDriver LoaderDllSearchResults C:\Windows\system32\kernelbase.dll[MofResourceName] urceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�� , �\>�S}� a � WDMClassesOfDriver LoaderDllSearchResults C:\Windows\system32\kernelbase.dll[MofResourceName] me] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�� , �\>�S}� a � WDMClassesOfDriver LoaderDllSearchResults C:\Windows\system32\kernelbase.dll[MofResourceName] urceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�� , �\>�S}� a � WDMClassesOfDriver LoaderDllSearchResults C:\Windows\system32\kernelbase.dll[MofResourceName] eName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�� , �\>�S}� a � WDMClassesOfDriver LoaderDllSearchResults C:\Windows\system32\kernelbase.dll[MofResourceName] 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�� , �\>�S}� a � WDMClassesOfDriver LoaderDllSearchResults C:\Windows\system32\kernelbase.dll[MofResourceName] urceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�� , �\>�S}� a � WDMClassesOfDriver LoaderDllSearchResults C:\Windows\system32\kernelbase.dll[MofResourceName] ] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�� , �\>�S}� a � WDMClassesOfDriver LoaderDllSearchResults C:\Windows\system32\kernelbase.dll[MofResourceName] ] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�� , �\>�S}� a � WDMClassesOfDriver LoaderDllSearchResults C:\Windows\system32\kernelbase.dll[MofResourceName] ourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�� , �\>�S}� a � WDMClassesOfDriver LoaderDllSearchResults C:\Windows\system32\kernelbase.dll[MofResourceName] eName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�� , �\>�S}� a � WDMClassesOfDriver LoaderDllSearchResults C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�� * �\>�S}� _ � WDMClassesOfDriver PageFault_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] l[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�� * �\>�S}� _ � WDMClassesOfDriver PageFault_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] [MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�� * �\>�S}� _ � WDMClassesOfDriver PageFault_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] ceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�� * �\>�S}� _ � WDMClassesOfDriver PageFault_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] me] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�� * �\>�S}� _ � WDMClassesOfDriver PageFault_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] me] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �+pl\}�
͝��C�� * �\>�S}� _ � WDMClassesOfDriver PageFault_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] V�����
͝��C�u ��7��� R � WDMClassesOfDriver Mark_V0 C:\Windows\system32\kernelbase.dll[MofResourceName] �/;� � w 6 y �]Pg� ; 3�~�� l /�e@ � ?O�s Y
��Hr � Y�W+ < �|Tpg B & X e S q l P k g _ p f s _ m a r k e r _ f i l e _ e r r o r _ l o g g i n g �V��7 � " 0 XeSqlPkg_pfs_marker_file_error_logging ( ) � �� * 8 D � � � � � � 4 > � � WU��������������������������������T � pfs_marker_file_error_logging EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid Error_Message C
� N V � ��a t � � string WmiDataId StringTermination NullTerminated Format w FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId Function_Module C
� m u � ��� � � � string WmiDataId StringTermination NullTerminated Format w RemainingLength 6
� # � �� uint32 WmiDataId Description RemainingLength resource C
� � � � ��� � � � string WmiDataId StringTermination NullTerminated Format w SequenceNumber 6
� $ , 7 D � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �V��7 �Q XeSqlPkg
C � ��. ; p v � � � � c����� � XeSqlPkg_pfs_metadata_consistency_validation Description Metadata consistency validation information for PFS Guid {94d48e1c-b9b1-41e3-b112-6ae576b0e846} locale MS\0x409 DisplayName pfs_metadata_consistency_validation �, X e S q l P k g _ p f s _ m e t a d a t a _ c o n s i s t e n c y _ v a l i d a t i o n �V��7 �� / 6 XeSqlPkg_pfs_metadata_consistency_validation . ) � ��% 0
> J � p ~ , � � k � � � 2 C � � T d WU��������������������������������������������� � pfs_metadata_consistency_validation EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid FragmentId 6
� D L W d � �� uint32 WmiDataId Description FragmentId metadata_key C
� � � � ��� �
string WmiDataId StringTermination NullTerminated Format w metadata_marker_file_value $ C
� } � � ��� � � � string WmiDataId StringTermination NullTerminated Format w metadata_sql_stored_value C
� * 2 � ��= P ` h string WmiDataId StringTermination NullTerminated Format w metadata_validation_result )
� � � � �� uint32 WmiDataId metdata_mismatch_type )
� ' � �� uint32 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength resource
( C
�
� ��& 9 I Q string WmiDataId StringTermination NullTerminated Format w SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �V��7 �D XeSqlPkg
C � �� , r x � � � � c����� � XeSqlPkg_xio_retry_task_stats Description Indicates the number of I/O requests processed by the IO retry task. Guid {0244BDAB-2C85-47DF-852A-CCE670CFDC98} locale MS\0x409 DisplayName xio_retry_task_stats � X e S q l P k g _ x i o _ r e t r y _ t a s k _ s t a t s �V��7 �� / ' XeSqlPkg_xio_retry_task_stats ) � �� !
/ ; � � a y � � 6 � � � � C O � � / WU��������������������������������������������� � xio_retry_task_stats EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid FragmentId 6
� 5 = H U � �� uint32 WmiDataId Description FragmentId IOs_failed_after_retry
( )
� � �
� �� uint32 WmiDataId IOs_fast_failed $ )
� � �� uint32 WmiDataId IOs_queued_after_retry )
� m u � �� uint32 WmiDataId IOs_queued_for_wait )
� � � � �� uint32 WmiDataId IOs_retried_successfully )
� 0 8 � �� uint32 WmiDataId queue_size )
� � � � �� uint32 WmiDataId RemainingLength 6
� � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� s { � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �V��7 �1 XeSqlPkg
C � ��' 4 W ] � � � � c����� � XeSqlPkg_xio_lease_renewal_task_stats Description XStore blobs lease renewal stats. Guid {5199374B-1FAA-41A6-B319-5BBEDAA4665B} locale MS\0x409 DisplayName xio_lease_renewal_task_stats �% X e S q l P k g _ x i o _ l e a s e _ r e n e w a l _ t a s k _ s t a t s �V��7 �W . / XeSqlPkg_xio_lease_renewal_task_stats ' ) � �� ) 7 C � � i y � � . � � ' : WU��������������������������������������������� � xio_lease_renewal_task_stats EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid FragmentId 6
� = E P ] � �� uint32 WmiDataId Description FragmentId leases_checked )
� � � � �� uint64 WmiDataId leases_renewed $ )
�
� �� uint64 WmiDataId RemainingLength 6
� r z � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � �
� �� uint32 WmiDataId Description SequenceNumber total_lease_count )
� q y � �� uint64 WmiDataId � X e S q l P k g �V��7 � XeSqlPkg
C � �� ' G M u } � � c����� � XeSqlPkg_xstore_io_stats Description XStore I/O request statistics. Guid {8BC549DC-0FE8-4C25-824B-BD3124080523} locale MS\0x409 DisplayName xstore_io_stats � X e S q l P k g 6X��7 � XeSqlPkg
C � ��! . F L t | � � c����� � XeSqlPkg_query_memory_pre_grant Description Query memory pre-grant Guid {73ebeff7-1300-42d1-aa39-ce871b412785} locale MS\0x409 DisplayName query_memory_pre_grant �ant �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�} % �\>�S}� Z � WDMClassesOfDriver TP_V2_CBDequeue C:\Windows\system32\kernelbase.dll[MofResourceName] me] ourceName] rceName] n XactSequence �e] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� ( )ߝ�t � ] � WDMClassesOfDriver ThreadPoolTrace_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] ourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� ( )ߝ�t � ] � WDMClassesOfDriver ThreadPoolTrace_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] ceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� ( )ߝ�t � ] � WDMClassesOfDriver ThreadPoolTrace_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� + )ߝ�t � ` � WDMClassesOfDriver TP_V2_TimerExpiration C:\Windows\system32\kernelbase.dll[MofResourceName] ceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� + )ߝ�t � ` � WDMClassesOfDriver TP_V2_TimerExpiration C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� + )ߝ�t � ` � WDMClassesOfDriver TP_V2_TimerExpiration C:\Windows\system32\kernelbase.dll[MofResourceName] Name] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� + )ߝ�t � ` � WDMClassesOfDriver TP_V2_TimerExpiration C:\Windows\system32\kernelbase.dll[MofResourceName] fResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� + )ߝ�t � ` � WDMClassesOfDriver TP_V2_TimerExpiration C:\Windows\system32\kernelbase.dll[MofResourceName] MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� + )ߝ�t � ` � WDMClassesOfDriver TP_V2_TimerExpiration C:\Windows\system32\kernelbase.dll[MofResourceName] eName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� + )ߝ�t � ` � WDMClassesOfDriver TP_V2_TimerExpiration C:\Windows\system32\kernelbase.dll[MofResourceName] sourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� + )ߝ�t � ` � WDMClassesOfDriver TP_V2_TimerExpiration C:\Windows\system32\kernelbase.dll[MofResourceName] ceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� + )ߝ�t � ` � WDMClassesOfDriver TP_V2_TimerExpiration C:\Windows\system32\kernelbase.dll[MofResourceName] fResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� + )ߝ�t � ` � WDMClassesOfDriver TP_V2_TimerExpiration C:\Windows\system32\kernelbase.dll[MofResourceName] fResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� + )ߝ�t � ` � WDMClassesOfDriver TP_V2_TimerExpiration C:\Windows\system32\kernelbase.dll[MofResourceName] dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� + )ߝ�t � ` � WDMClassesOfDriver TP_V2_TimerExpiration C:\Windows\system32\kernelbase.dll[MofResourceName] ourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� + )ߝ�t � ` � WDMClassesOfDriver TP_V2_TimerExpiration C:\Windows\system32\kernelbase.dll[MofResourceName] rceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� + )ߝ�t � ` � WDMClassesOfDriver TP_V2_TimerExpiration C:\Windows\system32\kernelbase.dll[MofResourceName] urceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� + )ߝ�t � ` � WDMClassesOfDriver TP_V2_TimerExpiration C:\Windows\system32\kernelbase.dll[MofResourceName] e] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� + )ߝ�t � ` � WDMClassesOfDriver TP_V2_TimerExpiration C:\Windows\system32\kernelbase.dll[MofResourceName] .dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� + )ߝ�t � ` � WDMClassesOfDriver TP_V2_TimerExpiration C:\Windows\system32\kernelbase.dll[MofResourceName] ourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� + )ߝ�t � ` � WDMClassesOfDriver TP_V2_TimerExpiration C:\Windows\system32\kernelbase.dll[MofResourceName] me] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� + )ߝ�t � ` � WDMClassesOfDriver TP_V2_TimerExpiration C:\Windows\system32\kernelbase.dll[MofResourceName] urceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� + )ߝ�t � ` � WDMClassesOfDriver TP_V2_TimerExpiration C:\Windows\system32\kernelbase.dll[MofResourceName] esourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� + )ߝ�t � ` � WDMClassesOfDriver TP_V2_TimerExpiration C:\Windows\system32\kernelbase.dll[MofResourceName] rceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� + )ߝ�t � ` � WDMClassesOfDriver TP_V2_TimerExpiration C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� + )ߝ�t � ` � WDMClassesOfDriver TP_V2_TimerExpiration C:\Windows\system32\kernelbase.dll[MofResourceName] urceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� + )ߝ�t � ` � WDMClassesOfDriver TP_V2_TimerExpiration C:\Windows\system32\kernelbase.dll[MofResourceName] ] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� + )ߝ�t � ` � WDMClassesOfDriver TP_V2_TimerExpiration C:\Windows\system32\kernelbase.dll[MofResourceName] � 5 = J string Description Text � � �n ID � _*�� � ,J � 7 �8� 3 �N��
t �iP_} � �{p� r ��`� gfϮ� � ��9 ^ - X e S q l P k g _ c o l u m n _ s t o r e _ r o w g r o u p _ r o u t e _ r o l l b a c k [��7 �8 ? 7 XeSqlPkg_column_store_rowgroup_route_rollback / ) � ��& 1 ? K � L ` � � & / y � � � � � � WU�������������������������������������������������������������< � column_store_rowgroup_route_rollback EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� 9 A � �� uint64 WmiDataId detour_rowgroup_id , )
� � � � �� uint64 WmiDataId FragmentId 6
� �
� �� uint32 WmiDataId Description FragmentId hobt_id )
� f n � �� uint64 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� S [ f s � �� uint32 WmiDataId Description SequenceNumber skip_rowgroup_id $ )
� � � � �� uint64 WmiDataId version_timestamp 4 )
� ) 1 � �� uint64 WmiDataId � X e S q l P k g [��7 �d XeSqlPkg
C � ��. ; � � � � � � c����� � XeSqlPkg_column_store_rowgroup_route_removed Description A route for a rowgroup version was removed for being no longer needed. Guid {96583686-0b46-4982-8eeb-17412cdabc5e} locale MS\0x409 DisplayName column_store_rowgroup_route_removed �, X e S q l P k g _ c o l u m n _ s t o r e _ r o w g r o u p _ r o u t e _ r e m o v e d [��7 �� 7 6 XeSqlPkg_column_store_rowgroup_route_removed . ) � ��% 0 > J � K W � � + � � � { � WU������������������������������������������������������ � column_store_rowgroup_route_removed EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� 8 @ � �� uint64 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId hobt_id )
� � �� uint64 WmiDataId RemainingLength 6
� o w � � � �� uint32 WmiDataId Description RemainingLength rowgroup_id $ )
� � � � �� uint64 WmiDataId SequenceNumber 6
� K S ^ k � �� uint32 WmiDataId Description SequenceNumber version_timestamp , )
� � � � �� uint64 WmiDataId � X e S q l P k g [��7 �L XeSqlPkg
C � ��+ 8 n t � � � � c����� � XeSqlPkg_column_store_acquire_insert_lock Description An attempt to lock an open deltastore for insertion. Guid {E5D26085-DB81-4BC9-B8D1-FFF1D4385AEC} locale MS\0x409 DisplayName column_store_acquire_insert_lock �) X e S q l P k g _ c o l u m n _ s t o r e _ a c q u i r e _ i n s e r t _ l o c k [��7 �( 2 3 XeSqlPkg_column_store_acquire_insert_lock + ) � ��" - ; G � � H X � � �
z � � � 3 D � � WU������������������������������������������������= � column_store_acquire_insert_lock EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� 5 = � �� uint16 WmiDataId delta_store_id )
� � � � �� uint64 WmiDataId delta_store_isnew & )
� � � � �� sint8 WmiDataId FragmentId 6
� N V a n � �� uint32 WmiDataId Description FragmentId hobt_id )
� � � � �� uint64 WmiDataId lock_attempt_timeout_count ' )
� ( � �� uint64 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
�
- � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g [��7 �J XeSqlPkg
C � ��) 6 n t � � � � c����� � XeSqlPkg_column_store_segment_eliminate Description A filter eliminated a columnstore segment during scan. Guid {40327607-1075-4408-86db-abadc0cc7e33} locale MS\0x409 DisplayName column_store_segment_eliminate �' X e S q l P k g _ c o l u m n _ s t o r e _ s e g m e n t _ e l i m i n a t e [��7 �� ) 1 XeSqlPkg_column_store_segment_eliminate ) ) � �� + 9 E � � k t � � D Q � � 4 ~ � WU���������������������������������������� � column_store_segment_eliminate EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid FragmentId 6
� ? G R _ � �� uint32 WmiDataId Description FragmentId hobt_id )
� � � � �� uint64 WmiDataId RemainingLength 6
� & 3 � �� uint32 WmiDataId Description RemainingLength rowgroup_id " )
� � � � �� uint32 WmiDataId SequenceNumber 6
� � � � �� uint32 WmiDataId Description SequenceNumber transaction_id_high )
� k s � �� uint16 WmiDataId transaction_id_low )
� � � � �� uint32 WmiDataId � X e S q l P k g [��7 �\ XeSqlPkg
C � ��( 5 � � � � � � c����� � XeSqlPkg_column_store_filters_pushdown Description A list of filters for columnstore index was pushed down to storage engine. Guid {44f06131-6c95-434e-bdc6-2da258dbf7e5} locale MS\0x409 DisplayName column_store_filters_pushdown � X e S q l P k g z\��7 �6 XeSqlPkg
C � �� ( h n � � � � c����� � XeSqlPkg_bad_memory_fixed Description Database page with bad memory detected by the operating system Guid {8a1a5ec8-082f-4e03-95f7-60913fba0824} locale MS\0x409 DisplayName bad_memory_fixed �xed �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�� - �\>�S}� b � WDMClassesOfDriver MSTapeDriveProblemEvent C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�� * �\>�S}� _ � WDMClassesOfDriver MSTapeProblemIoError C:\Windows\system32\kernelbase.dll[MofResourceName] l[MofResourceName] FFB8F4 n XactSequence �e] �$ P �s��p � �(,X � r�� � ! X e S q l P k g _ q u e r y v m _ c o n t e x t _ s h i p p i n g Q\��7 �� � + XeSqlPkg_queryvm_context_shipping # ) � �� % % 3 ? � � E ` � � j x � � ; R � � � [ x � � * H � � � O i � � * t � � � 4 K � � � ^ u � �
+
t
�
�
�
4 G � � � � � � 1
;
�
�
$ n � � � WUUUUUUUU���������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������W � queryvm_context_shipping EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid connect_brick_id )
� 2 : � �� uint64 WmiDataId context_brickgenerationid ; )
� � � � �� uint64 WmiDataId context_dbcompatlevel E )
� � � �� sint16 WmiDataId context_dbidprocpcp W )
� W _ � �� sint64 WmiDataId context_dbso
_ 4
� � � � ��� �� object WmiDataId Pointer context_dbso_daydatefirst ! � )
� ( 0 ! � �� sint64 WmiDataId context_dbso_ddlckpri " � )
� � � " � �� sint64 WmiDataId context_dbso_dtfmt � )
� � � � �� sint64 WmiDataId context_dbso_fipsflag $ � )
� H P $ � �� sint64 WmiDataId context_dbso_idtinsert_dbid x )
� � � � �� uint16 WmiDataId context_dbso_idtinsert_objid o )
� � �� sint64 WmiDataId context_dbso_idtinsert_state w )
� � � �� sint8 WmiDataId context_dbso_isolvl # � )
� � � # � �� sint64 WmiDataId context_dbso_langid % � )
� < D % � �� sint16 WmiDataId context_dbso_locktimeout � )
� � � � �� uint64 WmiDataId context_dbso_offsets � )
� � �� sint64 WmiDataId context_dbso_querygov � )
� a i � �� uint64 WmiDataId context_dbso_rowcnt z )
� � � � �� sint64 WmiDataId context_dbso_statlist � )
� ! ) � �� sint64 WmiDataId context_dbso_textsize � )
� � � � �� sint64 WmiDataId context_dbso_useropt1 c )
� � � � �� uint32 WmiDataId context_dbso_useropt1setmask k )
� K S � �� uint32 WmiDataId context_dbso_useropt2 g )
� � � � �� uint32 WmiDataId context_isdac D )
�
� �� sint8 WmiDataId context_issysadmin
C )
� b
i
� �� sint8 WmiDataId context_objidprocpcp O )
� �
�
� �� sint64 WmiDataId context_schidprocpcp G )
� ! ) � �� sint64 WmiDataId context_sessionid
+ )
� ~ �
� �� uint64 WmiDataId context_sessiontoken 3 )
� � � � �� uint64 WmiDataId dump_point P
� [ b � ��m ) v � � � uint8 WmiDataId XEMapId ValueMap � � 0 1 Values � � Send Receive FragmentId 6
�
%
� �� uint32 WmiDataId Description FragmentId query_id # )
� r
z
� �� uint64 WmiDataId RemainingLength 6
� �
�
�
�
� �� uint32 WmiDataId Description RemainingLength remote_exchange_node_id )
� [ c � �� sint32 WmiDataId remote_exchange_thread_id )
� � � � �� sint16 WmiDataId SequenceNumber 6
� ' / : G � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g R\��7 �� XeSqlPkg
C � ��$ 1 � � ) 6 c����Q � XeSqlPkg_queryvm_context_writeback Description Occurs immediately before QVM context is serialized and written back, and immediately after it is received and deserialized. Use this to get a snapshot of writeback QVM context data. Guid {f28b1522-fcbe-449e-967e-feeb2cc6c009} locale MS\0x409 DisplayName queryvm_context_writeback �" X e S q l P k g _ q u e r y v m _ c o n t e x t _ w r i t e b a c k S\��7 �c > , XeSqlPkg_queryvm_context_writeback $ ) � �� & 4 @ � � F Y � � � � � = G � � 0 z � � � WUU�����������������������������������������������������������c � queryvm_context_writeback EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid connect_brick_id )
� 3 ; � �� uint64 WmiDataId context_lasterror 3 )
� � � � �� sint64 WmiDataId context_newidt
+ )
� � �
� �� sint64 WmiDataId dump_point P
� g n � ��y ) � � � � uint8 WmiDataId XEMapId ValueMap � � 0 1 Values � � Send Receive FragmentId 6
� $ 1 � �� uint32 WmiDataId Description FragmentId query_id # )
� ~ � � �� uint64 WmiDataId RemainingLength 6
� � � � � �� uint32 WmiDataId Description RemainingLength remote_exchange_node_id )
� g o � �� sint32 WmiDataId remote_exchange_thread_id )
� � � � �� sint16 WmiDataId SequenceNumber 6
� 3 ; F S � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g T\��7 �\ XeSqlPkg
C � ��' 4 � � � � � � c����� � XeSqlPkg_queryvm_context_access_int64 Description Occurs whenever some context that fits in Int64 is accessed from within QVM. Guid {ebb1fb89-644a-4e1b-b129-d5f300f692a6} locale MS\0x409 DisplayName queryvm_context_access_int64 �t64 �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�� 3 �\>�S}� h � WDMClassesOfDriver KernelThermalConstraintChange C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�� ) �\>�S}� ^ � WDMClassesOfDriver IdleStateAccounting C:\Windows\system32\kernelbase.dll[MofResourceName] ] elbase.dll.mui[MofResourceName] e] 6 6 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0 �"�zw`� ͝��C�n xC���� M � WMIBinaryMofResource C:\Windows\system32\drivers\ndis.sys[MofResourceName] e] ame] Tqn P ��Rw\ ' WL� � �i;Ñ ; S Q L T r a c e E v e n t 2 1 7 �P��7 ��
e SQLTraceEvent217 6 � �� % B M \ _ p & 7 � � ( 6 � � e t � � � � # � � � � M Y
� � � � � 5
@
�
�
h w � � UUUUU������������������������������������������������������������������������������������������������j � SQLTraceEvent217_TYPE0 Description Plan Guide Successful Type0 EventType EventTypeName 0 ApplicationName P
� � � � � �
� �� string WmiDataId Description ApplicationName format w StringTermination Counted ClientProcessID 6
� { � � � � �� sint32 WmiDataId Description ClientProcessID DatabaseID 6
� � � �� sint32 WmiDataId Description DatabaseID DatabaseName
< P
� � � � � � � � � � �� string WmiDataId Description DatabaseName format w StringTermination Counted EventClass 8 6
� 9 A
L Y � �� sint32 WmiDataId Description EventClass EventSequence P 6
� � � � � � �� sint64 WmiDataId Description EventSequence HostName P
� O W b o y � � � � �� string WmiDataId Description HostName format w StringTermination Counted IsSystem X 6
� � � � �� sint32 WmiDataId Description IsSystem LoginName $ P
� � � � � � � � � � �� string WmiDataId Description LoginName format w StringTermination Counted LoginSid @ P
� ; C N [ e m p � � �� string WmiDataId Description LoginSid format c StringTermination Counted NTDomainName P
� � & . 1 D � �� string WmiDataId Description NTDomainName format w StringTermination Counted NTUserName P
� � � � � � � � � �� string WmiDataId Description NTUserName format w StringTermination Counted ObjectID 4 6
� X ` k x � �� sint32 WmiDataId Description ObjectID RequestID D 6
� � � � � � �� sint32 WmiDataId Description RequestID SessionLoginName \ P
� l t � � � � � � �� string WmiDataId Description SessionLoginName format w StringTermination Counted SPID ( 6
�
"
/
� �� sint32 WmiDataId Description SPID StartTime
, 6
� �
�
�
�
� �� uint64 WmiDataId Description StartTime TextData P
� * 7 A I L _ � �� string WmiDataId Description TextData format w StringTermination Counted TransactionID 6
� � � � � � �� sint64 WmiDataId Description TransactionID XactSequence H 6
� < D O \ � �� sint64 WmiDataId Description XactSequence � M S S Q L S E R V E R T r a c e �P��7 �� MSSQLSERVERTrace 6 � �� 8 > d q � � SQLTraceEvent218 Description Plan Guide Unsuccessful Guid 84e993e6-00da-4d70-97ef-3824ed2c4e93 DisplayName Plan Guide Unsuccessful Ev � S Q L T r a c e E v e n t 2 1 8 �P��7 ��
e SQLTraceEvent218 6 � �� % D O ^ a r ( 9 � � * 8 � � g v � � � � % � � � � O [ � � � � � 7
B
�
�
j y � � UUUUU������������������������������������������������������������������������������������������������l � SQLTraceEvent218_TYPE0 Description Plan Guide Unsuccessful Type0 EventType EventTypeName 0 ApplicationName P
� � � � � � �� string WmiDataId Description ApplicationName format w StringTermination Counted ClientProcessID 6
� } � � � � �� sint32 WmiDataId Description ClientProcessID DatabaseID 6
� � � �� sint32 WmiDataId Description DatabaseID DatabaseName
< P
� � � � � � � � � � �� string WmiDataId Description DatabaseName format w StringTermination Counted EventClass 8 6
� ; C
N [ � �� sint32 WmiDataId Description EventClass EventSequence P 6
� � � � � � �� sint64 WmiDataId Description EventSequence HostName P
� Q Y d q { � � � � �� string WmiDataId Description HostName format w StringTermination Counted IsSystem X 6
� � � � �� sint32 WmiDataId Description IsSystem LoginName $ P
� � � � � � � � � � �� string WmiDataId Description LoginName format w StringTermination Counted LoginSid @ P
� = E P ] g o r � � �� string WmiDataId Description LoginSid format c StringTermination Counted NTDomainName P
� �
( 0 3 F � �� string WmiDataId Description NTDomainName format w StringTermination Counted NTUserName P
� � � � � � � � � �� string WmiDataId Description NTUserName format w StringTermination Counted ObjectID 4 6
� Z b m z � �� sint32 WmiDataId Description ObjectID RequestID D 6
� � � � � � �� sint32 WmiDataId Description RequestID SessionLoginName \ P
� n v � � � � � � � �� string WmiDataId Description SessionLoginName format w StringTermination Counted SPID ( 6
�
$
1
� �� sint32 WmiDataId Description SPID StartTime
, 6
� �
�
�
�
� �� uint64 WmiDataId Description StartTime TextData P
� ! , 9 C K N a � �� string WmiDataId Description TextData format w StringTermination Counted TransactionID 6
� � � � � � �� sint64 WmiDataId Description TransactionID XactSequence H 6
� > F Q ^ � �� sint64 WmiDataId Description XactSequence � M S S Q L S E R V E R T r a c e �P��7 � MSSQLSERVERTrace 6 � �� B H n { � � SQLTraceEvent219 Description Matrix Transaction start and stop Guid 84e993e6-00db-4d70-97ef-3824ed2c4e93 DisplayName Matrix Transaction start and stop De �top De �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�w �\>�S}� T � WDMClassesOfDriver PoolTrace C:\Windows\system32\kernelbase.dll[MofResourceName] Name] ResourceName] me] 4�,w� � �1ʖ� 6 �3U�� � ��ӊ� E U3YZ�
� ə�� M ���� TXUj A �i��M y X e S q l P k g _ d y n _ t h r o t t l e _ c h e c k p o i n t ?V��7 �� ? * XeSqlPkg_dyn_throttle_checkpoint " ) � �� $
2 > � � F a � �
j ~ � � + � � ! 1 WU������������������������������������������������������������� � dyn_throttle_checkpoint EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid average_throughput )
� 3 ; � �� real64 WmiDataId average_writes_per_second )
� � � � �� real64 WmiDataId checkpoint_duration
8 )
� � �
� �� uint32 WmiDataId checkpoint_rate_iops , )
� W _ � �� real64 WmiDataId checkpoint_rate_mb $ )
� � � � �� real64 WmiDataId database_id 4 )
� � �� uint32 WmiDataId FragmentId 6
� o w � � � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� u } � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g @V��7 � XeSqlPkg
C � �� * > D l t ~ � c����� � XeSqlPkg_trace_flag_changed Description Trace flag changed Guid {142beaac-9a34-42ae-849a-3c2051bf13e7} locale MS\0x409 DisplayName trace_flag_changed � X e S q l P k g _ t r a c e _ f l a g _ c h a n g e d AV��7 �� " % XeSqlPkg_trace_flag_changed ) � �� - 9 � � 3 ? � � � � WU��������������������������������� � trace_flag_changed EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid flag )
� ( � �� uint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId new_value )
� � � � �� uint32 WmiDataId RemainingLength 6
� Y a l y � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber type P
� r z � ��� � � � � uint32 WmiDataId XEMapId ValueMap � � 0 1 Values � � Global Session � X e S q l P k g BV��7 � XeSqlPkg
C � ��" / H N v ~ � � c����� � XeSqlPkg_change_tracking_cleanup Description Change Tracking Cleanup Guid {D878EAE3-68D7-48FB-868E-8422E6D8A18F} locale MS\0x409 DisplayName change_tracking_cleanup � X e S q l P k g _ c h a n g e _ t r a c k i n g _ c l e a n u p CV��7 �f + * XeSqlPkg_change_tracking_cleanup " ) � �� $ 2 > � � n { � � A L � � , � � � � WU������������������������������������������ � change_tracking_cleanup EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid cleanup_id P
� R Z � ��e n x � � uint32 WmiDataId XEMapId ValueMap � � � � � � � � � � � � � � � 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 Values 3 H Y o � � � � � � 2 G U CleanupStatusChange UpdateRetention UpdateInvalidCleanup UpdateHardenedCleanup RowsCleanedUp BeginTableCleanup EndTableCleanup AddChangeTrackDbToQueue ProcessNewDatabase StartChangeTrackingCleanup StopChangeTrackingCleanup ErrorInTableCleanup RowsCleanedupInLoop RetryCleanup BeginManualTableCleanup database_id )
� � � � �� uint32 WmiDataId FragmentId 6
� ( 5 � �� uint32 WmiDataId Description FragmentId object_id )
� � � � �� sint32 WmiDataId RemainingLength 6
� � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� p x � � � �� uint32 WmiDataId Description SequenceNumber status )
� � � � �� uint32 WmiDataId value $ C
� J R � ��] p � � string WmiDataId StringTermination NullTerminated Format w � X e S q l P k g DV��7 �% XeSqlPkg
C � �� , S Y � � � � c����� � XeSqlPkg_syscommittab_cleanup Description Tracks SYS.SYSCOMMITTAB Table Cleanup Guid {8040BB1C-D62A-4327-AC4D-DDC45EC3FBB7} locale MS\0x409 DisplayName syscommittab_cleanup � X e S q l P k g _ s y s c o m m i t t a b _ c l e a n u p EV��7 �� 3 ' XeSqlPkg_syscommittab_cleanup ) � �� ! / ; � � c o � � � � j z WU�������������������������������������������������� � syscommittab_cleanup EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid cleaned_upto_date 6
� < D � ��O Z uint64 WmiDataId Extension WmiTime cleanup_ts ( )
� � � � �� uint64 WmiDataId database_id )
� � � �� uint32 WmiDataId FragmentId 6
� ` h s � � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� � � � � �� uint32 WmiDataId Description RemainingLength rows_deleted )
� W _ � �� uint64 WmiDataId SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g FV��7 � XeSqlPkg
C � �� * I O w � � c����� � XeSqlPkg_syscommittab_flush Description Tracks SYS.SYSCOMMITTAB flush Guid {2D7F99A0-E8EF-4B72-866B-CB9AC082F0E0} locale MS\0x409 DisplayName syscommittab_flush � X e S q l P k g HV��7 �Q XeSqlPkg
C � ��# 0 { � � � � � c����� � XeSqlPkg_committable_persist_info Description Tracks commit table when persisting the checkpoint timestamp to boot page Guid {493F6C3C-08EA-4B05-899E-5B4370E55C49} locale MS\0x409 DisplayName committable_persist_info �nfo �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�x �\>�S}� U � WDMClassesOfDriver ThreadPool C:\Windows\system32\kernelbase.dll[MofResourceName] MofResourceName] ] eName] G��ް � !glwj � A��d � P��); � (��h � ʙ�� � ��� f ���U � a < � a � u��jj��� ) � " @ ��K S [ n � } � � � U������������������������� � IdleStateAccounting Description Kernel Idle State Accounting AMENDMENT LOCALE ms_409 FailedTransitions +
� � � � � � � � uint32 DisplayName FailedTransitions Description FailedTransitions IdleTimeBuckets +
� 9 A � N _ � l uint32 DisplayName IdleTimeBuckets Description IdleTimeBuckets IdleTransitions +
� � � � � � � � uint32 DisplayName IdleTransitions Description IdleTransitions InvalidBucketIndex +
� X ` � m � � � uint32 DisplayName InvalidBucketIndex Description InvalidBucketIndex TotalTime +
� � � � � � uint64 DisplayName TotalTime Description TotalTime � W M I E v e n t v��jj��� & WMIEvent
) � 5 ��@ H P \ � � K R
� � _������������������������������������4 � IdleAccounting Description Kernel Idle Accounting AMENDMENT LOCALE ms_409 ResetCount +
� � � � � � � � uint32 DisplayName ResetCount Description ResetCount StartTime +
� � ( 3 � @ uint64 DisplayName StartTime Description StartTime State
+
� � � � � � � � object:IdleStateAccounting DisplayName Idle States Accounting Description Accounting Data for Kernel Idle States StateCount +
� F N � [ r � uint32 DisplayName Number of Idle States Description Total number of Kernel Idle States TotalTransitions +
� � � � � " uint32 DisplayName TotalTransitions Description TotalTransitions � w��jj��� ) � C ��N V ^ e � � J U � � U��������������������H � IdleStateBucketEx Description Kernel Idle State Bucket Extended AMENDMENT LOCALE ms_409 Count +
� � � � � � � � uint32 DisplayName Count Description Count MaxTimeUs +
� � ' 2 � ? uint32 DisplayName MaxTimeUs Description MaxTimeUs MinTimeUs +
� � � � � � � � uint32 DisplayName MinTimeUs Description MinTimeUs TotalTimeUs +
� � ! . � ; uint64 DisplayName TotalTimeUs Description TotalTimeUs � x��jj��� " ) � $ B ��M U ] p � � � 3 � � 2 = � � U��������������������������������* � IdleStateAccountingEx Description Kernel Idle State Accounting AMENDMENT LOCALE ms_409 FailedTransitions +
� � � � � � � � uint32 DisplayName FailedTransitions Description FailedTransitions IdleTimeBuckets
+
� ; U � b s � � object:IdleStateBucketEx DisplayName IdleTimeBuckets Description IdleTimeBuckets IdleTransitions +
� � � � � � uint32 DisplayName IdleTransitions Description IdleTransitions InvalidBucketIndex +
� l t � � � � � uint32 DisplayName InvalidBucketIndex Description InvalidBucketIndex MaxTimeUs +
� � � � ' uint32 DisplayName MaxTimeUs Description MaxTimeUs MinTimeUs +
� v ~ � � � � � uint32 DisplayName MinTimeUs Description MinTimeUs TotalTime +
� � � � � uint64 DisplayName TotalTime Description TotalTime � W M I E v e n t y��jj��� & WMIEvent
) � 7 ��B J R ^ � � M T � � _������������������������������������8 � IdleAccountingEx Description Kernel Idle Accounting AMENDMENT LOCALE ms_409 ResetCount +
� � � � � � � � uint32 DisplayName ResetCount Description ResetCount StartTime +
� � * 5 � B uint64 DisplayName StartTime Description StartTime State
+
� � � � � � � � object:IdleStateAccountingEx DisplayName Idle States Accounting Description Accounting Data for Kernel Idle States StateCount +
� J R � _ v � � uint32 DisplayName Number of Idle States Description Total number of Kernel Idle States TotalTransitions +
� � � � � & uint32 DisplayName TotalTransitions Description TotalTransitions � W M I E v e n t z��jj��� WMIEvent
��& . 6 C � � _���������������������G � KernelThermalPolicyChange AMENDMENT LOCALE ms_409 CoolingMode +
� | � � � � � � uint8 DisplayName Cooling Policy Description Current ACPI Cooling Mode Processors
+
�
� " . � ; uint64 DisplayName Processors Description Processors � W i n 3 2 _ P e r f R a w D a t a {��jj��,
Win32_PerfRawData 6 � # F � S j ��u } � � B N �������������� � ProcessorPerformance Description Processor Performance Information DisplayName Processor Performance AMENDMENT LOCALE ms_409 frequency +
� � � � � � � uint32 DisplayName Processor Frequency Description Processor Frequency is the frequency of the current processor in megahertz. Some processors are capable of regulating their frequency outside of the control of Windows. Processor Frequency will not accurately reflect actual processor frequency on these systems. Use Processor Information\% Processor Performance instead. percentage +
� � � � � � � � uint32 DisplayName % of Maximum Frequency Description % of Maximum Frequency is the percentage of the current processor's maximum frequency. Some processors are capable of regulating their frequency outside of the control of Windows. % of Maximum Frequency will not accurately reflect actual processor frequency on these systems. Use Processor Information\% Processor Performance instead. power +
� Q Y � f } � � uint32 DisplayName Processor State Flags Description Processor State Flags � T R C _ O B J E C T S jN��7 �� � TRC_OBJECTS
���������������������������������������������������������������������������������������������������������������������������������������������������������������� � OBJECT_CREATED �" R O O T \ M i c r o s o f t \ W i n d o w s \ D e v i c e G u a r d _ _ I n s t a n c e P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 9 4 5 D C C 5 B 6 4 9 B A 9 B D 8 0 D 7 3 7 3 0 1 9 A 6 9 9 C 2 6 D E 9 3 F 0 9 F 1 1 2 9 2 B C F C C C D 2 6 8 5 C 5 3 C A E E \ K I _ E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C \ I _ D 1 7 C 3 2 F 2 2 5 8 6 C 7 F F 6 8 3 7 7 F 9 A 8 2 D A 7 9 B F 8 D 5 4 B B 4 4 5 B 3 8 7 B 5 9 5 E 6 4 C 5 1 5 C C 0 3 4 A 7 D 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 \�n�^��
͝��C�� 3 J.3�� h � WDMClassesOfDriver MSNdis_FddiDownstreamNodeLong C:\Windows\system32\kernelbase.dll[MofResourceName] ] Name] Name] e] OBJECT_CREATED � � }A�pp j �ͼ�� � `�Q�l �nڅ � v�B�I x �j � � X e S q l P k g _ p e r f o b j e c t _ p r o c e s s ]\��7 � \ % XeSqlPkg_perfobject_process ) � ��
- 9 � � _ n c { � � " 3 � � , ; � � � � : L � � WUU������������������������������������������������������������������������������������������ � perfobject_process EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid FragmentId 6
� 3 ; F S � �� uint32 WmiDataId Description FragmentId instance_name
T C
� � �
� ��� � � � string WmiDataId StringTermination NullTerminated Format w percent_privileged_time )
� P X � �� uint64 WmiDataId percent_processor_time )
� � � � �� uint64 WmiDataId percent_user_time $ )
� � �� uint64 WmiDataId RemainingLength 6
� w � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � �� uint32 WmiDataId Description SequenceNumber virtual_bytes , )
� r z � �� uint64 WmiDataId virtual_bytes_peak 4 )
� � � � �� uint64 WmiDataId working_set
< )
� ' /
� �� uint64 WmiDataId working_set_peak L )
� � � � �� uint64 WmiDataId working_set_private D )
� � � � �� uint64 WmiDataId � X e S q l P k g ^\��7 �j XeSqlPkg
C � �� ) � � � � � � c����� � XeSqlPkg_perfobject_system Description Returns a set of counters associated with the System performance object. The event occurs once every 15 seconds. Guid {CA7C68E2-B99A-4D85-82C3-1F8CF0222D5F} locale MS\0x409 DisplayName perfobject_system � X e S q l P k g _ p e r f o b j e c t _ s y s t e m _\��7 ��
� $ XeSqlPkg_perfobject_system ) � �� , 8 � � I f � � : � � � ] y � � . K � � ! k w � P [ � � � � * t � � � WUUUU�������������������������������������������������������������������������������������������������������������������������������������������������������������! � perfobject_system EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid alignment_fixups_per_second )
� 6 > � �� uint64 WmiDataId context_switches_per_second $ )
� � � � �� uint64 WmiDataId exception_dispatches_per_second , )
� � �� uint64 WmiDataId file_control_bytes_per_second 4 )
� q y � �� uint64 WmiDataId file_control_operations_per_second
< )
� � �
� �� uint64 WmiDataId file_data_operations_per_second D )
� J R � �� uint64 WmiDataId file_read_bytes_per_second L )
� � � � �� uint64 WmiDataId file_read_operations_per_second
T )
� #
� �� uint64 WmiDataId file_write_bytes_per_second \ )
� � � � �� uint64 WmiDataId file_write_operations_per_second d )
� � � � �� uint64 WmiDataId floating_emulations_per_second l )
� X ` � �� uint64 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId percent_registry_quota_in_use )
� = E � �� uint64 WmiDataId processes t )
� � � � �� uint64 WmiDataId processor_queue_length | )
� � � � �� uint64 WmiDataId RemainingLength 6
� \ d o | � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � �� uint32 WmiDataId Description SequenceNumber system_calls_per_second � )
� a i � �� uint64 WmiDataId system_up_time � )
� � � � �� uint64 WmiDataId threads � )
� � �� uint64 WmiDataId � X e S q l P k g `\��7 �� XeSqlPkg
C � ��! . � � � � c����- � XeSqlPkg_perfobject_logicaldisk Description Returns a set of counters associated with the Logical Disk performance object. The event occurs once every 15 seconds for each hard or fixed disk drive. Guid {3E1FA98F-891B-46FE-84C4-3A4313329F73} locale MS\0x409 DisplayName perfobject_logicaldisk �( X e S q l P k g _ i n a c c u r a t e _ c a r d i n a l i t y _ e s t i m a t e e\��7 � 3 2 XeSqlPkg_inaccurate_cardinality_estimate * ) � ��! , : F � � G W � � � s | � � L \ � � WU�������������������������������������������������% � inaccurate_cardinality_estimate EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid actual_rows $ )
� 4 < � �� uint64 WmiDataId estimated_rows )
� � � � �� uint64 WmiDataId fire_count , )
� � � � �� uint32 WmiDataId FragmentId 6
� G O Z g � �� uint32 WmiDataId Description FragmentId node_id )
� � � � �� uint32 WmiDataId RemainingLength 6
� # . ; � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber thread_id )
� � �� uint32 WmiDataId � X e S q l P k g f\��7 �� XeSqlPkg
C � ��( 5 � � " * 4 A c����` � XeSqlPkg_large_cardinality_misestimate Description Occurs when the smaller of the estimated or actual cardinality of an iterator is at least 1 million rows and if the estimated and actual cardinality differ by at least 1 order of magnitude. Guid {98ad02f5-0ea2-4587-a35d-dda86ebb1338} locale MS\0x409 DisplayName large_cardinality_misestimate �ate �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C� ' �\>�S}� \ � WDMClassesOfDriver IdleStateBucketEx C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�� + �\>�S}� ` � WDMClassesOfDriver IdleStateAccountingEx C:\Windows\system32\kernelbase.dll[MofResourceName] ] me] � �/� 2 �TO/� h �"�* 5 �T+_ � �{~�
P u t�Z b ��rԼ : ��4� 6 I I S _ R e w r i t e _ T r a n s 6h�b �� IIS_Rewrite_Trans ] � �� 3 @ h s � � � � � � e t D N � � � � O V _U���������������������������� � SetServerVariable DisplayName SetServerVariable Description A set server variable action performed EventType EventTypeName SET_SERVER_VARIABLE EventLevel locale MS\0x409 ContextId
N
� $ / < H S Y �� � �� object WmiDataId Description Context ID extension Guid ActivityID ExpandedValue P
� � � � � ) 9 A � �� string WmiDataId Description The expanded server variable value StringTermination NullTerminated Format w IsHeader 6
� � � � � � �� boolean WmiDataId Description True if the server variable is a header Name P
� @ H S ` z � � � � �� string WmiDataId Description The server variable name StringTermination NullTerminated Format a Replace 6
� � � � �� boolean WmiDataId Description True if the server variable needs to be replaced or set Value P
� � � � � � � �� string WmiDataId Description The server variable value StringTermination NullTerminated Format w � I I S _ R e w r i t e _ T r a n s 6h�b �.
IIS_Rewrite_Trans ] � �� ) E R � � � � � � � � _������������� � RewriteDisabledKernelCache DisplayName RewriteDisabledKernelCache Description A rewrite rule caused to disable the kernel cache EventType EventTypeName REWRITE_DISABLED_KERNEL_CACHE EventLevel locale MS\0x409 ContextId
N
� C K V c o z � �� � �� object WmiDataId Description Context ID extension Guid ActivityID � I I S _ R e w r i t e _ T r a n s 6h�b �� IIS_Rewrite_Trans ] � �� % = J t � � � � � � � � _����������������M � RewriteFromCacheAction DisplayName RewriteFromCacheAction Description A Rewrite Action was perfored from cache EventType EventTypeName REWRITE_FROM_CACHE_ACTION EventLevel locale MS\0x409 CachedRewriteURL P
� 7 ? J W o � � � � �� string WmiDataId Description The cached rewrite URL StringTermination NullTerminated Format w ContextId
N
� $ 0 ; A �� � �� object WmiDataId Description Context ID extension Guid ActivityID ed � I I S _ R e w r i t e _ T r a n s 6h�b �q IIS_Rewrite_Trans ] � �� & ? L w � � � � � � � � � U c _���������������������� � RedirectFromCacheAction DisplayName RedirectFromCacheAction Description A Redirect Action was perfored from cache EventType EventTypeName REDIRECT_FROM_CACHE_ACTION EventLevel locale MS\0x409 CachedRedirectedURL P
� > F Q ^ w � � � � �� string WmiDataId Description The cached redirect URL StringTermination NullTerminated Format w ContextId
N
� , 8 C I �� � �� object WmiDataId Description Context ID extension Guid ActivityID RedirectType ]
� � � � � / 9 a i � � � �� uint32 WmiDataId ValueDescriptions $ Permanent Found SeeOther Temporary ValueMap M R W \ 301 302 303 307 Values } � � � Permanent Found SeeOther Temporary ValueType index � I I S _ R e w r i t e _ T r a n s 6h�b � IIS_Rewrite_Trans ] � �� , K X � � � � � � � � � � i u 2 > � � _��������������������������E � CustomResponseFromCacheAction DisplayName CustomResponseFromCacheAction Description A Custom Response Action was perfored from cache EventType EventTypeName CUSTOM_RESPONSE_FROM_CACHE_ACTION EventLevel locale MS\0x409 ContextId
N
� L T _ l x � � �� � �� object WmiDataId Description Context ID extension Guid ActivityID ErrorDescription P
�
% ; N ^ f � �� string WmiDataId Description Response description StringTermination NullTerminated Format w HttpReason P
� � � � � ' / � �� string WmiDataId Description Response reason StringTermination NullTerminated Format a HttpStatus 6
� � � � � � �� uint32 WmiDataId Description Response status code HttpSubStatus 6
� + � �� uint16 WmiDataId Description Response sub-status code � I I S _ R e w r i t e _ T r a n s 6h�b �(
IIS_Rewrite_Trans ] � �� * G T } � � � � � � � _������������� � AbortRequestFromCacheAction DisplayName AbortRequestFromCacheAction Description An Abort Action was perfored from cache EventType EventTypeName ABORT_REQUEST_FROM_CACHE_ACTION EventLevel locale MS\0x409 ContextId
N
� = E P ] i t z �� � �� object WmiDataId Description Context ID extension Guid ActivityID � I I S _ R e w r i t e _ T r a n s 6h�b �
IIS_Rewrite_Trans ] � �� 3 @ ` k z � � � � � _������������^ � NoActionFromCache DisplayName NoActionFromCache Description No operation action from cache EventType EventTypeName NO_ACTION_FROM_CACHE EventLevel locale MS\0x409 ContextId
N
� ( 5 A L R �� � �� object WmiDataId Description Context ID extension Guid ActivityID � I I S _ R e w r i t e _ T r a n s 6h�b ��
IIS_Rewrite_Trans ] � �� 1 > ] h w � � � � � _������������Z � NoMatchFromCache DisplayName NoMatchFromCache Description No matching action from cache EventType EventTypeName NO_MATCH_FROM_CACHE EventLevel locale MS\0x409 ContextId
N
� $ 1 = H N �� � �� object WmiDataId Description Context ID extension Guid ActivityID �yID �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �L����
͝��C�� 1 +/�Q �� f � WDMClassesOfDriver MSMCAEvent_SystemEventError C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �L����
͝��C�� , +/�Q �� a � WDMClassesOfDriver MSMCAEvent_SMBIOSError C:\Windows\system32\kernelbase.dll[MofResourceName] rceName] MofResourceName] er WMIEvent C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 m/h�b �
͝��C�� + )ߝ�t � ` � WDMClassesOfDriver SystemConfig_V1_Power C:\Windows\system32\kernelbase.dll[MofResourceName] [MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 m/h�b �
͝��C�� + )ߝ�t � ` � WDMClassesOfDriver SystemConfig_V1_Power C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 t/h�b �
͝��C�� ) )ߝ�t � ^ � WDMClassesOfDriver SystemConfig_V2_NIC C:\Windows\system32\kernelbase.dll[MofResourceName] ll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 t/h�b �
͝��C�� ) )ߝ�t � ^ � WDMClassesOfDriver SystemConfig_V2_NIC C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 t/h�b �
͝��C�� ) )ߝ�t � ^ � WDMClassesOfDriver SystemConfig_V2_NIC C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 t/h�b �
͝��C�� ) )ߝ�t � ^ � WDMClassesOfDriver SystemConfig_V2_NIC C:\Windows\system32\kernelbase.dll[MofResourceName] ll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 t/h�b �
͝��C�� ) )ߝ�t � ^ � WDMClassesOfDriver SystemConfig_V2_NIC C:\Windows\system32\kernelbase.dll[MofResourceName] [MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 t/h�b �
͝��C�� ) )ߝ�t � ^ � WDMClassesOfDriver SystemConfig_V2_NIC C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 w/h�b �
͝��C�� + )ߝ�t � ` � WDMClassesOfDriver SystemConfig_V2_Power C:\Windows\system32\kernelbase.dll[MofResourceName] ResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 w/h�b �
͝��C�� + )ߝ�t � ` � WDMClassesOfDriver SystemConfig_V2_Power C:\Windows\system32\kernelbase.dll[MofResourceName] ResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 w/h�b �
͝��C�� + )ߝ�t � ` � WDMClassesOfDriver SystemConfig_V2_Power C:\Windows\system32\kernelbase.dll[MofResourceName] ResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 w/h�b �
͝��C�� + )ߝ�t � ` � WDMClassesOfDriver SystemConfig_V2_Power C:\Windows\system32\kernelbase.dll[MofResourceName] ResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 w/h�b �
͝��C�� + )ߝ�t � ` � WDMClassesOfDriver SystemConfig_V2_Power C:\Windows\system32\kernelbase.dll[MofResourceName] [MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 w/h�b �
͝��C�� + )ߝ�t � ` � WDMClassesOfDriver SystemConfig_V2_Power C:\Windows\system32\kernelbase.dll[MofResourceName] urceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 w/h�b �
͝��C�� + )ߝ�t � ` � WDMClassesOfDriver SystemConfig_V2_Power C:\Windows\system32\kernelbase.dll[MofResourceName] l[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 w/h�b �
͝��C�� + )ߝ�t � ` � WDMClassesOfDriver SystemConfig_V2_Power C:\Windows\system32\kernelbase.dll[MofResourceName] urceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 w/h�b �
͝��C�� + )ߝ�t � ` � WDMClassesOfDriver SystemConfig_V2_Power C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 w/h�b �
͝��C�� + )ߝ�t � ` � WDMClassesOfDriver SystemConfig_V2_Power C:\Windows\system32\kernelbase.dll[MofResourceName] ResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 w/h�b �
͝��C�� + )ߝ�t � ` � WDMClassesOfDriver SystemConfig_V2_Power C:\Windows\system32\kernelbase.dll[MofResourceName] ResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 w/h�b �
͝��C�� + )ߝ�t � ` � WDMClassesOfDriver SystemConfig_V2_Power C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 w/h�b �
͝��C�� + )ߝ�t � ` � WDMClassesOfDriver SystemConfig_V2_Power C:\Windows\system32\kernelbase.dll[MofResourceName] l[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 w/h�b �
͝��C�� + )ߝ�t � ` � WDMClassesOfDriver SystemConfig_V2_Power C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 x/h�b �
͝��C�� - )ߝ�t � b � WDMClassesOfDriver SystemConfig_V2_Network C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 x/h�b �
͝��C�� - )ߝ�t � b � WDMClassesOfDriver SystemConfig_V2_Network C:\Windows\system32\kernelbase.dll[MofResourceName] MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 x/h�b �
͝��C�� - )ߝ�t � b � WDMClassesOfDriver SystemConfig_V2_Network C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 x/h�b �
͝��C�� - )ߝ�t � b � WDMClassesOfDriver SystemConfig_V2_Network C:\Windows\system32\kernelbase.dll[MofResourceName] sourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 x/h�b �
͝��C�� - )ߝ�t � b � WDMClassesOfDriver SystemConfig_V2_Network C:\Windows\system32\kernelbase.dll[MofResourceName] ResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 x/h�b �
͝��C�� - )ߝ�t � b � WDMClassesOfDriver SystemConfig_V2_Network C:\Windows\system32\kernelbase.dll[MofResourceName] F4 n XactSequence �e] U��3p � Ծ� � ��k�
? ��/�� � O
�wZ 7 L��,� � 7 X e S q l P k g _ c o l u m n s t o r e _ t i e r e d _ s t o r a g e _ s c a n n e r _ t r a c e _ p r i n t y[��7 � @ A XeSqlPkg_columnstore_tiered_storage_scanner_trace_print 9 ) � ��0 ; I U � s ~ � � ( � � 6 @ � � m z � � J U � � � M ] WUU������������������������������������������������������������� � columnstore_tiered_storage_scanner_trace_print EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid blob_id
, 6
� L T � ��_ j object WmiDataId Extension Variant column_id )
� � � � �� uint32 WmiDataId container_id
* )
�
� �� uint16 WmiDataId dbName 8 C
� y � � ��� � � � string WmiDataId StringTermination NullTerminated Format w FragmentId 6
�
* � �� uint32 WmiDataId Description FragmentId function 0 C
� � � � ��� � � � string WmiDataId StringTermination NullTerminated Format w message
4 C
� , 4
� ��? R b j string WmiDataId StringTermination NullTerminated Format w object_type & )
� � � � �� uint32 WmiDataId RemainingLength 6
� ! , 9 � �� uint32 WmiDataId Description RemainingLength rowset_id )
� � � � �� uint64 WmiDataId scanner_type )
� � � � �� uint16 WmiDataId segment_id " )
� : B � �� uint32 WmiDataId SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g z[��7 �k XeSqlPkg
C � ��; H } � � � � � c����� � XeSqlPkg_columnstore_tiered_storage_scanner_start_segment Description Columnstore tiered storage scanner start a segment. Guid {2C0E1A9F-56A8-49C8-B974-75B88CF59DF0} locale MS\0x409 DisplayName columnstore_tiered_storage_scanner_start_segment �9 X e S q l P k g _ c o l u m n s t o r e _ t i e r e d _ s t o r a g e _ s c a n n e r _ s t a r t _ s e g m e n t {[��7 �� 8 C XeSqlPkg_columnstore_tiered_storage_scanner_start_segment ; ) � ��2 = K W
u � � � " * � � 8 E � � j x � � ( WUU������������������������������������������������������ � columnstore_tiered_storage_scanner_start_segment EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid blob_id
, 6
� N V � ��a l object WmiDataId Extension Variant column_id )
� � � � �� uint32 WmiDataId container_id
* )
�
� �� uint16 WmiDataId dbName 0 C
� { � � ��� � � � string WmiDataId StringTermination NullTerminated Format w FragmentId 6
� , � �� uint32 WmiDataId Description FragmentId object_type & )
� | � � �� uint32 WmiDataId RemainingLength 6
� � � � � �� uint32 WmiDataId Description RemainingLength rowset_id )
� W _ � �� uint64 WmiDataId scanner_type )
� � � � �� uint16 WmiDataId segment_id " )
�
� �� uint32 WmiDataId SequenceNumber 6
� l t � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g |[��7 �j XeSqlPkg
C � ��9 F ~ � � � � � c����� � XeSqlPkg_columnstore_tiered_storage_scanner_end_segment Description Columnstore tiered storage scanner finishes a segment. Guid {0C1B1FFF-A1DD-4E54-9548-61FA2205DE76} locale MS\0x409 DisplayName columnstore_tiered_storage_scanner_end_segment �7 X e S q l P k g _ c o l u m n s t o r e _ t i e r e d _ s t o r a g e _ s c a n n e r _ e n d _ s e g m e n t }[��7 �� 8 A XeSqlPkg_columnstore_tiered_storage_scanner_end_segment 9 ) � ��0 ; I U � s ~ � � ( � � 6 C � � h v � � & WUU������������������������������������������������������ � columnstore_tiered_storage_scanner_end_segment EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid blob_id
, 6
� L T � ��_ j object WmiDataId Extension Variant column_id )
� � � � �� uint32 WmiDataId container_id
* )
�
� �� uint16 WmiDataId dbName 0 C
� y � � ��� � � � string WmiDataId StringTermination NullTerminated Format w FragmentId 6
�
* � �� uint32 WmiDataId Description FragmentId object_type & )
� z � � �� uint32 WmiDataId RemainingLength 6
� � � � � �� uint32 WmiDataId Description RemainingLength rowset_id )
� U ] � �� uint64 WmiDataId scanner_type )
� � � � �� uint16 WmiDataId segment_id " )
� � �� uint32 WmiDataId SequenceNumber 6
� j r } � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g ~[��7 �� XeSqlPkg
C � ��J W � � � � � � c����) � XeSqlPkg_columnstore_tiered_storage_scanner_start_rowgroup_consolidation Description Columnstore tiered storage scanner start a rowgroup consolidation. Guid {795AFB7A-66CE-4436-8F49-AD873695C756} locale MS\0x409 DisplayName columnstore_tiered_storage_scanner_start_rowgroup_consolidation �ion �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�� / �\>�S}� d � WDMClassesOfDriver WmiMonitorBrightnessEvent C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�� 1 �\>�S}� f � WDMClassesOfDriver WmiMonitorDescriptorMethods C:\Windows\system32\kernelbase.dll[MofResourceName] ResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�� 1 �\>�S}� f � WDMClassesOfDriver WmiMonitorDescriptorMethods C:\Windows\system32\kernelbase.dll[MofResourceName] ResourceName] ceName] �� S�
�ޯ� h�� � �Ŗ$] � )Bf�D � )�
% p�P/ � L�_ � T c p I p _ V 1 ���jj��� ' TcpIp_V1
� �� % � � � � g l � � ' / y � � WU�������������������������������������8 � TcpIp_V1_Receive EventType connid 4
� g o z �� � �� uint32 WmiDataId PointerType daddr
6
� � � � � � �� object WmiDataId extension IPAddr dport
6
� C K V a � �� object WmiDataId extension Port PID )
� � � � �� uint32 WmiDataId saddr
6
� � �� object WmiDataId extension IPAddr seqnum )
� f n � �� uint32 WmiDataId size )
� � � � �� uint32 WmiDataId sport
6
� ' 2 � �� object WmiDataId extension Port � T c p I p _ V 1 ���jj��� ' TcpIp_V1
� �� 0 8 � � z � � : B � � � � WU�������������������������������������K � TcpIp_V1_TypeGroup1 EventType
connid 4
� z � � �� � �� uint32 WmiDataId PointerType daddr
6
� � � � � �� object WmiDataId extension IPAddr dport
6
� V ^ i t � �� object WmiDataId extension Port PID )
� � � � �� uint32 WmiDataId saddr
6
� ' 2 � �� object WmiDataId extension IPAddr seqnum )
� y � � �� uint32 WmiDataId size )
� � � � �� uint32 WmiDataId sport
6
� ' / : E � �� object WmiDataId extension Port � T c p I p _ V 1 ���jj��~ 8 TcpIp_V1
� �� , 4 � � v { � � f s � � � � � � # 0 z � � � : A WUUU����������������������������������������������������� � TcpIp_V1_TypeGroup2 EventType connid , 4
� v ~ � �� � �� uint32 WmiDataId PointerType daddr
6
� � � � � � �� object WmiDataId extension IPAddr dport
6
� R Z e p � �� object WmiDataId extension Port mss )
� � � � �� uint16 WmiDataId PID )
� � �� uint32 WmiDataId rcvwin $ )
� S [ � �� uint32 WmiDataId rcvwinscale ( )
� � � � �� sint16 WmiDataId sackopt )
� � � �� uint16 WmiDataId saddr
6
� [ c n y � �� object WmiDataId extension IPAddr seqnum 0 )
� � � � �� uint32 WmiDataId size )
� � �� uint32 WmiDataId sndwinscale
* )
� g o
� �� sint16 WmiDataId sport
6
� � � � � � �� object WmiDataId extension Port tsopt )
� ' / � �� uint16 WmiDataId wsopt
" )
� x �
� �� uint16 WmiDataId � T c p I p _ V 1 ���jj��� TcpIp_V1
� �� ! G��������k � TcpIp_V1_Fail EventType Proto )
� X ` � �� uint32 WmiDataId � T c p I p _ V 1 ���jj��� / TcpIp_V1
� ��
" � � � � d m � �
w � � � � WU��������������������������������������������� � TcpIp_V1_Send EventType connid $ 4
� d l w �� � �� uint32 WmiDataId PointerType daddr
6
� � � � � � �� object WmiDataId extension IPAddr dport
6
� @ H S ^ � �� object WmiDataId extension Port endtime )
� � � � �� uint32 WmiDataId PID )
� � � � �� uint32 WmiDataId saddr
6
� Q Y d o � �� object WmiDataId extension IPAddr seqnum
( )
� � �
� �� uint32 WmiDataId size )
� � �� uint32 WmiDataId sport
6
� d l w � � �� object WmiDataId extension Port startime )
� � � � �� uint32 WmiDataId � T c p I p _ V 1 ���jj��� ' TcpIp_V1
� �� 8 @ � � � � � � B J � � � � WU�������������������������������������S � TcpIp_V1_TypeGroup3 EventType connid 4
� � � � �� � �� uint32 WmiDataId PointerType daddr
6
� � � � �� object WmiDataId extension IPAddr dport
6
� ^ f q | � �� object WmiDataId extension Port PID )
� � � � �� uint32 WmiDataId saddr
6
� $ / : � �� object WmiDataId extension IPAddr seqnum )
� � � � �� uint32 WmiDataId size )
� � � � �� uint32 WmiDataId sport
6
� / 7 B M � �� object WmiDataId extension Port � M S N T _ S y s t e m T r a c e ���jj��� MSNT_SystemTrace ) � ��
5 C����C � TcpIp Guid {9a280ac0-c8e0-11d1-84e2-00c04fb998a2} EventVersion � T c p I p ���jj��� / TcpIp � ��
# � � � � g p � � | � � � % � � WU��������������������������������������������� � TcpIp_SendIPV4 EventType connid
( 4
� e m
x �� � �� uint32 WmiDataId PointerType daddr
6
� � � � � � �� object WmiDataId extension IPAddrV4 dport
6
� C K V a � �� object WmiDataId extension Port endtime )
� � � � �� uint32 WmiDataId PID )
� � � � �� uint32 WmiDataId saddr
6
� T \ g r � �� object WmiDataId extension IPAddrV4 seqnum $ )
� � � � �� uint32 WmiDataId size )
� � �� uint32 WmiDataId sport
6
� i q | � � �� object WmiDataId extension Port startime )
� � � � �� uint32 WmiDataId �aId �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� 5 �\>�S}� j � WDMClassesOfDriver MSNdis_FddiShortMaximumListSize C:\Windows\system32\kernelbase.dll[MofResourceName] e] �8�݀ S [�m�� � ��q�h � �,�Y � � 8��
$ #s� � �s� 6 X e S q l P k g _ q u e r y _ e x e c u t i o n _ b a t c h _ p r o c e s s i n g _ b i t m a p _ b u i l d �X��7 �� , @ XeSqlPkg_query_execution_batch_processing_bitmap_build 8 ) � ��/ : H T � O [ � � $ < � � a q WU������������������������������������������� � query_execution_batch_processing_bitmap_build EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid bytes )
� < D � �� uint64 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId is_fast_bitmap ( )
� � �� sint8 WmiDataId query_operator_node_id )
� s { � �� sint32 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength row_count )
� N V � �� uint64 WmiDataId SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �X��7 �m XeSqlPkg
C � ��6 C � � � � � � c����� � XeSqlPkg_query_execution_range_elimination_map_build Description Occurs when range elimination map is built in batch processing. Guid {eb0468db-7d6f-465e-bed3-318b93e83f64} locale MS\0x409 DisplayName query_execution_range_elimination_map_build �4 X e S q l P k g _ q u e r y _ e x e c u t i o n _ r a n g e _ e l i m i n a t i o n _ m a p _ b u i l d �X��7 �q * > XeSqlPkg_query_execution_range_elimination_map_build 6 ) � ��- 8 F R � S _ � � 1 ? � � WU����������������������������������������� � query_execution_range_elimination_map_build EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid bucket_size )
� @ H � �� uint64 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId query_operator_node_id )
� & � �� sint32 WmiDataId ranges_count )
� v ~ � �� uint64 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� c k v � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �X��7 �a XeSqlPkg
C � ��< I r x � � � � c����� � XeSqlPkg_query_execution_column_store_segment_scan_started Description Occurs when column segment scan starts. Guid {0f7beae2-32fe-4e34-a3bb-be27252b62bd} locale MS\0x409 DisplayName query_execution_column_store_segment_scan_started �; X e S q l P k g _ q u e r y _ e x e c u t i o n _ c o l u m n _ s t o r e _ s e g m e n t _ s c a n _ f i n i s h e d �X��7 �� L E XeSqlPkg_query_execution_column_store_segment_scan_finished = ) � ��4 ? M Y � � � A J � � � U f � � 2 D � � WUU�������������������������������������������������������������������������g � query_execution_column_store_segment_scan_finished EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid FragmentId 6
� S [ f s � �� uint32 WmiDataId Description FragmentId impure_row_buckets_number
0 )
� � �
� �� sint64 WmiDataId input_rows_number 8 )
� . 6 � �� sint64 WmiDataId node_id )
� � � � �� sint32 WmiDataId output_rows_number @ )
� � � � �� sint64 WmiDataId pure_row_buckets_number ( )
� B J � �� sint64 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength rowgroup_id )
� ' � �� sint64 WmiDataId rowset_column_id $ )
� { � � �� sint32 WmiDataId SequenceNumber 6
� � � � � �� uint32 WmiDataId Description SequenceNumber thread_id )
� T \ � �� sint32 WmiDataId � X e S q l P k g �X��7 �� XeSqlPkg
C � ��> K � � � � � � c���� � XeSqlPkg_query_execution_column_store_rowgroup_scan_finished Description Occurs when row bucket processor finishes column store row group scan. Guid {40b21e6f-b58c-4821-9131-f5e6ebe6b11c} locale MS\0x409 DisplayName query_execution_column_store_rowgroup_scan_finished �< X e S q l P k g _ q u e r y _ e x e c u t i o n _ c o l u m n _ s t o r e _ r o w g r o u p _ s c a n _ f i n i s h e d �X��7 �t ` F XeSqlPkg_query_execution_column_store_rowgroup_scan_finished > ) � ��5 @ N Z c x � � ! 6 � � � � > Q � � j { � � G W � � WUU�������������������������������������������������������������������������������������������� � query_execution_column_store_rowgroup_scan_finished EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid cpu_cycles_counter0 , )
� P X � �� uint64 WmiDataId cpu_cycles_counter1
4 )
� � �
� �� uint64 WmiDataId cpu_cycles_counter2 < )
� � �� uint64 WmiDataId cpu_cycles_counter3 D )
� m u � �� uint64 WmiDataId cpu_cycles_counter4
L )
� � �
� �� uint64 WmiDataId cpu_cycles_counter5 T )
� + 3 � �� uint64 WmiDataId cpu_cycles_number $ )
� � � � �� uint64 WmiDataId FragmentId 6
� � � � � �� uint32 WmiDataId Description FragmentId node_id )
� W _ � �� sint32 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength rowgroup_id )
� 4 < � �� sint64 WmiDataId SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber thread_id )
�
� �� sint32 WmiDataId �aId �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�| $ �\>�S}� Y � WDMClassesOfDriver TP_V2_TimerSet C:\Windows\system32\kernelbase.dll[MofResourceName] rceName] fResourceName] nce �e] nS'P � V�*�8 Z �p9x� D �G?b� �
E v e n t T r a c e �wR|�C�� EventTrace ) ! 9 ��D L S � � E��������Q � ReflectorTraceGuid Description UMDF - Reflector Trace AMENDMENT LOCALE Flags 8
� � � � � � � � uint32 Description Enable Flags Values H Y g x � � � � � � � �
1 G ] s � � � � � �
# 9 O e { � � RD_TRACE_DRIVER RD_TRACE_FDO RD_TRACE_DEVICE RD_TRACE_CONTROL RD_TRACE_DMCONTROL RD_TRACE_LPC RD_TRACE_DISPATCH RD_TRACE_PNP RD_TRACE_PROCESS RD_TRACE_IO RD_TRACE_CANCEL RD_TRACE_DEVIF RD_TRACE_WMI RD_TRACE_RESERVED_0d RD_TRACE_RESERVED_0e RD_TRACE_RESERVED_0f RD_TRACE_RESERVED_10 RD_TRACE_RESERVED_11 RD_TRACE_RESERVED_12 RD_TRACE_RESERVED_13 RD_TRACE_RESERVED_14 RD_TRACE_RESERVED_15 RD_TRACE_RESERVED_16 RD_TRACE_RESERVED_17 RD_TRACE_RESERVED_18 RD_TRACE_RESERVED_19 RD_TRACE_RESERVED_1a RD_TRACE_RESERVED_1b RD_TRACE_RESERVED_1c RD_TRACE_RESERVED_1d RD_TRACE_RESERVED_1e RD_TRACE_FUNCTION ValueMap H T ` l x � � � � � � � � � � � , 8 D P \ h t � � � � � � 0x00000001 0x00000002 0x00000004 0x00000008 0x00000010 0x00000020 0x00000040 0x00000080 0x00000100 0x00000200 0x00000400 0x00000800 0x00001000 0x00002000 0x00004000 0x00008000 0x00010000 0x00020000 0x00040000 0x00080000 0x00100000 0x00200000 0x00400000 0x00800000 0x01000000 0x02000000 0x04000000 0x08000000 0x10000000 0x20000000 0x40000000 0x80000000 Level 8
� * 2 E uint32 Description Levels ValueDescriptions ] { � � � Abnormal exit or termination Severe errors that need logging Warnings such as allocation failure Includes non-error cases Detailed traces from intermediate steps Values $ + 2 ; H Fatal Error Warning Information Verbose _R �
E v e n t T r a c e �wR|�C�. EventTrace ) / ��: B I : A E��������� � TestTraceGuid Description UMDF - Test Trace AMENDMENT LOCALE Flags 8
� � � � � � , 6 uint32 Description Enable Flags Values > R b x � � � � � 7 O g � � � � � ' ? W o � � � � � � TEST_TRACE_GENERAL TEST_TRACE_APP TEST_TRACE_TSTDRIVER TEST_TRACE_FLTRDRIVER TEST_TRACE_RESERVED_04 TEST_TRACE_RESERVED_05 TEST_TRACE_RESERVED_06 TEST_TRACE_RESERVED_07 TEST_TRACE_RESERVED_08 TEST_TRACE_RESERVED_09 TEST_TRACE_RESERVED_0a TEST_TRACE_RESERVED_0b TEST_TRACE_RESERVED_0c TEST_TRACE_RESERVED_0d TEST_TRACE_RESERVED_0e TEST_TRACE_RESERVED_0f TEST_TRACE_RESERVED_10 TEST_TRACE_RESERVED_11 TEST_TRACE_RESERVED_12 TEST_TRACE_RESERVED_13 TEST_TRACE_RESERVED_14 TEST_TRACE_RESERVED_15 TEST_TRACE_RESERVED_16 TEST_TRACE_RESERVED_17 TEST_TRACE_RESERVED_18 TEST_TRACE_RESERVED_19 TEST_TRACE_RESERVED_1a TEST_TRACE_RESERVED_1b TEST_TRACE_RESERVED_1c TEST_TRACE_RESERVED_1d TEST_TRACE_RESERVED_1e TEST_TRACE_FUNCTION ValueMap � � � � � � & 2 > J V b n z � � � � � � � � � � �
" . 0x00000001 0x00000002 0x00000004 0x00000008 0x00000010 0x00000020 0x00000040 0x00000080 0x00000100 0x00000200 0x00000400 0x00000800 0x00001000 0x00002000 0x00004000 0x00008000 0x00010000 0x00020000 0x00040000 0x00080000 0x00100000 0x00200000 0x00400000 0x00800000 0x01000000 0x02000000 0x04000000 0x08000000 0x10000000 0x20000000 0x40000000 0x80000000 Level 8
� � � � � � v ~ uint32 Description Levels ValueDescriptions � � 3 M Abnormal exit or termination Severe errors that need logging Warnings such as allocation failure Includes non-error cases Detailed traces from intermediate steps Values � � � � � Fatal Error Warning Information Verbose ER �
E v e n t T r a c e �wR|�C� EventTrace ) % B ��M U \ $ + U��������� � DriverManagerTraceGuid Description UMDF - Driver Manager Trace AMENDMENT LOCALE Flags 8
� � � � � � uint32 Description Enable Flags Values Q ` w � � � � � � 6 M d { � � � � � 3 J a x � � � � � MGR_TRACE_MGR MGR_TRACE_SERVICE_KEY MGR_TRACE_DEVNODE MGR_TRACE_PROCESS MGR_TRACE_LPC MGR_TRACE_RESERVED_05 MGR_TRACE_RESERVED_06 MGR_TRACE_RESERVED_07 MGR_TRACE_RESERVED_08 MGR_TRACE_RESERVED_09 MGR_TRACE_RESERVED_0a MGR_TRACE_RESERVED_0b MGR_TRACE_RESERVED_0c MGR_TRACE_RESERVED_0d MGR_TRACE_RESERVED_0e MGR_TRACE_RESERVED_0f MGR_TRACE_RESERVED_10 MGR_TRACE_RESERVED_11 MGR_TRACE_RESERVED_12 MGR_TRACE_RESERVED_13 MGR_TRACE_RESERVED_14 MGR_TRACE_RESERVED_15 MGR_TRACE_RESERVED_16 MGR_TRACE_RESERVED_17 MGR_TRACE_RESERVED_18 MGR_TRACE_RESERVED_19 MGR_TRACE_RESERVED_1a MGR_TRACE_RESERVED_1b MGR_TRACE_RESERVED_1c MGR_TRACE_RESERVED_1d MGR_TRACE_RESERVED_1e MGR_TRACE_FUNCTION ValueMap � � � � � � � � ( 4 @ L X d p | � � � � � � � � � � 0x00000001 0x00000002 0x00000004 0x00000008 0x00000010 0x00000020 0x00000040 0x00000080 0x00000100 0x00000200 0x00000400 0x00000800 0x00001000 0x00002000 0x00004000 0x00008000 0x00010000 0x00020000 0x00040000 0x00080000 0x00100000 0x00200000 0x00400000 0x00800000 0x01000000 0x02000000 0x04000000 0x08000000 0x10000000 0x20000000 0x40000000 0x80000000 Level 8
� q y � � � ` h uint32 Description Levels ValueDescriptions � � � 7 Abnormal exit or termination Severe errors that need logging Warnings such as allocation failure Includes non-error cases Detailed traces from intermediate steps Values � � � � � Fatal Error Warning Information Verbose 0 �
E v e n t T r a c e �wR|�C�� EventTrace ) 0 ��; C J � � E��������? � WdfCoreTraceGuid Description UMDF - WDF Core AMENDMENT LOCALE Flags 8
� � � � � � X b uint32 Description Enable Flags Values . ? R ^ o � � � � � � � � � 2 A TRACINGFULL TRACINGERROR TRACINGDBGPRINT TRACINGFRAMEWORKS TRACINGAPI TRACINGAPIERROR TRACINGRESOURCES TRACINGLOCKING TRACINGCONTEXT TRACINGPOOL TRACINGHANDLE TRACINGPNP TRACINGIO TRACINGIOTARGET TRACINGDMA TRACINGREQUEST TRACINGDRIVER TRACINGDEVICE TRACINGUSEROBJECT TRACINGOBJECT TRACINGPNPPOWERSTATES ValueMap � � � � � � & 2 > J V b n z � � � � 0x00000001 0x00000002 0x00000004 0x00000008 0x00000010 0x00000020 0x00000040 0x00000080 0x00000100 0x00000200 0x00000400 0x00000800 0x00001000 0x00002000 0x00004000 0x00008000 0x00010000 0x00020000 0x00040000 0x00080000 0x00100000 Level 8
� 3 � � uint32 Description Levels ValueDescriptions K i � � � Abnormal exit or termination Severe errors that need logging Warnings such as allocation failure Includes non-error cases Detailed traces from intermediate steps Values ) 6 Fatal Error Warning Information Verbose 00 �ose 00 �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �L����
͝��C�� , +/�Q �� a � WDMClassesOfDriver WHEAErrorSourceMethods C:\Windows\system32\kernelbase.dll[MofResourceName] urceName] rceName] �1�` - qxk�� [�a�� � qD� � � �ԩG � M S N d i s ^��jj��� MSNdis ) ! � . O ��Z b j � MSNdis_QueryInterruptModeration Description NDIS Query Interrupt Moderation AMENDMENT LOCALE ms_409 ] � is_ W � 9 � WmiQueryInterruptModeration . � ; Description Query Interrupt Moderation K WIN-F6NF7R6I6PJ ROOT\wmi\ms_409 ���� � �� �� * � ����Q � __PARAMETERS abstract
Header object
� 2 in
� 2 Y �� NDIS WMI Method Common Header Description
)
� 2 Y ��� � ID
6
� 2 Y ��� � � object:MSNdis_WmiMethodHeader __ �� WIN-F6NF7R6I6PJ ROOT\wmi\ms_409 ���� � �7 �� * ����s � __PARAMETERS abstract
InterruptModeration object
� ? out
� ? f �� Interrupt Moderation of the adapter Description
)
� ? f ��� � ID
6
� F f ��� � � object:MSNdis_InterruptModerationParameters __ � M S N d i s _��jj��� MSNdis ) � , K ��V ^ f � MSNdis_SetInterruptModeration Description NDIS Set Interrupt Moderation AMENDMENT LOCALE ms_409 B � is_ S � WmiSetInterruptModeration , � 9 Description Set Interrupt Moderation � WIN-F6NF7R6I6PJ ROOT\wmi\ms_409 ���� � �e �� i C * � ��������� � __PARAMETERS abstract
MethodHeader object
� 8 in
� 8 _ �� NDIS WMI Common Method Header Description
)
� 8 _ ��� � ID
6
� 8 _ ��� � � object:MSNdis_WmiMethodHeader
InterruptModeration object
� ~ in
� ~ � �� Interrupt Moderation Parameters to set Description
)
� ~ � ��� � ID
6
� � � ��� � ? object:MSNdis_InterruptModerationParameters __ � WIN-F6NF7R6I6PJ ROOT\wmi\ms_409 ���� � �� �� *
����n � __PARAMETERS abstract
OutputInfo object
� 6 out
� 6 ] �� Output from Setting Interrupt Moderation of the adapter Description
)
� 6 ] ��� � ID
6
� Q ] ��� � object:MSNdis_WmiOutputInfo __ � M S N d i s `��jj��� MSNdis ) � ' A ��L T \ � MSNdis_SetLinkParameters Description NDIS Set Link Parameters AMENDMENT LOCALE ms_409 ) � is_ I � WmiSetLinkParameters ' � 4 Description Set Link Parameters � WIN-F6NF7R6I6PJ ROOT\wmi\ms_409 ���� � �[ �� i . * � ��������� � __PARAMETERS abstract
MethodHeader object
� 8 in
� 8 _ �� NDIS WMI Common Method Header Description
)
� 8 _ ��� � ID
6
� 8 _ ��� � � object:MSNdis_WmiMethodHeader
LinkParameters object
� y in
� y � �� Link Parameters to set Description
)
� y � ��� � ID
6
� r � ��� � * object:MSNdis_LinkParameters __ � WIN-F6NF7R6I6PJ ROOT\wmi\ms_409 ���� � �� �� * ����i � __PARAMETERS abstract
OutputInfo object
� 6 out
� 6 ] �� Output from Setting Link Parameters of the adapter Description
)
� 6 ] ��� � ID
6
� L ] ��� � object:MSNdis_WmiOutputInfo __ � M S N d i s a��jj��� MSNdis ) � ) E ��P X ` � MSNdis_QueryStatisticsInfo Description NDIS Query Statistics Info AMENDMENT LOCALE ms_409 � � is_ M � � � WmiQueryStatisticsInfo ) � 6 Description Query Statistics Info K WIN-F6NF7R6I6PJ ROOT\wmi\ms_409 ���� � �� �� * � ����Q � __PARAMETERS abstract
Header object
� 2 in
� 2 Y �� NDIS WMI Method Common Header Description
)
� 2 Y ��� � ID
6
� 2 Y ��� � � object:MSNdis_WmiMethodHeader __ �� WIN-F6NF7R6I6PJ ROOT\wmi\ms_409 ���� � �� �� * � ����Z � __PARAMETERS abstract
StatisticsInfo object
� : out
� : a �� Statistics Info of the adapter Description
)
� : a ��� � ID
6
� < a ��� � � object:MSNdis_StatisticsInfo __ � M S N d i s ���jj��r MSNdis ) & � 3 | ��� � � � ����� � MSNdis_80211_TransmitAntennaSelected Description The antenna selected for transmitting on the radio of the 802.11 device AMENDMENT LOCALE ms_409 Ndis80211TransmitAntennaSelected
� � � � � uint32 Description The transmit antenna number aS �ber aS �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �L����
͝��C�� ( +/�Q �� ] � WDMClassesOfDriver MSSmBios_SysidUUID C:\Windows\system32\kernelbase.dll[MofResourceName] ResourceName] ��N ` � ��'� � j�j� � ���-N � �m{� � suR|�C�� / ) % d ��o w � F a � � � � G ^ � � o � < Q # � � � � +
8
UUU���������������������������������������������
� RSOP_IEProgramSettings Description Object which contains details of program associations for IE. AMENDMENT LOCALE calendarProgram +
� � � � ' 4 string Description Specifies the Internet calendar program you want to use with Internet Explorer. DisplayName Calendar Program checkIfIEIsDefaultBrowser
( +
� � � � m z boolean Description Specifies whether you want Internet Explorer to remain your default Internet browser, even if you install additional Internet browsing software. When this check box is selected, each time Internet Explorer starts it checks to make sure it is still registered as the default Internet browser. If another program is registered as the default browser, Internet Explorer asks whether you want to restore Internet Explorer as your default browser. DisplayName Check If IE Is Default Browser contactListProgram $ +
� � � � ] j string Description Specifies the Internet contacts or address-book program you want to use with Internet Explorer. DisplayName Contact List Program emailProgram +
� � � � + 8 string Description Specifies the Internet e-mail program you want to use with Internet Explorer. DisplayName Email Program htmlEditorHKCURegData +
� � � � � � string Description DisplayName HTML Editor HKCU Registry Data htmlEditorHKLMRegData +
� + 3 @ B O string Description DisplayName HTML Editor HKLM Registry Data htmlEditorProgram +
� � � � ) string Description Specifies the HTML editing program you want to use with Internet Explorer. DisplayName HTMLEditorProgram internetCallProgram +
� � � � � � string Description Specifies the Internet call program you want to use with Internet Explorer. DisplayName Internet Call Program newsgroupsProgram +
� \ d q � � string Description Specifies the Internet newsreader program you want to use with Internet Explorer. DisplayName Newsgroups Program rsopID 6
� 1 � ��9 F j w string Description Foreign key to RSOP_PolicySetting. DisplayName RSOP ID rsopPrecedence 6
� � � ��� �
uint32 Description Foreign key to RSOP_PolicySetting. DisplayName RSOP Precedence useIEForFTP * +
� q
z
�
�
�
boolean Description DisplayName Use Internet Explorer For FTP � tuR|�C�i ) - n ��y � � D U ��������� � RSOP_IEImportedProgramSettings Description Program settings object for the IE browser, used for IEAK RSoP. AMENDMENT LOCALE policySetting f 6
� � � ��� � ' 4 ref:RSOP_IEAKPolicySetting Description Reference to the RSOP_IEAKPolicySetting. DisplayName Policy Setting programSettings f 6
� � � ��� � � � ref:RSOP_IEProgramSettings Description Reference to the imported program settings. DisplayName Program Settings Na � wuR|�C�� < ) $ 1 � ��� � � ! � � X ` � � 9 C � � " 5 � � ! ) � � g q � � K [ UUU���������������������������������������������������������� � RSOP_IEConnectionDialUpCredentials Description Object which contains details for a phone number used for dialing up to the internet. AMENDMENT LOCALE callbackID +
� � � � � uint32 Description DisplayName Callback ID callbackNumber +
� Z b o q ~ string Description DisplayName Callback Number connectionName 6
� � � ��� � : G string Description Unique name of a location from which the internet can be dialed. DisplayName Connection Name domain +
� � � � � � string Description DisplayName Domain entryName +
� - string Description DisplayName Entry Name password +
� | � � � � string Description DisplayName Password phoneNumber +
� � � string Description DisplayName Phone Number rasDialParamsData $ +
� n u � � � uint8 Description DisplayName RAS Dial Params Data rasDialParamsDataSize
( +
� � � uint32 Description DisplayName Size rsopID 6
� m � ��u � � � string Description Foreign key to RSOP_PolicySetting. DisplayName RSOP ID rsopPrecedence 6
� � �� % I V sint32 Description Foreign key to RSOP_PolicySetting. DisplayName RSOP Precedence subEntry , +
� � � � � � uint32 Description DisplayName Sub Entry userName 0 +
� $ 1 3 @ string Description DisplayName User Name windowsVersion
4 +
� � � � � � uint32 Description DisplayName Windows Version � xuR|�C�� ) ( 5 � ��� � � s � ���������6 � RSOP_IEConnectionDialUpCredentialsLink Description Dial-up credentials for a given IE internet connection , used for IEAK RSoP. AMENDMENT LOCALE dialUpCredentials f 6
� � � �� " T a ref:RSOP_IEConnectionDialUpCredentials Description Reference to the dial-up connection credentials. DisplayName Dial Up Settings policySetting f 6
� � � ��� � & ref:RSOP_IEAKPolicySetting Description Reference to the RSOP_IEAKPolicySetting. DisplayName Policy Setting s. � yuR|�C�� ) " / � ��� � � k � 3 � � Z j U��������������������� � RSOP_IEConnectionWinINetSettings Description Object which contains details for WinINet internet connection settings for a given connection. AMENDMENT LOCALE connectionName 6
� � � ��� M Z string Description Unique name of a location from which the internet can be dialed. DisplayName Connection Name internetPerConnOptionListData +
� � � � � � uint8 Description DisplayName Internet Per Connection Option List Data internetPerConnOptionListDataSize +
� l t � � � uint32 Description DisplayName Internet Per Connection Option List Data Size rsopID 6
� � �� D Q string Description Foreign key to RSOP_PolicySetting. DisplayName RSOP ID rsopPrecedence 6
� � � ��� � � � sint32 Description Foreign key to RSOP_PolicySetting. DisplayName RSOP Precedence �nce �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� 0 �\>�S}� e � WDMClassesOfDriver MSNdis_TokenRingLostFrames C:\Windows\system32\kernelbase.dll[MofResourceName] fResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 #M����
͝��C�� 5 +/�Q �� j � WDMClassesOfDriver MSNdis_TcpOffloadHardwareConfig C:\Windows\system32\kernelbase.dll[MofResourceName] esourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 #M����
͝��C�� 5 +/�Q �� j � WDMClassesOfDriver MSNdis_TcpOffloadHardwareConfig C:\Windows\system32\kernelbase.dll[MofResourceName] ll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 #M����
͝��C�� 5 +/�Q �� j � WDMClassesOfDriver MSNdis_TcpOffloadHardwareConfig C:\Windows\system32\kernelbase.dll[MofResourceName] ResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 #M����
͝��C�� 5 +/�Q �� j � WDMClassesOfDriver MSNdis_TcpOffloadHardwareConfig C:\Windows\system32\kernelbase.dll[MofResourceName] ResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 #M����
͝��C�� 5 +/�Q �� j � WDMClassesOfDriver MSNdis_TcpOffloadHardwareConfig C:\Windows\system32\kernelbase.dll[MofResourceName] rceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 #M����
͝��C�� 5 +/�Q �� j � WDMClassesOfDriver MSNdis_TcpOffloadHardwareConfig C:\Windows\system32\kernelbase.dll[MofResourceName] rceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 #M����
͝��C�� 5 +/�Q �� j � WDMClassesOfDriver MSNdis_TcpOffloadHardwareConfig C:\Windows\system32\kernelbase.dll[MofResourceName] esourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 #M����
͝��C�� 5 +/�Q �� j � WDMClassesOfDriver MSNdis_TcpOffloadHardwareConfig C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 (M����
͝��C�� 1 +/�Q �� f � WDMClassesOfDriver MSNdis_HDSplitCurrentConfig C:\Windows\system32\kernelbase.dll[MofResourceName] sourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 (M����
͝��C�� 1 +/�Q �� f � WDMClassesOfDriver MSNdis_HDSplitCurrentConfig C:\Windows\system32\kernelbase.dll[MofResourceName] ll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 (M����
͝��C�� 1 +/�Q �� f � WDMClassesOfDriver MSNdis_HDSplitCurrentConfig C:\Windows\system32\kernelbase.dll[MofResourceName] l[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 (M����
͝��C�� 1 +/�Q �� f � WDMClassesOfDriver MSNdis_HDSplitCurrentConfig C:\Windows\system32\kernelbase.dll[MofResourceName] urceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 (M����
͝��C�� 1 +/�Q �� f � WDMClassesOfDriver MSNdis_HDSplitCurrentConfig C:\Windows\system32\kernelbase.dll[MofResourceName] l[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 (M����
͝��C�� 1 +/�Q �� f � WDMClassesOfDriver MSNdis_HDSplitCurrentConfig C:\Windows\system32\kernelbase.dll[MofResourceName] ame] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 (M����
͝��C�� 1 +/�Q �� f � WDMClassesOfDriver MSNdis_HDSplitCurrentConfig C:\Windows\system32\kernelbase.dll[MofResourceName] nelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 (M����
͝��C�� 1 +/�Q �� f � WDMClassesOfDriver MSNdis_HDSplitCurrentConfig C:\Windows\system32\kernelbase.dll[MofResourceName] rceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 (M����
͝��C�� 1 +/�Q �� f � WDMClassesOfDriver MSNdis_HDSplitCurrentConfig C:\Windows\system32\kernelbase.dll[MofResourceName] ll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 (M����
͝��C�� 1 +/�Q �� f � WDMClassesOfDriver MSNdis_HDSplitCurrentConfig C:\Windows\system32\kernelbase.dll[MofResourceName] urceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 (M����
͝��C�� 1 +/�Q �� f � WDMClassesOfDriver MSNdis_HDSplitCurrentConfig C:\Windows\system32\kernelbase.dll[MofResourceName] rceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 (M����
͝��C�� 1 +/�Q �� f � WDMClassesOfDriver MSNdis_HDSplitCurrentConfig C:\Windows\system32\kernelbase.dll[MofResourceName] ResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 (M����
͝��C�� 1 +/�Q �� f � WDMClassesOfDriver MSNdis_HDSplitCurrentConfig C:\Windows\system32\kernelbase.dll[MofResourceName] rnelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 (M����
͝��C�� 1 +/�Q �� f � WDMClassesOfDriver MSNdis_HDSplitCurrentConfig C:\Windows\system32\kernelbase.dll[MofResourceName] se.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 (M����
͝��C�� 1 +/�Q �� f � WDMClassesOfDriver MSNdis_HDSplitCurrentConfig C:\Windows\system32\kernelbase.dll[MofResourceName] [MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 (M����
͝��C�� 1 +/�Q �� f � WDMClassesOfDriver MSNdis_HDSplitCurrentConfig C:\Windows\system32\kernelbase.dll[MofResourceName] l[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 (M����
͝��C�� 1 +/�Q �� f � WDMClassesOfDriver MSNdis_HDSplitCurrentConfig C:\Windows\system32\kernelbase.dll[MofResourceName] fResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 (M����
͝��C�� 1 +/�Q �� f � WDMClassesOfDriver MSNdis_HDSplitCurrentConfig C:\Windows\system32\kernelbase.dll[MofResourceName] esourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 (M����
͝��C�� 1 +/�Q �� f � WDMClassesOfDriver MSNdis_HDSplitCurrentConfig C:\Windows\system32\kernelbase.dll[MofResourceName] ntCapabilities C:\Windows\system32\kernelbase.dll[MofResourceName] sourceName] fResourceName] iv � ��dΐ �r�ؔ a �uʮ�
�
�x� ^ ��Z/] T � �� � �n�*6 - <��^c � G X e S q l P k g _ c o l u m n s t o r e _ r o w g r o u p _ q u a l i f i e d _ f o r _ t u p l e m o v e r _ a g g r e s s i v e _ m e r g e �Z��7 �^ ? Q XeSqlPkg_columnstore_rowgroup_qualified_for_tuplemover_aggressive_merge I ) � ��@ K Y e f r � � 6 A � � � � m z � � WU�������������������������������������������������������������H � columnstore_rowgroup_qualified_for_tuplemover_aggressive_merge EventType EventVersion ActivityId
N
� � � � � � �� � ��� object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� S [ � �� uint64 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId index_id $ )
� # + � �� uint64 WmiDataId object_id )
� x � � �� uint64 WmiDataId partition_number , )
� � � � �� uint64 WmiDataId RemainingLength 6
� < D O \ � �� uint32 WmiDataId Description RemainingLength rowgroup_id 4 )
� � � � �� uint64 WmiDataId SequenceNumber 6
� + 8 � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �Z��7 �9 XeSqlPkg
C � ��) 6 ] c � � � � c����� � XeSqlPkg_columnstore_index_reorg_failed Description An Index Reorganize operation failed. Guid {A8176089-6132-43FE-AC57-6CA719CAD613} locale MS\0x409 DisplayName columnstore_index_reorg_failed �' X e S q l P k g _ c o l u m n s t o r e _ i n d e x _ r e o r g _ f a i l e d �Z��7 �� B 1 XeSqlPkg_columnstore_index_reorg_failed ) ) � �� + 9 E � � F T � � # m { � � J W � � �
~ � ) I WUU���������������������������������������������������������������� � columnstore_index_reorg_failed EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� 3 ; � �� uint64 WmiDataId error_number
. )
� � �
� �� uint32 WmiDataId FragmentId 6
� � � � �� uint32 WmiDataId Description FragmentId hobt_id )
� Z b � �� uint64 WmiDataId is_in_memory - )
� � � � �� uint8 WmiDataId RemainingLength 6
� ! , 9 � �� uint32 WmiDataId Description RemainingLength rowgroup_id $ )
� � � � �� uint64 WmiDataId rowgroup_state , )
� � � � �� uint8 WmiDataId SequenceNumber 6
� N V a n � �� uint32 WmiDataId Description SequenceNumber source_rowgroup_id_list : C
� � � � ��� & string WmiDataId StringTermination NullTerminated Format w source_rowgroup_id_list_length 2 )
� � � � �� uint64 WmiDataId � X e S q l P k g �Z��7 �6 XeSqlPkg
C � ��% 2 ^ d � � � � c����� � XeSqlPkg_column_store_code_coverage Description Code coverage Xevent for columnstore code. Guid {015BC3DD-00C2-425E-A91F-FD302327C965} locale MS\0x409 DisplayName column_store_code_coverage �# X e S q l P k g _ c o l u m n _ s t o r e _ c o d e _ c o v e r a g e �Z��7 �� / - XeSqlPkg_column_store_code_coverage % ) � �� ' 5 A � � A N � � \ m � � # � � WU��������������������������������������������� � column_store_code_coverage EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid code_point )
� . 6 � �� uint32 WmiDataId description ( C
� � � � ��� � � � string WmiDataId StringTermination NullTerminated Format w FragmentId 6
� 0 8 C P � �� uint32 WmiDataId Description FragmentId optional_value1 )
� � � � �� real64 WmiDataId optional_value2 )
� � � �� real64 WmiDataId RemainingLength 6
� g o z � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �Z��7 �] XeSqlPkg
C � ��* 7 � � � � � � c����� � XeSqlPkg_column_store_redirect_no_detour Description A versioned scan skipped scanning the rowgroup which is too new for it. Guid {16416D42-6F7E-47B9-8F2A-EE2DDDE394E1} locale MS\0x409 DisplayName column_store_redirect_no_detour �( X e S q l P k g _ c o l u m n _ s t o r e _ r e d i r e c t _ n o _ d e t o u r �Z��7 �� C 2 XeSqlPkg_column_store_redirect_no_detour * ) � ��! ,
: F � � G S � � ' � � � � H X � � e x WU����������������������������������������������������������������� � column_store_redirect_no_detour EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� 4 < � �� uint64 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId hobt_id )
� � �� uint64 WmiDataId RemainingLength 6
� k s ~ � � �� uint32 WmiDataId Description RemainingLength row_count , )
� � � � �� uint64 WmiDataId rowgroup_id $ )
� 5 = � �� uint64 WmiDataId SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber state
< C
� $ ,
� ��7 J Z b string WmiDataId StringTermination NullTerminated Format w version_timestamp 4 )
� � � � �� uint64 WmiDataId � X e S q l P k g �Z��7 �Y XeSqlPkg
C � ��' 4 � � � � � c����� � XeSqlPkg_column_store_redirect_detour Description A versioned scan was detoured from a newer rowgroup to an older rowgroup. Guid {B8151171-3A02-4CE3-9CA4-CD505FA2484D} locale MS\0x409 DisplayName column_store_redirect_detour �our �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �����
͝��C�z " ��7��� W � WDMClassesOfDriver WmiMonitorID C:\Windows\system32\kernelbase.dll[MofResourceName] L)gR � D D L _ S Y M M E T R I C _ K E Y _ E V E N T S kN��7 �� < " DDL_SYMMETRIC_KEY_EVENTS ������������������������������������������������������������ � DROP_SYMMETRIC_KEY �KEY �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 *J����
͝��C�� ) +/�Q �� ^ � WDMClassesOfDriver MSNdis_ObjectHeader C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 +J����
͝��C�� , +/�Q �� a � WDMClassesOfDriver MSNdis_WmiMethodHeader C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 M����
͝��C�� 3 +/�Q �� h � WDMClassesOfDriver MSNdis_FddiLongCurrentAddress C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 M����
͝��C�� / +/�Q �� d � WDMClassesOfDriver MSNdis_FddiAttachmentType C:\Windows\system32\kernelbase.dll[MofResourceName] MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 M����
͝��C�� / +/�Q �� d � WDMClassesOfDriver MSNdis_FddiAttachmentType C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 M����
͝��C�� + +/�Q �� ` � WDMClassesOfDriver MSNdis_FddiFramesLost C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 M����
͝��C�� 3 +/�Q �� h � WDMClassesOfDriver MSNdis_FddiRingManagmentState C:\Windows\system32\kernelbase.dll[MofResourceName] eName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 M����
͝��C�� 3 +/�Q �� h � WDMClassesOfDriver MSNdis_FddiRingManagmentState C:\Windows\system32\kernelbase.dll[MofResourceName] Name] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 M����
͝��C�� 3 +/�Q �� h � WDMClassesOfDriver MSNdis_FddiRingManagmentState C:\Windows\system32\kernelbase.dll[MofResourceName] ceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 M����
͝��C�� 3 +/�Q �� h � WDMClassesOfDriver MSNdis_FddiRingManagmentState C:\Windows\system32\kernelbase.dll[MofResourceName] [MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 M����
͝��C�� 3 +/�Q �� h � WDMClassesOfDriver MSNdis_FddiRingManagmentState C:\Windows\system32\kernelbase.dll[MofResourceName] MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 M����
͝��C�� 3 +/�Q �� h � WDMClassesOfDriver MSNdis_FddiRingManagmentState C:\Windows\system32\kernelbase.dll[MofResourceName] fResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 M����
͝��C�� 3 +/�Q �� h � WDMClassesOfDriver MSNdis_FddiRingManagmentState C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 M����
͝��C�� + +/�Q �� ` � WDMClassesOfDriver MSNdis_FddiLemRejects C:\Windows\system32\kernelbase.dll[MofResourceName] MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 M����
͝��C�� + +/�Q �� ` � WDMClassesOfDriver MSNdis_FddiLemRejects C:\Windows\system32\kernelbase.dll[MofResourceName] dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 M����
͝��C�� + +/�Q �� ` � WDMClassesOfDriver MSNdis_FddiLemRejects C:\Windows\system32\kernelbase.dll[MofResourceName] se.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 M����
͝��C�� + +/�Q �� ` � WDMClassesOfDriver MSNdis_FddiLemRejects C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 M����
͝��C�� + +/�Q �� ` � WDMClassesOfDriver MSNdis_FddiLemRejects C:\Windows\system32\kernelbase.dll[MofResourceName] se.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 M����
͝��C�� + +/�Q �� ` � WDMClassesOfDriver MSNdis_FddiLemRejects C:\Windows\system32\kernelbase.dll[MofResourceName] .dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 M����
͝��C�� + +/�Q �� ` � WDMClassesOfDriver MSNdis_FddiLemRejects C:\Windows\system32\kernelbase.dll[MofResourceName] base.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 M����
͝��C�� + +/�Q �� ` � WDMClassesOfDriver MSNdis_FddiLemRejects C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 M����
͝��C�� 1 +/�Q �� f � WDMClassesOfDriver MSNdis_FddiLConnectionState C:\Windows\system32\kernelbase.dll[MofResourceName] l[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 M����
͝��C�� 1 +/�Q �� f � WDMClassesOfDriver MSNdis_FddiLConnectionState C:\Windows\system32\kernelbase.dll[MofResourceName] rceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 M����
͝��C�� 1 +/�Q �� f � WDMClassesOfDriver MSNdis_FddiLConnectionState C:\Windows\system32\kernelbase.dll[MofResourceName] dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 M����
͝��C�� 1 +/�Q �� f � WDMClassesOfDriver MSNdis_FddiLConnectionState C:\Windows\system32\kernelbase.dll[MofResourceName] ourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 M����
͝��C�� 1 +/�Q �� f � WDMClassesOfDriver MSNdis_FddiLConnectionState C:\Windows\system32\kernelbase.dll[MofResourceName] esourceName] 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �K�8P��
͝��C�� 1 �k+K�� f � WDMClassesOfDriver MSNdis_FddiLConnectionState C:\Windows\system32\kernelbase.dll[MofResourceName] e] e] eName] K��@ 1 �N\bq @gE�y h S Q L T r a c e E v e n t 2 1 fO��7 �� j SQLTraceEvent21 6 � �� $ 4 ? N Q b $ � � [ g � � � �
� � � � 9 D � � � � n z + 6 � � n
x
�
�
V a � � B L �
UUUUU�����������������������������������������������������������������������������������������������������}
� SQLTraceEvent21_TYPE0 Description EventLog Type0 EventType EventTypeName 0 ApplicationName $ P
� � � � � � � � � �� string WmiDataId Description ApplicationName format w StringTermination Counted BinaryData P
� � � � � � � � � � �� string WmiDataId Description BinaryData format c StringTermination Counted ClientProcessID 6
� * 2 = J � �� sint32 WmiDataId Description ClientProcessID DatabaseID 6
� � � � � � �� sint32 WmiDataId Description DatabaseID DatabaseName H P
� C K V c q y | � � �� string WmiDataId Description DatabaseName format w StringTermination Counted Error D 6
� � � � � �� sint32 WmiDataId Description Error EventClass
< 6
� Z b m z � �� sint32 WmiDataId Description EventClass EventSequence T 6
� � � � � � �� sint64 WmiDataId Description EventSequence HostName P
� p x � � � � � � � �� string WmiDataId Description HostName format w StringTermination Counted IsSystem \ 6
� " / � �� sint32 WmiDataId Description IsSystem LoginName ( P
� � �
� � � � � � � �� string WmiDataId Description LoginName format w StringTermination Counted LoginSid L P
� \ d o | � � � � � �� string WmiDataId Description LoginSid format c StringTermination Counted NTDomainName P
� ! , 9 G O R e � �� string WmiDataId Description NTDomainName format w StringTermination Counted NTUserName P
� � � � � " � �� string WmiDataId Description NTUserName format w StringTermination Counted RequestID P 6
� z � � � � �� sint32 WmiDataId Description RequestID SessionLoginName ` P
�
(
5
G
O
R
e
� �� string WmiDataId Description SessionLoginName format w StringTermination Counted Severity 8 6
� �
�
�
�
� �� sint32 WmiDataId Description Severity SPID
, 6
� 0 8 C P � �� sint32 WmiDataId Description SPID StartTime 0 6
� � � � � � �� uint64 WmiDataId Description StartTime State @ 6
� # . ; � �� sint32 WmiDataId Description State TextData P
� � � � � � � � � � �� string WmiDataId Description TextData format w StringTermination Counted TransactionID 6
� N
V
a
n
� �� sint64 WmiDataId Description TransactionID � M S S Q L S E R V E R T r a c e gO��7 �� MSSQLSERVERTrace 6 � �� ( . T a k � SQLTraceEvent22 Description ErrorLog Guid 84e993e6-0016-4d70-97ef-3824ed2c4e93 DisplayName ErrorLog � S Q L T r a c e E v e n t 2 2 hO��7 �2 f SQLTraceEvent22 6 � �� $ 4 ? N Q b ) � � ( � � M Y � � K U | � 7 A � � � � n y � � � � )
/
�
�
� � > M UUUUU�������������������������������������������������������������������������������������������������� � SQLTraceEvent22_TYPE0 Description ErrorLog Type0 EventType EventTypeName 0 ApplicationName P
� � � � � � � � � �� string WmiDataId Description ApplicationName format w StringTermination Counted ClientProcessID 6
� m u � � � �� sint32 WmiDataId Description ClientProcessID DatabaseID 6
� � � � �� sint32 WmiDataId Description DatabaseID DatabaseName D P
� � � � � � � � � � �� string WmiDataId Description DatabaseName format w StringTermination Counted Error @ 6
� & . 9 F � �� sint32 WmiDataId Description Error EventClass 8 6
� � �
� � � �� sint32 WmiDataId Description EventClass EventSequence P 6
� $ / < � �� sint64 WmiDataId Description EventSequence HostName P
� � � � � � � � � � �� string WmiDataId Description HostName format w StringTermination Counted IsSystem X 6
� R Z e r � �� sint32 WmiDataId Description IsSystem LoginName $ P
� � � � . � �� string WmiDataId Description LoginName format w StringTermination Counted LoginSid H P
� � � � � � � � � � �� string WmiDataId Description LoginSid format c StringTermination Counted NTDomainName P
� \ d o | � � � � � �� string WmiDataId Description NTDomainName format w StringTermination Counted NTUserName P
� # . ; G O R e � �� string WmiDataId Description NTUserName format w StringTermination Counted RequestID L 6
� � � � � � �� sint32 WmiDataId Description RequestID SessionLoginName \ P
� X ` k x � � � � � �� string WmiDataId Description SessionLoginName format w StringTermination Counted Severity 4 6
� �
� �� sint32 WmiDataId Description Severity SPID ( 6
� s
{
�
�
� �� sint32 WmiDataId Description SPID StartTime
, 6
� �
�
�
� �� uint64 WmiDataId Description StartTime State
< 6
� ^ f q ~ � �� sint32 WmiDataId Description State TextData P
� � �
" 5 � �� string WmiDataId Description TextData format w StringTermination Counted TransactionID 6
� � � � � � �� sint64 WmiDataId Description TransactionID �nID �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ߴ����
͝��C�{ # ��7��� X � WDMClassesOfDriver ObObjectEvent C:\Windows\system32\kernelbase.dll[MofResourceName] N���� ؗa
�
Kf�,� :Gߗ� (nm0 " �NE* )"G 0 ��M�w 0 | S�
� �o� f� � �D� ��c� ���4 " i��V " d��x �|g�� ��� -��� Q��� �K�� &7ܚ ����+ uM��I " ��J�k YL�J} '4�̓ 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� / J.3�� d � WDMClassesOfDriver MSNdis_PortAuthParameters C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�} % J.3�� Z � WDMClassesOfDriver MSNdis_PortChar C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�~ & J.3�� [ � WDMClassesOfDriver MSNdis_PortArray C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� . J.3�� c � WDMClassesOfDriver MSNdis_PciDeviceProperty C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� : J.3�� o � WDMClassesOfDriver MSNdis_WmiTcpLargeSendOffloadV1_IPv4 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� 5 J.3�� j � WDMClassesOfDriver MSNdis_WmiTcpLargeSendOffloadV1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� H J.3�� } � WDMClassesOfDriver MSNdis_WmiTcpIpChecksumOffload_IPv4TransmitReceive C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� H J.3�� } � WDMClassesOfDriver MSNdis_WmiTcpIpChecksumOffload_IPv6TransmitReceive C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� 4 J.3�� i � WDMClassesOfDriver MSNdis_WmiTcpIpChecksumOffload C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� 8 J.3�� m � WDMClassesOfDriver MSNdis_WmiIPSecOffloadV1_Supported C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� 5 J.3�� j � WDMClassesOfDriver MSNdis_WmiIPSecOffloadV1_IPv4AH C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� 6 J.3�� k � WDMClassesOfDriver MSNdis_WmiIPSecOffloadV1_IPv4ESP C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� . J.3�� c � WDMClassesOfDriver MSNdis_WmiIPSecOffloadV1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� : J.3�� o � WDMClassesOfDriver MSNdis_WmiTcpLargeSendOffloadV2_IPv4 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� : J.3�� o � WDMClassesOfDriver MSNdis_WmiTcpLargeSendOffloadV2_IPv6 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� 5 J.3�� j � WDMClassesOfDriver MSNdis_WmiTcpLargeSendOffloadV2 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C� ' J.3�� \ � WDMClassesOfDriver MSNdis_WmiOffload C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� 1 J.3�� f � WDMClassesOfDriver MSNdis_TcpOffloadParameters C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� 4 J.3�� i � WDMClassesOfDriver MSNdis_WmiTcpConnectionOffload C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� 4 J.3�� i � WDMClassesOfDriver MSNdis_WmiHDSplitCurrentConfig C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� . J.3�� c � WDMClassesOfDriver MSNdis_HDSplitParameters C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� 8 J.3�� m � WDMClassesOfDriver MSNdis_WmiReceiveScaleCapabilities C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� 6 J.3�� k � WDMClassesOfDriver MSNdis_ReceiveFilterCapabilities C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� : J.3�� o � WDMClassesOfDriver MSNdis_ReceiveFilterGlobalParameters C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� * J.3�� _ � WDMClassesOfDriver MSNdis_CountedString C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� . J.3�� c � WDMClassesOfDriver MSNdis_ReceiveFilterInfo C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� 3 J.3�� h � WDMClassesOfDriver MSNdis_ReceiveFilterInfoArray C:\Windows\system32\kernelbase.dll[MofResourceName] me] _NetworkType C:\Windows\system32\kernelbase.dll[MofResourceName] -�/�� �h��� J �� * �~� ���M' 7�0#C t��[ K 9�}�C�{ � $ 1 D � UserSettings UserSettingsProvider Description The user settings � Se sPr � The % � � j } � � �
� � n � � RestoreByTemplateId ' < ��I ��Q ^ Implemented Static Description Restore users' application and Windows settings back to the original settings state. Z a42c9160500003S ROOT\Microsoft\UEV ���� � �� �� > � * � ��������B � __PARAMETERS abstract TemplateId string
� 6 In
� 6 ] �� Template ID Description )
� 6 ] ��� � ID 6
� $ ] ��� � � string RestoreType uint32
� K In
� K r �� Restore Type Description )
� K r ��� � ID 6
� : r ��� � � uint32 __ � ExportPackage ' L ��Y ��a n Implemented Static Description Export a settings package file to a XML file listing all the settings in the package. a42c9160500003S ROOT\Microsoft\UEV ���� � �� �� *
����V � __PARAMETERS abstract AbsolutePathToPackage string
� A In
� A h �� Absolute path to the settings package file Description )
� A h ��� � ID 6
� N h ��� � string __ �� a42c9160500003S ROOT\Microsoft\UEV ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue string
� ^ string out
� ^ f �� __ � GetPackageVersion ' � ��� ��� � Implemented Static Description Get the version of a settings package. a42c9160500003S ROOT\Microsoft\UEV ���� � �� �� *
����V � __PARAMETERS abstract AbsolutePathToPackage string
� A In
� A h �� Absolute path to the settings package file Description )
� A h ��� � ID 6
� N h ��� � string __ �� a42c9160500003S ROOT\Microsoft\UEV ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � IsUserMsaConnected ' � ��� ��� � Implemented Static Description Check if the user live ID is connected. � a42c9160500003S ROOT\Microsoft\UEV ���� � �( �� * m ��� � __PARAMETERS abstract ReturnValue boolean
� _ Boolean out
� _ h �� __ � RestoreBackup ' � ��� ��� � Implemented static Description Restores the backup packages from another machine. Returns false if a restore is already pending, true otherwise a42c9160500003S ROOT\Microsoft\UEV ���� � �� �� * ����_ � __PARAMETERS abstract ComputerName string
� 8 In
� 8 _ �� Fully qualified computer name from which to restore packages Description )
� 8 _ ��� � ID 6
� W _ ��� � string __ �� a42c9160500003S ROOT\Microsoft\UEV ���� � �( �� * m ��� � __PARAMETERS abstract ReturnValue boolean
� _ Boolean out
� _ h �� __ �5 7 E 5 F 3 A D D 9 E 2 4 2 C 4 E 9 F 9 E D F 7 9 A A 9 7 F 7 9 E 7 9 1 1 C 5 A 8 B 9 0 2 E C 1 5 0 D 6 4 4 2 E 3 B 8 5 A 5 A A :�}�C�ȝ��C�� ���9 X � __Win32Provider {D4950C79-806D-4ECE-9DB1-11B34D33F514} ComputerConfigurationProvider E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C ;�}�C� ȝ��C�� �� ���� �� m � __InstanceProviderRegistration \\.\root\Microsoft\UEV:__Win32Provider.Name="ComputerConfigurationProvider" R O O T \ M i c r o s o f t \ U E V _ _ I n s t a n c e P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 5 9 4 1 1 6 5 5 A 8 F 9 5 E E 7 B E A B D F B 8 9 8 8 6 1 D F A 8 E 2 B F 2 3 2 9 3 A 8 A F E 9 6 B 2 E 5 B B 2 3 6 E 7 F E 0 1 \ K I _ E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C \ I _ 1 2 F 9 C 4 5 C 6 3 3 D 9 A 3 5 E A D 4 B 2 1 8 3 1 2 6 9 F 9 2 F 0 6 6 A 3 C 0 4 F A 0 0 0 6 0 4 B B F D B 6 7 F 8 7 B F 6 A C __ � R O O T \ M i c r o s o f t \ U E V _ _ I n s t a n c e P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 5 9 4 1 1 6 5 5 A 8 F 9 5 E E 7 B E A B D F B 8 9 8 8 6 1 D F A 8 E 2 B F 2 3 2 9 3 A 8 A F E 9 6 B 2 E 5 B B 2 3 6 E 7 F E 0 1 \ K I _ E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C \ I _ 6 A B 4 C 2 6 A 7 6 8 D B A D 9 7 2 0 2 3 0 7 5 B D 6 1 5 0 6 6 6 0 6 2 8 C C A 5 9 7 0 C 8 9 9 2 F 7 0 E F 5 A A 2 F 9 3 2 C 9 __ � R O O T \ M i c r o s o f t \ U E V _ _ M e t h o d P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 5 9 4 1 1 6 5 5 A 8 F 9 5 E E 7 B E A B D F B 8 9 8 8 6 1 D F A 8 E 2 B F 2 3 2 9 3 A 8 A F E 9 6 B 2 E 5 B B 2 3 6 E 7 F E 0 1 \ K I _ 7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D \ I _ F B F 5 0 E 9 B 0 5 7 9 9 D A 2 F 0 7 A 7 9 2 0 2 B 0 E 7 B 5 3 E 9 C 0 7 3 4 9 C E 7 F 1 C 4 1 4 4 8 3 2 6 1 C 3 3 3 3 3 9 0 9 `�{� I s a p i _ T r a n s >�4 �
Isapi_Trans
) � �� + 6 _������������� � W3ISAPIEnd EventType EventLevel ContextId
A
� � � � � � �� � �� object WmiDataId extension Guid ActivityID �yID �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� 3 �\>�S}� h � WDMClassesOfDriver MSNdis_FddiLongCurrentAddress C:\Windows\system32\kernelbase.dll[MofResourceName] ] � ���π � ��~ 6 �Dw�;
� @AE' � ;5�B� | ��Y � ɣ�
� # X e S q l P k g _ b u f f e r _ p o o l _ p a g e _ a l l o c a t e d C\��7 �' D - XeSqlPkg_buffer_pool_page_allocated % ) � �� ' 5 A � � � � � � 4 C � � � � 5 F � � ? N � � WUU����������������������������������������������������������������� � buffer_pool_page_allocated EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid allocator_type 0 P
� Y a � ��l c u � � uint32 WmiDataId XEMapId ValueMap � � � � � � 2 3 5 0 4 1 Values � � � � � EMERGENCY LARGEPAGE LAST NONE RESERVATION SINGLE FragmentId 6
� X ` k x � �� uint32 WmiDataId Description FragmentId numa_node_id
4 )
� � �
� �� uint32 WmiDataId number_pages )
� ! ) � �� uint64 WmiDataId page_location ( )
� z � � �� uint64 WmiDataId page_size )
� � � � �� uint64 WmiDataId pool_id < )
� " * � �� uint32 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� " / � �� uint32 WmiDataId Description SequenceNumber steal_options 8 P
� � � � ��� � � � uint32 WmiDataId XEMapId BitMap � � � � 1 16 4 64 32 0 8 2 BitValues > J X i s } � � ColdBuffer DecommitPage ForShortTermUse IsMapped L2DiskIo NoStealOption NoZeroing PartOfReservation worker_address
4
� � � �� �� object WmiDataId Pointer � X e S q l P k g D\��7 � XeSqlPkg
C � ��! . : @ h p z � c����� � XeSqlPkg_buffer_pool_page_freed Description Page freed Guid {4c0968d6-535b-453e-bef4-80332559b0d6} locale MS\0x409 DisplayName buffer_pool_page_freed � X e S q l P k g _ b u f f e r _ p o o l _ p a g e _ f r e e d E\��7 �� ; ) XeSqlPkg_buffer_pool_page_freed ! ) � �� #
1 = � � c q � � " l w � � G W � � 6 F WU��������������������������������������������������������� � buffer_pool_page_freed EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid FragmentId 6
� 7 ? J W � �� uint32 WmiDataId Description FragmentId numa_node_id 0 )
� � � � �� uint32 WmiDataId number_pages )
� � �� uint64 WmiDataId page_location ( )
� Y a � �� uint64 WmiDataId page_size )
� � � � �� uint64 WmiDataId RemainingLength 6
� ) 6 � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber steal_options
4 P
� 8 @
� ��K � T \ � � uint32 WmiDataId XEMapId BitMap � � � � � � � � 1 16 4 64 32 0 8 2 BitValues � � � � � # ColdBuffer DecommitPage ForShortTermUse IsMapped L2DiskIo NoStealOption NoZeroing PartOfReservation worker_address
4
� � � � ��� �� object WmiDataId Pointer � X e S q l P k g F\��7 �� XeSqlPkg
C � ��) 6 � � � � � � c���� � XeSqlPkg_index_build_extents_allocation Description Occurs when new extents are allocated during index building. Use this event to indentify how extents are used by an index. Guid {72833EED-0E7A-4248-87AF-EBCD6C8D57BE} locale MS\0x409 DisplayName index_build_extents_allocation �' X e S q l P k g _ i n d e x _ b u i l d _ e x t e n t s _ a l l o c a t i o n G\��7 � + 1 XeSqlPkg_index_build_extents_allocation ) ) � �� + 9 E � � H X � � � P \ � � R b � � WU�����������������������������������������4 � index_build_extents_allocation EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid breaks_number )
� 5 = � �� uint32 WmiDataId extents_number )
� � � � �� uint32 WmiDataId file_id )
� � � � �� uint32 WmiDataId first_extent_id $ )
� = E � �� uint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� ! ) 4 A � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber thread_internal_id )
� ! ) � �� uint32 WmiDataId � X e S q l P k g H\��7 �� XeSqlPkg
C � ��3 @ � � � � � � c���� � XeSqlPkg_metadata_persist_last_value_for_sequence Description Pre-allocating new cache range for a Sequence object.See system view sys.sequences for more details. Guid {9ce55442-0d75-4355-922d-0eec384825dd} locale MS\0x409 DisplayName metadata_persist_last_value_for_sequence �1 X e S q l P k g _ m e t a d a t a _ p e r s i s t _ l a s t _ v a l u e _ f o r _ s e q u e n c e I\��7 �@ ; XeSqlPkg_metadata_persist_last_value_for_sequence 3 ) � ��* 5 C O � u � ) � � � W����������������������������y � metadata_persist_last_value_for_sequence EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid FragmentId 6
� I Q \ i � �� uint32 WmiDataId Description FragmentId persisted_value C
� � � � ��� �
string WmiDataId StringTermination NullTerminated Format w RemainingLength 6
� m u � � � �� uint32 WmiDataId Description RemainingLength sequence_id )
� � � � �� sint32 WmiDataId SequenceNumber 6
� I Q \ i � �� uint32 WmiDataId Description SequenceNumber �ber �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�� + �\>�S}� ` � WDMClassesOfDriver KernelIdleStateChange C:\Windows\system32\kernelbase.dll[MofResourceName] .mui[MofResourceName] 8:�� � >zr�? < `��`{ � t�ZI ] ���o � �tJ� B ��Y � ~j�� v # X e S q l P k g _ m e t a d a t a _ a g e n t _ l o c k _ o b j e c t gZ��7 �Q ' - XeSqlPkg_metadata_agent_lock_object % ) � �� ' 5 A � � ? L � � + u � � WU������������������������������������� � metadata_agent_lock_object EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid brick_id )
� , 4 � �� uint32 WmiDataId database_id )
� � � � �� uint32 WmiDataId FragmentId 6
� � � � � �� uint32 WmiDataId Description FragmentId mode P
� v ~ � ��� B � � F N uint32 WmiDataId XEMapId ValueMap � � � $ ( , / 2 5 8 < ? C 12 6 7 8 21 0 15 16 17 18 13 14 19 20 3 2 1 9 10 4 11 5 Values � � � � � � � � � � � � � � � � BU IS IU IX LAST_MODE NL RI_NL RI_S RI_U RI_X RS_S RS_U RX_S RX_U S SCH_M SCH_S SIU SIX U UIX X object_id )
� b j � �� sint32 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� O W b o � �� uint32 WmiDataId Description SequenceNumber d � X e S q l P k g hZ��7 � XeSqlPkg
C � �� , B H p x � � c����� � XeSqlPkg_metadata_lock_object Description Metadata lock object Guid {4898aca0-e2c4-11dd-baf7-0a7355d89593} locale MS\0x409 DisplayName metadata_lock_object � X e S q l P k g _ m e t a d a t a _ l o c k _ o b j e c t iZ��7 �E ' ' XeSqlPkg_metadata_lock_object ) � �� ! / ; � � 9 F � � % o � � WU�������������������������������������y � metadata_lock_object EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid brick_id )
� & . � �� uint32 WmiDataId database_id )
� } � � �� uint32 WmiDataId FragmentId 6
� � � � � �� uint32 WmiDataId Description FragmentId mode P
� p x � ��� B � � @ H uint32 WmiDataId XEMapId ValueMap � � � � �
" & ) , / 2 6 9 = 12 6 7 8 21 0 15 16 17 18 13 14 19 20 3 2 1 9 10 4 11 5 Values � � � � � � � � � � � � � � � � �
BU IS IU IX LAST_MODE NL RI_NL RI_S RI_U RI_X RS_S RS_U RX_S RX_U S SCH_M SCH_S SIU SIX U UIX X object_id )
� \ d � �� sint32 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� I Q \ i � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g jZ��7 �5 XeSqlPkg
C � ��* 7 X ^ � � � � c����� � XeSqlPkg_metadata_initiate_unlock_object Description Metadata initiate unlock object Guid {7921adfe-e2c9-11dd-93e1-0a9555d89593} locale MS\0x409 DisplayName metadata_initiate_unlock_object �( X e S q l P k g _ m e t a d a t a _ i n i t i a t e _ u n l o c k _ o b j e c t kZ��7 �@ " 2 XeSqlPkg_metadata_initiate_unlock_object * ) � ��! , : F � � D Q � � " l } � WU��������������������������������v � metadata_initiate_unlock_object EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid brick_id )
� 1 9 � �� uint32 WmiDataId database_id )
� � � � �� uint32 WmiDataId FragmentId 6
� � � � � �� uint32 WmiDataId Description FragmentId object_id )
� Y a � �� sint32 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� F N Y f � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g lZ��7 � XeSqlPkg
C � ��! . F L t | � � c����� � XeSqlPkg_metadata_unlock_object Description Metadata unlock object Guid {84aa24b2-e2c9-11dd-94b5-539555d89593} locale MS\0x409 DisplayName metadata_unlock_object � X e S q l P k g _ m e t a d a t a _ u n l o c k _ o b j e c t mZ��7 �. " ) XeSqlPkg_metadata_unlock_object ! ) � �� # 1 = � � ; H � � c t � � WU��������������������������������m � metadata_unlock_object EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid brick_id )
� ( 0 � �� uint32 WmiDataId database_id )
� � � �� uint32 WmiDataId FragmentId 6
� � � � � �� uint32 WmiDataId Description FragmentId object_id )
� P X � �� sint32 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� = E P ] � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g nZ��7 �N XeSqlPkg
C � ��! . z � � � � � c����� � XeSqlPkg_metadata_add_segmentid Description Metadata add the segmentid column into secondary indexes of matrixdb heaps Guid {99d4d8d6-9b51-4ac3-82d9-2a280bd90ed1} locale MS\0x409 DisplayName metadata_add_segmentid �tid �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�y ! �\>�S}� V � WDMClassesOfDriver MMCSSWakeup C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�v �\>�S}� S � WDMClassesOfDriver MuiTrace C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�z " �\>�S}� W � WDMClassesOfDriver MuiTraceData C:\Windows\system32\kernelbase.dll[MofResourceName] :\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] urceName] � �M�<� c �dZ� � pO�� 9 ���# k �JYy� � fB;" u l�� � �
F�j | =�� � 3 X e S q l P k g _ c o l u m n s t o r e _ d e l e t e _ b u f f e r _ s t a t e _ t r a n s i t i o n �Z��7 �� I = XeSqlPkg_columnstore_delete_buffer_state_transition 5 ) � ��, 7 E Q � R ^ � � l u � � ! j u � � , � � % / WUU����������������������������������������������������������������������� � columnstore_delete_buffer_state_transition EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� ? G � �� uint64 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId from_state = C
� + 3 � ��> Q a i string WmiDataId StringTermination NullTerminated Format w hobt_id 4 )
� � � � �� uint64 WmiDataId index_id $ )
� � �� uint64 WmiDataId is_in_memory
< )
� X _
� �� uint8 WmiDataId object_id )
� � � � �� uint64 WmiDataId partition_number , )
� � �� uint64 WmiDataId RemainingLength 6
� p x � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � �� uint32 WmiDataId Description SequenceNumber to_state A C
� � � � ��� � � � string WmiDataId StringTermination NullTerminated Format w � X e S q l P k g �Z��7 �� XeSqlPkg
C � ��L Y � � � �
c����P � XeSqlPkg_columnstore_delete_buffer_closed_rowgroup_with_generationid_found Description Delete buffer can not be flushed due to existence of one or more closed rowgroups with generation ID. Guid {20288B79-5497-4AE6-B7F9-31821DC886FE} locale MS\0x409 DisplayName columnstore_delete_buffer_closed_rowgroup_with_generationid_found �J X e S q l P k g _ c o l u m n s t o r e _ d e l e t e _ b u f f e r _ c l o s e d _ r o w g r o u p _ w i t h _ g e n e r a t i o n i d _ f o u n d �Z��7 �� ( T XeSqlPkg_columnstore_delete_buffer_closed_rowgroup_with_generationid_found L ) � ��C N \ h i u � � k x � � ' WU��������������������������������������� � columnstore_delete_buffer_closed_rowgroup_with_generationid_found EventType EventVersion ActivityId
N
� � � � � � �� � �� object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� V ^ � �� uint16 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� : B M Z � �� uint32 WmiDataId Description RemainingLength rowgroup_id )
� � � � �� uint64 WmiDataId rowset_id )
� � �� uint64 WmiDataId SequenceNumber 6
� k s ~ � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �Z��7 �C XeSqlPkg
C � ��. ; b h � � � � c����� � XeSqlPkg_columnstore_tuple_mover_task_wakeup Description Fired when tuple mover task wakes up. Guid {518ff101-9e4a-4f63-9e68-2e9f5b210f90} locale MS\0x409 DisplayName columnstore_tuple_mover_task_wakeup �, X e S q l P k g _ c o l u m n s t o r e _ t u p l e _ m o v e r _ t a s k _ w a k e u p �Z��7 �$ 6 XeSqlPkg_columnstore_tuple_mover_task_wakeup . ) � ��% 0 > J � p � � W���������������������z � columnstore_tuple_mover_task_wakeup EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid FragmentId 6
� D L W d � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� J R ] j � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �Z��7 �M XeSqlPkg
C � ��- : m s � � � � c����� � XeSqlPkg_columnstore_tuple_mover_task_sleep Description Fired just before tuple mover task goes to sleep. Guid {00cc8871-94e8-40b2-ac72-af4500f4af02} locale MS\0x409 DisplayName columnstore_tuple_mover_task_sleep �+ X e S q l P k g _ c o l u m n s t o r e _ t u p l e _ m o v e r _ t a s k _ s l e e p �Z��7 �e . 5 XeSqlPkg_columnstore_tuple_mover_task_sleep - ) � ��$ / = I � Q b � � ( 9 � � 2 B WU��������������������������������������������� � columnstore_tuple_mover_task_sleep EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid compress_timestamp )
� > F � �� uint64 WmiDataId flush_timestamp $ )
� � � � �� uint64 WmiDataId FragmentId 6
� � � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� } � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
�
" � �� uint32 WmiDataId Description SequenceNumber sleep_duration )
� y � � �� uint64 WmiDataId � X e S q l P k g �Z��7 �T XeSqlPkg
C � ��6 C k q � � � � c����� � XeSqlPkg_columnstore_tuple_mover_task_skipped_rowset Description Fired when tuple mover skips a rowset. Guid {455e7ed6-b151-404c-aca4-79fa7fb15109} locale MS\0x409 DisplayName columnstore_tuple_mover_task_skipped_rowset � X e S q l P k g 4[��7 �m XeSqlPkg
C � ��2 ? � � � � � � c����� � XeSqlPkg_blob_container_accessor_refresh_failure Description Failed to load the table into memory in the blob container accessor API Guid {6028d678-e928-42b7-9aba-d3e21d9be4a0} locale MS\0x409 DisplayName blob_container_accessor_refresh_failure �ure �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�~ & �\>�S}� [ � WDMClassesOfDriver MSTapeDriveParam C:\Windows\system32\kernelbase.dll[MofResourceName] sourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�~ & �\>�S}� [ � WDMClassesOfDriver MSTapeDriveParam C:\Windows\system32\kernelbase.dll[MofResourceName] MofResourceName] eName] i[MofResourceName] 2\kernelbase.dll[MofResourceName] L �� } 2\�]
� ���� � ���r�
� �pl@T � �G� � �Q^�� @ �B�u� � S y s t e m C o n f i g _ V 2 ���jj��G SystemConfig_V2 6 � ' = � L V ��a i q ~ � � # 0 ~ � � � 6 E W����������������������������� � SystemConfig_V2_Services Description System Configuration EventTypeName Services AMENDMENT LOCALE ms_409 DisplayName
� � � � � string Description DisplayName ProcessId
� � uint32 Description ProcessId ProcessName
� \ d � q string Description ProcessName ServiceName
� � � � � string Description ServiceName ServiceState
� � ( uint32 Description ServiceState SubProcessTag
� q y � � uint32 Description SubProcessTag � S y s t e m C o n f i g _ V 2 ���jj��� SystemConfig_V2 6 � $ : � I P ��[ c k q � � % + � � � � Z ^ � � WU�������������� � SystemConfig_V2_Power Description System Configuration EventTypeName Power AMENDMENT LOCALE ms_409 Pad1
� � � � � uint8 Description Reserved; do not use. Pad2
� � � uint8 Description Reserved; do not use. Pad3
� W ^ � k uint8 Description Reserved; do not use. S1
� � � � � uint8 Description S1 S2
� � � uint8 Description S2 S3
� B I � V uint8 Description S3 S4
� � � � � uint8 Description S4 S5
� � � � � uint8 Description S5 � S y s t e m C o n f i g _ V 2 ���jj��� SystemConfig_V2 6 � & < � K T ��_ g o � � � / C � � W���������������������� � SystemConfig_V2_Network Description System Configuration EventTypeName Network AMENDMENT LOCALE ms_409 MaxHashTableSize
� � � � � uint32 Description MaxHashTableSize MaxUserPort
�
� " uint32 Description MaxUserPort TcbTablePartitions
� o w � � uint32 Description TcbTablePartitions TcpTimedWaitDelay
� � � � � uint32 Description TcpTimedWaitDelay � S y s t e m C o n f i g _ V 2 ���jj��o Y SystemConfig_V2 6 � + A � P ] ��h p x � � � , 8 � � � � 7 C � � � � L _ � � # o � � � C U � � V f � � WUUU������������������������������������������������������������������������������������" � SystemConfig_V2_OpticalMedia Description System Configuration EventTypeName OpticalDisk AMENDMENT LOCALE ms_409 BusType
� � � � � uint16 Description BusType BytesPerSector <
� � uint32 Description BytesPerSector DeviceName L
� d l � y string Description DeviceName DeviceType
� � � � � uint16 Description DeviceType DiscStatus
@
� � + uint16 Description DiscStatus DiskNumber
� o w � � uint16 Description DiskNumber DriveLetter D
� � � � � string Description DriveLetter FileSystemName H
� ' / � < string Description FileSystemName LastSessionStatus B
� � � � � uint16 Description LastSessionStatus ManufacturerName P
� � � � string Description ManufacturerName MediaType
� O W � d uint16 Description MediaType NextWritableAddress ,
� � � � � uint64 Description NextWritableAddress NumberOfFreeBlocks
� " � / uint64 Description NumberOfFreeBlocks NumberOfSessions
4
� � � � � uint32 Description NumberOfSessions NumberOfTracks 8
� � � � � uint32 Description NumberOfTracks Size
� ; C � P uint64 Description Size StartingOffset
� � � � � uint64 Description StartingOffset TotalNumberOfBlocks $
� � �
uint64 Description TotalNumberOfBlocks � S y s t e m C o n f i g _ V 2 ��jj��� SystemConfig_V2 6 � " 8 � G L ��W _ g z � � ; H � � W�������������������������� � SystemConfig_V2_IRQ Description System Configuration EventTypeName IRQ AMENDMENT LOCALE ms_409 DeviceDescription
� � � � � string Description DeviceDescription DeviceDescriptionLen
� � % uint32 Description DeviceDescriptionLen IRQAffinity
� t | � � uint64 Description IRQAffinity IRQNum
� � � � � uint32 Description IRQNum � S y s t e m C o n f i g _ V 2 ��jj��W SystemConfig_V2 6 � " 8 � G L ��W _ g z � � 5 ? � � � � P Z W����������������������������� � SystemConfig_V2_PnP Description System Configuration EventTypeName PnP AMENDMENT LOCALE ms_409 DescriptionLength
� � � � � uint32 Description DescriptionLength DeviceDescription
�
� " string Description DeviceDescription DeviceID
� k s � � string Description DeviceID FriendlyName
� � � � � string Description FriendlyName FriendlyNameLength
� ' / � < uint32 Description FriendlyNameLength IDLength
� � � � � uint32 Description IDLength � S y s t e m C o n f i g _ V 2 ��jj��
SystemConfig_V2 6 � ) ? � N Z ��e m u � � � 3 H � � W�������������������������d � SystemConfig_V2_IDEChannel Description System Configuration EventTypeName IDEChannel AMENDMENT LOCALE ms_409 DeviceTimingMode
� � � � � uint32 Description DeviceTimingMode DeviceType
� � ' uint32 Description DeviceType LocationInformation
� t | � � string Description LocationInformation LocationInformationLen
� � � � � uint32 Description LocationInformationLen TargetId
� E M � Z uint32 Description TargetId � S y s t e m C o n f i g _ V 2 ��jj���
SystemConfig_V2 6 � ' = � L V ��a i q | � � W������������ � SystemConfig_V2_NumaNode Description System Configuration EventTypeName NumaNode AMENDMENT LOCALE ms_409 NodeCount
� � � � � uint32 Description NodeCount NodeMap
� � � uint64 Description NodeMap �Map �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �L����
͝��C�� 3 +/�Q �� h � WDMClassesOfDriver MSMCAEvent_SwitchToCMCPolling C:\Windows\system32\kernelbase.dll[MofResourceName] me] Name] j�U�� ���� �)�� a
) �~ vUH~. ���A ! �T�b " ��ph�
��k}� �H�I� N��
�UY�� ��b� !ek v8Yl ώ�4 �p8�Q m��i 6��} �_�Ɩ W�� z�F� ����� �r0�� "
8x ���A+ 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ݡn�^��
͝��C�� / J.3�� d � WDMClassesOfDriver MSNdis_PMAdminConfigState C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ޡn�^��
͝��C�� / J.3�� d � WDMClassesOfDriver MSNdis_PMAdminConfigParam C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ߡn�^��
͝��C�� * J.3�� _ � WDMClassesOfDriver MSNdis_PMAdminConfig C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� . J.3�� c � WDMClassesOfDriver MSNdis_PMCapabilityState C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� 0 J.3�� e � WDMClassesOfDriver MSNdis_PMCapabilitiesParam C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� + J.3�� ` � WDMClassesOfDriver MSNdis_PMCapabilities C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� 9 J.3�� n � WDMClassesOfDriver MSNdis_80211_ReceiveAntennaSelected C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� : J.3�� o � WDMClassesOfDriver MSNdis_80211_TransmitAntennaSelected C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� , J.3�� a � WDMClassesOfDriver MSNdis_80211_DataRates C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� 3 J.3�� h � WDMClassesOfDriver MSNdis_80211_DesiredDataRates C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� 0 J.3�� e � WDMClassesOfDriver MSNdis_80211_Configuration C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� - J.3�� b � WDMClassesOfDriver MSNdis_80211_Statistics C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� ) J.3�� ^ � WDMClassesOfDriver MSNdis_80211_AddWEP C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� , J.3�� a � WDMClassesOfDriver MSNdis_80211_RemoveWEP C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� / J.3�� d � WDMClassesOfDriver MSNdis_80211_Disassociate C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� 0 J.3�� e � WDMClassesOfDriver MSNdis_80211_BssIdListScan C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� 5 J.3�� j � WDMClassesOfDriver MSNdis_80211_AuthenticationMode C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� 0 J.3�� e � WDMClassesOfDriver MSNdis_80211_PrivacyFilter C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� , J.3�� a � WDMClassesOfDriver MSNdis_80211_WEPStatus C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� 1 J.3�� f � WDMClassesOfDriver MSNdis_80211_ReloadDefaults C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� - J.3�� b � WDMClassesOfDriver MSNdis_StatusResetStart C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� + J.3�� ` � WDMClassesOfDriver MSNdis_StatusResetEnd C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� / J.3�� d � WDMClassesOfDriver MSNdis_StatusMediaConnect C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� 2 J.3�� g � WDMClassesOfDriver MSNdis_StatusMediaDisconnect C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� : J.3�� o � WDMClassesOfDriver MSNdis_StatusMediaSpecificIndication C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� 2 J.3�� g � WDMClassesOfDriver MSNdis_StatusLinkSpeedChange C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� / J.3�� d � WDMClassesOfDriver MSNdis_StatusProtocolBind C:\Windows\system32\kernelbase.dll[MofResourceName] e] i � WDMClassesOfDriver MSNdis_StatusDot11RoamingStart C:\Windows\system32\kernelbase.dll[MofResourceName] ase.dll[MofResourceName] -:/� ��>� �5*� + ª� ' "�&�@ � ��\ ! �Fw[} * Hya� ' � ��
& xsU� 2�8
j��/ # 9|R�R Xw�%q ϛ�D� �t~� ��_�� &��@� �{�� ! T+�` - t
qA ��Ôa }B )} 5��T� ��
! �2eJ� H���� 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ǡn�^��
͝��C�� 2 J.3�� g � WDMClassesOfDriver MSNdis_80211_ConfigurationFH C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ɡn�^��
͝��C�� , J.3�� a � WDMClassesOfDriver MSNdis_80211_WLanBssId C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 v�n�^��
͝��C�� C J.3�� x � WDMClassesOfDriver MSNdis_QueryReceiveFilterHardwareCapabilities C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 w�n�^��
͝��C�� ? J.3�� t � WDMClassesOfDriver MSNdis_QueryReceiveFilterGlobalParameters C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 x�n�^��
͝��C�� 4 J.3�� i � WDMClassesOfDriver MSNdis_EnumerateReceiveFilters C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 y�n�^��
͝��C�� 9 J.3�� n � WDMClassesOfDriver MSNdis_QueryReceiveFilterParameters C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 z�n�^��
͝��C�� B J.3�� w � WDMClassesOfDriver MSNdis_QueryReceiveFilterCurrentCapabilities C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 {�n�^��
͝��C�� ? J.3�� t � WDMClassesOfDriver MSNdis_QueryNicSwitchHardwareCapabilities C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 |�n�^��
͝��C�� > J.3�� s � WDMClassesOfDriver MSNdis_QueryNicSwitchCurrentCapabilities C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 }�n�^��
͝��C�� 8 J.3�� m � WDMClassesOfDriver MSNdis_QueryReceiveQueueParameters C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ~�n�^��
͝��C�� 3 J.3�� h � WDMClassesOfDriver MSNdis_EnumerateReceiveQueues C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� ; J.3�� p � WDMClassesOfDriver MSNdis_80211_BaseServiceSetIdentifier C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� 7 J.3�� l � WDMClassesOfDriver MSNdis_80211_ServiceSetIdentifier C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� . J.3�� c � WDMClassesOfDriver MSNdis_80211_NetworkType C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� 8 J.3�� m � WDMClassesOfDriver MSNdis_80211_NetworkTypesSupported C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� 3 J.3�� h � WDMClassesOfDriver MSNdis_80211_NetworkTypeInUse C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� , J.3�� a � WDMClassesOfDriver MSNdis_80211_PowerMode C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� 5 J.3�� j � WDMClassesOfDriver MSNdis_80211_TransmitPowerLevel C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� 9 J.3�� n � WDMClassesOfDriver MSNdis_80211_ReceivedSignalStrength C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� E J.3�� z � WDMClassesOfDriver MSNdis_80211_ReceivedSignalStrengthEventTrigger C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� 8 J.3�� m � WDMClassesOfDriver MSNdis_80211_NetworkInfrastructure C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� 4 J.3�� i � WDMClassesOfDriver MSNdis_80211_ConfigurationInfo C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� + J.3�� ` � WDMClassesOfDriver MSNdis_80211_BSSIList C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� 5 J.3�� j � WDMClassesOfDriver MSNdis_80211_InfrastructureMode C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� 9 J.3�� n � WDMClassesOfDriver MSNdis_80211_FragmentationThreshold C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� / J.3�� d � WDMClassesOfDriver MSNdis_80211_RTSThreshold C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� 3 J.3�� h � WDMClassesOfDriver MSNdis_80211_NumberOfAntennas C:\Windows\system32\kernelbase.dll[MofResourceName] �� z ̉@k� 4 ��.
�,*G 0 W�1`w m ��5�� d �U�H � X e S q l P k g _ f i l e _ w r i t e _ t h r o t t l e d �U��7 �( B ' XeSqlPkg_file_write_throttled ) � �� ! / ; � � < I � � � R ^ � � B R � � � � � � � � 5 E � � WUUU�������������������������������������������������������������� � file_write_throttled EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id $ )
� ) 1 � �� uint32 WmiDataId file_handle
4
� � � � ��� �� object WmiDataId Pointer file_id ( )
� � � � �� uint16 WmiDataId filegroup_id
* )
� ? G
� �� uint16 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId io_data
: 6
� # � ��. 9 object WmiDataId Extension Variant is_reserved_io
5 )
� � �
� �� sint8 WmiDataId is_volume_limit_hit 4 )
� � � � �� sint8 WmiDataId mode P
� ] e � ��p y � � � uint32 WmiDataId XEMapId ValueMap � � 0 1 Values � � Contiguous Scatter/Gather offset )
� � �� uint64 WmiDataId path 6 C
� n v � ��� � � � string WmiDataId StringTermination NullTerminated Format w RemainingLength 6
� $ � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber size , )
� � � � �� uint64 WmiDataId � X e S q l P k g �U��7 � XeSqlPkg
C � �� ( > D l t ~ � c����� � XeSqlPkg_checkpoint_begin Description Checkpoint has begun Guid {99ca2b70-a594-4250-9ca6-b761a9486fd2} locale MS\0x409 DisplayName checkpoint_begin � X e S q l P k g _ c h e c k p o i n t _ b e g i n �U��7 �� + # XeSqlPkg_checkpoint_begin ) � �� + 7 � � 8 G � � U d � � t � � w � WU������������������������������������������ � checkpoint_begin EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� % - � �� uint32 WmiDataId database_name C
� � � � ��� � � � string WmiDataId StringTermination NullTerminated Format w FragmentId 6
� ) 1 < I � �� uint32 WmiDataId Description FragmentId logical_db_id
$ 6
� � � � ��� � object:guid WmiDataId Extension Guid logical_db_name C
� 3 ; � ��F Y i q string WmiDataId StringTermination NullTerminated Format w physical_db_id
6
� � � � ��� � object:guid WmiDataId Extension Guid RemainingLength 6
� F N Y f � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g V��7 � XeSqlPkg
C � �� & < B j r | � c����� � XeSqlPkg_checkpoint_end Description Checkpoint has ended Guid {43694edc-2f3b-4e10-b13f-14393f3bd9d6} locale MS\0x409 DisplayName checkpoint_end � X e S q l P k g _ c h e c k p o i n t _ e n d V��7 �' 3 ! XeSqlPkg_checkpoint_end ) � �� ) 5 � � � � � � y � ' � � $ � � 3 D � � WUU������������������������������������������������= � checkpoint_end EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid checkpoint_lsn
( C
� @ H
� ��S f v ~ string WmiDataId StringTermination NullTerminated Format w database_id )
� � � � �� uint32 WmiDataId database_name C
� 8 @ � ��K ^ n v string WmiDataId StringTermination NullTerminated Format w dirty_page_lsn , C
� � � � ��� string WmiDataId StringTermination NullTerminated Format w FragmentId 6
� k s ~ � � �� uint32 WmiDataId Description FragmentId logical_db_id
$ 6
� � � � ��
object:guid WmiDataId Extension Guid logical_db_name C
� u } � ��� � � � string WmiDataId StringTermination NullTerminated Format w physical_db_id
6
�
� ��" - object:guid WmiDataId Extension Guid RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
�
- � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g V��7 �< XeSqlPkg
C � ��& 3 c i � � � � c����� � XeSqlPkg_analysis_pass_bootpage_info Description Occurs during analysis pass of crash recovery. Guid {fcc4db16-dafc-492d-9bce-17750207ca92} locale MS\0x409 DisplayName analysis_pass_bootpage_info �% X e S q l P k g _ r e c o v e r y _ s i m p l e _ l o g _ t r u n c a t e V��7 �5 / XeSqlPkg_recovery_simple_log_truncate ' ) � �� ) 7 C � � D M � � f w � � WU������������������������������p � recovery_simple_log_truncate EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� 1 9 � �� uint32 WmiDataId file_id )
� � � � �� uint16 WmiDataId FragmentId 6
� � � � � �� uint32 WmiDataId Description FragmentId page_id )
� S [ � �� uint32 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� @ H S ` � �� uint32 WmiDataId Description SequenceNumber �ber �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�~ & �\>�S}� [ � WDMClassesOfDriver ObReferenceEvent C:\Windows\system32\kernelbase.dll[MofResourceName] ] ��� �tGb� � [4� ͟R�� xv\� �]� �c4 3-�DI S��,Q
1d�i (��g� ��iL�
A�ܴ
40� �w�]� ?e�:� �� Qo�~� �dpV
���J( ��53 W�!�C ���U 'ep �4�:{
���W� �(u� �J��� 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 '�n�^��
͝��C�w J.3�� T � WDMClassesOfDriver MSRedbook C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ؤn�^��
͝��C�v J.3�� S � WDMClassesOfDriver MSSerial C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ٤n�^��
͝��C� ' J.3�� \ � WDMClassesOfDriver MSSerial_PortName C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ڤn�^��
͝��C� ' J.3�� \ � WDMClassesOfDriver MSSerial_CommInfo C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ۤn�^��
͝��C�� 4 J.3�� i � WDMClassesOfDriver MSSerial_HardwareConfiguration C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ܤn�^��
͝��C�� 5 J.3�� j � WDMClassesOfDriver MSSerial_PerformanceInformation C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ݤn�^��
͝��C�� - J.3�� b � WDMClassesOfDriver MSSerial_CommProperties C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ޤn�^��
͝��C�x J.3�� U � WDMClassesOfDriver MSParallel C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ߤn�^��
͝��C�� 0 J.3�� e � WDMClassesOfDriver MSParallel_AllocFreeCounts C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� 7 J.3�� l � WDMClassesOfDriver MSParallel_DeviceBytesTransferred C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� 1 J.3�� f � WDMClassesOfDriver MSRedbook_DriverInformation C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� + J.3�� ` � WDMClassesOfDriver MSRedbook_Performance C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�} % J.3�� Z � WDMClassesOfDriver RegisteredGuids C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�x J.3�� U � WDMClassesOfDriver EventTrace C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�~ & J.3�� [ � WDMClassesOfDriver MSNT_SystemTrace C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� , J.3�� a � WDMClassesOfDriver MSNT_CKCLTraceProvider C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� ( J.3�� ] � WDMClassesOfDriver EventTraceEvent_V0 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� * J.3�� _ � WDMClassesOfDriver EventTrace_V0_Header C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� 3 J.3�� h � WDMClassesOfDriver Header_Extension_V0_TypeGroup C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�{ # J.3�� X � WDMClassesOfDriver RDComplete_V0 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� ( J.3�� ] � WDMClassesOfDriver EventTraceEvent_V1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� * J.3�� _ � WDMClassesOfDriver EventTrace_V1_Header C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� 3 J.3�� h � WDMClassesOfDriver Header_Extension_V1_TypeGroup C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�{ # J.3�� X � WDMClassesOfDriver RDComplete_V1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�} % J.3�� Z � WDMClassesOfDriver EventTraceEvent C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C� ' J.3�� \ � WDMClassesOfDriver EventTrace_Header C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� 0 J.3�� e � WDMClassesOfDriver Header_Extension_TypeGroup C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�x J.3�� U � WDMClassesOfDriver RDComplete C:\Windows\system32\kernelbase.dll[MofResourceName] Name] e.dll[MofResourceName] sourceName] l.mui[MofResourceName] �J��� ' 4��� � �9{L � �^� � ���9� � n�?�~ i �rą� � u��kk d 4 X e S q l P k g _ q u e r y _ e x e c u t i o n _ b p _ h a s h _ a g g _ m e m _ u s a g e _ s t a t s �X��7 �� T > XeSqlPkg_query_execution_bp_hash_agg_mem_usage_stats 6 ) � ��- 8 F R � a m � � E ] � � Z r � � B R � � - WUU���������������������������������������������������������������������������������w � query_execution_bp_hash_agg_mem_usage_stats EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid current_repartition_pages 0 )
� N V � �� sint64 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId global_hash_accum_pages_size
8 )
� 2 :
� �� sint64 WmiDataId global_hash_table_size @ )
� � � � �� sint64 WmiDataId partition_count ( )
� � � � �� sint64 WmiDataId partition_id )
� G O � �� sint64 WmiDataId query_operator_node_id )
� � � � �� sint32 WmiDataId RemainingLength 6
� $ 1 � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber worker_id )
� � �� sint64 WmiDataId worker_mem_usage H )
� d l � �� sint64 WmiDataId � X e S q l P k g �X��7 �m XeSqlPkg
C � ��. ; � � � � � � c����� � XeSqlPkg_query_execution_push_down_aggregate Description Occurs when a hashed aggregation operator is pushed down to the storage engine. Guid {21F95AC5-E07F-4EDD-BD7F-786D1FC71FE9} locale MS\0x409 DisplayName query_execution_push_down_aggregate �, X e S q l P k g _ q u e r y _ e x e c u t i o n _ p u s h _ d o w n _ a g g r e g a t e �X��7 �a " 6 XeSqlPkg_query_execution_push_down_aggregate . ) � ��% 0 > J � Q ] � � ' ? � � WU��������������������������������� � query_execution_push_down_aggregate EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid aggregation_count )
� > F � �� uint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId group_by_count )
� � �� uint32 WmiDataId query_operator_node_id )
� v ~ � �� sint32 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� c k v � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �X��7 �a XeSqlPkg
C � ��7 D w } � � � � c����� � XeSqlPkg_query_execution_dynamic_push_down_statistics Description Telemetry for dynamic aggregate pushdown to scan. Guid {78144E19-4110-4375-8F75-9F69BB5B9DE2} locale MS\0x409 DisplayName query_execution_dynamic_push_down_statistics �5 X e S q l P k g _ q u e r y _ e x e c u t i o n _ d y n a m i c _ p u s h _ d o w n _ s t a t i s t i c s �X��7 �V 7 ? XeSqlPkg_query_execution_dynamic_push_down_statistics 7 ) � ��. 9 G S � y � � � R _ � � H � � ' q � � WUU����������������������������������������������������J � query_execution_dynamic_push_down_statistics EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid FragmentId 6
� M U ` m � �� uint32 WmiDataId Description FragmentId node_id )
� � � � �� sint32 WmiDataId RemainingLength 6
� ! ) 4 A � �� uint32 WmiDataId Description RemainingLength rowgroup_id )
� � � � �� uint64 WmiDataId rows_not_pushed_down_due_to_encoding
, )
�
� �� uint32 WmiDataId rows_not_pushed_down_due_to_possible_overflow 0 )
� � � �� uint32 WmiDataId rows_not_pushed_down_due_to_pushdown_disabled ( )
� � � �� uint32 WmiDataId rows_pushed_down_in_thread $ )
� ^ f � �� uint32 WmiDataId SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber thread_id )
� 7 ? � �� sint32 WmiDataId � X e S q l P k g �X��7 �A XeSqlPkg
C � ��( 5 f l � � � � c����� � XeSqlPkg_remote_dmv_stream_open_client Description Remote DMV stream client side open call is made Guid {6F21AFBF-AD4E-4e17-BA4B-3401540556BE} locale MS\0x409 DisplayName remote_dmv_stream_open_client �& X e S q l P k g _ r e m o t e _ d m v _ s t r e a m _ o p e n _ c l i e n t �X��7 � + 0 XeSqlPkg_remote_dmv_stream_open_client ( ) � �� * 8 D � � I [ � � ! 3 } � � � � � WU�����������������������������������������? � remote_dmv_stream_open_client EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid client_brick_id )
� 6 > � �� uint32 WmiDataId client_stream_id )
� � � � �� uint32 WmiDataId FragmentId 6
� � � � �� uint32 WmiDataId Description FragmentId internal_stvf_id )
� j r � �� uint32 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� W _ j w � �� uint32 WmiDataId Description SequenceNumber server_brick_id )
� � � � �� uint32 WmiDataId server_session_id $ )
� , 4 � �� uint32 WmiDataId � X e S q l P k g �X��7 �< XeSqlPkg
C � ��( 5 a g � � � � c����� � XeSqlPkg_remote_dmv_stream_open_server Description Remote DMV stream is open call is serviced Guid {9748888C-3898-4d04-95A1-60F1DB3F6AED} locale MS\0x409 DisplayName remote_dmv_stream_open_server �ver �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�� + �\>�S}� ` � WDMClassesOfDriver TP_V2_TimerSetNtTimer C:\Windows\system32\kernelbase.dll[MofResourceName] ] Name] e] �(
٠ 7 ���� � ]��CZ � ���5
^ �i$� � K��r = �0x� K �y�� F G�d@ a X e S q l P k g _ f i l e g r o u p _ n a m e _ c h a n g e qW��7 �� ' ( XeSqlPkg_filegroup_name_change ) � �� " 0 < � � = R � � � p z � � WU������������������������������������� � filegroup_name_change EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� * 2 � �� uint32 WmiDataId database_segment_id )
� � � � �� uint32 WmiDataId filegroup_id )
� � � � �� uint32 WmiDataId FragmentId 6
� D L W d � �� uint32 WmiDataId Description FragmentId new_name C
� � � � ��� � string WmiDataId StringTermination NullTerminated Format w RemainingLength 6
� a i t � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g rW��7 �[ XeSqlPkg
C � ��$ 1 � � � � � � c����� � XeSqlPkg_filegroup_property_change Description Occurs when the file group manager changed the property for a physical filegroup. Guid {b6d0fe4c-06f2-478e-9478-399ac3836f0a} locale MS\0x409 DisplayName filegroup_property_change �" X e S q l P k g _ f i l e g r o u p _ p r o p e r t y _ c h a n g e sW��7 � ' , XeSqlPkg_filegroup_property_change $ ) � �� & 4 @ � � A V � � � t � � � * : WU�������������������������������������� � filegroup_property_change EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� . 6 � �� uint32 WmiDataId database_segment_id )
� � � � �� uint32 WmiDataId filegroup_id )
� � � � �� uint32 WmiDataId FragmentId 6
� H P [ h � �� uint32 WmiDataId Description FragmentId new_property P
� � � � ��� � � 4 < uint32 WmiDataId XEMapId ValueMap " % ( + . 1 4 5 2 3 0 1 Values X j ~ � � � AutogrowAllFiles AutogrowSingleFile Offline Online ReadOnly ReadWrite RemainingLength 6
� � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� ~ � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g tW��7 �6 XeSqlPkg
C � ��% 2 ^ d � � � � c����� � XeSqlPkg_group_commit_value_changed Description Number of group commit waiters has changed Guid {268c5088-ea00-465f-9224-2a4b9fe34bd5} locale MS\0x409 DisplayName group_commit_value_changed �# X e S q l P k g _ g r o u p _ c o m m i t _ v a l u e _ c h a n g e d uW��7 �� 3 - XeSqlPkg_group_commit_value_changed % ) � �� '
5 A � � B S � � 2 | � � � _ o � � 6 I WU������������������������������������������������� � group_commit_value_changed EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid duration_ms )
� / 7 � �� uint64 WmiDataId flushes_per_sec $ )
� � � � �� uint32 WmiDataId FragmentId 6
� � �
� �� uint32 WmiDataId Description FragmentId next_sample_duration_ms ( )
� i q � �� uint32 WmiDataId next_sample_index
, )
� � �
� �� uint32 WmiDataId RemainingLength 6
� . 6 A N � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber waiters )
� # + � �� uint32 WmiDataId waiters_per_flush )
� � � � �� uint32 WmiDataId � X e S q l P k g vW��7 � XeSqlPkg
C � �� + D J r z � � c����� � XeSqlPkg_log_flush_requested Description Log flush was requested Guid {d9b42c24-fb8a-4744-80f6-9b15149173a1} locale MS\0x409 DisplayName log_flush_requested � X e S q l P k g _ l o g _ f l u s h _ r e q u e s t e d wW��7 �� - & XeSqlPkg_log_flush_requested ) � ��
. : � � ; G � � " l y � � � � C S � � WU������������������������������������������ � log_flush_requested EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� ( 0 � �� uint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId is_delayed_durable ( )
� � �� sint8 WmiDataId log_block_id )
� Y a � �� uint64 WmiDataId only_signal
) )
� � �
� �� sint8 WmiDataId reason P
� ( 0 � ��; D N g o sint32 WmiDataId XEMapId ValueMap ^ a d 0 1 2 Values � � Waiters limit reached Time limit reached Immediate request RemainingLength 6
� % 2 � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber waiters )
� � �� uint32 WmiDataId � X e S q l P k g xW��7 � XeSqlPkg
C � �� , L R z � � � c����� � XeSqlPkg_log_buffer_allocated Description Log write buffer was allocated Guid {455e9012-2a18-4131-b6bf-1391e93d7acd} locale MS\0x409 DisplayName log_buffer_allocated � X e S q l P k g �X��7 �9 XeSqlPkg
C � ��+ 8 [ a � � � � c����� � XeSqlPkg_query_rpc_process_cmd_lob_action Description Processing LobAction RPC command. Guid {9de85962-44bf-45ec-923d-c6c8a8a4bf7b} locale MS\0x409 DisplayName query_rpc_process_cmd_lob_action �ion �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�| $ �\>�S}� Y � WDMClassesOfDriver TP_V2_CBCancel C:\Windows\system32\kernelbase.dll[MofResourceName] rceName] ceName] ofResourceName] ����p � ´�� ) �3�.D ) �6�m G =i2� l װ�� � S Q L T r a c e E v e n t 1 2 4 P��7 �s SQLTraceEvent124 6 � �� % @ K Z ] n $ 5 � � & 2 � � _ n � � c m " � � c m � � W a � � � � K
W
� � � � =
O
v � � � � | � 5 D UUUUUU������������������������������������������������������������������������������������������������������������������������� � SQLTraceEvent124_TYPE0 Description Broker:Conversation Type0 EventType EventTypeName 0 ApplicationName $ P
� � � � � � � �� string WmiDataId Description ApplicationName format w StringTermination Counted ClientProcessID 6
� y � � � � �� sint32 WmiDataId Description ClientProcessID DatabaseID 6
� �
� �� sint32 WmiDataId Description DatabaseID DBUserName P P
� � � � � � � � � � �� string WmiDataId Description DBUserName format w StringTermination Counted EventClass 8 6
� 3 ;
F S � �� sint32 WmiDataId Description EventClass EventSequence d 6
� � � � � � �� sint64 WmiDataId Description EventSequence EventSubClass 4 6
� 4 < G T � �� sint32 WmiDataId Description EventSubClass FileName @ P
� � � � � � � � �� string WmiDataId Description FileName format w StringTermination Counted GUID
l C
� s { � � � � � �� object WmiDataId Description GUID extension Guid HostName P
� % 2 < D G Z � �� string WmiDataId Description HostName format w StringTermination Counted IsSystem p 6
� � � � � � �� sint32 WmiDataId Description IsSystem LineNumber 6
� + 3 > K � �� sint32 WmiDataId Description LineNumber LoginSid T P
� � � � � � � � � �� string WmiDataId Description LoginSid format c StringTermination Counted MethodName ` P
� z � � � � � � � � �� string WmiDataId Description MethodName format w StringTermination Counted NTDomainName P
� 9 A L Y g o r � � �� string WmiDataId Description NTDomainName format w StringTermination Counted NTUserName P
� �
$
,
/
B
� �� string WmiDataId Description NTUserName format w StringTermination Counted ObjectName
< P
� �
�
�
�
�
�
�
�
� �� string WmiDataId Description ObjectName format w StringTermination Counted OwnerName D P
� q y � � � � � � � �� string WmiDataId Description OwnerName format w StringTermination Counted ProviderName \ P
� / 7 B O ] e h { � �� string WmiDataId Description ProviderName format w StringTermination Counted RoleName H P
� � � �
!
4
� �� string WmiDataId Description RoleName format w StringTermination Counted SessionLoginName t P
� �
�
�
�
�
�
�
�
� �� string WmiDataId Description SessionLoginName format w StringTermination Counted SPID ( 6
� P X
c p � �� sint32 WmiDataId Description SPID StartTime
, 6
� � � � � � �� uint64 WmiDataId Description StartTime TargetLoginName X P
� _ g r � � � � � �� string WmiDataId Description TargetLoginName format w StringTermination Counted TargetUserName L P
� % - 8 E U ] ` s � �� string WmiDataId Description TargetUserName format w StringTermination Counted TextData P
� � � � , � �� string WmiDataId Description TextData format w StringTermination Counted TransactionID 6
� � � � � � �� sint64 WmiDataId Description TransactionID � M S S Q L S E R V E R T r a c e P��7 �� MSSQLSERVERTrace 6 � �� 9 ? e r � � SQLTraceEvent125 Description Deprecation Announcement Guid 84e993e6-007d-4d70-97ef-3824ed2c4e93 DisplayName Deprecation Announcement ve � M S S Q L S E R V E R T r a c e �P��7 �� MSSQLSERVERTrace 6 � �� 9 ? e r � � SQLTraceEvent182 Description TM: Begin Tran completed Guid 84e993e6-00b6-4d70-97ef-3824ed2c4e93 DisplayName TM: Begin Tran completed ve �% X e S q l P k g _ q u e r y _ t s q l _ s c a l a r _ u d f _ p a r s e d +Q��7 �� ' / XeSqlPkg_query_tsql_scalar_udf_parsed ' ) � �� ) 7 C � � D P � � & � � + u WU������������������������������������� � query_tsql_scalar_udf_parsed EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� 1 9 � �� uint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId object_id )
�
� �� sint32 WmiDataId RemainingLength 6
� j r } � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � �� uint32 WmiDataId Description SequenceNumber stmt_count )
� b j � �� sint32 WmiDataId udf_name C
� � � � ��� � string WmiDataId StringTermination NullTerminated Format w � X e S q l P k g ,Q��7 �D XeSqlPkg
C � ��) 6 h n � � � � c����� � XeSqlPkg_tsql_scalar_udf_not_inlineable Description Encountered a scalar UDF that is not inlineable. Guid {0C91D45A-8DCC-40A5-98EB-260F8825F9CC} locale MS\0x409 DisplayName tsql_scalar_udf_not_inlineable � X e S q l P k g �Q��7 �� XeSqlPkg
C � ��C P � � � � � � c����1 � XeSqlPkg_query_optimizer_cardinality_estimation_join_side_ignored Description Occurs when cardinality estimation for a join is produced by ignoring one of the inputs. Guid {860e28a2-8ca9-467a-ba3c-0bfd71e34dd0} locale MS\0x409 DisplayName query_optimizer_cardinality_estimation_join_side_ignored �red �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ᴹ���
͝��C�x ��7��� U � WDMClassesOfDriver ThreadPool C:\Windows\system32\kernelbase.dll[MofResourceName] ���� � Y�F�b } O�?a� � ���� w ��� ! �,��2 � ���� j e=�'. C 6 X e S q l P k g _ r e m o t e _ c s _ g a r b a g e _ c o l l e c t i o n _ b a t c h _ c o m p l e t i o n �[��7 �N @ XeSqlPkg_remote_cs_garbage_collection_batch_completion 8 ) � ��/ : H T � � � . x � � W����������������������������� � remote_cs_garbage_collection_batch_completion EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid dbName C
� W _ � ��j } � � string WmiDataId StringTermination NullTerminated Format w FragmentId 6
� � � � � �� uint32 WmiDataId Description FragmentId numberOfEntriesProcessed )
� e m � �� uint32 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� R Z e r � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �[��7 �U XeSqlPkg
C � ��2 ? p v � � � � c����� � XeSqlPkg_remote_cs_garbage_collection_task_start Description Remote CS Garbage Collection Task Start XEvents Guid {25d9c3c5-9557-4f47-b40b-10437eaa3e3a} locale MS\0x409 DisplayName remote_cs_garbage_collection_task_start �0 X e S q l P k g _ r e m o t e _ c s _ g a r b a g e _ c o l l e c t i o n _ t a s k _ s t a r t �[��7 �C : XeSqlPkg_remote_cs_garbage_collection_task_start 2 ) � ��) 4 B N � � � � � p � � WU�����������������������������t � remote_cs_garbage_collection_task_start EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid dbName C
� Q Y � ��d w � � string WmiDataId StringTermination NullTerminated Format w FragmentId 6
� � � � � �� uint32 WmiDataId Description FragmentId level P
� s z � ��� g � � � � uint8 WmiDataId XEMapId ValueMap � � � � 2 1 3 0 Values � � � � BATCH DB ROW TASK RemainingLength 6
� ? G R _ � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber targetLogicalDbId
6
� K X � ��c n object:guid WmiDataId Extension Guid � X e S q l P k g �[��7 �O XeSqlPkg
C � ��0 = l r � � � � c����� � XeSqlPkg_remote_cs_garbage_collection_task_end Description Remote CS Garbage Collection Task End XEvents Guid {0236299a-1b44-489c-a3cf-eb5f2addff0e} locale MS\0x409 DisplayName remote_cs_garbage_collection_task_end �. X e S q l P k g _ r e m o t e _ c s _ g a r b a g e _ c o l l e c t i o n _ t a s k _ e n d �[��7 �� ( 8 XeSqlPkg_remote_cs_garbage_collection_task_end 0 ) � ��' 2 @ L � � � � � � i p E V � � O b WU��������������������������������������� � remote_cs_garbage_collection_task_end EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid dbName C
� O W � ��b u � � string WmiDataId StringTermination NullTerminated Format w durationInSeconds )
� � � � �� uint64 WmiDataId FragmentId 6
� = E P ] � �� uint32 WmiDataId Description FragmentId level P
� � � � ��� g � � uint8 WmiDataId XEMapId ValueMap
2 1 3 0 Values / 6 : ? BATCH DB ROW TASK RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� ' 2 ? � �� uint32 WmiDataId Description SequenceNumber targetLogicalDbId
! 6
� � � � ��� � object:guid WmiDataId Extension Guid � X e S q l P k g �[��7 �j XeSqlPkg
C � ��9 F ~ � � � � � c����� � XeSqlPkg_remote_cs_garbage_collection_drop_from_catalog Description Remote CS Garbage Collection Drop From Catalog XEvents Guid {6f03fa93-cf49-4ca3-a2f1-cab82c9db115} locale MS\0x409 DisplayName remote_cs_garbage_collection_drop_from_catalog �7 X e S q l P k g _ r e m o t e _ c s _ g a r b a g e _ c o l l e c t i o n _ d r o p _ f r o m _ c a t a l o g �[��7 �� " A XeSqlPkg_remote_cs_garbage_collection_drop_from_catalog 9 ) � ��0 ; I U � u } � � � � WU�������������������������������� � remote_cs_garbage_collection_drop_from_catalog EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid blob_id
6
� L Y � ��d o object:guid WmiDataId Extension Guid dbName C
� � � � ��� � string WmiDataId StringTermination NullTerminated Format w fork_id
6
� \ i � ��t object:guid WmiDataId Extension Guid FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� V ^ i v � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �[��7 � XeSqlPkg
C � ��! . G M u } � � c����� � XeSqlPkg_page_reference_tracker Description Page is being looked up Guid {e88032c5-2f9c-453a-8eb8-b7221bf8b056} locale MS\0x409 DisplayName page_reference_tracker �ker �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�� 6 �\>�S}� k � WDMClassesOfDriver WmiMonitorAnalogVideoInputParams C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�� 7 �\>�S}� l � WDMClassesOfDriver WmiMonitorDigitalVideoInputParams C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�� - �\>�S}� b � WDMClassesOfDriver WmiMonitorColorXYZinCIE C:\Windows\system32\kernelbase.dll[MofResourceName] Name] �e] ��4� z �U
8l&) �K7AB ! � ��c ! -N厄 " �=a� í+�
B a s e S t a t u s l��C�N � BaseStatus ) � �� � - ? 5 F x � � � � B T � � � � 9 m � � � �
? ^ � � � � * 6 s � � H i � � � 7 D v � � � � D ^ � � � � ! 8 k ~ � � �
y � �
<
N
�
�
�
�
% L g � � �
9
K
�
�
�
% Y t � � / b } � � � A M � � � � 6 D v � � � / a � � � � F e � � @P @ @� �� � � � ��� ����� ����� ������������ � ���� �������� � ��� �
� � ���� � � � MSFT_MpComputerStatus ProtectionManagement locale AMEngineVersion i
� p � �� string AMProductVersion
� � � �� string AMRunningMode
� � � �� string AMServiceEnabled m
� 9 � �� boolean AMServiceVersion
� ~ � �� string AntispywareEnabled % w
� � � �� boolean AntispywareSignatureAge
� � �� uint32 AntispywareSignatureLastUpdated e
$
� c � �� datetime AntispywareSignatureVersion
� � string AntivirusEnabled $ u
� � � �� boolean AntivirusSignatureAge ,
� 7 � �� uint32 AntivirusSignatureLastUpdated e
0
� � � �� datetime AntivirusSignatureVersion (
� � � �� string BehaviorMonitorEnabled # s
� ! � �� boolean ComputerID '
� k � �� � �� string ComputerState )
� � � � � �� uint32 BitMap � � � � � � 0 1 2 4 8 16 DefenderSignaturesOutOfDate
� ? � �� boolean DeviceControlDefaultEnforcement 2 �
� � � �� string DeviceControlPoliciesLastUpdated e 3 �
� � � �� datetime DeviceControlState 1 �
� / � �� string FullScanAge H
� n � �� uint32 FullScanEndTime e D
� � � �� datetime FullScanOverdue Q
� � � �� boolean FullScanRequired S
� ; � �� boolean FullScanSignatureVersion M
� � � �� string FullScanStartTime e @
� � � �� datetime InitializationProgress > �
� � �� string IoavProtectionEnabled " q
� b � �� boolean IsTamperProtected ' {
� � � �� boolean IsVirtualMachine & y
� � � �� boolean LastFullScanSource L )
� A H R � �� uint8 ValueMap j m p s v 0 1 2 3 4 LastQuickScanSource b )
� � � � � �� uint8 ValueMap � � � � � 0 1 2 3 4 NISEnabled + �
� 3
� �� boolean NISEngineVersion * �
� x
� �� string NISSignatureAge 8
� �
� �� uint32 NISSignatureLastUpdated e <
� � �� datetime NISSignatureVersion 4
� D string OnAccessProtectionEnabled ! o
� � � �� boolean ProductStatus
)
� � � � � �� uint32 BitMap \ _ b e h k o s w | � � � � � � � � � � � � � � � � 0 1 2 4 8 16 32 64 128 256 512 1024 2048 4096 8192 16384 32768 65536 131072 262144 524288 1048576 2097152 4194304 8388608 16777216 QuickScanAge ^
� 1
� �� uint32 QuickScanEndTime e Z
� u
� �� datetime QuickScanOverdue g
� �
� �� boolean QuickScanSignatureVersion c
� � �� string QuickScanStartTime e V
� O � �� datetime RealTimeProtectionEnabled ) �
� � � �� boolean RealTimeScanDirection U )
� � � � �� uint8 ValueMap 0 1 2 RebootRequired
� Y � �� boolean SmartAppControlExpiration = �
� � � �� string SmartAppControlState < �
� � � �� string TamperProtectionSource ( }
� 9 � �� string TDTCapable 0 �
� w � �� string TDTMode . �
� � � �� string TDTSiloType / �
� � � �� string TDTStatus , �
� . � �� string TDTTelemetry - �
� n � �� string TroubleShootingDailyMaxQuota : �
� � � �� string TroubleShootingDailyQuotaLeft 8 �
� � �� string TroubleShootingEndTime 6 �
� Y � �� string TroubleShootingExpirationLeft 7 �
� � � �� string TroubleShootingMode 4 �
� � � �� string TroubleShootingModeSource ; �
� > � �� string TroubleShootingQuotaResetTime 9 �
� � � �� string TroubleShootingStartTime 5 �
� � � �� string �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 !0pl\}�
͝��C�� - ��
�S}� l � WDMClassesOfDriver MSNdis_MaximumTotalSize C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 "0pl\}�
͝��C�� ' ��
�S}� f � WDMClassesOfDriver MSNdis_MacOptions C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 #0pl\}�
͝��C�� / ��
�S}� n � WDMClassesOfDriver MSNdis_MediaConnectStatus C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 $0pl\}�
͝��C�� / ��
�S}� n � WDMClassesOfDriver MSNdis_MaximumSendPackets C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 %0pl\}�
͝��C�� 0 ��
�S}� o � WDMClassesOfDriver MSNdis_VendorDriverVersion C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 &0pl\}�
͝��C�� + ��
�S}� j � WDMClassesOfDriver MSNdis_VlanIdentifier C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� + J.3�� ` � WDMClassesOfDriver SystemConfig_V1_Video C:\Windows\system32\kernelbase.dll[MofResourceName] ] ] ernelbase.dll.mui[MofResourceName] $G*G� ���� �#�� A�Y� �k |T0U3 LE,&N ����j ?m]��
� ;
� ��v� �C=��
C(R_� % �ڜZ $ ���, *���K z�!f # u�K�� ܟ}ũ % <\�?� �@� � $ �c� ce��- ! gנ'N o�l ZY�� " /x0� 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 0pl\}�
͝��C� ��
�S}� \ � WDMClassesOfDriver MSPower C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� 1 J.3�� f � WDMClassesOfDriver MSNdis_StatusProtocolUnbind C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� 0 J.3�� e � WDMClassesOfDriver MSNdis_StatusDevicePowerOn C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� 1 J.3�� f � WDMClassesOfDriver MSNdis_StatusDevicePowerOff C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� 2 J.3�� g � WDMClassesOfDriver MSNdis_StatusDevicePowerOnEx C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� 3 J.3�� h � WDMClassesOfDriver MSNdis_StatusDevicePowerOffEx C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� 4 J.3�� i � WDMClassesOfDriver MSNdis_StatusTaskOffloadChange C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� 5 J.3�� j � WDMClassesOfDriver MSNdis_StatusPacketFilterChange C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� 0 J.3�� e � WDMClassesOfDriver MSNdis_StatusNetworkChange C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� 4 J.3�� i � WDMClassesOfDriver MSNdis_StatusOperationalStatus C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� , J.3�� a � WDMClassesOfDriver MSNdis_StatusLinkState C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� , J.3�� a � WDMClassesOfDriver MSNdis_StatusPortState C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� = J.3�� r � WDMClassesOfDriver MSNdis_StatusExternalConnectivityChange C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� < J.3�� q � WDMClassesOfDriver MSNdis_StatusMediaSpecificIndicationEx C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� 7 J.3�� l � WDMClassesOfDriver MSNdis_StatusHDSplitCurrentConfig C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� 3 J.3�� h � WDMClassesOfDriver MSNdis_StatusDot11ScanConfirm C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� ; J.3�� p � WDMClassesOfDriver MSNdis_StatusDot11MPDUMaxLengthChange C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� 8 J.3�� m � WDMClassesOfDriver MSNdis_StatusDot11AssociationStart C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� = J.3�� r � WDMClassesOfDriver MSNdis_StatusDot11AssociationCompletion C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� 7 J.3�� l � WDMClassesOfDriver MSNdis_StatusDot11ConnectionStart C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� < J.3�� q � WDMClassesOfDriver MSNdis_StatusDot11ConnectionCompletion C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� 4 J.3�� i � WDMClassesOfDriver MSNdis_StatusDot11RoamingStart C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� 9 J.3�� n � WDMClassesOfDriver MSNdis_StatusDot11RoamingCompletion C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� 6 J.3�� k � WDMClassesOfDriver MSNdis_StatusDot11Disassociation C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� 6 J.3�� k � WDMClassesOfDriver MSNdis_StatusDot11TkipmicFailure C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� : J.3�� o � WDMClassesOfDriver MSNdis_StatusDot11PmkidCandidateList C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� 6 J.3�� k � WDMClassesOfDriver MSNdis_StatusDot11PhyStateChange C:\Windows\system32\kernelbase.dll[MofResourceName] ase.dll.mui[MofResourceName] CPIMOFResource] 6� �p
���*y
, �A��� i �D� ! �^`/ �
hJ j M S M o n i t o r C l a s s \��jj��� MSMonitorClass ) � * J ��U ] e � WmiMonitorBrightnessMethods Description Monitor brightness control API AMENDMENT LOCALE ms_409 & � oni P � � De � $ ( igh B � k o END � � � � � WmiSetBrightness # � 0 Description Set current brightness setting ] WIN-F6NF7R6I6PJ ROOT\wmi\ms_409 ���� � � �� D * � �����P � __PARAMETERS abstract Timeout uint32
� 3 in
� 3 Z �� Timeout - in seconds Description )
� 3 Z ��� � ID 6
� * Z ��� � � uint32 Brightness uint8
� P in
� P v �� Brightness - percentage Description )
� P v ��� � ID 6
� I v ��� � uint8 __ � WmiRevertToPolicyBrightness � � � Description Sets the brightness back to the policy setting WmiSetALSBrightnessState S � ` Description Controls the ambient light sensor brightness state � WIN-F6NF7R6I6PJ ROOT\wmi\ms_409 ���� � �{ �� * � ��2 � __PARAMETERS abstract State boolean
� 1 in
� 1 Y �� ALS brightness state Description )
� 1 Y ��� � ID 6
� ) Y ��� � � boolean __ � WmiSetALSBrightness � � � Description Sets the ambient light sensor brightness value � WIN-F6NF7R6I6PJ ROOT\wmi\ms_409 ���� � �� �� * � �6 � __PARAMETERS abstract Brightness uint8
� 6 in
� 6 \ �� Brightness - percentage Description )
� 6 \ ��� � ID 6
� / \ ��� � � uint8 __ � W M I E v e n t ]��jj�� WMIEvent
��& . 6 B �������������� � WmiMonitorBrightnessEvent AMENDMENT LOCALE ms_409 Brightness
� n u � � uint8 Description Current Monitor Brightness - percentage � M S M o n i t o r C l a s s ^��jj��5 MSMonitorClass ) � ( M ��X ` h q � � U������� � WmiMonitorRawEEdidV1Block Description Monitor's raw EDID v.1.x data block AMENDMENT LOCALE ms_409 Content
� � � � � uint8 Description Block content Id
� � � � uint8 Description Block ID Type +
� M T � a m � u uint8 Description Block type Values � � � � Uninitialized Other EDID base block EDID map block � M S M o n i t o r C l a s s _��jj��� MSMonitorClass ) � * X ��c k s � WmiMonitorDescriptorMethods Description Monitor's raw EDID v.1.x data block accessor AMENDMENT LOCALE ms_409 0 � oni � q � WmiGetMonitorRawEEdidV1Block < � I k � x DisplayName Read EDID v.1.x descriptor block Description Reads specified EDID v.1.x descriptor block � WIN-F6NF7R6I6PJ ROOT\wmi\ms_409 ���� � �p �� * � �$ � __PARAMETERS abstract BlockId uint8
� 3 in
� 3 Y �� Block ID DisplayName )
� 3 Y ��� � ID 6
� Y ��� � � uint8 __ �� WIN-F6NF7R6I6PJ ROOT\wmi\ms_409 ���� � �? �� � � * u ������ � __PARAMETERS abstract BlockType uint8
� 5 out
� 5 [ �� Block Type DisplayName )
� 5 [ ��� � � � Uninitialized Other EDID base block EDID map block Values 6
� 5 [ ��� � % � ID C
� � [ ��� � % � q uint8 BlockContent uint8
� � out
� � �� Block content DisplayName )
� � ��Q B ID 6
� � ��Q B � uint8 __ � M S M o n i t o r C l a s s `��jj��� MSMonitorClass ) � ' ��2 : B T � � ) | � � � Z m � � U���������������������B � WmiMonitorID Description Monitor ID AMENDMENT LOCALE ms_409 ManufacturerName
� � � � � uint16 Description Manufacturer name ProductCodeID
� � � � � uint16 Description Vendor assigned product code ID SerialNumberID
� U ] � j uint16 Description Serial number ID UserFriendlyName
� � � � � uint16 Description User-friendly name UserFriendlyNameLength
� ' / � < uint16 Description Length of user-friendly name WeekOfManufacture
� � � � � uint8 Description Week of manufacture (1..53, 0 = undefined) YearOfManufacture
� � - uint16 Description Year of manufacture � a��jj��R ) $ � 1 W ��b j r � � � � � - � � � � Z l U�������������� � WmiMonitorSupportedDisplayFeatures Description Monitor's supported display features AMENDMENT LOCALE ms_409 ActiveOffSupported
� � � � � boolean Description Active Off/Very Low Power Support DisplayType +
� 1 8 � E S � [ uint8 Description Display type Values k � � Monochrome/grayscale display RGB color display Non-RGB multicolor display GTFSupported
� � � � boolean Description GTF support HasPreferredTimingMode
� Y b � o boolean Description Has a preferred timing mode sRGBSupported
� � � � � boolean Description sRGB support StandbySupported
� ) 2 � ? boolean Description VESA DPMS Standby support SuspendSupported
� � � � � boolean Description VESA DPMS Suspend support �ort �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �L����
͝��C�� ) +/�Q �� ^ � WDMClassesOfDriver MSMCAEvent_BusError C:\Windows\system32\kernelbase.dll[MofResourceName] rceName] e] ] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �.h�b �
͝��C�� , )ߝ�t � a � WDMClassesOfDriver Registry_V0_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �.h�b �
͝��C�� , )ߝ�t � a � WDMClassesOfDriver Registry_V0_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �.h�b �
͝��C�u )ߝ�t � R � WDMClassesOfDriver SplitIo C:\Windows\system32\kernelbase.dll[MofResourceName] MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �.h�b �
͝��C�u )ߝ�t � R � WDMClassesOfDriver SplitIo C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �.h�b �
͝��C�w )ߝ�t � T � WDMClassesOfDriver FileIo_V0 C:\Windows\system32\kernelbase.dll[MofResourceName] .dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �.h�b �
͝��C�w )ߝ�t � T � WDMClassesOfDriver FileIo_V0 C:\Windows\system32\kernelbase.dll[MofResourceName] base.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �.h�b �
͝��C�w )ߝ�t � T � WDMClassesOfDriver FileIo_V0 C:\Windows\system32\kernelbase.dll[MofResourceName] se.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �.h�b �
͝��C�w )ߝ�t � T � WDMClassesOfDriver FileIo_V0 C:\Windows\system32\kernelbase.dll[MofResourceName] se.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �.h�b �
͝��C�w )ߝ�t � T � WDMClassesOfDriver FileIo_V0 C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �.h�b �
͝��C�| $ )ߝ�t � Y � WDMClassesOfDriver FileIo_V0_Name C:\Windows\system32\kernelbase.dll[MofResourceName] l[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �.h�b �
͝��C�| $ )ߝ�t � Y � WDMClassesOfDriver FileIo_V0_Name C:\Windows\system32\kernelbase.dll[MofResourceName] esourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �.h�b �
͝��C�| $ )ߝ�t � Y � WDMClassesOfDriver FileIo_V0_Name C:\Windows\system32\kernelbase.dll[MofResourceName] .dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �.h�b �
͝��C�| $ )ߝ�t � Y � WDMClassesOfDriver FileIo_V0_Name C:\Windows\system32\kernelbase.dll[MofResourceName] ResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �.h�b �
͝��C�| $ )ߝ�t � Y � WDMClassesOfDriver FileIo_V0_Name C:\Windows\system32\kernelbase.dll[MofResourceName] nelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �.h�b �
͝��C�| $ )ߝ�t � Y � WDMClassesOfDriver FileIo_V0_Name C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �.h�b �
͝��C�| $ )ߝ�t � Y � WDMClassesOfDriver FileIo_V1_Name C:\Windows\system32\kernelbase.dll[MofResourceName] ll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �.h�b �
͝��C�| $ )ߝ�t � Y � WDMClassesOfDriver FileIo_V1_Name C:\Windows\system32\kernelbase.dll[MofResourceName] l[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �.h�b �
͝��C�| $ )ߝ�t � Y � WDMClassesOfDriver FileIo_V1_Name C:\Windows\system32\kernelbase.dll[MofResourceName] ourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �.h�b �
͝��C�| $ )ߝ�t � Y � WDMClassesOfDriver FileIo_V1_Name C:\Windows\system32\kernelbase.dll[MofResourceName] ase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �.h�b �
͝��C�| $ )ߝ�t � Y � WDMClassesOfDriver FileIo_V1_Name C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �.h�b �
͝��C�w )ߝ�t � T � WDMClassesOfDriver FileIo_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �.h�b �
͝��C�| $ )ߝ�t � Y � WDMClassesOfDriver FileIo_V2_Name C:\Windows\system32\kernelbase.dll[MofResourceName] .dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �.h�b �
͝��C�| $ )ߝ�t � Y � WDMClassesOfDriver FileIo_V2_Name C:\Windows\system32\kernelbase.dll[MofResourceName] esourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �.h�b �
͝��C�| $ )ߝ�t � Y � WDMClassesOfDriver FileIo_V2_Name C:\Windows\system32\kernelbase.dll[MofResourceName] l[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �.h�b �
͝��C�| $ )ߝ�t � Y � WDMClassesOfDriver FileIo_V2_Name C:\Windows\system32\kernelbase.dll[MofResourceName] ResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �.h�b �
͝��C�| $ )ߝ�t � Y � WDMClassesOfDriver FileIo_V2_Name C:\Windows\system32\kernelbase.dll[MofResourceName] se.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �.h�b �
͝��C�| $ )ߝ�t � Y � WDMClassesOfDriver FileIo_V2_Name C:\Windows\system32\kernelbase.dll[MofResourceName] ceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �.h�b �
͝��C�| $ )ߝ�t � Y � WDMClassesOfDriver FileIo_V2_Name C:\Windows\system32\kernelbase.dll[MofResourceName] MS\0x409 DisplayName recovery_unit_new_dbsegment_id_set � �� sint32 WmiDataId � ofResourceName] ��t? �s@ ( T�-"h
u � ���> : �QՄx � �E�w � �
�Cc � ֯�4O
� L��z0 � F��� \ �l��@ 8 ���yx U �u��� W �%$ � p㱓 � \)� R O O T \ R s o p \ C o m p u t e r R S O P _ E x t e n s i o n E v e n t S o u r c e L i n k e v e n t S o u r c e � N S _ C C A 0 3 7 7 0 E 5 6 2 E 2 A 1 7 0 E D E D 2 0 A 5 8 9 C 0 6 9 A 2 0 4 5 A 9 B C D 7 4 1 2 B 7 7 D 0 6 8 8 4 6 D 9 0 5 4 E C 4 \ K I _ 2 7 2 E 5 7 5 3 D C 3 E E C D D 6 0 5 7 0 3 8 D B 6 F 2 6 1 7 0 E 7 D 1 C D 5 6 5 B 9 5 4 C 6 C 4 A 4 0 6 C B 1 B C 2 D 0 2 3 E \ I _ D 8 E B B 8 1 4 8 1 B 8 8 B C F 5 5 F C 8 9 2 9 C 4 C 8 8 2 A F 2 9 3 A 9 1 C 6 5 E C 4 D C C 5 3 7 5 8 3 8 8 7 C E 3 9 5 7 B D @ R O O T \ R s o p \ C o m p u t e r R S O P _ E x t e n s i o n E v e n t S o u r c e L i n k e x t e n s i o n S t a t u s � N S _ C C A 0 3 7 7 0 E 5 6 2 E 2 A 1 7 0 E D E D 2 0 A 5 8 9 C 0 6 9 A 2 0 4 5 A 9 B C D 7 4 1 2 B 7 7 D 0 6 8 8 4 6 D 9 0 5 4 E C 4 \ K I _ 2 7 2 E 5 7 5 3 D C 3 E E C D D 6 0 5 7 0 3 8 D B 6 F 2 6 1 7 0 E 7 D 1 C D 5 6 5 B 9 5 4 C 6 C 4 A 4 0 6 C B 1 B C 2 D 0 2 3 E \ I _ D 8 E B B 8 1 4 8 1 B 8 8 B C F 5 5 F C 8 9 2 9 C 4 C 8 8 2 A F 2 9 3 A 9 1 C 6 5 E C 4 D C C 5 3 7 5 8 3 8 8 7 C E 3 9 5 7 B D D 6 F 2 3 A C 5 C C B E B 4 7 E C C F 7 B F 1 2 9 5 2 3 2 5 8 8 7 9 F D E D 9 D 2 8 2 F 5 5 8 0 4 3 F F 8 0 2 4 9 A 7 E D 5 9 6 ۍ��j��ѝ��C�} 6 ( ^ � RSOP_ExtensionEventSource Application Group Policy {CA08E3CC-4A42-4D71-8947-6B57A75E1AC3} 0 4 5 4 D D D A 9 A B 9 9 9 B 5 E 0 5 A 2 F 4 6 8 B A 8 8 8 F 0 D 0 7 9 4 E 6 B A 1 E B D C C F 2 A 4 4 6 3 E C 0 3 2 5 8 C C 6 ݍ��j���Н��C�9
� RSOP_SOM Local E 7 0 6 F F 8 5 8 6 C 5 2 A 7 1 7 6 A C A 4 8 D 7 7 0 2 E C 2 A 6 5 5 0 5 6 4 F 0 E 4 2 B 0 C 0 9 A E 3 F D 1 C C E A 6 2 C D 4 ލ��j���Н��C�� M W 9 ��k 7 ��
o � RSOP_GPO C:\Windows\System32\GroupPolicy\Machine Local Group Policy LocalGPO Local Group Policy B 0 F E 4 3 D 7 F 9 B D B F B 5 8 0 A 0 C A 5 5 2 7 E F 2 5 F 6 B 3 6 E C 4 B 6 7 1 B A 1 4 3 B 3 3 8 B 3 8 0 B 1 F 4 5 C 2 7 D ߍ��j�� ѝ��C�o %
�� C � RSOP_GPLink RSOP_GPO.id="LocalGPO" RSOP_SOM.id="Local",reason=1 R O O T \ R s o p \ C o m p u t e r R S O P _ G P L i n k G P O � N S _ C C A 0 3 7 7 0 E 5 6 2 E 2 A 1 7 0 E D E D 2 0 A 5 8 9 C 0 6 9 A 2 0 4 5 A 9 B C D 7 4 1 2 B 7 7 D 0 6 8 8 4 6 D 9 0 5 4 E C 4 \ K I _ B 0 F E 4 3 D 7 F 9 B D B F B 5 8 0 A 0 C A 5 5 2 7 E F 2 5 F 6 B 3 6 E C 4 B 6 7 1 B A 1 4 3 B 3 3 8 B 3 8 0 B 1 F 4 5 C 2 7 D \ I _ 9 D B B 4 C 3 B F 3 B 3 0 B A E 5 D 6 C 9 2 6 F 4 0 F 2 D D 5 5 3 8 1 A 6 2 6 2 8 1 9 D B C 8 0 F 2 4 8 2 8 3 8 0 5 2 C 4 0 4 D R O O T \ R s o p \ C o m p u t e r R S O P _ G P L i n k S O M � N S _ C C A 0 3 7 7 0 E 5 6 2 E 2 A 1 7 0 E D E D 2 0 A 5 8 9 C 0 6 9 A 2 0 4 5 A 9 B C D 7 4 1 2 B 7 7 D 0 6 8 8 4 6 D 9 0 5 4 E C 4 \ K I _ B 0 F E 4 3 D 7 F 9 B D B F B 5 8 0 A 0 C A 5 5 2 7 E F 2 5 F 6 B 3 6 E C 4 B 6 7 1 B A 1 4 3 B 3 3 8 B 3 8 0 B 1 F 4 5 C 2 7 D \ I _ 9 D B B 4 C 3 B F 3 B 3 0 B A E 5 D 6 C 9 2 6 F 4 0 F 2 D D 5 5 3 8 1 A 6 2 6 2 8 1 9 D B C 8 0 F 2 4 8 2 8 3 8 0 5 2 C 4 0 4 D 6 4 6 5 9 A B 9 F 8 F 1 C 4 B 5 6 8 D B 6 4 3 8 B A E 1 1 B 2 6 E E 8 F 9 3 C B 5 F 8 1 9 5 E 2 1 E 8 C 3 8 3 D 6 C 4 4 C C 4 1 ��j��ȝ��C�Q
: � __NAMESPACE S_1_5_21_128080908_2238061424_149367449_500 F D 1 C 1 D 4 1 4 B 7 1 B 5 0 8 2 C 2 6 6 A 6 5 0 E 3 1 E F 6 D 5 0 1 9 3 8 2 7 2 4 2 4 4 B 6 8 5 F 2 1 7 C 0 A A E 0 0 A 9 2 1 ��j��Cȝ��C�$ � __SystemSecurity 4 1 C 5 3 E 6 D B 1 A C F 2 4 5 3 C E F D 4 1 3 9 8 1 9 8 E 6 1 3 F 1 0 D F F 4 7 7 0 9 E C A B 1 D 7 F 0 3 7 7 5 6 A C 8 C E 7 ��j��ȝ��C�� � � __thisNAMESPACE � �� � l ? ? ? $ # \�pf��*�� C I M _ I n d i c a t i o n ��j�� ) CIM_Indication 6 �� ( / ? K X + < �����������������������������������������p � CIM_ClassIndication Abstract Version 2.6.0 UMLPackagePath CIM::Event Description CIM_ClassIndication is an abstract superclass describing changes in the definition of the schema. Subclasses represent specific types of change notifications, such as class creation, deletion and modification. ClassDefinition
" )
� s { ��� � object Required Description The current definition of the class that is created, changed or deleted in the schema. In the case of a CIM_ClassDeletion Indication, the definition for the class just prior to deletion should be placed in this property. t � C I M _ C l a s s I n d i c a t i o n ��j�� ) CIM_ClassIndication + # 3 ? L ������������������������������������������ � CIM_ClassDeletion Version 2.6.0 UMLPackagePath CIM::Event Description CIM_ClassDeletion notifies when a class is deleted from the schema. th � C I M _ C l a s s I n d i c a t i o n ��j�� ) CIM_ClassIndication + # 3 ? L ������������������������������������������ � CIM_ClassCreation Version 2.6.0 UMLPackagePath CIM::Event Description CIM_ClassCreation notifies when a new class is defined in the schema. � C I M _ C l a s s I n d i c a t i o n ��j��� - CIM_ClassIndication + ' 7 C P � � ��������������������������������������������� � CIM_ClassModification Version 2.6.0 UMLPackagePath CIM::Event Description CIM_ClassModification notifies when a class definition in the schema is modified. PreviousClassDefinition
& )
� � � �� object Required Description A copy of the 'previous' class definition whose change generated the Indication. PreviousClassDefinition contains an 'older' copy of the class' information, as compared to what is found in the ClassDefinition property (inherited from ClassIndication). , � C I M _ I n d i c a t i o n ��j��^ 1 CIM_Indication 6 �� ' . > J W ) � � ^ w ������������������������������������������������� � CIM_InstIndication Abstract Version 2.9.0 UMLPackagePath CIM::Event Description CIM_InstIndication is an abstract superclass describing changes to instances. Subclasses represent specific types of change notifications, such as instance creation, deletion and modification. SourceInstance
" )
� ` h ��r object Required Description A copy of the instance that changed to generate the Indication. SourceInstance contains the current values of the properties selected by the Indication Filter's Query. In the case of CIM_InstDeletion, the property values are copied before the instance is deleted. SourceInstanceHost
* +
� � � � 3 string Description The host name or IP address of the SourceInstance. ModelCorrespondence ; CIM_InstIndication.SourceInstance SourceInstanceModelPath & +
� � � � r � string Description The Model Path of the SourceInstance. The following format MUST be used to encode the Model Path:
<NamespacePath>:<ClassName>.<Prop1>="<Value1>",
<Prop2>="<Value2>", ... ModelCorrespondence � CIM_InstIndication.SourceInstance . �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� ) J.3�� ^ � WDMClassesOfDriver SystemConfig_V1_NIC C:\Windows\system32\kernelbase.dll[MofResourceName] ResourceName] e � CIM_InstIndication.SourceInstance . � ��o�� K�V� #$ ! F�H! % �W��F ' O7w�m ��m� � R?h�
J�X�� [W:� �g�[�
zv� �0M� �Z��
�#� �x0 �KC �"� K X7�^ 1�ƀf q�y @�<~ �κ� O &� �ră� � �W� ��� 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� 0 J.3�� e � WDMClassesOfDriver Header_DbgIdRSDS_TypeGroup C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� 0 J.3�� e � WDMClassesOfDriver Header_BuildInfo_TypeGroup C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� 9 J.3�� n � WDMClassesOfDriver Header_ProviderBinaryPath_TypeGroup C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� = J.3�� r � WDMClassesOfDriver Header_PartitionInfoExtension_TypeGroup C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� ? J.3�� t � WDMClassesOfDriver Header_PartitionInfoExtensionV2_TypeGroup C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� 7 J.3�� l � WDMClassesOfDriver Header_LastDroppedTimes_TypeGroup C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�x J.3�� U � WDMClassesOfDriver Process_V0 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� + J.3�� ` � WDMClassesOfDriver Process_V0_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�x J.3�� U � WDMClassesOfDriver Process_V1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� + J.3�� ` � WDMClassesOfDriver Process_V1_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�x J.3�� U � WDMClassesOfDriver Process_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� + J.3�� ` � WDMClassesOfDriver Process_V2_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� 2 J.3�� g � WDMClassesOfDriver Process_Terminate_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� + J.3�� ` � WDMClassesOfDriver Process_V2_TypeGroup2 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� + J.3�� ` � WDMClassesOfDriver Process_V2_TypeGroup3 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� + J.3�� ` � WDMClassesOfDriver Process_V2_TypeGroup4 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� + J.3�� ` � WDMClassesOfDriver Process_V2_TypeGroup5 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�x J.3�� U � WDMClassesOfDriver Process_V3 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� + J.3�� ` � WDMClassesOfDriver Process_V3_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�x J.3�� U � WDMClassesOfDriver Process_V4 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� + J.3�� ` � WDMClassesOfDriver Process_V4_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�u J.3�� R � WDMClassesOfDriver Process C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� 0 J.3�� e � WDMClassesOfDriver Process_Defunct_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4
�n�^��
͝��C�w J.3�� T � WDMClassesOfDriver Thread_V0 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� * J.3�� _ � WDMClassesOfDriver Thread_V0_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�w J.3�� T � WDMClassesOfDriver Thread_V1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4
�n�^��
͝��C�� * J.3�� _ � WDMClassesOfDriver Thread_V1_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� * J.3�� _ � WDMClassesOfDriver Thread_V1_TypeGroup2 C:\Windows\system32\kernelbase.dll[MofResourceName] me] ���� �G ��
;~fR� �5�W� ���� ,�)� /|�� ��� ټ��
��ï$ Z�4�0
�:
�.SXK
�6��X h '�x MvzЏ +�� :ߋ� #� � ��F�� ˤ]b� n���� ���� e
J�� �D� �X=�" 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�x J.3�� U � WDMClassesOfDriver CSwitch_V1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�} % J.3�� Z � WDMClassesOfDriver WorkerThread_V1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�w J.3�� T � WDMClassesOfDriver Thread_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� * J.3�� _ � WDMClassesOfDriver Thread_V2_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�{ # J.3�� X � WDMClassesOfDriver ThreadSetName C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�x J.3�� U � WDMClassesOfDriver CSwitch_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�t J.3�� Q � WDMClassesOfDriver CompCS C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�v J.3�� S � WDMClassesOfDriver SpinLock C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�y ! J.3�� V � WDMClassesOfDriver ReadyThread C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�| $ J.3�� Y � WDMClassesOfDriver ThreadAffinity C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�z " J.3�� W � WDMClassesOfDriver WorkerThread C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� ) J.3�� ^ � WDMClassesOfDriver AntiStarvationBoost C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�} % J.3�� Z � WDMClassesOfDriver ThreadMigration C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� ( J.3�� ] � WDMClassesOfDriver KernelQueueEnqueue C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� ( J.3�� ] � WDMClassesOfDriver KernelQueueDequeue C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� / J.3�� d � WDMClassesOfDriver WorkerThread_StartStop_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C� ' J.3�� \ � WDMClassesOfDriver AutoBoostSetFloor C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� ) J.3�� ^ � WDMClassesOfDriver AutoBoostClearFloor C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 !�n�^��
͝��C�� . J.3�� c � WDMClassesOfDriver AutoBoostEntryExhaustion C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 "�n�^��
͝��C�� * J.3�� _ � WDMClassesOfDriver SubProcessTagChanged C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 #�n�^��
͝��C�w J.3�� T � WDMClassesOfDriver Thread_V3 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 $�n�^��
͝��C�� * J.3�� _ � WDMClassesOfDriver Thread_V3_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 %�n�^��
͝��C�| $ J.3�� Y � WDMClassesOfDriver ThreadPriority C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 &�n�^��
͝��C�x J.3�� U � WDMClassesOfDriver CSwitch_V3 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 '�n�^��
͝��C�w J.3�� T � WDMClassesOfDriver Thread_V4 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 (�n�^��
͝��C� ' J.3�� \ � WDMClassesOfDriver Thread_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 )�n�^��
͝��C�x J.3�� U � WDMClassesOfDriver CSwitch_V4 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 *�n�^��
͝��C�y ! J.3�� V � WDMClassesOfDriver PowerEvents C:\Windows\system32\kernelbase.dll[MofResourceName] ourceName] ourceName] Group1 C:\Windows\system32\kernelbase.dll[MofResourceName] rceName] MofResourceName] ] �n�� 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 *O����
͝��C�~ & +/�Q �� [ � WDMClassesOfDriver KernelPerfStates C:\Windows\system32\kernelbase.dll[MofResourceName] 32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 *O����
͝��C�~ & +/�Q �� [ � WDMClassesOfDriver KernelPerfStates C:\Windows\system32\kernelbase.dll[MofResourceName] ase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 *O����
͝��C�~ & +/�Q �� [ � WDMClassesOfDriver KernelPerfStates C:\Windows\system32\kernelbase.dll[MofResourceName] dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 *O����
͝��C�~ & +/�Q �� [ � WDMClassesOfDriver KernelPerfStates C:\Windows\system32\kernelbase.dll[MofResourceName] se.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 *O����
͝��C�~ & +/�Q �� [ � WDMClassesOfDriver KernelPerfStates C:\Windows\system32\kernelbase.dll[MofResourceName] ernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 *O����
͝��C�~ & +/�Q �� [ � WDMClassesOfDriver KernelPerfStates C:\Windows\system32\kernelbase.dll[MofResourceName] ernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 *O����
͝��C�~ & +/�Q �� [ � WDMClassesOfDriver KernelPerfStates C:\Windows\system32\kernelbase.dll[MofResourceName] ll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 *O����
͝��C�~ & +/�Q �� [ � WDMClassesOfDriver KernelPerfStates C:\Windows\system32\kernelbase.dll[MofResourceName] rnelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 *O����
͝��C�~ & +/�Q �� [ � WDMClassesOfDriver KernelPerfStates C:\Windows\system32\kernelbase.dll[MofResourceName] system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 *O����
͝��C�~ & +/�Q �� [ � WDMClassesOfDriver KernelPerfStates C:\Windows\system32\kernelbase.dll[MofResourceName] e.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 *O����
͝��C�~ & +/�Q �� [ � WDMClassesOfDriver KernelPerfStates C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 *O����
͝��C�~ & +/�Q �� [ � WDMClassesOfDriver KernelPerfStates C:\Windows\system32\kernelbase.dll[MofResourceName] rnelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 *O����
͝��C�~ & +/�Q �� [ � WDMClassesOfDriver KernelPerfStates C:\Windows\system32\kernelbase.dll[MofResourceName] nelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 *O����
͝��C�~ & +/�Q �� [ � WDMClassesOfDriver KernelPerfStates C:\Windows\system32\kernelbase.dll[MofResourceName] base.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 *O����
͝��C�~ & +/�Q �� [ � WDMClassesOfDriver KernelPerfStates C:\Windows\system32\kernelbase.dll[MofResourceName] nelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 *O����
͝��C�~ & +/�Q �� [ � WDMClassesOfDriver KernelPerfStates C:\Windows\system32\kernelbase.dll[MofResourceName] 32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 *O����
͝��C�~ & +/�Q �� [ � WDMClassesOfDriver KernelPerfStates C:\Windows\system32\kernelbase.dll[MofResourceName] rnelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 *O����
͝��C�~ & +/�Q �� [ � WDMClassesOfDriver KernelPerfStates C:\Windows\system32\kernelbase.dll[MofResourceName] dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 *O����
͝��C�~ & +/�Q �� [ � WDMClassesOfDriver KernelPerfStates C:\Windows\system32\kernelbase.dll[MofResourceName] elbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 *O����
͝��C�~ & +/�Q �� [ � WDMClassesOfDriver KernelPerfStates C:\Windows\system32\kernelbase.dll[MofResourceName] nelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 *O����
͝��C�~ & +/�Q �� [ � WDMClassesOfDriver KernelPerfStates C:\Windows\system32\kernelbase.dll[MofResourceName] ystem32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 *O����
͝��C�~ & +/�Q �� [ � WDMClassesOfDriver KernelPerfStates C:\Windows\system32\kernelbase.dll[MofResourceName] ernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 *O����
͝��C�~ & +/�Q �� [ � WDMClassesOfDriver KernelPerfStates C:\Windows\system32\kernelbase.dll[MofResourceName] se.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 *O����
͝��C�~ & +/�Q �� [ � WDMClassesOfDriver KernelPerfStates C:\Windows\system32\kernelbase.dll[MofResourceName] se.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 *O����
͝��C�~ & +/�Q �� [ � WDMClassesOfDriver KernelPerfStates C:\Windows\system32\kernelbase.dll[MofResourceName] ll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 *O����
͝��C�~ & +/�Q �� [ � WDMClassesOfDriver KernelPerfStates C:\Windows\system32\kernelbase.dll[MofResourceName] elbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 *O����
͝��C�~ & +/�Q �� [ � WDMClassesOfDriver KernelPerfStates C:\Windows\system32\kernelbase.dll[MofResourceName] me] ame] & ��� �� [ � WDMClassesOfDriver KernelPerfStates C:\Windows\system32\kernelbase.dll[MofResourceName] sourceName] �$�
�i�� �6�� 9�ȁ� w�h� ��|' �z��' �� �A ?0�W
3.�Ks 8]�1z �]!D�
�A��� r1*C� OU��� n�� ��|D� ��� o��b ct��! �|��0 ��qt? <B#^N b�[W 2:g�k ��Z�t �j(� ��� 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 +�n�^��
͝��C�} % J.3�� Z � WDMClassesOfDriver IdleExitLatency C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ,�n�^��
͝��C�w J.3�� T � WDMClassesOfDriver DiskIo_V0 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 -�n�^��
͝��C�� * J.3�� _ � WDMClassesOfDriver DiskIo_V0_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 .�n�^��
͝��C�w J.3�� T � WDMClassesOfDriver DiskIo_V1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 /�n�^��
͝��C�� * J.3�� _ � WDMClassesOfDriver DiskIo_V1_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 0�n�^��
͝��C�� 0 J.3�� e � WDMClassesOfDriver V1_DriverMajorFunctionCall C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 1�n�^��
͝��C�� 2 J.3�� g � WDMClassesOfDriver V1_DriverMajorFunctionReturn C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 2�n�^��
͝��C�� . J.3�� c � WDMClassesOfDriver V1_DriverCompleteRequest C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 3�n�^��
͝��C�� 4 J.3�� i � WDMClassesOfDriver V1_DriverCompleteRequestReturn C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 4�n�^��
͝��C�w J.3�� T � WDMClassesOfDriver DiskIo_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 5�n�^��
͝��C�� * J.3�� _ � WDMClassesOfDriver DiskIo_V2_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 6�n�^��
͝��C�� * J.3�� _ � WDMClassesOfDriver DiskIo_V2_TypeGroup2 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 7�n�^��
͝��C�� * J.3�� _ � WDMClassesOfDriver DiskIo_V2_TypeGroup3 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 8�n�^��
͝��C�� - J.3�� b � WDMClassesOfDriver DriverMajorFunctionCall C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 9�n�^��
͝��C�� / J.3�� d � WDMClassesOfDriver DriverMajorFunctionReturn C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 :�n�^��
͝��C�� - J.3�� b � WDMClassesOfDriver DriverCompletionRoutine C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ;�n�^��
͝��C�� + J.3�� ` � WDMClassesOfDriver DriverCompleteRequest C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 <�n�^��
͝��C�� 1 J.3�� f � WDMClassesOfDriver DriverCompleteRequestReturn C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 =�n�^��
͝��C�t J.3�� Q � WDMClassesOfDriver DiskIo C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 >�n�^��
͝��C� ' J.3�� \ � WDMClassesOfDriver DiskIo_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ?�n�^��
͝��C� ' J.3�� \ � WDMClassesOfDriver DiskIo_TypeGroup3 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 @�n�^��
͝��C� ' J.3�� \ � WDMClassesOfDriver DiskIo_TypeGroup2 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 A�n�^��
͝��C�y ! J.3�� V � WDMClassesOfDriver Registry_V0 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 B�n�^��
͝��C�� , J.3�� a � WDMClassesOfDriver Registry_V0_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 C�n�^��
͝��C�y ! J.3�� V � WDMClassesOfDriver Registry_V1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 D�n�^��
͝��C�� , J.3�� a � WDMClassesOfDriver Registry_V1_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 E�n�^��
͝��C�v J.3�� S � WDMClassesOfDriver Registry C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 F�n�^��
͝��C�� ) J.3�� ^ � WDMClassesOfDriver Registry_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] �)�%�
(E�U� O�n��
p
l� \*S~ � �* j�B:, �ek > ��7N
�k�Xg ����l
�
Ѻv
V� B} �[��� }��Ȑ �J�� ���-� �jI� p�r�� IK3�� �Ӿ� *Ō�� ����
� R G� b ȍ�� jzz7" ><� -
4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 G�n�^��
͝��C�z " J.3�� W � WDMClassesOfDriver Registry_TxR C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 H�n�^��
͝��C� ' J.3�� \ � WDMClassesOfDriver Registry_Counters C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 I�n�^��
͝��C�} % J.3�� Z � WDMClassesOfDriver Registry_Config C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 J�n�^��
͝��C�� - J.3�� b � WDMClassesOfDriver Registry_HiveInitialize C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 K�n�^��
͝��C�� * J.3�� _ � WDMClassesOfDriver Registry_HiveDestroy C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 L�n�^��
͝��C� ' J.3�� \ � WDMClassesOfDriver Registry_HiveLink C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 M�n�^��
͝��C�� * J.3�� _ � WDMClassesOfDriver Registry_HiveRundown C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 N�n�^��
͝��C�� ( J.3�� ] � WDMClassesOfDriver Registry_HiveDirty C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 O�n�^��
͝��C�� 1 J.3�� f � WDMClassesOfDriver Registry_ChangeNotification C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 P�n�^��
͝��C�u J.3�� R � WDMClassesOfDriver SplitIo C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 Q�n�^��
͝��C�z " J.3�� W � WDMClassesOfDriver SplitIo_Info C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 R�n�^��
͝��C�w J.3�� T � WDMClassesOfDriver FileIo_V0 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 S�n�^��
͝��C�| $ J.3�� Y � WDMClassesOfDriver FileIo_V0_Name C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 T�n�^��
͝��C�w J.3�� T � WDMClassesOfDriver FileIo_V1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 U�n�^��
͝��C�| $ J.3�� Y � WDMClassesOfDriver FileIo_V1_Name C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 V�n�^��
͝��C�w J.3�� T � WDMClassesOfDriver FileIo_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 W�n�^��
͝��C�| $ J.3�� Y � WDMClassesOfDriver FileIo_V2_Name C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 X�n�^��
͝��C�~ & J.3�� [ � WDMClassesOfDriver FileIo_V2_Create C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 Y�n�^��
͝��C�� ( J.3�� ] � WDMClassesOfDriver FileIo_V2_SimpleOp C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 Z�n�^��
͝��C�� ) J.3�� ^ � WDMClassesOfDriver FileIo_V2_ReadWrite C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 [�n�^��
͝��C�| $ J.3�� Y � WDMClassesOfDriver FileIo_V2_Info C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 \�n�^��
͝��C� ' J.3�� \ � WDMClassesOfDriver FileIo_V2_DirEnum C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ]�n�^��
͝��C�} % J.3�� Z � WDMClassesOfDriver FileIo_V2_OpEnd C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ^�n�^��
͝��C� ' J.3�� \ � WDMClassesOfDriver FileIo_V2_MapFile C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 _�n�^��
͝��C�t J.3�� Q � WDMClassesOfDriver FileIo C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 `�n�^��
͝��C�y ! J.3�� V � WDMClassesOfDriver FileIo_Name C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 a�n�^��
͝��C�{ # J.3�� X � WDMClassesOfDriver FileIo_Create C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 b�n�^��
͝��C�} % J.3�� Z � WDMClassesOfDriver FileIo_SimpleOp C:\Windows\system32\kernelbase.dll[MofResourceName] urceName] ame] # + � MS_WmiInternal AMENDMENT LOCALE ms_409 � � ���[� � ��� ��h� �4���
>�/� +� i}�
���n#
z��-
rУ3 t~йD g�K�J
C�}X
��Oi oﮒz ��$�� k�;e� 8ob�� ��"� om° T�� d,}� ��N� ��#� {�'Z� i�ܙ� Q�I }L�& 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 c�n�^��
͝��C�~ & J.3�� [ � WDMClassesOfDriver FileIo_ReadWrite C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 d�n�^��
͝��C�y ! J.3�� V � WDMClassesOfDriver FileIo_Info C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 e�n�^��
͝��C�| $ J.3�� Y � WDMClassesOfDriver FileIo_DirEnum C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 f�n�^��
͝��C�z " J.3�� W � WDMClassesOfDriver FileIo_OpEnd C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 g�n�^��
͝��C�� * J.3�� _ � WDMClassesOfDriver FileIo_PathOperation C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 h�n�^��
͝��C�w J.3�� T � WDMClassesOfDriver FltIoInit C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 i�n�^��
͝��C�} % J.3�� Z � WDMClassesOfDriver FltIoCompletion C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 j�n�^��
͝��C�z " J.3�� W � WDMClassesOfDriver FltIoFailure C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 k�n�^��
͝��C�v J.3�� S � WDMClassesOfDriver TcpIp_V0 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 l�n�^��
͝��C�� ) J.3�� ^ � WDMClassesOfDriver TcpIp_V0_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 m�n�^��
͝��C�v J.3�� S � WDMClassesOfDriver TcpIp_V1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 n�n�^��
͝��C�~ & J.3�� [ � WDMClassesOfDriver TcpIp_V1_Receive C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 o�n�^��
͝��C�� ) J.3�� ^ � WDMClassesOfDriver TcpIp_V1_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 p�n�^��
͝��C�� ) J.3�� ^ � WDMClassesOfDriver TcpIp_V1_TypeGroup2 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 q�n�^��
͝��C�{ # J.3�� X � WDMClassesOfDriver TcpIp_V1_Fail C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 r�n�^��
͝��C�{ # J.3�� X � WDMClassesOfDriver TcpIp_V1_Send C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 s�n�^��
͝��C�� ) J.3�� ^ � WDMClassesOfDriver TcpIp_V1_TypeGroup3 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 t�n�^��
͝��C�s J.3�� P � WDMClassesOfDriver TcpIp C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 u�n�^��
͝��C�| $ J.3�� Y � WDMClassesOfDriver TcpIp_SendIPV4 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 v�n�^��
͝��C�~ & J.3�� [ � WDMClassesOfDriver TcpIp_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 w�n�^��
͝��C�~ & J.3�� [ � WDMClassesOfDriver TcpIp_TypeGroup2 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 x�n�^��
͝��C�x J.3�� U � WDMClassesOfDriver TcpIp_Fail C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 y�n�^��
͝��C�| $ J.3�� Y � WDMClassesOfDriver TcpIp_SendIPV6 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 z�n�^��
͝��C�~ & J.3�� [ � WDMClassesOfDriver TcpIp_TypeGroup3 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 {�n�^��
͝��C�~ & J.3�� [ � WDMClassesOfDriver TcpIp_TypeGroup4 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 |�n�^��
͝��C�v J.3�� S � WDMClassesOfDriver UdpIp_V0 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 }�n�^��
͝��C�� ) J.3�� ^ � WDMClassesOfDriver UdpIp_V0_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ~�n�^��
͝��C�v J.3�� S � WDMClassesOfDriver UdpIp_V1 C:\Windows\system32\kernelbase.dll[MofResourceName] me] dll[MofResourceName] S�6^� Q � WDMClassesOfDriver ISR_V1 C:\Windows\system32\kernelbase.dll[MofResourceName] Name] me
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap A E L V _ j t ~ OK Error Degraded Unknown Pred Fail Starting Stopping Service � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values ? C J T ] h r | OK Error Degraded Unknown Pred Fail Starting Stopping Service � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � " � � � MSFT_CliProperty SystemVariable The SystemVariable property indicates whether the variable is a system variable. A system variable is set by the operating system, and is independent from user environment settings. SystemVariable � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � ! � MSFT_CliProperty UserName The UserName property indicates the owner of the environment setting. It is set to "<SYSTEM>" for settings that are specific to the system (as opposed to a specific user) and "<DEFAULT>" for default user settings. UserName � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ( � MSFT_CliQualifier MaxLen # 260 � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � ! � MSFT_CliProperty VariableValue The VariableValue property contains the placeholder variable of an environment variable. Information like the file system directory can change from machine to machine. The operating system substitutes placeholders for these. VariableValue k �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty x � � MSFT_CliFormat WRITEABLE ' E
9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � k � MSFT_CliProperty Name The Name property contains a character string specifying the name of a Win32 environment variable. By specifying the name of a variable that does not yet exist, an application can create a new environment variable. /nExample: Path. Name # ? W 8 Q � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING j , � MSFT_CliQualifier CIMTYPE $ string � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING f & � MSFT_CliQualifier key True � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING # � � MSFT_CliQualif��l� �
62� x{7�� tg� ��� � (�e` �O ҵ � BɆ�
��* ����0 ����;
��TH �jr�S ra9�a
���n �K w| ��i� � q�� ɡ얛 ��� YF� �&�D� �=D�
�Qs�� C��A ���- ��9T- 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� ) J.3�� ^ � WDMClassesOfDriver UdpIp_V1_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�s J.3�� P � WDMClassesOfDriver UdpIp C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�~ & J.3�� [ � WDMClassesOfDriver UdpIp_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�x J.3�� U � WDMClassesOfDriver UdpIp_Fail C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�~ & J.3�� [ � WDMClassesOfDriver UdpIp_TypeGroup2 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�v J.3�� S � WDMClassesOfDriver Image_V0 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�{ # J.3�� X � WDMClassesOfDriver Image_V0_Load C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�v J.3�� S � WDMClassesOfDriver Image_V1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�{ # J.3�� X � WDMClassesOfDriver Image_V1_Load C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�v J.3�� S � WDMClassesOfDriver Image_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�{ # J.3�� X � WDMClassesOfDriver Image_Load_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�} % J.3�� Z � WDMClassesOfDriver KernelImageBase C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�{ # J.3�� X � WDMClassesOfDriver HypercallPage C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�~ & J.3�� [ � WDMClassesOfDriver LoaderBasicEvent C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�} % J.3�� Z � WDMClassesOfDriver LoaderBaseEvent C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�~ & J.3�� [ � WDMClassesOfDriver LoaderCodedEvent C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�s J.3�� P � WDMClassesOfDriver Image C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�x J.3�� U � WDMClassesOfDriver Image_Load C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� , J.3�� a � WDMClassesOfDriver LoaderCodedEventStatus C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� * J.3�� _ � WDMClassesOfDriver LoaderCodedEventPath C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C� ' J.3�� \ � WDMClassesOfDriver LoaderNewDllEvent C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� , J.3�� a � WDMClassesOfDriver LoaderDllSearchResults C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� - J.3�� b � WDMClassesOfDriver LoaderPathSearchResults C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�z " J.3�� W � WDMClassesOfDriver PageFault_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� * J.3�� _ � WDMClassesOfDriver PageFault_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� ) J.3�� ^ � WDMClassesOfDriver PageFault_HardFault C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� 3 J.3�� h � WDMClassesOfDriver PageFault_HeapRangeRundown_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� / J.3�� d � WDMClassesOfDriver PageFault_HeapRangeCreate C:\Windows\system32\kernelbase.dll[MofResourceName] R � WDMClassesOfDriver Mark_V0 C:\Windows\system32\kernelbase.dll[MofResourceName] ��g�� r 1P��R ��S�d <���z � !$l � X�J0\ S "G�{�
� �S�¡ � �+�A� ^ ���� � 2b=� -���� �t� M S N d i s h��jj��N MSNdis A �� � �� � ) / W c k � � � U����������� � MSNdis_FddiAttachmentType WMI WMIProv guid {acf1403d-a61c-11d0-8dd4-00c04fc3358c} WmiExpense Active
� � � �� boolean InstanceName '
� � � �� � �� string NdisFddiAttachmentType 6
� E � ��M W � uint32 ValueMap
� � � � � � � � � � � � � 1 2 3 4 5 6 7 8 9 10 11 12 13 WmiDataId � M S N d i s i��jj��� MSNdis A �� � �� � " + 1 Y e m � � � U����������e � MSNdis_FddiUpstreamNodeLong WMI WMIProv guid {acf1403e-a61c-11d0-8dd4-00c04fc3358c} WmiExpense Active
� � � �� boolean InstanceName '
� � � �� � �� string NdisFddiUpstreamNodeLong
)
� < � ��Z object:MSNdis_NetworkAddress WmiDataId � M S N d i s j��jj��� MSNdis A �� � �� � $ - 3 [ g o � � � U����������i � MSNdis_FddiDownstreamNodeLong WMI WMIProv guid {acf1403f-a61c-11d0-8dd4-00c04fc3358c} WmiExpense Active
� � � �� boolean InstanceName '
� � � �� � �� string NdisFddiDownstreamNodeLong
)
� @ � ��^ object:MSNdis_NetworkAddress WmiDataId � � M S N d i s k��jj��� MSNdis A �� � �� � & , T ` h � � � � U����������E � MSNdis_FddiFrameErrors WMI WMIProv guid {acf14040-a61c-11d0-8dd4-00c04fc3358c} WmiExpense Active
� � � �� boolean InstanceName '
� � � �� � �� string NdisFddiFrameErrors )
� 2 � ��: uint32 WmiDataId se � M S N d i s l��jj��� MSNdis A �� � �� � % + S _ g � � � � U����������C � MSNdis_FddiFramesLost WMI WMIProv guid {acf14041-a61c-11d0-8dd4-00c04fc3358c} WmiExpense Active
� � � �� boolean InstanceName '
� � � �� � �� string NdisFddiFramesLost )
� 0 � ��8 uint32 WmiDataId e � M S N d i s m��jj��/ MSNdis A �� � �� � $ - 3 [ g o � � � U����������� � MSNdis_FddiRingManagmentState WMI WMIProv guid {acf14042-a61c-11d0-8dd4-00c04fc3358c} WmiExpense Active
� � � �� boolean InstanceName '
� � � �� � �� string NdisFddiRingManagmentState 6
� M � ��U _ � uint32 ValueMap � � � � � � � � 1 2 3 4 5 6 7 8 WmiDataId � M S N d i s n��jj��� MSNdis A �� � �� � & , T ` h � � � � U����������E � MSNdis_FddiLctFailures WMI WMIProv guid {acf14043-a61c-11d0-8dd4-00c04fc3358c} WmiExpense Active
� � � �� boolean InstanceName '
� � � �� � �� string NdisFddiLctFailures )
� 2 � ��: uint32 WmiDataId se � M S N d i s o��jj��� MSNdis A �� � �� � % + S _ g � � � � U����������C � MSNdis_FddiLemRejects WMI WMIProv guid {acf14044-a61c-11d0-8dd4-00c04fc3358c} WmiExpense Active
� � � �� boolean InstanceName '
� � � �� � �� string NdisFddiLemRejects )
� 0 � ��8 uint32 WmiDataId e � M S N d i s p��jj��: MSNdis A �� � �� � " + 1 Y e m � � � U����������� � MSNdis_FddiLConnectionState WMI WMIProv guid {acf14045-a61c-11d0-8dd4-00c04fc3358c} WmiExpense Active
� � � �� boolean InstanceName '
� � � �� � �� string NdisFddiLConnectionState 6
� I � ��Q [ � uint32 ValueMap
� � � � � � � � � � 1 2 3 4 5 6 7 8 9 10 WmiDataId ap � M S N d i s q��jj��� MSNdis �� H R � � � � U����: � MSNdis_ObjectHeader WMI guid {2b1831b2-2216-4ede-a469-9fe3dd6d5a7e} Revision )
� � � ��� uint8 WmiDataId Size )
� � � ��� uint16 WmiDataId Type )
� ( � ��/ uint8 WmiDataId ct � M S N d i s r��jj��� " MSNdis �� # K S � �
W c � � U���������������������������������U � MSNdis_WmiMethodHeader WMI guid {e3eac9dd-2fd3-4963-bffd-b4692888c0d4} Header
)
� � � ��� object:MSNdis_ObjectHeader WmiDataId NetLuid )
� � � ��� uint64 WmiDataId Padding )
� D � ��L uint32 WmiDataId PortNumber )
� � � ��� uint32 WmiDataId RequestId )
� � � ��� uint64 WmiDataId Timeout )
� B � ��J uint32 WmiDataId � M S N d i s s��jj��� " MSNdis �� H P � �
T ` � � � U���������������������������������R � MSNdis_WmiSetHeader WMI guid {3b5605d8-1aaf-4ff6-85b9-bc5fb973dc54} Header
)
� � � ��� object:MSNdis_ObjectHeader WmiDataId NetLuid )
� � � ��� uint64 WmiDataId Padding )
� A � ��I uint32 WmiDataId PortNumber )
� � � ��� uint32 WmiDataId RequestId )
� � � ��� uint64 WmiDataId Timeout )
� ? � ��G uint32 WmiDataId � M S N d i s t��jj��� MSNdis �� ! I U � � � � V ` � � � U�����������������Y � MSNdis_WmiOutputInfo WMI guid {7510bb9d-df70-4f7e-ba07-e29d330b3cc5} DataOffset )
� � � ��� uint32 WmiDataId Flags )
� � � ��� uint32 WmiDataId Header
)
� / � ��K object:MSNdis_ObjectHeader WmiDataId Padding1 )
� � � ��� uint8 WmiDataId Padding2
)
� � � ��� uint16 WmiDataId SupportedRevision )
� G � ��N uint8 WmiDataId �aId �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �*pl\}�
͝��C�� 3 �\>�S}� h � WDMClassesOfDriver MSNdis_FddiShortMulticastList C:\Windows\system32\kernelbase.dll[MofResourceName] �6.� ʷ�� �/� 5 } � rA- ����H �1��] K��om ���?t
+�@�� ]�ȕ � ��
�g#n� �S�� V�1� ��c<� �߅�� Jjr5� ҂N�� ���!� +� �4 ���0 ���J?
b~�@I ��{�R ��S с_jX 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� 2 J.3�� g � WDMClassesOfDriver PageFault_HeapRangeTypeGroup C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� 0 J.3�� e � WDMClassesOfDriver PageFault_HeapRangeDestroy C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� / J.3�� d � WDMClassesOfDriver PageFault_ImageLoadBacked C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� , J.3�� a � WDMClassesOfDriver PageFault_VirtualAlloc C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� 3 J.3�� h � WDMClassesOfDriver PageFault_VirtualAllocRundown C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� - J.3�� b � WDMClassesOfDriver PageFault_VirtualRotate C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� ( J.3�� ] � WDMClassesOfDriver PageFault_MemReset C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�w J.3�� T � WDMClassesOfDriver PageFault C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� 0 J.3�� e � WDMClassesOfDriver PageFault_HeapRangeRundown C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�y ! J.3�� V � WDMClassesOfDriver PerfInfo_V0 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�u J.3�� R � WDMClassesOfDriver Mark_V0 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�y ! J.3�� V � WDMClassesOfDriver PerfInfo_V1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�t J.3�� Q � WDMClassesOfDriver ISR_V1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�t J.3�� Q � WDMClassesOfDriver DPC_V1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C� ' J.3�� \ � WDMClassesOfDriver SampledProfile_V1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�y ! J.3�� V � WDMClassesOfDriver PerfInfo_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�| $ J.3�� Y � WDMClassesOfDriver SampledProfile C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C� ' J.3�� \ � WDMClassesOfDriver PmcCounterProfile C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� / J.3�� d � WDMClassesOfDriver SampledProfileInterval_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� ) J.3�� ^ � WDMClassesOfDriver PmcCounterConfig_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� - J.3�� b � WDMClassesOfDriver CounterCorruptionStatus C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� - J.3�� b � WDMClassesOfDriver PmcCounterCorruption_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C� ' J.3�� \ � WDMClassesOfDriver SpinLockConfig_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�z " J.3�� W � WDMClassesOfDriver SysCallEnter C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�y ! J.3�� V � WDMClassesOfDriver SysCallExit C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�q J.3�� N � WDMClassesOfDriver ISR C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�u J.3�� R � WDMClassesOfDriver ISR_MSI C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�| $ J.3�� Y � WDMClassesOfDriver ISR_Unexpected C:\Windows\system32\kernelbase.dll[MofResourceName] Windows\system32\kernelbase.dll[MofResourceName] rceName] �Yj�� �Ώ� '�=;�
2V�
e��
�j~�
a��S� ��� #�n�
��Uk#
P.�#0 E��6
�d�M �N�\ a�)c
���cp �&b{ oP� �vhd� m<��� ��eٰ h.� ŭ�5� �,��� � t�
x�h� �X8 �g 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�q J.3�� N � WDMClassesOfDriver DPC C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�u J.3�� R � WDMClassesOfDriver WDF_DPC C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�u J.3�� R � WDMClassesOfDriver WDF_ISR C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�z " J.3�� W � WDMClassesOfDriver WDF_WorkItem C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�} % J.3�� Z � WDMClassesOfDriver DebuggerEnabled C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�z " J.3�� W � WDMClassesOfDriver IoTimerEvent C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� ( J.3�� ] � WDMClassesOfDriver SetOrExpireKTimer2 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�{ # J.3�� X � WDMClassesOfDriver CancelKTimer2 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�| $ J.3�� Y � WDMClassesOfDriver DisableKTimer2 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�} % J.3�� Z � WDMClassesOfDriver FinalizeKTimer2 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�v J.3�� S � WDMClassesOfDriver PerfInfo C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ¥n�^��
͝��C�� / J.3�� d � WDMClassesOfDriver SampledProfileInterval_V3 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ån�^��
͝��C� ' J.3�� \ � WDMClassesOfDriver SpinLockConfig_V3 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ĥn�^��
͝��C�w J.3�� T � WDMClassesOfDriver StackWalk C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ťn�^��
͝��C�} % J.3�� Z � WDMClassesOfDriver StackWalk_Event C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ƥn�^��
͝��C�{ # J.3�� X � WDMClassesOfDriver StackWalk_Key C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ǥn�^��
͝��C�� * J.3�� _ � WDMClassesOfDriver StackWalk_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ȥn�^��
͝��C�r J.3�� O � WDMClassesOfDriver ALPC C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ɥn�^��
͝��C� ' J.3�� \ � WDMClassesOfDriver ALPC_Send_Message C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ʥn�^��
͝��C�� * J.3�� _ � WDMClassesOfDriver ALPC_Receive_Message C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ˥n�^��
͝��C�� ) J.3�� ^ � WDMClassesOfDriver ALPC_Wait_For_Reply C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ̥n�^��
͝��C�� / J.3�� d � WDMClassesOfDriver ALPC_Wait_For_New_Message C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ͥn�^��
͝��C�y ! J.3�� V � WDMClassesOfDriver ALPC_Unwait C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 Υn�^��
͝��C� ' J.3�� \ � WDMClassesOfDriver HeapTraceProvider C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ϥn�^��
͝��C�z " J.3�� W � WDMClassesOfDriver HeapTrace_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 Хn�^��
͝��C�{ # J.3�� X � WDMClassesOfDriver HeapCreate_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ѥn�^��
͝��C�w J.3�� T � WDMClassesOfDriver HeapAlloc C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ҥn�^��
͝��C�y ! J.3�� V � WDMClassesOfDriver HeapRealloc C:\Windows\system32\kernelbase.dll[MofResourceName] ClassesOfDriver HeapSubsegmentReuseThresholdActivated C:\Windows\system32\kernelbase.dll[MofResourceName] esourceName] SystemConfig_V2_Network C:\Windows\system32\kernelbase.dll[MofResourceName] �g�� � 61ˁ� H ��KI� �L�� j �+Ԇk � �,L V .�P%� �p�� D ��� � � X e S q l P k g _ q u e r y _ r p c _ i n s e r t _ r o w �X��7 �� , ' XeSqlPkg_query_rpc_insert_row ) � �� ! / 9 � � � � @ L � r � � | � WU������������������������������������������� � query_rpc_insert_row EventType EventVersion accessor )
� p x � �� uint64 WmiDataId accessor_bindings )
� � � � �� uint64 WmiDataId accessor_buffer_size $ )
� - 5 � �� uint32 WmiDataId ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid FragmentId 6
� F N Y f � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� L T _ l � �� uint32 WmiDataId Description SequenceNumber use_local_rowset ( )
� � � � �� sint8 WmiDataId � X e S q l P k g �X��7 � XeSqlPkg
C � �� - M S { � � � c����� � XeSqlPkg_query_rpc_delete_rows Description Deleting rows from RPC rowset. Guid {18f0e3cc-f352-4174-8e8f-c12c1cc1fb45} locale MS\0x409 DisplayName query_rpc_delete_rows � X e S q l P k g _ q u e r y _ r p c _ d e l e t e _ r o w s �X��7 �� ( XeSqlPkg_query_rpc_delete_rows ) � �� " 0 < � � b s � � > N � � W���������������������� � query_rpc_delete_rows EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid FragmentId 6
� 6 > I V � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength row_deleted )
� , 3 � �� sint8 WmiDataId SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber use_local_rowset )
� � �� sint8 WmiDataId � X e S q l P k g �X��7 �B XeSqlPkg
C � ��+ 8 d j � � � � c����� � XeSqlPkg_query_rpc_fetch_row_by_key_value Description Fetching row by key value from RPC rowset. Guid {c264916a-bfa9-4529-bc4f-9006706e3c43} locale MS\0x409 DisplayName query_rpc_fetch_row_by_key_value �) X e S q l P k g _ q u e r y _ r p c _ f e t c h _ r o w _ b y _ k e y _ v a l u e �X��7 �w B 3 XeSqlPkg_query_rpc_fetch_row_by_key_value + ) � ��" - ; G � � F U � � f r � � : Q � � � � � WUU���������������������������������������������������������������d � query_rpc_fetch_row_by_key_value EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid cache_keys < )
� 4 ; � �� sint8 WmiDataId data_accessor ( )
� � � � �� uint64 WmiDataId data_accessor_bindings 0 )
� � � � �� uint64 WmiDataId data_accessor_buffer_size
8 )
� S [
� �� uint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId key_accessor )
� ' / � �� uint64 WmiDataId key_accessor_bindings )
� � � � �� uint64 WmiDataId key_accessor_buffer_size $ )
� � � � �� uint32 WmiDataId RemainingLength 6
� T \ g t � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber use_local_rowset = )
� R Y � �� sint8 WmiDataId � X e S q l P k g �X��7 �. XeSqlPkg
C � ��% 2 V \ � � � � c����� � XeSqlPkg_query_rpc_insert_index_row Description Inserting index row in RPC rowset. Guid {17bbc16d-1515-46d8-8402-f6c5211af541} locale MS\0x409 DisplayName query_rpc_insert_index_row �# X e S q l P k g _ q u e r y _ r p c _ i n s e r t _ i n d e x _ r o w �X��7 �� , - XeSqlPkg_query_rpc_insert_index_row % ) � �� ' 5 ? � � � � F R � x � � � � WU������������������������������������������� � query_rpc_insert_index_row EventType EventVersion accessor )
� v ~ � �� uint64 WmiDataId accessor_bindings )
� � � � �� uint64 WmiDataId accessor_buffer_size $ )
� 3 ; � �� uint32 WmiDataId ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid FragmentId 6
� L T _ l � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� R Z e r � �� uint32 WmiDataId Description SequenceNumber use_local_rowset ( )
� � � � �� sint8 WmiDataId � X e S q l P k g �X��7 � XeSqlPkg
C � �� , J P x � � � c����� � XeSqlPkg_query_rpc_end_update Description Ending update in RPC rowset. Guid {c430fedd-925b-45c4-a59b-f07d8d5c5cca} locale MS\0x409 DisplayName query_rpc_end_update � X e S q l P k g _ q u e r y _ r p c _ e n d _ u p d a t e �X��7 �j ' XeSqlPkg_query_rpc_end_update ) � �� ! / ; � � a r � � k } W����������������������� � query_rpc_end_update EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid FragmentId 6
� 5 = H U � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� ; C N [ � �� uint32 WmiDataId Description SequenceNumber use_local_rowset )
� � � � �� sint8 WmiDataId �aId �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �,pl\}�
͝��C�� ( �\>�S}� ] � WDMClassesOfDriver TP_V2_WTNodeSwitch C:\Windows\system32\kernelbase.dll[MofResourceName] ResourceName] ctSequence �e] A��p� �����
�Y��
a� ��� S��w
2��( ���? ���U
7~Aj �LU� # x�/R�
}��ݩ ~i%C� �ι
�(H�
pj� 7QD��
�P� � �Y� S�k� d|�
�@!�
�� r�D0 ��*E �h�Z ��Ewk 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ӥn�^��
͝��C�v J.3�� S � WDMClassesOfDriver HeapFree C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ԥn�^��
͝��C�} % J.3�� Z � WDMClassesOfDriver HeapSnapShot_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 եn�^��
͝��C�} % J.3�� Z � WDMClassesOfDriver Heap_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ֥n�^��
͝��C�� * J.3�� _ � WDMClassesOfDriver Heap_SubsegmentGroup C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ץn�^��
͝��C�� ( J.3�� ] � WDMClassesOfDriver HeapCommitDecommit C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 إn�^��
͝��C�� . J.3�� c � WDMClassesOfDriver HeapSubsegmentInitialize C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ٥n�^��
͝��C�� / J.3�� d � WDMClassesOfDriver HeapAffinityManagerEnable C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ڥn�^��
͝��C�� . J.3�� c � WDMClassesOfDriver HeapAffinitySlotAssigned C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ۥn�^��
͝��C�� - J.3�� b � WDMClassesOfDriver HeapSubSegmentActivated C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ܥn�^��
͝��C�� - J.3�� b � WDMClassesOfDriver HeapAffinitySlotChanged C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ݥn�^��
͝��C�� ; J.3�� p � WDMClassesOfDriver HeapSubsegmentReuseThresholdActivated C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ޥn�^��
͝��C�w J.3�� T � WDMClassesOfDriver HeapTrace C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ߥn�^��
͝��C�x J.3�� U � WDMClassesOfDriver HeapCreate C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�x J.3�� U � WDMClassesOfDriver HeapExpand C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�z " J.3�� W � WDMClassesOfDriver HeapSnapShot C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�z " J.3�� W � WDMClassesOfDriver HeapContract C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� * J.3�� _ � WDMClassesOfDriver CritSecTraceProvider C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�z " J.3�� W � WDMClassesOfDriver CritSecTrace C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�~ & J.3�� [ � WDMClassesOfDriver CritSecCollision C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�y ! J.3�� V � WDMClassesOfDriver CritSecInit C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�x J.3�� U � WDMClassesOfDriver Lost_Event C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�z " J.3�� W � WDMClassesOfDriver RT_LostEvent C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�} % J.3�� Z � WDMClassesOfDriver SystemConfig_V0 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� ) J.3�� ^ � WDMClassesOfDriver SystemConfig_V0_CPU C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� - J.3�� b � WDMClassesOfDriver SystemConfig_V0_PhyDisk C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� - J.3�� b � WDMClassesOfDriver SystemConfig_V0_LogDisk C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� ) J.3�� ^ � WDMClassesOfDriver SystemConfig_V0_NIC C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� + J.3�� ` � WDMClassesOfDriver SystemConfig_V0_Video C:\Windows\system32\kernelbase.dll[MofResourceName] lassesOfDriver SystemConfig_V2_Network C:\Windows\system32\kernelbase.dll[MofResourceName] ceName] l[MofResourceName] ��C�0 X �q3� � O�*E � i�} � Bs+M� � q;��� z iMI�A � �$ų� � W�ẵ � ���N :n�{j ��;̀ ��_q� �D�� �3�^�
�[��� ��g�� A�� I I S _ T r a c e �5h�b �. IIS_Trace [ � ��
/ 5 ] k x ~ ��� � o��������� � ANCM_Events Description ANCM runtime events Guid {82ADEAD7-12B2-4781-BDCA-5A4B6C757191} EventVersion DisplayName ANCM EventANCMRuntime locale MS\0x409 � A N C M _ E v e n t s �5h�b �� ANCM_Events
C � �� 6 A M \ | � Q \ _���������������� � ANCMAppStart Description Start application success EventType EventLevel EventTypeName ANCM_START_APPLICATION_SUCCESS AppDescription P
� � � �
# 6 F N � �� string WmiDataId Description Application Description StringTermination NullTerminated format w ContextId
N
� � � � � � � � �� � �� object WmiDataId Description Context ID extension Guid ActivityID � A N C M _ E v e n t s �5h�b �� ANCM_Events
C � �� 9 D P _ | � , @ _���������������� � ANCMAppStartFail Description Start application failed EventType EventLevel EventTypeName ANCM_START_APPLICATION_FAIL ContextId
N
� � � � �� � �� object WmiDataId Description Context ID extension Guid ActivityID FailureDescription P
� � � � � � � � �� string WmiDataId Description Application Start Failure Description StringTermination NullTerminated format w � A N C M _ E v e n t s �5h�b ��
ANCM_Events
C � �� 9 D P _ { � _������������+ � ANCMForwardStart Description Start forwarding request EventType EventLevel EventTypeName ANCM_REQUEST_FORWARD_START ContextId
N
� � � � �� � �� object WmiDataId Description Context ID extension Guid ActivityID � A N C M _ E v e n t s �5h�b ��
ANCM_Events
C � �� 8 C O ^ x � _������������( � ANCMForwardEnd Description Finish forwarding request EventType EventLevel EventTypeName ANCM_REQUEST_FORWARD_END ContextId
N
� � � � � �� � �� object WmiDataId Description Context ID extension Guid ActivityID � A N C M _ E v e n t s �5h�b �L ANCM_Events
C � �� : E Q ` { � + 6 _����������������� � ANCMForwardFail Description Forwarding request failure EventType EventLevel EventTypeName ANCM_REQUEST_FORWARD_FAIL ContextId
N
� � � � �� � �� object WmiDataId Description Context ID extension Guid ActivityID ErrorCode C
� � � � � � � � �� uint32 WmiDataId Description Error code format x � A N C M _ E v e n t s �5h�b �Z ANCM_Events
C � �� " C N Z i � � 0 @ _����������������� � ANCMWinHttpCallBack Description Receiving callback from WinHttp EventType EventLevel EventTypeName ANCM_WINHTTP_CALLBACK ContextId
N
� � � � $ �� � �� object WmiDataId Description Context ID extension Guid ActivityID InternetStatus C
� � � � � � � � �� uint32 WmiDataId Description InternetStatus format x � A N C M _ E v e n t s �5h�b ��
ANCM_Events
C � �� C N Z i � � _������������< � ANCMExecuteStart Description Starting inprocess execute request EventType EventLevel EventTypeName ANCM_INPROC_EXECUTE_REQUEST_START ContextId
N
� � � * 0 �� � �� object WmiDataId Description Context ID extension Guid ActivityID � A N C M _ E v e n t s �5h�b �k ANCM_Events
C � �� ? J V e � � = L _����������������� � ANCMExecuteEnd Description Ending inprocess execute request EventType EventLevel EventTypeName ANCM_INPROC_EXECUTE_REQUEST_COMPLETION ContextId
N
� � � + 1 �� � �� object WmiDataId Description Context ID extension Guid ActivityID requestStatus C
� � � � � � � � �� uint32 WmiDataId Description Notification status format d �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 0pl\}�
͝��C�� * ��
�S}� i � WDMClassesOfDriver MSPower_DeviceEnable C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� . J.3�� c � WDMClassesOfDriver SystemConfig_V0_Services C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� + J.3�� ` � WDMClassesOfDriver SystemConfig_V0_Power C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� ) J.3�� ^ � WDMClassesOfDriver SystemConfig_V0_IRQ C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� ) J.3�� ^ � WDMClassesOfDriver SystemConfig_V0_PnP C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�} % J.3�� Z � WDMClassesOfDriver SystemConfig_V1 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� ) J.3�� ^ � WDMClassesOfDriver SystemConfig_V1_CPU C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� - J.3�� b � WDMClassesOfDriver SystemConfig_V1_PhyDisk C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ��n�^��
͝��C�� - J.3�� b � WDMClassesOfDriver SystemConfig_V1_LogDisk C:\Windows\system32\kernelbase.dll[MofResourceName] sourceName] ase.dll.mui[MofResourceName] ourceName] s\system32\kernelbase.dll[MofResourceName] 5 F 4 q�jj��
͝��C�� 3���� ] � WDMClassesOfDriver Debugger C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] esourceName] � g�� �d�� � $]~� C ��6 = =re�F � ��=� v g��e � 4F��V x � �� z �`��H t <�db� � ���~� � � �� 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 =�4 �
͝��C�� * M�� D� a � WDMClassesOfDriver MS_SystemInformation C:\Windows\System32\drivers\mssmbios.sys[MofResource] I I S _ T r a n s �=�4 �� IIS_Trans ) � �� 9 ( 4 ? � � D Q � � _����������������������� � W3GeneralSetResponseTrailer EventType EventLevel ContextId
A
� � � � � � �� � �� object WmiDataId extension Guid ActivityID HeaderName 6
� ! 4 � �� string WmiDataId StringTermination NullTerminated HeaderValue 6
� � � � � � �� string WmiDataId StringTermination NullTerminated Replace )
� � �� boolean WmiDataId � I I S _ T r a c e �=�4 � IIS_Trace N � �� H V c v ��� � o��������� � IIS_Authentication_Trans Guid {c33bbe8f-985b-4080-81e6-005f1a06b9e2} EventVersion DisplayName IISAuthentication EventHttpRequest locale MS\0x409 � I I S _ A u t h e n t i c a t i o n _ T r a n s �=�4 �� " IIS_Authentication_Trans ) � ��
$ 7 � � _����������������t � W3AuthStart EventType EventLevel AuthTypeSupported ]
� � � � � @ H � � � � � �� uint32 WmiDataId DefineValues � �
, MD_AUTH_ANONYMOUS MD_AUTH_BASIC MD_AUTH_NT MD_AUTH_MD5 MD_AUTH_PASSPORT MD_ACCESS_MAP_CERT Values d o v z � � Anonymous Basic NT Digest Passport MapCliCert ValueMap � � � � � � 0x1 0x2 0x4 0x10 0x40 0x80 format x ContextId
A
� D L W b h �� � �� object WmiDataId extension Guid ActivityID � I I S _ A u t h e n t i c a t i o n _ T r a n s �=�4 �a " IIS_Authentication_Trans ) � �� ( 2 � � � � a q _U������������������������������� � W3AuthSucceeded EventType EventLevel AuthType ]
� � � � � ; C � � � � � �� uint32 WmiDataId DefineValues � � � ' MD_AUTH_ANONYMOUS MD_AUTH_BASIC MD_AUTH_NT MD_AUTH_MD5 MD_AUTH_PASSPORT MD_ACCESS_MAP_CERT Values _ j q u } � Anonymous Basic NT Digest Passport CertMap ValueMap � � � � � � 0x1 0x2 0x4 0x10 0x40 0x80 format x AuthUserName C
� A I T g w � �� string WmiDataId StringTermination NullTerminated format w ContextId
A
� � � � � �� � �� object WmiDataId extension Guid ActivityID NTLMUsed )
� M V � �� boolean WmiDataId RemoteUserName C
� � � � � � � �� string WmiDataId StringTermination NullTerminated format w TokenImpersonationLevel ]
� � � � � Y c � � � � � �� uint32 WmiDataId DefineValues � � � < IMPERSONATION_LEVEL_ANONYMOUS IMPERSONATION_LEVEL_IDENTIFY IMPERSONATION_LEVEL_IMPERSONATE IMPERSONATION_LEVEL_DELEGATE IMPERSONATION_LEVEL_UNKNOWN ValueMap { � � � � 0x0 0x1 0x2 0x3 0x4 ValueType index format x � I I S _ A u t h e n t i c a t i o n _ T r a n s �=�4 �.
" IIS_Authentication_Trans ) � �� # / : _������������� � W3AuthTypeNotSupported EventType EventLevel ContextId
A
� � � � � � �� � �� object WmiDataId extension Guid ActivityID � I I S _ A u t h e n t i c a t i o n _ T r a n s �=�4 �� " IIS_Authentication_Trans ) � ��
% 1 < � � _����������������( � W3AuthInvalidAnonAccount EventType EventLevel ContextId
A
� � � � � � �� � �� object WmiDataId extension Guid ActivityID ErrorCode 6
�
% � �� uint32 WmiDataId format x � I I S _ A u t h e n t i c a t i o n _ T r a n s �=�4 �0
" IIS_Authentication_Trans ) � �� % 1 < _������������� � W3AuthPasswdChangeNeeded EventType EventLevel ContextId
A
� � � � � � �� � �� object WmiDataId extension Guid ActivityID � I I S _ A u t h e n t i c a t i o n _ T r a n s �=�4 �2
" IIS_Authentication_Trans ) � �� ' 3 > _������������� � W3AuthPasswdChangeDisabled EventType EventLevel ContextId
A
� � � � � � �� � �� object WmiDataId extension Guid ActivityID � I I S _ A u t h e n t i c a t i o n _ T r a n s �=�4 �,
" IIS_Authentication_Trans ) � �� ! - 8 _������������� � W3AuthBadBasicHeader EventType EventLevel ContextId
A
� � � � � � �� � �� object WmiDataId extension Guid ActivityID � I I S _ R e w r i t e _ T r a n s �5h�b �� IIS_Rewrite_Trans ] � �� ( C P m x � � � � � � r � _����������������� � ConditionsEvaluationStart DisplayName ConditionsEvaluationStart Description Condition evaluation starts EventType EventTypeName CONDITIONS_EVALUATION_START EventLevel locale MS\0x409 ContextId
N
� ) 1 < I U ` f �� � �� object WmiDataId Description Context ID extension Guid ActivityID LogicalGrouping j
� � 7 J � � � � � � � �� uint32 WmiDataId Description Logical condition grouping ValueDescriptions V } Must match all conditions to succeed. Match any condition to succeed. ValueMap � � 0 1 Values � � MatchAll MatchAny ValueType index ce � I I S _ R e w r i t e _ T r a n s �5h�b �� IIS_Rewrite_Trans ] � �� & ? L h s � � � � � � k v _�������������� � ConditionsEvaluationEnd DisplayName ConditionsEvaluationEnd Description Conditions evaluation ends EventType EventTypeName CONDITIONS_EVALUATION_END EventLevel locale MS\0x409 ContextId
N
� " * 5 B N Y _ �� � �� object WmiDataId Description Context ID extension Guid ActivityID Succeeded 6
� � � � � � �� boolean WmiDataId Description True if the conditions evaluation succeeded �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� 3 J.3�� h � WDMClassesOfDriver SystemConfig_V2_CodeIntegrity C:\Windows\system32\kernelbase.dll[MofResourceName] esourceName] fResourceName] K��P 1 �N\b� @gE�� h A�Z� S Q L T r a c e E v e n t 2 1 fO��7 �� j SQLTraceEvent21 6 � �� $ 4 ? N Q b $ � � [ g � � � �
� � � � 9 D � � � � n z + 6 � � n
x
�
�
V a � � B L �
UUUUU�����������������������������������������������������������������������������������������������������}
� SQLTraceEvent21_TYPE0 Description EventLog Type0 EventType EventTypeName 0 ApplicationName $ P
� � � � � � � � � �� string WmiDataId Description ApplicationName format w StringTermination Counted BinaryData P
� � � � � � � � � � �� string WmiDataId Description BinaryData format c StringTermination Counted ClientProcessID 6
� * 2 = J � �� sint32 WmiDataId Description ClientProcessID DatabaseID 6
� � � � � � �� sint32 WmiDataId Description DatabaseID DatabaseName H P
� C K V c q y | � � �� string WmiDataId Description DatabaseName format w StringTermination Counted Error D 6
� � � � � �� sint32 WmiDataId Description Error EventClass
< 6
� Z b m z � �� sint32 WmiDataId Description EventClass EventSequence T 6
� � � � � � �� sint64 WmiDataId Description EventSequence HostName P
� p x � � � � � � � �� string WmiDataId Description HostName format w StringTermination Counted IsSystem \ 6
� " / � �� sint32 WmiDataId Description IsSystem LoginName ( P
� � �
� � � � � � � �� string WmiDataId Description LoginName format w StringTermination Counted LoginSid L P
� \ d o | � � � � � �� string WmiDataId Description LoginSid format c StringTermination Counted NTDomainName P
� ! , 9 G O R e � �� string WmiDataId Description NTDomainName format w StringTermination Counted NTUserName P
� � � � � " � �� string WmiDataId Description NTUserName format w StringTermination Counted RequestID P 6
� z � � � � �� sint32 WmiDataId Description RequestID SessionLoginName ` P
�
(
5
G
O
R
e
� �� string WmiDataId Description SessionLoginName format w StringTermination Counted Severity 8 6
� �
�
�
�
� �� sint32 WmiDataId Description Severity SPID
, 6
� 0 8 C P � �� sint32 WmiDataId Description SPID StartTime 0 6
� � � � � � �� uint64 WmiDataId Description StartTime State @ 6
� # . ; � �� sint32 WmiDataId Description State TextData P
� � � � � � � � � � �� string WmiDataId Description TextData format w StringTermination Counted TransactionID 6
� N
V
a
n
� �� sint64 WmiDataId Description TransactionID � M S S Q L S E R V E R T r a c e gO��7 �� MSSQLSERVERTrace 6 � �� ( . T a k � SQLTraceEvent22 Description ErrorLog Guid 84e993e6-0016-4d70-97ef-3824ed2c4e93 DisplayName ErrorLog � S Q L T r a c e E v e n t 2 2 hO��7 �2 f SQLTraceEvent22 6 � �� $ 4 ? N Q b ) � � ( � � M Y � � K U | � 7 A � � � � n y � � � � )
/
�
�
� � > M UUUUU�������������������������������������������������������������������������������������������������� � SQLTraceEvent22_TYPE0 Description ErrorLog Type0 EventType EventTypeName 0 ApplicationName P
� � � � � � � � � �� string WmiDataId Description ApplicationName format w StringTermination Counted ClientProcessID 6
� m u � � � �� sint32 WmiDataId Description ClientProcessID DatabaseID 6
� � � � �� sint32 WmiDataId Description DatabaseID DatabaseName D P
� � � � � � � � � � �� string WmiDataId Description DatabaseName format w StringTermination Counted Error @ 6
� & . 9 F � �� sint32 WmiDataId Description Error EventClass 8 6
� � �
� � � �� sint32 WmiDataId Description EventClass EventSequence P 6
� $ / < � �� sint64 WmiDataId Description EventSequence HostName P
� � � � � � � � � � �� string WmiDataId Description HostName format w StringTermination Counted IsSystem X 6
� R Z e r � �� sint32 WmiDataId Description IsSystem LoginName $ P
� � � � . � �� string WmiDataId Description LoginName format w StringTermination Counted LoginSid H P
� � � � � � � � � � �� string WmiDataId Description LoginSid format c StringTermination Counted NTDomainName P
� \ d o | � � � � � �� string WmiDataId Description NTDomainName format w StringTermination Counted NTUserName P
� # . ; G O R e � �� string WmiDataId Description NTUserName format w StringTermination Counted RequestID L 6
� � � � � � �� sint32 WmiDataId Description RequestID SessionLoginName \ P
� X ` k x � � � � � �� string WmiDataId Description SessionLoginName format w StringTermination Counted Severity 4 6
� �
� �� sint32 WmiDataId Description Severity SPID ( 6
� s
{
�
�
� �� sint32 WmiDataId Description SPID StartTime
, 6
� �
�
�
� �� uint64 WmiDataId Description StartTime State
< 6
� ^ f q ~ � �� sint32 WmiDataId Description State TextData P
� � �
" 5 � �� string WmiDataId Description TextData format w StringTermination Counted TransactionID 6
� � � � � � �� sint64 WmiDataId Description TransactionID �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 $�n�^��
͝��C�~ & J.3�� [ � WDMClassesOfDriver DebugPrint_Event C:\Windows\system32\kernelbase.dll[MofResourceName] V�ת� � �N��� "zV� � !�f�g � ;�[z
o G��| � �B�$ z �q%|� ��F� l >� 2 �.Y[L � M S _ W m i I n t e r n a l ��jj��� MS_WmiInternal ) � L ��W _ g � MSWmi_MofData Description This class supplies the binary mof information AMENDMENT LOCALE ms_409 � � W i n 3 2 _ M S I R e s o u r c e ���C�� Win32_MSIResource ) � ��� � � � r | � � �������������������������G � Win32_Property Description This table contains the property names and values for all defined properties in the installation. Properties with Null values are not present in the table. AMENDMENT LOCALE ms_409 ProductCode )
� � ��! . string Description The product code for the product of which this property is a part. Property )
� � � ��� � string Description The name of the property. Value
� + string Description The value of the property. � W i n 3 2 _ M S I R e s o u r c e ���C�p Win32_MSIResource )
� ��� � � � � � ' 2 � � / 9 U����������������������������� � Win32_Patch Description Instances of this class represent individual patches that are to be applied to a particular file and whose source reside at a specified location. AMENDMENT LOCALE ms_409 Attributes
� uint16 Description A bit flag representing patch attributes. A value of 1 indicates that the failure to apply this patch is not a fatal error. File )
� � � ��� � string Description The FileID of the Win32_FileSpecification this patch applies to. PatchSize
� ^ f s uint32 Description The size of the patch in bytes. ProductCode )
� � � ��� � string Description The product code for the product to which this patch is applied. Sequence )
� p � ��x � sint16 Description The position of this patch in the sequence of patches on the source media. � W i n 3 2 _ M S I R e s o u r c e ���C�l Win32_MSIResource ) � ��� � � � R _ ���������������������� � Win32_Binary Description Instances ofthis class represent binary information (such as bitmapps, icons, executables, etc...) that are used by an installation. AMENDMENT LOCALE ms_409 Data
� � � string Description This property represents the binary data that is associated with this object. ProductCode )
� � � ��� � string Description The product code for the product of which this binary is a part. � W i n 3 2 _ M S I R e s o u r c e ���C�5 Win32_MSIResource ) # � ��� � � � � � � � C P � � U������������������������������� � Win32_ServiceControl Description Instances of this class represent instrctions for controlling both installed and uninstalled services. AMENDMENT LOCALE ms_409 Arguments
� � � � string Description A list of arguments for starting services. The arguments are separated by null characters [~]. For example, the list of arguments One, Two, and Three are listed as: One[~]Two[~]Three. Event
� � � � string Description A bit map representing the operations for which this object applies. The following are the valid values
Hexadecimal
Decimal
Description
0x001
1
Starts the service during the StartServices action.
0x002
2
Stops the service during the StopServices action. \nn 0x004
4
<reserved>
0x008
8
Deletes the service during the DeleteServices action.
The following values are only used during an uninstall
Hexadecimal
Decimal
Description
0x010
16
Starts the service during the StartServices action.
0x020
32
Stops the service during the StopServices action.
0x040
64
<reserved>
0x080
128
Deletes the service during the DeleteServices action. ID )
� � � ��� � string Description A unique key identifying this service control item within its product. ProductCode )
� � � ��� � string Description The product code for the product of which this service control is a part. Wait
� ! . uint16 Description A value of 1 in this column means to wait until the service actually completes before proceeding. This implies that the event is critical to the install, and that if the event fails the resulting error cannot be ignored. A value of 0 in this column means to wait only until the service control manager (SCM) reports that this service is in a pending state. � C I M _ S e t t i n g ���C�z CIM_Setting
�� ( 0 ; � � ��������������������� � Win32_ODBCAttribute AMENDMENT LOCALE ms_409 Attribute )
� r � ��z � string Description The name of the ODBC attribute. Value
� � � � string Description The value of this attribute. � C I M _ S e t t i n g ���C�L CIM_Setting
��& . 6 A � � a h �������������������������� � Win32_ODBCSourceAttribute AMENDMENT LOCALE ms_409 Attribute )
� x � ��� � string Description The name of the data source attribute. DataSource )
� � � ��
string Description Token name for the data source within its package to which this attribute applies. Value
� � � � string Description The value for this data source attribute. � ���C�� ) ) � ��� � � � Win32_SoftwareFeatureCheck Description This association relates an MSI feature with any condition or locational information that a feature may require. AMENDMENT LOCALE ms_409 � � C I M _ S o f t w a r e E l e m e n t C h e c k s ���C�" # CIM_SoftwareElementChecks ) ) � ��� � ?����������� � Win32_SoftwareElementCheck Description This association relates an MSI element with any condition or locational information that a feature may require. AMENDMENT LOCALE ms_409 � ���C� ) � ��� � � � Win32_ActionCheck Description This association relates an MSI action with any locational information it requires. This location is in the form of a file and/or directory specification. AMENDMENT LOCALE ms_409 � � ���C�� ) ! r ��} � � � Win32_SettingCheck Description This association relates an MSI check with any setting information it requires. AMENDMENT LOCALE ms_409 � �409 � �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �L����
͝��C� ' +/�Q �� \ � WDMClassesOfDriver MSWmi_PnPDeviceId C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �L����
͝��C�� , +/�Q �� a � WDMClassesOfDriver MSWmi_PnPInstanceNames C:\Windows\system32\kernelbase.dll[MofResourceName] _ g � MSWmi_MofData Description This class supplies the binary mof information AMENDMENT LOCALE ms_409 � � ���ـ � ´��+ ) �3�.T ) �6�} G =i2� l װ��0 � ��Q-� S Q L T r a c e E v e n t 1 2 4 P��7 �s SQLTraceEvent124 6 � �� % @ K Z ] n $ 5 � � & 2 � � _ n � � c m " � � c m � � W a � � � � K
W
� � � � =
O
v � � � � | � 5 D UUUUUU������������������������������������������������������������������������������������������������������������������������� � SQLTraceEvent124_TYPE0 Description Broker:Conversation Type0 EventType EventTypeName 0 ApplicationName $ P
� � � � � � � �� string WmiDataId Description ApplicationName format w StringTermination Counted ClientProcessID 6
� y � � � � �� sint32 WmiDataId Description ClientProcessID DatabaseID 6
� �
� �� sint32 WmiDataId Description DatabaseID DBUserName P P
� � � � � � � � � � �� string WmiDataId Description DBUserName format w StringTermination Counted EventClass 8 6
� 3 ;
F S � �� sint32 WmiDataId Description EventClass EventSequence d 6
� � � � � � �� sint64 WmiDataId Description EventSequence EventSubClass 4 6
� 4 < G T � �� sint32 WmiDataId Description EventSubClass FileName @ P
� � � � � � � � �� string WmiDataId Description FileName format w StringTermination Counted GUID
l C
� s { � � � � � �� object WmiDataId Description GUID extension Guid HostName P
� % 2 < D G Z � �� string WmiDataId Description HostName format w StringTermination Counted IsSystem p 6
� � � � � � �� sint32 WmiDataId Description IsSystem LineNumber 6
� + 3 > K � �� sint32 WmiDataId Description LineNumber LoginSid T P
� � � � � � � � � �� string WmiDataId Description LoginSid format c StringTermination Counted MethodName ` P
� z � � � � � � � � �� string WmiDataId Description MethodName format w StringTermination Counted NTDomainName P
� 9 A L Y g o r � � �� string WmiDataId Description NTDomainName format w StringTermination Counted NTUserName P
� �
$
,
/
B
� �� string WmiDataId Description NTUserName format w StringTermination Counted ObjectName
< P
� �
�
�
�
�
�
�
�
� �� string WmiDataId Description ObjectName format w StringTermination Counted OwnerName D P
� q y � � � � � � � �� string WmiDataId Description OwnerName format w StringTermination Counted ProviderName \ P
� / 7 B O ] e h { � �� string WmiDataId Description ProviderName format w StringTermination Counted RoleName H P
� � � �
!
4
� �� string WmiDataId Description RoleName format w StringTermination Counted SessionLoginName t P
� �
�
�
�
�
�
�
�
� �� string WmiDataId Description SessionLoginName format w StringTermination Counted SPID ( 6
� P X
c p � �� sint32 WmiDataId Description SPID StartTime
, 6
� � � � � � �� uint64 WmiDataId Description StartTime TargetLoginName X P
� _ g r � � � � � �� string WmiDataId Description TargetLoginName format w StringTermination Counted TargetUserName L P
� % - 8 E U ] ` s � �� string WmiDataId Description TargetUserName format w StringTermination Counted TextData P
� � � � , � �� string WmiDataId Description TextData format w StringTermination Counted TransactionID 6
� � � � � � �� sint64 WmiDataId Description TransactionID � M S S Q L S E R V E R T r a c e P��7 �� MSSQLSERVERTrace 6 � �� 9 ? e r � � SQLTraceEvent125 Description Deprecation Announcement Guid 84e993e6-007d-4d70-97ef-3824ed2c4e93 DisplayName Deprecation Announcement ve � M S S Q L S E R V E R T r a c e �P��7 �� MSSQLSERVERTrace 6 � �� 9 ? e r � � SQLTraceEvent182 Description TM: Begin Tran completed Guid 84e993e6-00b6-4d70-97ef-3824ed2c4e93 DisplayName TM: Begin Tran completed ve �% X e S q l P k g _ q u e r y _ t s q l _ s c a l a r _ u d f _ p a r s e d +Q��7 �� ' / XeSqlPkg_query_tsql_scalar_udf_parsed ' ) � �� ) 7 C � � D P � � & � � + u WU������������������������������������� � query_tsql_scalar_udf_parsed EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� 1 9 � �� uint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId object_id )
�
� �� sint32 WmiDataId RemainingLength 6
� j r } � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � �� uint32 WmiDataId Description SequenceNumber stmt_count )
� b j � �� sint32 WmiDataId udf_name C
� � � � ��� � string WmiDataId StringTermination NullTerminated Format w � X e S q l P k g ,Q��7 �D XeSqlPkg
C � ��) 6 h n � � � � c����� � XeSqlPkg_tsql_scalar_udf_not_inlineable Description Encountered a scalar UDF that is not inlineable. Guid {0C91D45A-8DCC-40A5-98EB-260F8825F9CC} locale MS\0x409 DisplayName tsql_scalar_udf_not_inlineable � X e S q l P k g �Q��7 �� XeSqlPkg
C � ��C P � � � � � � c����1 � XeSqlPkg_query_optimizer_cardinality_estimation_join_side_ignored Description Occurs when cardinality estimation for a join is produced by ignoring one of the inputs. Guid {860e28a2-8ca9-467a-ba3c-0bfd71e34dd0} locale MS\0x409 DisplayName query_optimizer_cardinality_estimation_join_side_ignored �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 %�n�^��
͝��C�w J.3�� T � WDMClassesOfDriver PoolTrace C:\Windows\system32\kernelbase.dll[MofResourceName] �AP� Y ��� � �8�&� � �| N� � �d�� w m�}#C
�;�bP
m�vF] ��x�n
nr\h л�ە �捼� �?�� ��0�� ��4 �
�AY�� �B�< 8��[" ��;�6 jɻ]R �#Fl !�3]� G�-5� ���� & �� C 2 0 D 4 B 0 2 1 E 0 A F F B 6 1 E 5 D 9 0 A 8 A D 1 A 9 4 9 C B A 9 4 8 B 6 E D 6 C 5 0 6 F D 3 F 6 2 3 4 7 7 D E 2 D D F 5 D ������Н��C�� ) " } v 3 � � RSOP_Session 20211027194331.000000+000 Session1 G U ^ h S-1-5-32-544 S-1-1-0 S-1-5-11 S-1-16-16384 Local WIN-F6NF7R6I6PJ I I S _ A u t h e n t i c a t i o n _ T r a n s �=�4 �� " IIS_Authentication_Trans ) � �� # / : � � _����������������& � W3AuthBasicLogonFailed EventType EventLevel ContextId
A
� � � � � � �� � �� object WmiDataId extension Guid ActivityID ErrorCode 6
� # � �� uint32 WmiDataId format x � I I S _ A u t h e n t i c a t i o n _ T r a n s �=�4 �� " IIS_Authentication_Trans ) � �� % 1 < � � _����������������( � W3AuthWDigestLogonFailed EventType EventLevel ContextId
A
� � � � � � �� � �� object WmiDataId extension Guid ActivityID ErrorCode 6
�
% � �� uint32 WmiDataId format x � I I S _ A u t h e n t i c a t i o n _ T r a n s �=�4 �� " IIS_Authentication_Trans ) � �� ' 3 > � � _����������������* � W3AuthIISDigestLogonFailed EventType EventLevel ContextId
A
� � � � � � �� � �� object WmiDataId extension Guid ActivityID ErrorCode 6
� ' � �� uint32 WmiDataId format x � I I S _ S t a r t u p _ T r a n s �>�4 �=
IIS_Startup_Trans ) � �� $ % 1 = �������������� � W3StartupFilterLoadStart EventType EventLevel FilterName C
� � � � � � � � �� string WmiDataId StringTermination NullTerminated format w �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�} % J.3�� Z � WDMClassesOfDriver SystemConfig_V3 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�} % J.3�� Z � WDMClassesOfDriver SystemConfig_V4 C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� ) J.3�� ^ � WDMClassesOfDriver SystemConfig_V3_CPU C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� ) J.3�� ^ � WDMClassesOfDriver SystemConfig_V3_IRQ C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� . J.3�� c � WDMClassesOfDriver SystemConfig_V3_Services C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� ) J.3�� ^ � WDMClassesOfDriver SystemConfig_V3_PnP C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� 4 J.3�� i � WDMClassesOfDriver SystemConfig_V3_MobilePlatform C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� ) J.3�� ^ � WDMClassesOfDriver SystemConfig_V4_PnP C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� 4 J.3�� i � WDMClassesOfDriver SystemConfig_V4_MobilePlatform C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�z " J.3�� W � WDMClassesOfDriver SystemConfig C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�~ & J.3�� [ � WDMClassesOfDriver SystemConfig_PnP C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� 3 J.3�� h � WDMClassesOfDriver SystemConfig_V2_TelemetryInfo C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� , J.3�� a � WDMClassesOfDriver SystemConfig_V2_Defrag C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� 4 J.3�� i � WDMClassesOfDriver SystemConfig_V2_MobilePlatform C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� 2 J.3�� g � WDMClassesOfDriver SystemConfig_V2_DeviceFamily C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� / J.3�� d � WDMClassesOfDriver SystemConfig_V2_FlightIds C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �n�^��
͝��C�� 0 J.3�� e � WDMClassesOfDriver SystemConfig_V2_Processors C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 !�n�^��
͝��C�� 1 J.3�� f � WDMClassesOfDriver SystemConfig_Virtualization C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 "�n�^��
͝��C� ' J.3�� \ � WDMClassesOfDriver SystemConfig_Boot C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 #�n�^��
͝��C�v J.3�� S � WDMClassesOfDriver Debugger C:\Windows\system32\kernelbase.dll[MofResourceName] .dll[MofResourceName] � ier MappingStrings / 5 True Win32Registry|System\CurrentControlSet\Control\Session Manager\Environment � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING k + � MSFT_CliQualifier Override % Name � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING g ' � MSFT_CliQualifier read ! True � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING h ( � MSFT_CliQualifier write " True d 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier * ! / X � MSFT_CliProperty VariableValue The VariableValue property contains the placeholder variable of a Win32 environment variable. Information like the file system directory can change from machine to machine. The operating system substitutes placeholders for these./nExample: %SystemRoot%. VariableValue C _ % > � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING j , � MSFT_CliQualifier CIMTYPE $ string � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING # � � MSFT_CliQualifier MappingStrings / 7 string Win32Registry|System\CurrentControlSet\Control\Session Manager\Environment � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING g ' � MSFT_CliQualifier read ! True � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING h ( � MSFT_CliQualifier write " True Environment Select * from Win32_Environment H��` y �>*� E �#� \ �+��z g
�-s~� S Q L T r a c e E v e n t 1 2 8 P��7 �A { SQLTraceEvent128 6 � �� % L W f i z 0 < � � m y * 6 � � ( 7 � � c m � � � � O Z � � � � G S
�
�
; F � � ~ � � � h
q
�
�
� � ' UUUUUU���������������������������������������������������������������������������������������������������������������������� � SQLTraceEvent128_TYPE0 Description Audit Database Management Event Type0 EventType EventTypeName 0 ApplicationName P
� � � � � ' � �� string WmiDataId Description ApplicationName format w StringTermination Counted DatabaseID 6
� � � � � � �� sint32 WmiDataId Description DatabaseID DatabaseName H P
� + 8 F N Q d � �� string WmiDataId Description DatabaseName format w StringTermination Counted DBUserName P P
� � � � � ! � �� string WmiDataId Description DBUserName format w StringTermination Counted EventClass 8 6
� z �
� � � �� sint32 WmiDataId Description EventClass EventSequence d 6
� � � �� sint64 WmiDataId Description EventSequence EventSubClass
0 6
� { � � � � �� sint32 WmiDataId Description EventSubClass HostName P
� % 2 < D G Z � �� string WmiDataId Description HostName format w StringTermination Counted IsSystem l 6
� � � � � � �� sint32 WmiDataId Description IsSystem LoginName P
� D L W d o w z � � �� string WmiDataId Description LoginName format w StringTermination Counted LoginSid T P
� � ( 0 3 F � �� string WmiDataId Description LoginSid format c StringTermination Counted NestLevel @ 6
� � � � � � �� sint32 WmiDataId Description NestLevel NTDomainName P
� 5 = H U c k n � � �� string WmiDataId Description NTDomainName format w StringTermination Counted NTUserName P
� � � ( + > � �� string WmiDataId Description NTUserName format w StringTermination Counted ObjectName D P
� � � � � � � � � � �� string WmiDataId Description ObjectName format w StringTermination Counted ObjectType
< 6
� T
\
g
t
� �� sint32 WmiDataId Description ObjectType OwnerName L P
� �
�
�
2 � �� string WmiDataId Description OwnerName format w StringTermination Counted RequestID X 6
� � � � � � �� sint32 WmiDataId Description RequestID SessionLoginName p P
� % - 8 E W _ b u � �� string WmiDataId Description SessionLoginName format w StringTermination Counted SPID $ 6
� � � � � � �� sint32 WmiDataId Description SPID StartTime ( 6
� =
E
P
]
� �� uint64 WmiDataId Description StartTime Success 4 6
� �
�
�
�
� �� sint32 WmiDataId Description Success TextData P
� F N Y f p x { � � �� string WmiDataId Description TextData format w StringTermination Counted TransactionID 6
� � � �
� �� sint64 WmiDataId Description TransactionID XactSequence \ 6
� k s ~ � � �� sint64 WmiDataId Description XactSequence � M S S Q L S E R V E R T r a c e P��7 �
MSSQLSERVERTrace 6 � �� G M s � � � SQLTraceEvent129 Description Audit Database Object Management Event Guid 84e993e6-0081-4d70-97ef-3824ed2c4e93 DisplayName Audit Database Object Management Event ip � X e S q l P k g 0Q��7 �4 XeSqlPkg
C � ��* 7 W ] � � � � c����� � XeSqlPkg_app_domain_ring_buffer_recorded Description AppDomain ring buffer recorded Guid {F498523F-4677-4C4F-8608-133DAD124CA8} locale MS\0x409 DisplayName app_domain_ring_buffer_recorded �( X e S q l P k g _ a p p _ d o m a i n _ r i n g _ b u f f e r _ r e c o r d e d 1Q��7 �� U 2 XeSqlPkg_app_domain_ring_buffer_recorded * ) � ��! , : B � � � � � � � � � � � Z ^ � � � R c � � \ c � a m � � O ` WUUU��������������������������������������������������������������������������������� � app_domain_ring_buffer_recorded EventType EventVersion action < C
� � � � ��� � � � string WmiDataId StringTermination NullTerminated Format w ActivityId
N
� < I T a m �� � ��y � object:guid WmiDataId Description ActivityId ActivityID Extension Guid app_domain_address
4
� � � � ��� �� object WmiDataId Pointer call_stack
L C
� Y a � ��l w � � object WmiDataId Extension Variant XEVLD callstack database_id $ )
� � � � �� uint32 WmiDataId doom_reason H C
� G O � ��Z m } � string WmiDataId StringTermination NullTerminated Format w FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId generation
, )
� G O
� �� sint32 WmiDataId id )
� � � � �� uint32 WmiDataId owner_id ( )
� � � � �� uint32 WmiDataId references 0 )
� ? G � �� uint32 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� , 4 ? L � �� uint32 WmiDataId Description SequenceNumber state D C
� � � � ��� � � � string WmiDataId StringTermination NullTerminated Format w task_address
8 4
� E M
� ��X �� object WmiDataId Pointer timestamp0 )
� � � � �� uint64 WmiDataId type @ C
� � ��! 4 D L string WmiDataId StringTermination NullTerminated Format w weak_references 4 )
� � � � �� uint32 WmiDataId �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 &�n�^��
͝��C�{ # J.3�� X � WDMClassesOfDriver PoolAllocFree C:\Windows\system32\kernelbase.dll[MofResourceName] ResourceName] ] me] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �.h�b �
͝��C�~ & )ߝ�t � [ � WDMClassesOfDriver FileIo_ReadWrite C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �.h�b �
͝��C�z " )ߝ�t � W � WDMClassesOfDriver FileIo_OpEnd C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �.h�b �
͝��C�� * )ߝ�t � _ � WDMClassesOfDriver FileIo_PathOperation C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �.h�b �
͝��C�� ) )ߝ�t � ^ � WDMClassesOfDriver TcpIp_V1_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] esourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �.h�b �
͝��C�� ) )ߝ�t � ^ � WDMClassesOfDriver TcpIp_V1_TypeGroup1 C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �.h�b �
͝��C�s )ߝ�t � P � WDMClassesOfDriver TcpIp C:\Windows\system32\kernelbase.dll[MofResourceName] ase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �.h�b �
͝��C�s )ߝ�t � P � WDMClassesOfDriver TcpIp C:\Windows\system32\kernelbase.dll[MofResourceName] base.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �.h�b �
͝��C�s )ߝ�t � P � WDMClassesOfDriver TcpIp C:\Windows\system32\kernelbase.dll[MofResourceName] l[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �.h�b �
͝��C�s )ߝ�t � P � WDMClassesOfDriver TcpIp C:\Windows\system32\kernelbase.dll[MofResourceName] elbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �.h�b �
͝��C�s )ߝ�t � P � WDMClassesOfDriver TcpIp C:\Windows\system32\kernelbase.dll[MofResourceName] MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �.h�b �
͝��C�s )ߝ�t � P � WDMClassesOfDriver TcpIp C:\Windows\system32\kernelbase.dll[MofResourceName] base.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �.h�b �
͝��C�s )ߝ�t � P � WDMClassesOfDriver TcpIp C:\Windows\system32\kernelbase.dll[MofResourceName] rnelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �.h�b �
͝��C�s )ߝ�t � P � WDMClassesOfDriver TcpIp C:\Windows\system32\kernelbase.dll[MofResourceName] rnelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �.h�b �
͝��C�s )ߝ�t � P � WDMClassesOfDriver TcpIp C:\Windows\system32\kernelbase.dll[MofResourceName] base.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �.h�b �
͝��C�s )ߝ�t � P � WDMClassesOfDriver TcpIp C:\Windows\system32\kernelbase.dll[MofResourceName] e.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �.h�b �
͝��C�s )ߝ�t � P � WDMClassesOfDriver TcpIp C:\Windows\system32\kernelbase.dll[MofResourceName] .dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �.h�b �
͝��C�s )ߝ�t � P � WDMClassesOfDriver TcpIp C:\Windows\system32\kernelbase.dll[MofResourceName] .dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �.h�b �
͝��C�s )ߝ�t � P � WDMClassesOfDriver TcpIp C:\Windows\system32\kernelbase.dll[MofResourceName] se.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �.h�b �
͝��C�s )ߝ�t � P � WDMClassesOfDriver TcpIp C:\Windows\system32\kernelbase.dll[MofResourceName] elbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �.h�b �
͝��C�s )ߝ�t � P � WDMClassesOfDriver TcpIp C:\Windows\system32\kernelbase.dll[MofResourceName] rnelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �.h�b �
͝��C�s )ߝ�t � P � WDMClassesOfDriver TcpIp C:\Windows\system32\kernelbase.dll[MofResourceName] ase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �.h�b �
͝��C�s )ߝ�t � P � WDMClassesOfDriver TcpIp C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �.h�b �
͝��C�| $ )ߝ�t � Y � WDMClassesOfDriver TcpIp_SendIPV4 C:\Windows\system32\kernelbase.dll[MofResourceName] urceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �.h�b �
͝��C�| $ )ߝ�t � Y � WDMClassesOfDriver TcpIp_SendIPV4 C:\Windows\system32\kernelbase.dll[MofResourceName] ourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �.h�b �
͝��C�| $ )ߝ�t � Y � WDMClassesOfDriver TcpIp_SendIPV4 C:\Windows\system32\kernelbase.dll[MofResourceName] dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �.h�b �
͝��C�| $ )ߝ�t � Y � WDMClassesOfDriver TcpIp_SendIPV4 C:\Windows\system32\kernelbase.dll[MofResourceName] fResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �.h�b �
͝��C�| $ )ߝ�t � Y � WDMClassesOfDriver TcpIp_SendIPV4 C:\Windows\system32\kernelbase.dll[MofResourceName] fResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �.h�b �
͝��C�| $ )ߝ�t � Y � WDMClassesOfDriver TcpIp_SendIPV4 C:\Windows\system32\kernelbase.dll[MofResourceName] 574.3882809400.289 I_D929809A496C845E10911E67228C10A2B19480AAFE64197093268F31A9CBE7CA.1567.2626696120.261 B8A137D5AFDEB625F91 C_4BEC7645E2863E66AB342FBA6288E3E94B92567D31F8ED34E1C8D99E55FFB8F4 n XactSequence �e] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �.h�b �
͝��C�x )ߝ�t � U � WDMClassesOfDriver TcpIp_Fail C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �.h�b �
͝��C�v )ߝ�t � S � WDMClassesOfDriver UdpIp_V1 C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �.h�b �
͝��C�v )ߝ�t � S � WDMClassesOfDriver Image_V0 C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �.h�b �
͝��C�{ # )ߝ�t � X � WDMClassesOfDriver Image_V0_Load C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 /h�b �
͝��C�~ & )ߝ�t � [ � WDMClassesOfDriver LoaderCodedEvent C:\Windows\system32\kernelbase.dll[MofResourceName] ceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 /h�b �
͝��C�~ & )ߝ�t � [ � WDMClassesOfDriver LoaderCodedEvent C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 /h�b �
͝��C�x )ߝ�t � U � WDMClassesOfDriver Image_Load C:\Windows\system32\kernelbase.dll[MofResourceName] dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 /h�b �
͝��C�x )ߝ�t � U � WDMClassesOfDriver Image_Load C:\Windows\system32\kernelbase.dll[MofResourceName] ResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 /h�b �
͝��C�x )ߝ�t � U � WDMClassesOfDriver Image_Load C:\Windows\system32\kernelbase.dll[MofResourceName] .dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 /h�b �
͝��C�x )ߝ�t � U � WDMClassesOfDriver Image_Load C:\Windows\system32\kernelbase.dll[MofResourceName] .dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 /h�b �
͝��C�x )ߝ�t � U � WDMClassesOfDriver Image_Load C:\Windows\system32\kernelbase.dll[MofResourceName] ResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 /h�b �
͝��C�x )ߝ�t � U � WDMClassesOfDriver Image_Load C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 /h�b �
͝��C�� , )ߝ�t � a � WDMClassesOfDriver LoaderCodedEventStatus C:\Windows\system32\kernelbase.dll[MofResourceName] eName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 /h�b �
͝��C�� , )ߝ�t � a � WDMClassesOfDriver LoaderCodedEventStatus C:\Windows\system32\kernelbase.dll[MofResourceName] eName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 /h�b �
͝��C�� , )ߝ�t � a � WDMClassesOfDriver LoaderCodedEventStatus C:\Windows\system32\kernelbase.dll[MofResourceName] esourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 /h�b �
͝��C�� , )ߝ�t � a � WDMClassesOfDriver LoaderCodedEventStatus C:\Windows\system32\kernelbase.dll[MofResourceName] me] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 /h�b �
͝��C�� , )ߝ�t � a � WDMClassesOfDriver LoaderCodedEventStatus C:\Windows\system32\kernelbase.dll[MofResourceName] eName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 /h�b �
͝��C�� , )ߝ�t � a � WDMClassesOfDriver LoaderCodedEventStatus C:\Windows\system32\kernelbase.dll[MofResourceName] esourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 /h�b �
͝��C�� , )ߝ�t � a � WDMClassesOfDriver LoaderCodedEventStatus C:\Windows\system32\kernelbase.dll[MofResourceName] 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 /h�b �
͝��C�� , )ߝ�t � a � WDMClassesOfDriver LoaderCodedEventStatus C:\Windows\system32\kernelbase.dll[MofResourceName] urceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 /h�b �
͝��C�� , )ߝ�t � a � WDMClassesOfDriver LoaderCodedEventStatus C:\Windows\system32\kernelbase.dll[MofResourceName] 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 /h�b �
͝��C�� , )ߝ�t � a � WDMClassesOfDriver LoaderCodedEventStatus C:\Windows\system32\kernelbase.dll[MofResourceName] ceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 /h�b �
͝��C�� , )ߝ�t � a � WDMClassesOfDriver LoaderCodedEventStatus C:\Windows\system32\kernelbase.dll[MofResourceName] urceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 /h�b �
͝��C�� , )ߝ�t � a � WDMClassesOfDriver LoaderCodedEventStatus C:\Windows\system32\kernelbase.dll[MofResourceName] rceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 /h�b �
͝��C�� , )ߝ�t � a � WDMClassesOfDriver LoaderCodedEventStatus C:\Windows\system32\kernelbase.dll[MofResourceName] urceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 /h�b �
͝��C�� , )ߝ�t � a � WDMClassesOfDriver LoaderCodedEventStatus C:\Windows\system32\kernelbase.dll[MofResourceName] urceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 /h�b �
͝��C�� , )ߝ�t � a � WDMClassesOfDriver LoaderCodedEventStatus C:\Windows\system32\kernelbase.dll[MofResourceName] urceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 /h�b �
͝��C�� , )ߝ�t � a � WDMClassesOfDriver LoaderCodedEventStatus C:\Windows\system32\kernelbase.dll[MofResourceName] � � � string Description Source File Name Text
� 5 = J string Description Text � � �n ID � X�[p - �;鞝 9 �mP�� _ �D{ 5 I ���~ W ���N� S Q L T r a c e E v e n t 1 3 9 4P��7 �� � SQLTraceEvent139 6 � �� % J U d g x . ; � � 2 > � � k w � � i s " ( � � i r � � ] g " � � � � Q
[
�
�
� � E O �
�
�
7 B � � ' 8 � � � � UUUUUU����������������������������������������������������������������������������������������������������������������������������5 � SQLTraceEvent139_TYPE0 Description Broker:Forwarded Message Sent Type0 EventType EventTypeName 0 ApplicationName P
� � � � � % � �� string WmiDataId Description ApplicationName format w StringTermination Counted BigintData1 l 6
� � � � � �� sint64 WmiDataId Description BigintData1 ClientProcessID 6
� ! � �� sint32 WmiDataId Description ClientProcessID DatabaseID 6
� � � � � � �� sint32 WmiDataId Description DatabaseID DBUserName P P
� + 8 D L O b � �� string WmiDataId Description DBUserName format w StringTermination Counted EventClass
< 6
� � � � � � �� sint32 WmiDataId Description EventClass EventSequence d 6
� : B M Z � �� sint64 WmiDataId Description EventSequence FileName @ P
� � � � � � � �� string WmiDataId Description FileName format w StringTermination Counted GUID
t C
� y � � � � � � �� object WmiDataId Description GUID extension Guid HostName P
� + 8 B J M ` � �� string WmiDataId Description HostName format w StringTermination Counted IndexID 4 6
� � � � � � �� sint32 WmiDataId Description IndexID IntegerData 8 6
� 0 8
C P � �� sint32 WmiDataId Description IntegerData LoginSid T P
� � � � � � � �
� �� string WmiDataId Description LoginSid format c StringTermination Counted MethodName ` P
� � � � � � � � � � �� string WmiDataId Description MethodName format w StringTermination Counted NTDomainName P
� ? G R _ m u x � � �� string WmiDataId Description NTDomainName format w StringTermination Counted NTUserName P
� �
*
2
5
H
� �� string WmiDataId Description NTUserName format w StringTermination Counted ObjectID , 6
� �
�
�
�
� �� sint32 WmiDataId Description ObjectID OwnerName D P
� 2 : E R ] e h { � �� string WmiDataId Description OwnerName format w StringTermination Counted ProviderName \ P
� � � & ) < � �� string WmiDataId Description ProviderName format w StringTermination Counted RoleName H P
� � � � � � � � � � �� string WmiDataId Description RoleName format w StringTermination Counted SessionLoginName x P
� n
v
�
�
�
�
�
�
� �� string WmiDataId Description SessionLoginName format w StringTermination Counted SPID 6
� $ 1 � �� sint32 WmiDataId Description SPID StartTime $ 6
� � � � � � �� uint64 WmiDataId Description StartTime Success
0 6
� � � �� sint32 WmiDataId Description Success TargetLoginName X P
� � � � � � � � � � �� string WmiDataId Description TargetLoginName format w StringTermination Counted TargetUserName L P
� \ d o | � � � � � �� string WmiDataId Description TargetUserName format w StringTermination Counted TransactionID 6
� & � �� sint64 WmiDataId Description TransactionID � M S S Q L S E R V E R T r a c e 5P��7 � MSSQLSERVERTrace 6 � �� A G m z � � SQLTraceEvent140 Description Broker:Forwarded Message Dropped Guid 84e993e6-008c-4d70-97ef-3824ed2c4e93 DisplayName Broker:Forwarded Message Dropped D � X e S q l P k g _ r e s o u r c e n a m e _ w r i t t e n AQ��7 �
' XeSqlPkg_resourcename_written ) � �� ! / ; � � 9 E � � P a � � W����������������������������Z � resourcename_written EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid error_id )
� & . � �� sint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId message C
� � ��" 5 E M string WmiDataId StringTermination NullTerminated Format w RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� * 2 = J � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g BQ��7 �! XeSqlPkg
C � �� * Q W � � � c����� � XeSqlPkg_objectname_written Description ObjectName qualified errorlog written Guid {674ffc97-5e52-4e6c-a65b-9c7890669439} locale MS\0x409 DisplayName objectname_written � X e S q l P k g _ o b j e c t n a m e _ w r i t t e n CQ��7 � % XeSqlPkg_objectname_written ) � �� - 9 � � 7 C � � N _ � � W����������������������������X � objectname_written EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid error_id )
� $ , � �� sint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId message C
�
� �� 3 C K string WmiDataId StringTermination NullTerminated Format w RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� ( 0 ; H � �� uint32 WmiDataId Description SequenceNumber �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 '�n�^��
͝��C�� * J.3�� _ � WDMClassesOfDriver SessionPoolAllocFree C:\Windows\system32\kernelbase.dll[MofResourceName] eName] esourceName] ame] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� ) )ߝ�t � ^ � WDMClassesOfDriver SystemConfig_V4_PnP C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� ) )ߝ�t � ^ � WDMClassesOfDriver SystemConfig_V4_PnP C:\Windows\system32\kernelbase.dll[MofResourceName] .dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� ) )ߝ�t � ^ � WDMClassesOfDriver SystemConfig_V4_PnP C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� 3 )ߝ�t � h � WDMClassesOfDriver SystemConfig_V2_TelemetryInfo C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� / )ߝ�t � d � WDMClassesOfDriver SystemConfig_V2_FlightIds C:\Windows\system32\kernelbase.dll[MofResourceName] esourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� / )ߝ�t � d � WDMClassesOfDriver SystemConfig_V2_FlightIds C:\Windows\system32\kernelbase.dll[MofResourceName] dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� / )ߝ�t � d � WDMClassesOfDriver SystemConfig_V2_FlightIds C:\Windows\system32\kernelbase.dll[MofResourceName] ll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� / )ߝ�t � d � WDMClassesOfDriver SystemConfig_V2_FlightIds C:\Windows\system32\kernelbase.dll[MofResourceName] urceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� / )ߝ�t � d � WDMClassesOfDriver SystemConfig_V2_FlightIds C:\Windows\system32\kernelbase.dll[MofResourceName] fResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� / )ߝ�t � d � WDMClassesOfDriver SystemConfig_V2_FlightIds C:\Windows\system32\kernelbase.dll[MofResourceName] eName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� / )ߝ�t � d � WDMClassesOfDriver SystemConfig_V2_FlightIds C:\Windows\system32\kernelbase.dll[MofResourceName] Name] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� / )ߝ�t � d � WDMClassesOfDriver SystemConfig_V2_FlightIds C:\Windows\system32\kernelbase.dll[MofResourceName] Name] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� / )ߝ�t � d � WDMClassesOfDriver SystemConfig_V2_FlightIds C:\Windows\system32\kernelbase.dll[MofResourceName] urceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� / )ߝ�t � d � WDMClassesOfDriver SystemConfig_V2_FlightIds C:\Windows\system32\kernelbase.dll[MofResourceName] fResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� / )ߝ�t � d � WDMClassesOfDriver SystemConfig_V2_FlightIds C:\Windows\system32\kernelbase.dll[MofResourceName] urceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� / )ߝ�t � d � WDMClassesOfDriver SystemConfig_V2_FlightIds C:\Windows\system32\kernelbase.dll[MofResourceName] fResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� / )ߝ�t � d � WDMClassesOfDriver SystemConfig_V2_FlightIds C:\Windows\system32\kernelbase.dll[MofResourceName] MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� / )ߝ�t � d � WDMClassesOfDriver SystemConfig_V2_FlightIds C:\Windows\system32\kernelbase.dll[MofResourceName] dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� / )ߝ�t � d � WDMClassesOfDriver SystemConfig_V2_FlightIds C:\Windows\system32\kernelbase.dll[MofResourceName] e] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� / )ߝ�t � d � WDMClassesOfDriver SystemConfig_V2_FlightIds C:\Windows\system32\kernelbase.dll[MofResourceName] MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� / )ߝ�t � d � WDMClassesOfDriver SystemConfig_V2_FlightIds C:\Windows\system32\kernelbase.dll[MofResourceName] l[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� / )ߝ�t � d � WDMClassesOfDriver SystemConfig_V2_FlightIds C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� 0 )ߝ�t � e � WDMClassesOfDriver SystemConfig_V2_Processors C:\Windows\system32\kernelbase.dll[MofResourceName] rceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� 0 )ߝ�t � e � WDMClassesOfDriver SystemConfig_V2_Processors C:\Windows\system32\kernelbase.dll[MofResourceName] [MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� 0 )ߝ�t � e � WDMClassesOfDriver SystemConfig_V2_Processors C:\Windows\system32\kernelbase.dll[MofResourceName] rceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� 0 )ߝ�t � e � WDMClassesOfDriver SystemConfig_V2_Processors C:\Windows\system32\kernelbase.dll[MofResourceName] ll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �/h�b �
͝��C�� 0 )ߝ�t � e � WDMClassesOfDriver SystemConfig_V2_Processors C:\Windows\system32\kernelbase.dll[MofResourceName]
� � � � string Description Source File Name Text
� 5 = J string Description Text � � �n ID � �(�Ip K �V0λ 5 "��� � �3��| � '��� � �|��
S Q L T r a c e E v e n t 1 6 8 jP��7 � � SQLTraceEvent168 6 � �� % K V e h y / ; � � r ~ � � � � + : � � # - � � Z d � � N Y � � < J �
�
�
2 > � � k v � � �
�
) � � Q ` � � UUUUUU����������������������������������������������������������������������������������������������������������������������������S � SQLTraceEvent168_TYPE0 Description Showplan XML For Query Compile Type0 EventType EventTypeName 0 ApplicationName ( P
� � �
� � & � �� string WmiDataId Description ApplicationName format w StringTermination Counted BinaryData P
� � � � � � � � � � �� string WmiDataId Description BinaryData format c StringTermination Counted ClientProcessID $ 6
� A I T a � �� sint32 WmiDataId Description ClientProcessID DatabaseID 6
� � � � � � �� sint32 WmiDataId Description DatabaseID DatabaseName T P
� Z b m z � � � � � �� string WmiDataId Description DatabaseName format w StringTermination Counted EventClass D 6
� � � �� sint32 WmiDataId Description EventClass EventSequence h 6
� ~ � � � � �� sint64 WmiDataId Description EventSequence GroupID x 6
� �
� �� sint32 WmiDataId Description GroupID HostName P
� � � � � � � � � � �� string WmiDataId Description HostName format w StringTermination Counted IntegerData @ 6
� - 5 @ M � �� sint32 WmiDataId Description IntegerData IsSystem p 6
� � � � � � �� sint32 WmiDataId Description IsSystem LineNumber 6
� " * 5 B � �� sint32 WmiDataId Description LineNumber LoginName
, P
� � � � � � � � � �� string WmiDataId Description LoginName format w StringTermination Counted LoginSid X P
� q y � � � � � � � �� string WmiDataId Description LoginSid format c StringTermination Counted NestLevel L 6
� $ 1 � �� sint32 WmiDataId Description NestLevel NTDomainName P
� � � � � � � � � � �� string WmiDataId Description NTDomainName format w StringTermination Counted NTUserName P
� g
o
z
�
�
�
�
�
� �� string WmiDataId Description NTUserName format w StringTermination Counted ObjectID
< 6
� ( � �� sint32 WmiDataId Description ObjectID ObjectName P P
� � � � � � � � � � �� string WmiDataId Description ObjectName format w StringTermination Counted ObjectType H 6
� ? G R _ � �� sint32 WmiDataId Description ObjectType RequestID \ 6
� � � � � � �� sint32 WmiDataId Description RequestID SessionLoginName t P
� U
]
h
u
�
�
�
�
� �� string WmiDataId Description SessionLoginName format w StringTermination Counted SPID 0 6
� �
� �� sint32 WmiDataId Description SPID StartTime 4 6
� m u
� � � �� uint64 WmiDataId Description StartTime TextData P
� * 2 5 H � �� string WmiDataId Description TextData format w StringTermination Counted TransactionID 6
� � � � � � �� sint64 WmiDataId Description TransactionID XactSequence ` 6
� % - 8 E � �� sint64 WmiDataId Description XactSequence � M S S Q L S E R V E R T r a c e kP��7 �� MSSQLSERVERTrace 6 � �� ? E k x � � SQLTraceEvent169 Description Showplan All For Query Compile Guid 84e993e6-00a9-4d70-97ef-3824ed2c4e93 DisplayName Showplan All For Query Compile 9 � X e S q l P k g _ f i l e s t r e a m _ f i l e _ i o _ d u m p UQ��7 �4 * XeSqlPkg_filestream_file_io_dump " ) � �� $ 2 > � � Y f � t � �
W����������������������������~ � filestream_file_io_dump EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid data
6
� 2 : � ��E P object WmiDataId Extension Variant description C
� � � � ��� � � � string WmiDataId StringTermination NullTerminated Format w FragmentId 6
� H P [ h � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� N V a n � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g VQ��7 �Y XeSqlPkg
C � ��+ 8 { � � � � � c����� � XeSqlPkg_filestream_file_write_completion Description Occurs when a write completion for a FILESTREAM file is received. Guid {C7512043-EDDB-4a06-B72D-2D4337D0325A} locale MS\0x409 DisplayName filestream_file_write_completion �) X e S q l P k g _ f i l e s t r e a m _ f i l e _ w r i t e _ c o m p l e t i o n WQ��7 �� 3 XeSqlPkg_filestream_file_write_completion + ) � ��" - ; G � M Y � � = N � � G N WU������������������������������� � filestream_file_write_completion EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid completion_count )
� : B � �� uint16 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId offsets
6
� � ��) 4 object WmiDataId Extension Variant RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� * 7 � �� uint32 WmiDataId Description SequenceNumber sizes
6
� � � � ��� � object WmiDataId Extension Variant �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 (�n�^��
͝��C�z " J.3�� W � WDMClassesOfDriver PoolSnapshot C:\Windows\system32\kernelbase.dll[MofResourceName] ame] ame] � F D 3 B B D 4 C 4 2 A C 2 F 7 F E F 2 6 4 3 4 0 A 9 E B 7 8 A 5 8 1 F E 5 C 2 8 5 6 1 C B 6 3 E D F 7 8 0 B 3 2 9 E A C 2 E E 4 �b��5��͝��C�Q� + T � �� �� �� �� MSFT_CliAlias � F N u � � � � �
U�������������������������4 � MSFT_CliConnection Authority
� > STRING Locale
� m STRING NameSpace
� � STRING Password
� � STRING Server
� � STRING User
� , STRING | � ( + � MSFT_CliConnection ms_409 ROOT\CIMV2 . Filesystem directory entry management. l 6& �A �D %� �# �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty �" � � MSFT_CliFormat table STATUS ; � > } * c � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � * � MSFT_CliProperty Status The Status property is a string indicating the current status of the object. Various operational and non-operational statuses can be defined. Operational statuses are "OK", "Degraded" and "Pred Fail". "Pred Fail" indicates that an element may be functioning properly but predicting a failure in the near future. An example is a SMART-enabled hard drive. Non-operational statuses can also be specified. These are "Error", "Starting", "Stopping" and "Service". The latter, "Service", could apply during mirror-resilvering of a disk, reload of a user permissions list, or other administrative work. Not all such work is on-line, yet the managed element is neither "OK" nor in one of the other states. Status � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 10 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap A E L V _ j t ~ OK Error Degraded Unknown Pred Fail Starting Stopping Service � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values ? C J T ] h r | OK Error Degraded Unknown Pred Fail Starting Stopping Service ? 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � r ~ � MSFT_CliProperty Compressed The Compressed property is a boolean value indicating that the file is compressed. Compressed ; 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � o z � MSFT_CliProperty Encrypted The Encrypted property is a boolean value indicating that the file is encrypted. Encrypted � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o � � � � MSFT_CliProperty Name The Name property is a string representing the inherited name that serves as a key of a logical file instance within a file system. Full path names should be provided. Example: c:\winnt\system\win.ini Name 5 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � j t � MSFT_CliProperty Readable The Readable property is a boolean value indicating if the file can be read. Readable ; 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � o z � MSFT_CliProperty Writeable The Writeable property is a boolean value indicating if the file can be written. Writeable �,` W��d 3 �Næ� � Ylg�� ] ~]�� S Q L T r a c e E v e n t 1 7 0 nP��7 �� � SQLTraceEvent170 6 � �� % I T c f w - 9 � � p | � � � � j v � � h w � � � � & � � � � � � �
�
D P � � { � �
s
�
< B � � & / � � c s ( 2 � � c q UUUUUUU���������������������������������������������������������������������������������������������������������������������������������������������� � SQLTraceEvent170_TYPE0 Description Audit Server Scope GDR Event Type0 EventType EventTypeName 0 ApplicationName $ P
� � � � � $ � �� string WmiDataId Description ApplicationName format w StringTermination Counted BinaryData P
� � � � � � � � � � �� string WmiDataId Description BinaryData format c StringTermination Counted ClientProcessID 6
� ? G R _ � �� sint32 WmiDataId Description ClientProcessID DatabaseID 6
� � � � � � �� sint32 WmiDataId Description DatabaseID DatabaseName X P
� X ` k x � � � � � �� string WmiDataId Description DatabaseName format w StringTermination Counted DBUserName ` P
� * 7 C K N a � �� string WmiDataId Description DBUserName format w StringTermination Counted EventClass H 6
� � � � � � �� sint32 WmiDataId Description EventClass EventSequence | 6
� 9 A L Y � �� sint64 WmiDataId Description EventSequence EventSubClass
@ 6
� � � � � � �� sint32 WmiDataId Description EventSubClass HostName P
� R Z e r | � � � � �� string WmiDataId Description HostName format w StringTermination Counted IsSystem � 6
� � � � �� sint32 WmiDataId Description IsSystem LoginName ( P
� � �
� � � � � � � �� string WmiDataId Description LoginName format w StringTermination Counted LoginSid d P
� > F Q ^ h p s � � �� string WmiDataId Description LoginSid format c StringTermination Counted NestLevel P 6
� � � � � � �� sint32 WmiDataId Description NestLevel NTDomainName P
� u } � � � � � � � �� string WmiDataId Description NTDomainName format w StringTermination Counted NTUserName P
� 4
<
G
T
`
h
k
~
� �� string WmiDataId Description NTUserName format w StringTermination Counted ObjectName T P
� �
�
% ( ; � �� string WmiDataId Description ObjectName format w StringTermination Counted ObjectType L 6
� � � � � � �� sint32 WmiDataId Description ObjectType OwnerName \ P
� ) 1 < I T \ _ r � �� string WmiDataId Description OwnerName format w StringTermination Counted Permissions 8 6
� � �
� � � �� sint64 WmiDataId Description Permissions RequestID p 6
� H
P
[
h
� �� sint32 WmiDataId Description RequestID SessionLoginName � P
� �
�
�
3 � �� string WmiDataId Description SessionLoginName format w StringTermination Counted SPID
, 6
� � � � � � �� sint32 WmiDataId Description SPID StartTime 0 6
� � � �� uint64 WmiDataId Description StartTime Success D 6
� s { � � � �� sint32 WmiDataId Description Success TargetLoginName h P
� + < D G Z � �� string WmiDataId Description TargetLoginName format w StringTermination Counted TargetLoginSid l P
� � � � � � �� string WmiDataId Description TargetLoginSid format c StringTermination Counted TextData P
� � � � � � � � � � �� string WmiDataId Description TextData format w StringTermination Counted TransactionID 6
� 4 < G T � �� sint64 WmiDataId Description TransactionID XactSequence t 6
� � � � � � �� sint64 WmiDataId Description XactSequence � M S S Q L S E R V E R T r a c e oP��7 �� MSSQLSERVERTrace 6 � �� > D j w � � SQLTraceEvent171 Description Audit Server Object GDR Event Guid 84e993e6-00ab-4d70-97ef-3824ed2c4e93 DisplayName Audit Server Object GDR Event 71 �& X e S q l P k g _ b r o k e r _ t r a n s m i s s i o n _ t i m e r _ s e t [Q��7 �� 8 0 XeSqlPkg_broker_transmission_timer_set ( ) � �� * 8 D � � @ M � � b n � � 7 H � � A H H S WUU������������������������������������������������������ � broker_transmission_timer_set EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid asb_id )
� - 5 � �� uint64 WmiDataId database_id )
� � � � �� uint32 WmiDataId dialog_id
1 6
� � � � ��� object:guid WmiDataId Extension Guid expires
- )
� O W
� �� uint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId initiator_flag )
� % , � �� sint8 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� $ 1 � �� uint32 WmiDataId Description SequenceNumber timer ) P
� � � � ��� : � � � � sint32 WmiDataId XEMapId ValueMap � � � � 2 1 0 3 Values 0 Delivery OutgoingAck OutOfOrderWatch x_NumTransmissionTimer unique_id ! )
� � � � �� uint64 WmiDataId � X e S q l P k g \Q��7 �5 XeSqlPkg
C � ��* 7 X ^ � � � � c����� � XeSqlPkg_broker_transmission_timer_reset Description Broker transmission timer reset Guid {723A69C4-BA2A-4d3a-918B-C197FE8CCF8D} locale MS\0x409 DisplayName broker_transmission_timer_reset �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 )�n�^��
͝��C�u J.3�� R � WDMClassesOfDriver ObTrace C:\Windows\system32\kernelbase.dll[MofResourceName] Name] ��� ` " ��H��
�
�� .
a�YV� �S�� S Q L T r a c e E v e n t 1 9 4 �P��7 �� f SQLTraceEvent194 6 � �� % G R a d u + < � � - ; � � j y � � b l % � � \ g ! � � � � N \
�
�
R X � � < F �
UUUUU�������������������������������������������������������������������������������������������������w
� SQLTraceEvent194_TYPE0 Description OLEDB Provider Information Type0 EventType EventTypeName 0 ApplicationName P
� � � � � " � �� string WmiDataId Description ApplicationName format w StringTermination Counted ClientProcessID 6
� � � � � � �� sint32 WmiDataId Description ClientProcessID DatabaseID 6
� ! � �� sint32 WmiDataId Description DatabaseID DatabaseName 8 P
� � �
� � � � � � � �� string WmiDataId Description DatabaseName format w StringTermination Counted EventClass 4 6
� > F Q ^ � �� sint32 WmiDataId Description EventClass EventSequence L 6
� � � � � � �� sint64 WmiDataId Description EventSequence GroupID \ 6
� 9 A L Y � �� sint32 WmiDataId Description GroupID HostName P
� � � � � � � � � �� string WmiDataId Description HostName format w StringTermination Counted IsSystem T 6
� i q | � � �� sint32 WmiDataId Description IsSystem LinkedServerName @ P
� # 5 = @ S � �� string WmiDataId Description LinkedServerName format w StringTermination Counted LoginName $ P
� � � � � � � � � �� string WmiDataId Description LoginName format w StringTermination Counted LoginSid
< P
� � � � � � � � � �� string WmiDataId Description LoginSid format c StringTermination Counted NTDomainName P
� < D O \ j r u � � �� string WmiDataId Description NTDomainName format w StringTermination Counted NTUserName P
� � ' / 2 E � �� string WmiDataId Description NTUserName format w StringTermination Counted ProviderName D P
� � � � � � � �
� �� string WmiDataId Description ProviderName format w StringTermination Counted RequestID H 6
� ^
f
q
~
� �� sint32 WmiDataId Description RequestID SessionLoginName X P
� �
+ 3 6 I � �� string WmiDataId Description SessionLoginName format w StringTermination Counted SPID ( 6
� � �
� � � �� sint32 WmiDataId Description SPID StartTime
, 6
� $ 1 � �� uint64 WmiDataId Description StartTime TextData P
� � � � � � � � � � �� string WmiDataId Description TextData format w StringTermination Counted TransactionID 6
� H
P
[
h
� �� sint64 WmiDataId Description TransactionID � M S S Q L S E R V E R T r a c e �P��7 �� MSSQLSERVERTrace 6 � �� + 1 W d p � SQLTraceEvent195 Description Mount Tape Guid 84e993e6-00c3-4d70-97ef-3824ed2c4e93 DisplayName Mount Tape p � S Q L T r a c e E v e n t 1 9 5 �P��7 �� a SQLTraceEvent195 6 � �� % 7 B Q T e , � � + � � V _ � � H W � � L U � � { � � � � � o { , > � � e
p
�
�
UUUU��������������������������������������������������������������������������������������������� � SQLTraceEvent195_TYPE0 Description Mount Tape Type0 EventType EventTypeName 0 ApplicationName P
� � � � � � � � � �� string WmiDataId Description ApplicationName format w StringTermination Counted ClientProcessID 6
� p x � � � �� sint32 WmiDataId Description ClientProcessID DatabaseID 6
� � � � �� sint32 WmiDataId Description DatabaseID DatabaseName D P
� � � � � � � � � � �� string WmiDataId Description DatabaseName format w StringTermination Counted Duration $ 6
� , 4
? L � �� sint64 WmiDataId Description Duration EndTime 4 6
� � � � � � �� uint64 WmiDataId Description EndTime EventClass
@ 6
� $ / < � �� sint32 WmiDataId Description EventClass EventSequence H 6
� � � � � � �� sint64 WmiDataId Description EventSequence EventSubClass < 6
� %
0 = � �� sint32 WmiDataId Description EventSubClass GroupID X 6
� � � � � � �� sint32 WmiDataId Description GroupID HostName P
� * 2 = J T \ _ r � �� string WmiDataId Description HostName format w StringTermination Counted IsSystem P 6
� � � � � � �� sint32 WmiDataId Description IsSystem LoginName P
� \ d o | � � � � � �� string WmiDataId Description LoginName format w StringTermination Counted NTDomainName P
� " - : H P S f � �� string WmiDataId Description NTDomainName format w StringTermination Counted NTUserName P
� � � � �
# � �� string WmiDataId Description NTUserName format w StringTermination Counted SessionLoginName T P
� � � � � � � � � � �� string WmiDataId Description SessionLoginName format w StringTermination Counted SPID 6
� ?
G
R
_
� �� sint32 WmiDataId Description SPID StartTime
, 6
� �
�
�
�
� �� uint64 WmiDataId Description StartTime TextData P
� G O Z g q y | � � �� string WmiDataId Description TextData format w StringTermination Counted � M S S Q L S E R V E R T r a c e �P��7 �� MSSQLSERVERTrace 6 � �� . 4 Z g v � SQLTraceEvent196 Description Assembly Load Guid 84e993e6-00c4-4d70-97ef-3824ed2c4e93 DisplayName Assembly Load � �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 *�n�^��
͝��C�{ # J.3�� X � WDMClassesOfDriver ObHandleEvent C:\Windows\system32\kernelbase.dll[MofResourceName] e] urceName] Name] Tqn ` ��Rwl ' WL� � �i;á ; � g�� S Q L T r a c e E v e n t 2 1 7 �P��7 ��
e SQLTraceEvent217 6 � �� % B M \ _ p & 7 � � ( 6 � � e t � � � � # � � � � M Y
� � � � � 5
@
�
�
h w � � UUUUU������������������������������������������������������������������������������������������������j � SQLTraceEvent217_TYPE0 Description Plan Guide Successful Type0 EventType EventTypeName 0 ApplicationName P
� � � � � �
� �� string WmiDataId Description ApplicationName format w StringTermination Counted ClientProcessID 6
� { � � � � �� sint32 WmiDataId Description ClientProcessID DatabaseID 6
� � � �� sint32 WmiDataId Description DatabaseID DatabaseName
< P
� � � � � � � � � � �� string WmiDataId Description DatabaseName format w StringTermination Counted EventClass 8 6
� 9 A
L Y � �� sint32 WmiDataId Description EventClass EventSequence P 6
� � � � � � �� sint64 WmiDataId Description EventSequence HostName P
� O W b o y � � � � �� string WmiDataId Description HostName format w StringTermination Counted IsSystem X 6
� � � � �� sint32 WmiDataId Description IsSystem LoginName $ P
� � � � � � � � � � �� string WmiDataId Description LoginName format w StringTermination Counted LoginSid @ P
� ; C N [ e m p � � �� string WmiDataId Description LoginSid format c StringTermination Counted NTDomainName P
� � & . 1 D � �� string WmiDataId Description NTDomainName format w StringTermination Counted NTUserName P
� � � � � � � � � �� string WmiDataId Description NTUserName format w StringTermination Counted ObjectID 4 6
� X ` k x � �� sint32 WmiDataId Description ObjectID RequestID D 6
� � � � � � �� sint32 WmiDataId Description RequestID SessionLoginName \ P
� l t � � � � � � �� string WmiDataId Description SessionLoginName format w StringTermination Counted SPID ( 6
�
"
/
� �� sint32 WmiDataId Description SPID StartTime
, 6
� �
�
�
�
� �� uint64 WmiDataId Description StartTime TextData P
� * 7 A I L _ � �� string WmiDataId Description TextData format w StringTermination Counted TransactionID 6
� � � � � � �� sint64 WmiDataId Description TransactionID XactSequence H 6
� < D O \ � �� sint64 WmiDataId Description XactSequence � M S S Q L S E R V E R T r a c e �P��7 �� MSSQLSERVERTrace 6 � �� 8 > d q � � SQLTraceEvent218 Description Plan Guide Unsuccessful Guid 84e993e6-00da-4d70-97ef-3824ed2c4e93 DisplayName Plan Guide Unsuccessful Ev � S Q L T r a c e E v e n t 2 1 8 �P��7 ��
e SQLTraceEvent218 6 � �� % D O ^ a r ( 9 � � * 8 � � g v � � � � % � � � � O [ � � � � � 7
B
�
�
j y � � UUUUU������������������������������������������������������������������������������������������������l � SQLTraceEvent218_TYPE0 Description Plan Guide Unsuccessful Type0 EventType EventTypeName 0 ApplicationName P
� � � � � � �� string WmiDataId Description ApplicationName format w StringTermination Counted ClientProcessID 6
� } � � � � �� sint32 WmiDataId Description ClientProcessID DatabaseID 6
� � � �� sint32 WmiDataId Description DatabaseID DatabaseName
< P
� � � � � � � � � � �� string WmiDataId Description DatabaseName format w StringTermination Counted EventClass 8 6
� ; C
N [ � �� sint32 WmiDataId Description EventClass EventSequence P 6
� � � � � � �� sint64 WmiDataId Description EventSequence HostName P
� Q Y d q { � � � � �� string WmiDataId Description HostName format w StringTermination Counted IsSystem X 6
� � � � �� sint32 WmiDataId Description IsSystem LoginName $ P
� � � � � � � � � � �� string WmiDataId Description LoginName format w StringTermination Counted LoginSid @ P
� = E P ] g o r � � �� string WmiDataId Description LoginSid format c StringTermination Counted NTDomainName P
� �
( 0 3 F � �� string WmiDataId Description NTDomainName format w StringTermination Counted NTUserName P
� � � � � � � � � �� string WmiDataId Description NTUserName format w StringTermination Counted ObjectID 4 6
� Z b m z � �� sint32 WmiDataId Description ObjectID RequestID D 6
� � � � � � �� sint32 WmiDataId Description RequestID SessionLoginName \ P
� n v � � � � � � � �� string WmiDataId Description SessionLoginName format w StringTermination Counted SPID ( 6
�
$
1
� �� sint32 WmiDataId Description SPID StartTime
, 6
� �
�
�
�
� �� uint64 WmiDataId Description StartTime TextData P
� ! , 9 C K N a � �� string WmiDataId Description TextData format w StringTermination Counted TransactionID 6
� � � � � � �� sint64 WmiDataId Description TransactionID XactSequence H 6
� > F Q ^ � �� sint64 WmiDataId Description XactSequence � M S S Q L S E R V E R T r a c e �P��7 � MSSQLSERVERTrace 6 � �� B H n { � � SQLTraceEvent219 Description Matrix Transaction start and stop Guid 84e993e6-00db-4d70-97ef-3824ed2c4e93 DisplayName Matrix Transaction start and stop De �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 +�n�^��
͝��C�� , J.3�� a � WDMClassesOfDriver ObHandleDuplicateEvent C:\Windows\system32\kernelbase.dll[MofResourceName] eName] me] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 </h�b �
͝��C� ' )ߝ�t � \ � WDMClassesOfDriver ALPC_Send_Message C:\Windows\system32\kernelbase.dll[MofResourceName] ceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 </h�b �
͝��C� ' )ߝ�t � \ � WDMClassesOfDriver ALPC_Send_Message C:\Windows\system32\kernelbase.dll[MofResourceName] esourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 </h�b �
͝��C� ' )ߝ�t � \ � WDMClassesOfDriver ALPC_Send_Message C:\Windows\system32\kernelbase.dll[MofResourceName] esourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 </h�b �
͝��C� ' )ߝ�t � \ � WDMClassesOfDriver ALPC_Send_Message C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 </h�b �
͝��C� ' )ߝ�t � \ � WDMClassesOfDriver ALPC_Send_Message C:\Windows\system32\kernelbase.dll[MofResourceName] .dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 </h�b �
͝��C� ' )ߝ�t � \ � WDMClassesOfDriver ALPC_Send_Message C:\Windows\system32\kernelbase.dll[MofResourceName] ResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 </h�b �
͝��C� ' )ߝ�t � \ � WDMClassesOfDriver ALPC_Send_Message C:\Windows\system32\kernelbase.dll[MofResourceName] urceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 </h�b �
͝��C� ' )ߝ�t � \ � WDMClassesOfDriver ALPC_Send_Message C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 </h�b �
͝��C� ' )ߝ�t � \ � WDMClassesOfDriver ALPC_Send_Message C:\Windows\system32\kernelbase.dll[MofResourceName] MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 </h�b �
͝��C� ' )ߝ�t � \ � WDMClassesOfDriver ALPC_Send_Message C:\Windows\system32\kernelbase.dll[MofResourceName] eName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 </h�b �
͝��C� ' )ߝ�t � \ � WDMClassesOfDriver ALPC_Send_Message C:\Windows\system32\kernelbase.dll[MofResourceName] se.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 </h�b �
͝��C� ' )ߝ�t � \ � WDMClassesOfDriver ALPC_Send_Message C:\Windows\system32\kernelbase.dll[MofResourceName] ] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 </h�b �
͝��C� ' )ߝ�t � \ � WDMClassesOfDriver ALPC_Send_Message C:\Windows\system32\kernelbase.dll[MofResourceName] ResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 </h�b �
͝��C� ' )ߝ�t � \ � WDMClassesOfDriver ALPC_Send_Message C:\Windows\system32\kernelbase.dll[MofResourceName] .dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 </h�b �
͝��C� ' )ߝ�t � \ � WDMClassesOfDriver ALPC_Send_Message C:\Windows\system32\kernelbase.dll[MofResourceName] ourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 </h�b �
͝��C� ' )ߝ�t � \ � WDMClassesOfDriver ALPC_Send_Message C:\Windows\system32\kernelbase.dll[MofResourceName] Name] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 </h�b �
͝��C� ' )ߝ�t � \ � WDMClassesOfDriver ALPC_Send_Message C:\Windows\system32\kernelbase.dll[MofResourceName] ourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 </h�b �
͝��C� ' )ߝ�t � \ � WDMClassesOfDriver ALPC_Send_Message C:\Windows\system32\kernelbase.dll[MofResourceName] Name] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 </h�b �
͝��C� ' )ߝ�t � \ � WDMClassesOfDriver ALPC_Send_Message C:\Windows\system32\kernelbase.dll[MofResourceName] ResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 </h�b �
͝��C� ' )ߝ�t � \ � WDMClassesOfDriver ALPC_Send_Message C:\Windows\system32\kernelbase.dll[MofResourceName] ] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 </h�b �
͝��C� ' )ߝ�t � \ � WDMClassesOfDriver ALPC_Send_Message C:\Windows\system32\kernelbase.dll[MofResourceName] sourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 </h�b �
͝��C� ' )ߝ�t � \ � WDMClassesOfDriver ALPC_Send_Message C:\Windows\system32\kernelbase.dll[MofResourceName] ourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 </h�b �
͝��C� ' )ߝ�t � \ � WDMClassesOfDriver ALPC_Send_Message C:\Windows\system32\kernelbase.dll[MofResourceName] [MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 </h�b �
͝��C� ' )ߝ�t � \ � WDMClassesOfDriver ALPC_Send_Message C:\Windows\system32\kernelbase.dll[MofResourceName] l[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 </h�b �
͝��C� ' )ߝ�t � \ � WDMClassesOfDriver ALPC_Send_Message C:\Windows\system32\kernelbase.dll[MofResourceName] Name] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 </h�b �
͝��C� ' )ߝ�t � \ � WDMClassesOfDriver ALPC_Send_Message C:\Windows\system32\kernelbase.dll[MofResourceName] sourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 </h�b �
͝��C� ' )ߝ�t � \ � WDMClassesOfDriver ALPC_Send_Message C:\Windows\system32\kernelbase.dll[MofResourceName] e] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 </h�b �
͝��C� ' )ߝ�t � \ � WDMClassesOfDriver ALPC_Send_Message C:\Windows\system32\kernelbase.dll[MofResourceName] � � string Description Source File Name Text
� 5 = J string Description Text � � �n ID � ٜz� � hH�$ Y �k�} � ���I � VÓp � �m�0� � �� s S
-{L� & X e S q l P k g _ b r o k e r _ t r a n s m i s s i o n _ e x c e p t i o n �R��7 �0 ( 0 XeSqlPkg_broker_transmission_exception ( ) � �� * 8 D � � l z � � + u � � � H Y � � WU��������������������������������������R � broker_transmission_exception EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid conversation_id
! 6
� C P � ��[ f object:guid WmiDataId Extension Guid error_number )
� � � � �� sint32 WmiDataId error_severity )
� � �� sint32 WmiDataId error_state )
� b j � �� sint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId is_initiator )
� 6 = � �� sint8 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� " * 5 B � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �R��7 �1 XeSqlPkg
C � �� - ^ d � � � � c����� � XeSqlPkg_broker_queue_disabled Description Occurs when a Service Broker queue is disabled. Guid {802d00c5-37a3-47d1-b0d2-1d38dfa44d4a} locale MS\0x409 DisplayName broker_queue_disabled � X e S q l P k g _ b r o k e r _ q u e u e _ d i s a b l e d �R��7 �x " ( XeSqlPkg_broker_queue_disabled ) � �� " 0 < � � = L � � Z d � � 4 D WU��������������������������������� � broker_queue_disabled EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� * 2 � �� uint32 WmiDataId database_name C
� � � � ��� � � � string WmiDataId StringTermination NullTerminated Format w FragmentId 6
� . 6 A N � �� uint32 WmiDataId Description FragmentId queue_id )
� � � � �� sint32 WmiDataId RemainingLength 6
� # � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �R��7 �� XeSqlPkg
C � ��. ; � � � � � � c����# � XeSqlPkg_broker_mirrored_route_state_changed Description Occurs every time Service Broker receives an open or close connection request from either of the mirrored instances. Guid {19a973b4-ce7b-4274-9042-d77671c6ecf7} locale MS\0x409 DisplayName broker_mirrored_route_state_changed �, X e S q l P k g _ b r o k e r _ m i r r o r e d _ r o u t e _ s t a t e _ c h a n g e d �R��7 �o 0 6 XeSqlPkg_broker_mirrored_route_state_changed . ) � ��% 0 > J � � � ; Q � � � � ! + � � i z � � WUU���������������������������������������������s � broker_mirrored_route_state_changed EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid address_mirror C
� U ] � ��h { � � string WmiDataId StringTermination NullTerminated Format w address_principal C
� � � ��
0 8 string WmiDataId StringTermination NullTerminated Format w error_message_mirror C
� � � � ��� � � � string WmiDataId StringTermination NullTerminated Format w error_message_prinicipal ! C
� N V � ��a t � � string WmiDataId StringTermination NullTerminated Format w FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId mirrored_route_state P
� � � ��� � � � � uint8 WmiDataId XEMapId ValueMap � � � 1 2 3 Values � � Operational Operational with principal only Not operational mirroring_role_mirror
% C
� | �
� ��� � � � string WmiDataId StringTermination NullTerminated Format w mirroring_role_principal ) C
� ( 0 � ��; N ^ f string WmiDataId StringTermination NullTerminated Format w RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� C K V c � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �R��7 �i XeSqlPkg
C � ��0 = � � � � � � c����� � XeSqlPkg_broker_remote_message_acknowledgement Description Occurs when Service Broker sends or receives a message acknowledgement. Guid {839ba147-249a-438b-b137-faa0dc1acaed} locale MS\0x409 DisplayName broker_remote_message_acknowledgement �* X e S q l P k g _ m a n a g e d _ d a t a b a s e _ r e s t o r e _ d d l _ i n f o �R��7 �� 8 4 XeSqlPkg_managed_database_restore_ddl_info , ) � ��# . < H � L Z � � � v � � � ( 9 � � 2 > � � WUU������������������������������������������������������ � managed_database_restore_ddl_info EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid backend_session 4 )
� : A � �� sint8 WmiDataId device_count $ )
� � � � �� uint32 WmiDataId file_count ( )
� � � � �� uint32 WmiDataId FragmentId 6
� J R ] j � �� uint32 WmiDataId Description FragmentId page_count , )
� � � � �� uint32 WmiDataId relocation_count
0 )
�
� �� uint32 WmiDataId RemainingLength 6
� } � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
�
" � �� uint32 WmiDataId Description SequenceNumber stats_mask )
� u } � �� uint64 WmiDataId value_option_mask )
� � � � �� uint64 WmiDataId �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ,�n�^��
͝��C�y ! J.3�� V � WDMClassesOfDriver ObTypeEvent C:\Windows\system32\kernelbase.dll[MofResourceName] ] .dll.mui[MofResourceName] s �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � + � MSFT_CliFormat SYSTEM
D � � U � b
�
x � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty __CLASS __CLASS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __DERIVATION __DERIVATION � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __DYNASTY __DYNASTY � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty __GENUS __GENUS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier t � , � MSFT_CliProperty __NAMESPACE __NAMESPACE � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o � " � MSFT_CliProperty __PATH __PATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier y � $ 6 � MSFT_CliProperty __PROPERTY_COUNT __PROPERTY_COUNT � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __RELPATH __RELPATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier q � & � MSFT_CliProperty __SERVER __SERVER � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __SUPERCLASS __SUPERCLASS I �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty V � � MSFT_CliFormat INSTANCE " � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier m � � MSFT_CliProperty Name Name 'J �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty 4I PC � MSFT_CliFormat list FULL � " a �
P � � ; z � � D �" �$ �& �) �+ E. �0 D3 �5 �7 �> A � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier \ � � � � MSFT_CliProperty AccessMask The AccessMask property is a bit array representing the access rights to the given file or directory held by the user or group on whose behalf the instance is returned. AccessMask ; 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � q z � MSFT_CliProperty Archive The Archive property is a boolean value indicating that the file should be archived. Archive ? 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � r ~ � MSFT_CliProperty Compressed The Compressed property is a boolean value indicating that the file is compressed. Compressed t 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier : � % � � � MSFT_CliProperty CompressionMethod The CompressionMethod property is a free form string indicating the algorithm or tool used to compress the logical file. CompressionMethod 0 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � g o � MSFT_CliProperty CSName The CSName property is a string indicating the name of the computer system. CSName 6 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � h u � MSFT_CliProperty Description The Description property provides a textual description of the object. Description ? 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � w ~ � MSFT_CliProperty Drive The Drive property is a string representing the drive letter (including colon) of the file. Drive j 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier 0 � ) � � � MSFT_CliProperty EightDotThreeFileName The EightDotThreeFileName property is a string representing the DOS-compatible file name for this file. EightDotThreeFileName ; 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � o z � MSFT_CliProperty Encrypted The Encrypted property is a boolean value indicating that the file is encrypted. Encrypted 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � $ 5 G � MSFT_CliProperty EncryptionMethod The EncryptionMethod property is a free form string indicating the algorithm or tool used to encrypt the logical file. If it is not possible (or not desired) to describe the encryption scheme (perhaps for security reasons), use the following words: "Unknown" to represent that it is not known whether the logical file is encrypted or not, "Encrypted" to represent that the file is encrypted but either its encryption scheme is not known or not disclosed, and "Not Encrypted" to represent that the logical file is not encrypt��Y� � �Z � 6�_1� � �1o�� y V�� � ��}�� � \��� Z V�$�� c z��)D � �'l� ( X e S q l P k g _ d a t a b a s e _ d d l _ s t m t _ r u n t i m e _ c h e c k 5S��7 �B 2 XeSqlPkg_database_ddl_stmt_runtime_check * ) � ��! , : F � � G V � � d u � � n ~ WU�����������������������������{ � database_ddl_stmt_runtime_check EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� 4 < � �� uint32 WmiDataId database_name C
� � � � ��� � � � string WmiDataId StringTermination NullTerminated Format w FragmentId 6
� 8 @ K X � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� > F Q ^ � �� uint32 WmiDataId Description SequenceNumber statement_type P
� � � � ��� # � ! ) uint8 WmiDataId XEMapId ValueMap 1 2 3 4 Values = N ] k CREATE DATABASE DROP DATABASE USE DATABASE ALTER DATABASE � X e S q l P k g 6S��7 �X XeSqlPkg
C � ��0 = u { � � � � c����� � XeSqlPkg_database_segment_local_creation_begin Description Start to create a database segment at the local brick. Guid {4d19bf10-5958-4726-aa16-56575646565f} locale MS\0x409 DisplayName database_segment_local_creation_begin �. X e S q l P k g _ d a t a b a s e _ s e g m e n t _ l o c a l _ c r e a t i o n _ b e g i n 7S��7 �V " 8 XeSqlPkg_database_segment_local_creation_begin 0 ) � ��' 2 @ L � J W � � | � WU��������������������������������� � database_segment_local_creation_begin EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid brick_id )
� 7 ? � �� uint32 WmiDataId database_id )
� � � � �� uint32 WmiDataId database_segment_id )
� � � � �� uint32 WmiDataId FragmentId 6
� P X c p � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� V ^ i v � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g 8S��7 �Q XeSqlPkg
C � ��. ; p v � � � � c����� � XeSqlPkg_database_segment_local_creation_end Description One database segment is created at the local brick. Guid {edbdd3c7-c54b-4dcf-9d9a-7cf47eed3ba6} locale MS\0x409 DisplayName database_segment_local_creation_end �, X e S q l P k g _ d a t a b a s e _ s e g m e n t _ l o c a l _ c r e a t i o n _ e n d 9S��7 �R " 6 XeSqlPkg_database_segment_local_creation_end . ) � ��% 0 > J � � H U � � �
z � WU��������������������������������� � database_segment_local_creation_end EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid brick_id )
� 5 = � �� uint32 WmiDataId database_id )
� � � � �� uint32 WmiDataId database_segment_id )
� � � � �� uint32 WmiDataId FragmentId 6
� N V a n � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� T \ g t � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g :S��7 �� XeSqlPkg
C � ��, 9 � � � � � � c���� � XeSqlPkg_database_segment_all_files_create Description All files on one database segment are created, and primary file information is inserted into metadata. Guid {8bbf007c-835f-41cb-9998-f60c589e646d} locale MS\0x409 DisplayName database_segment_all_files_create �* X e S q l P k g _ d a t a b a s e _ s e g m e n t _ a l l _ f i l e s _ c r e a t e ;S��7 �� 4 XeSqlPkg_database_segment_all_files_create , ) � ��# . < H � � I ^ � � $ 5 � � W����������������������������. � database_segment_all_files_create EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� 6 > � �� uint32 WmiDataId database_segment_id )
� � � � �� uint32 WmiDataId FragmentId 6
� � � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� y � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g <S��7 �; XeSqlPkg
C � ��' 4 a g � � � � c����� � XeSqlPkg_all_database_segments_create Description All required database segments are created. Guid {5e85c44b-a5a1-41cc-89aa-86e93c674ae9} locale MS\0x409 DisplayName all_database_segments_create �% X e S q l P k g _ a l l _ d a t a b a s e _ s e g m e n t s _ c r e a t e =S��7 �G " / XeSqlPkg_all_database_segments_create ' ) � �� ) 7 C � � A N � � � v � � WU��������������������������������� � all_database_segments_create EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid brick_id )
� . 6 � �� uint32 WmiDataId database_id )
� � � � �� uint32 WmiDataId database_segment_count )
� � � � �� uint32 WmiDataId FragmentId 6
� J R ] j � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� P X c p � �� uint32 WmiDataId Description SequenceNumber �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 -�n�^��
͝��C�� * J.3�� _ � WDMClassesOfDriver ObHandleRundownEvent C:\Windows\system32\kernelbase.dll[MofResourceName] ed. EncryptionMethod C 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � w � � MSFT_CliProperty Extension The Extension property is a string representing the file's extension (without the dot). Extension E 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � z � � MSFT_CliProperty FileName The FileName property is a string representing the filename (without extension) of the file. FileName * 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � _ i � MSFT_CliProperty FileSize The FileSize property represents the size of the file (in bytes). FileSize W 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � � MSFT_CliProperty FileType The FileType property is a string descriptor representing the file type (indicated by the Extension property). FileType * 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � a i � MSFT_CliProperty FSName The FSName property is string indicating the name of the file system. FSName - 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � d l � MSFT_CliProperty Hidden The Hidden property is a boolean value indicating if the file is hidden. Hidden � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier O � � � � MSFT_CliProperty InstallDate The InstallDate property is datetime value indicating when the object was installed. A lack of a value does not indicate that the object is not installed. InstallDate d 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier * � � � � MSFT_CliProperty InUseCount The InUseCount property is an integer indicating the number of 'file opens' that are currently active against the file. InUseCount N 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � MSFT_CliProperty LastAccessed The LastAccessed property is a datetime value indicating the time the file was last accessed. LastAccessed N 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � MSFT_CliProperty LastModified The LastModified property is a datetime value indicating the time the file was last modified. LastModified � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o � � � � MSFT_CliProperty Name The Name property is a string representing the inherited name that serves as a key of a logical file instance within a file system. Full path names should be provided. Example: c:\winnt\system\win.ini Name k 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier 1 � � � � MSFT_CliProperty Path The Path property is a string representing the path of the file. This includes leading and trailing backslashes. Example: \windows\system\ Path 5 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � j t � MSFT_CliProperty Readable The Readable property is a boolean value indicating if the file can be read. Readable � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � i q � � MSFT_CliProperty Status The Status property is a string indicating the current status of the object. Status � � / � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 10 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap A E L V _ j t ~ OK Error Degraded Unknown Pred Fail Starting Stopping Service � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values ? C J T ] h r | OK Error Degraded Unknown Pred Fail Starting Stopping Service 4 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � k s � MSFT_CliProperty System The system property is a boolean value indicating if the file is a system file. System ; 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � o z � MSFT_CliProperty Writeable The Writeable property is a boolean value indicating if the file can be written. Writeable V$ �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty c# � � MSFT_CliFormat TABLE BRIEF B s � N � ] - 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � d l � MSFT_CliProperty Hidden The Hidden property is a boolean value indicating if the file is hidden. Hidden ; 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � q z � MSFT_CliProperty Archive The Archive property is a boolean value indicating that the file should be archived. Archive j 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier 0 � ) � � � MSFT_CliProperty EightDotThreeFileName The EightDotThreeFileName property is a string representing the DOS-compatible file name for this file. EightDotThreeFileName * 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � _ i � MSFT_CliProperty FileSize The FileSize property represents the size of the file (in bytes). FileSize � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier O � � � � MSFT_CliProperty Name The Name property is a string representing the inherited name that serves as a key of a logical file instance within a file system. Full path names should be provided. Name ? 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � r ~ � MSFT_CliProperty Compressed The Compressed property is a boolean value indicating that the file is compressed. Compressed ; 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q ��� � �^� u -��m
8 iZ�jB � ���5� � e]T�� V ��� � HPX� l ̈�{! P z�?7q p ��o�� ! X e S q l P k g _ s t r e t c h _ c o d e g e n _ e r r o r l o g T��7 �{ " + XeSqlPkg_stretch_codegen_errorlog # ) � �� % 3 ? � � @ K � � Y d � � 4 D WU��������������������������������� � stretch_codegen_errorlog EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� - 5 � �� uint32 WmiDataId error_log C
� � � � ��� � � � string WmiDataId StringTermination NullTerminated Format w FragmentId 6
� - 5 @ M � �� uint32 WmiDataId Description FragmentId object_id )
� � � � �� uint32 WmiDataId RemainingLength 6
� # � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g T��7 �M XeSqlPkg
C � ��& 3 t z � � � � c����� � XeSqlPkg_stretch_sync_metadata_start Description Reports the start of metadata checks during the migration task. Guid {C12AFABF-D72E-49C9-833B-D40F35610FE8} locale MS\0x409 DisplayName stretch_sync_metadata_start �$ X e S q l P k g _ s t r e t c h _ s y n c _ m e t a d a t a _ s t a r t T��7 �� . XeSqlPkg_stretch_sync_metadata_start & ) � �� ( 6 B � � C O � � % � � W���������������������������� � stretch_sync_metadata_start EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� 0 8 � �� uint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId object_id )
� � �� uint32 WmiDataId RemainingLength 6
� i q | � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g T��7 �o XeSqlPkg
C � ��- : � � � � � � c���� � XeSqlPkg_stretch_migration_batch_generation Description Reports the start or completion of the T-SQL batch generation for stretch migration Guid {a254f7fb-2e39-419e-8dfb-77f51e99ca29} locale MS\0x409 DisplayName stretch_migration_batch_generation �+ X e S q l P k g _ s t r e t c h _ m i g r a t i o n _ b a t c h _ g e n e r a t i o n T��7 �G " 5 XeSqlPkg_stretch_migration_batch_generation - ) � ��$ / = I � J U � � & p � � WU��������������������������������z � stretch_migration_batch_generation EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� 7 ? � �� uint32 WmiDataId direction )
� � � � �� sint32 WmiDataId FragmentId 6
� � � � �� uint32 WmiDataId Description FragmentId object_id )
� ] e � �� uint32 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� J R ] j � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g T��7 �. XeSqlPkg
C � �� - [ a � � � � c����� � XeSqlPkg_stretch_codegen_start Description Reports the start of stretch code generation Guid {5D50C7C5-906E-4CE3-BB5A-F49E98FB126D} locale MS\0x409 DisplayName stretch_codegen_start � X e S q l P k g _ s t r e t c h _ c o d e g e n _ s t a r t T��7 �} " ( XeSqlPkg_stretch_codegen_start ) � �� " 0 < � � = I � � ^ i � � 9 I WU��������������������������������� � stretch_codegen_start EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� * 2 � �� uint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId message_file_path C
� % � ��0 C S [ string WmiDataId StringTermination NullTerminated Format w object_id )
� � � � �� uint32 WmiDataId RemainingLength 6
� ( � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g
T��7 �D XeSqlPkg
C � ��, 9 e k � � � � c����� � XeSqlPkg_stretch_create_remote_table_start Description Reports the start of remote table creation Guid {421200F6-EDA9-4EF8-A532-CB5CB5B7A638} locale MS\0x409 DisplayName stretch_create_remote_table_start �* X e S q l P k g _ s t r e t c h _ c r e a t e _ r e m o t e _ t a b l e _ s t a r t T��7 �� 4 XeSqlPkg_stretch_create_remote_table_start , ) � ��# . < H � � I U � � + � � W����������������������������$ � stretch_create_remote_table_start EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� 6 > � �� uint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId object_id )
� � �� uint32 WmiDataId RemainingLength 6
� o w � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g T��7 �H XeSqlPkg
C � ��* 7 k q � � � � c����� � XeSqlPkg_stretch_unprovision_table_start Description Reports the start of stretch table un-provisioning Guid {C22573FC-F62F-4B01-8225-825C6CF72C72} locale MS\0x409 DisplayName stretch_unprovision_table_start �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 .�n�^��
͝��C�{ # J.3�� X � WDMClassesOfDriver ObObjectEvent C:\Windows\system32\kernelbase.dll[MofResourceName] i[MofResourceName] String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � o z � MSFT_CliProperty Encrypted The Encrypted property is a boolean value indicating that the file is encrypted. Encrypted 5 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � j t � MSFT_CliProperty Readable The Readable property is a boolean value indicating if the file can be read. Readable FSDir WHERE Name='#' Select * from Win32_Directory � �� H [9 �h [~ O� g� ) Ҵ �! ^b K� �Z � � A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 � � W f �
�
� MSFT_CliVerb TakeOwnerShip The TakeOwnerShip method obtains ownership of the logical file specified in the object path . If the logical file is actually a directory, then TakeOwnerShip will act recursively, taking ownership of all the files and sub-directories the directory contains. /nIt returns one of the following integer values:/n0 - The request was successful./n2 - Access was denied./n8 - An unspecified failure occurred./n9 - The name specified was invalid./n10 - The object specified already exists./n11 - The file system is not NTFS./n12 - The platform is not Windows NT or Windows 2000./n13 - The drive is not the same./n14 - The directory is not empty./n15 - There has been a sharing violation./n16 - The start file specified was invalid./n17 - A privilege required for the operation is not held./n21 - A parameter specified is invalid./n TakeOwnerShip v � q e � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � ) � MSFT_CliQualifier Description ( The TakeOwnerShip method obtains ownership of the logical file specified in the object path . If the logical file is actually a directory, then TakeOwnerShip will act recursively, taking ownership of all the files and sub-directories the directory contain � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap
U X [ ^ a e i m q u y } � 0 2 8 9 10 11 12 13 14 15 16 17 21 X � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � R � MSFT_CliQualifier Values
S \ k � � � � � � + ? Success Access Denied Unspecified failure Invalid object Object already exists File system not NTFS r��x� t �#�T � �u� � >v�ɀ � ?
� � �
�� � M��U � #zU� 8 X e S q l P k g _ s t r e t c h _ t a b l e _ d a t a _ r e c o n c i l i a t i o n _ r e s u l t s _ e v e n t KT��7 �� 8 B XeSqlPkg_stretch_table_data_reconciliation_results_event : ) � ��1 < J V
W d � � ] i � � . ? � � � � WUU������������������������������������������������������ � stretch_table_data_reconciliation_results_event EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� D L � �� uint32 WmiDataId duration_ms )
� � � � �� sint64 WmiDataId error_number % )
� � � � �� sint32 WmiDataId error_state
) )
� J R
� �� sint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId is_success )
� # � �� sint8 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength rows - )
� � � � �� sint64 WmiDataId SequenceNumber 6
� X ` k x � �� uint32 WmiDataId Description SequenceNumber table_id )
� � � � �� uint32 WmiDataId � X e S q l P k g LT��7 �p XeSqlPkg
C � ��. ; � � � � � � c���� � XeSqlPkg_stretch_table_unprovision_completed Description Reports the completion removal of local resources for a table that was unstretched Guid {CB571559-1CF8-4CD9-B269-3109BC829C22} locale MS\0x409 DisplayName stretch_table_unprovision_completed �, X e S q l P k g _ s t r e t c h _ t a b l e _ u n p r o v i s i o n _ c o m p l e t e d MT��7 �t 0 6 XeSqlPkg_stretch_table_unprovision_completed . ) � ��% 0
> J � K X � � � Q ] � � " 3 � � , 6 WU���������������������������������������������� � stretch_table_unprovision_completed EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� 8 @ � �� uint32 WmiDataId duration_ms )
� � � � �� sint64 WmiDataId error_number % )
� � � � �� sint32 WmiDataId error_state
) )
� > F
� �� sint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId is_success )
� � �� sint8 WmiDataId RemainingLength 6
� w � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � �� uint32 WmiDataId Description SequenceNumber table_id )
� m u � �� uint32 WmiDataId � X e S q l P k g NT��7 �u XeSqlPkg
C � ��2 ? � � � � � � c���� � XeSqlPkg_stretch_table_hinted_admin_update_event Description Reports the execution of a Stretch update DML operation that uses an admin hint Guid {EC369788-59D7-45EA-B9AB-A40403F48BE6} locale MS\0x409 DisplayName stretch_table_hinted_admin_update_event �0 X e S q l P k g _ s t r e t c h _ t a b l e _ h i n t e d _ a d m i n _ u p d a t e _ e v e n t OT��7 �# 4 : XeSqlPkg_stretch_table_hinted_admin_update_event 2 ) � ��) 4 B N � O \ � � � U a � � & / � � G W � � WUU������������������������������������������������� � stretch_table_hinted_admin_update_event EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� < D � �� uint32 WmiDataId duration_ms )
� � � � �� sint64 WmiDataId error_number % )
� � � � �� sint32 WmiDataId error_state
) )
� B J
� �� sint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId is_success )
� � �� sint8 WmiDataId message - C
� � � � ��� � � � string WmiDataId StringTermination NullTerminated Format w RemainingLength 6
� ) 6 � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber table_id )
� � �� uint32 WmiDataId � X e S q l P k g PT��7 �u XeSqlPkg
C � ��2 ? � � � � � � c���� � XeSqlPkg_stretch_table_hinted_admin_delete_event Description Reports the execution of a Stretch delete DML operation that uses an admin hint Guid {E456A9E0-3951-46FB-8357-34F72D2A6020} locale MS\0x409 DisplayName stretch_table_hinted_admin_delete_event �0 X e S q l P k g _ s t r e t c h _ t a b l e _ h i n t e d _ a d m i n _ d e l e t e _ e v e n t QT��7 �# 4 : XeSqlPkg_stretch_table_hinted_admin_delete_event 2 ) � ��) 4 B N � O \ � � � U a � � & / � � G W � � WUU������������������������������������������������� � stretch_table_hinted_admin_delete_event EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� < D � �� uint32 WmiDataId duration_ms )
� � � � �� sint64 WmiDataId error_number % )
� � � � �� sint32 WmiDataId error_state
) )
� B J
� �� sint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId is_success )
� � �� sint8 WmiDataId message - C
� � � � ��� � � � string WmiDataId StringTermination NullTerminated Format w RemainingLength 6
� ) 6 � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber table_id )
� � �� uint32 WmiDataId �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 /�n�^��
͝��C�~ & J.3�� [ � WDMClassesOfDriver ObReferenceEvent C:\Windows\system32\kernelbase.dll[MofResourceName] F}~_� U ���� � �Y��| V R�Ӹ� � &�}\ � �-3 � -�ު � bS�> � ��}�� " X e S q l P k g _ s t r e t c h _ t a b l e _ q u e r y _ e r r o r ST��7 �� ( , XeSqlPkg_stretch_table_query_error $ ) � �� & 4 @ � � A O � � � � l x � � G W � � WU�������������������������������������� � stretch_table_query_error EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� . 6 � �� uint32 WmiDataId error_number )
� � � � �� sint32 WmiDataId error_state ! )
� � � � �� sint32 WmiDataId FragmentId 6
� @ H S ` � �� uint32 WmiDataId Description FragmentId is_success )
� � � � �� sint8 WmiDataId RemainingLength 6
� ) 6 � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber table_id )
� � �� uint32 WmiDataId � X e S q l P k g TT��7 �_ XeSqlPkg
C � ��( 5 � � � � � � c����� � XeSqlPkg_remote_data_archive_telemetry Description Occurs whenever an on premise system transmits a telemetry event to Azure DB. Guid {2DED87B4-7DCD-43CF-AFD0-054FC8AFD11C} locale MS\0x409 DisplayName remote_data_archive_telemetry �& X e S q l P k g _ r e m o t e _ d a t a _ a r c h i v e _ t e l e m e t r y UT��7 �� R 0 XeSqlPkg_remote_data_archive_telemetry ( ) � �� * 8 D � � E S � � � p | � � A T � � B W � � ' � � ? E � � WUUU������������������������������������������������������������������������������� � remote_data_archive_telemetry EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid duration_ms )
� 2 : � �� sint64 WmiDataId error_number
- )
� � �
� �� sint32 WmiDataId error_state 1 )
� � � � �� sint32 WmiDataId event_timestamp 5 6
� I Q � ��\ g uint64 WmiDataId Extension WmiTime FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId is_success )
� / 6 � �� sint8 WmiDataId local_database_id )
� � � � �� sint32 WmiDataId local_event_name I C
� � �� ' 7 ? string WmiDataId StringTermination NullTerminated Format w local_instance_guid
= 6
� � �
� ��� � object:guid WmiDataId Extension Guid local_table_id )
� � �� sint32 WmiDataId message A C
� x � � ��� � � � string WmiDataId StringTermination NullTerminated Format w RemainingLength 6
� ! . � �� uint32 WmiDataId Description RemainingLength rows % )
� | � � �� sint64 WmiDataId SequenceNumber 6
� � � � � �� uint32 WmiDataId Description SequenceNumber server_name E C
� q y � ��� � � � string WmiDataId StringTermination NullTerminated Format w � X e S q l P k g VT��7 �b XeSqlPkg
C � ��1 > ~ � � � � � c����� � XeSqlPkg_remote_data_archive_telemetry_rejected Description Occurs whenever an AzureDB Stretch telemetry event is rejected Guid {D927AF2E-7CD6-483E-A6DA-80F0692EB0BB} locale MS\0x409 DisplayName remote_data_archive_telemetry_rejected �/ X e S q l P k g _ r e m o t e _ d a t a _ a r c h i v e _ t e l e m e t r y _ r e j e c t e d WT��7 �6 + 9 XeSqlPkg_remote_data_archive_telemetry_rejected 1 ) � ��( 3 A M � s � L ^ � J [ � � WU�����������������������������������������T � remote_data_archive_telemetry_rejected EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid event_timestamp 6
� L T � ��_ j uint64 WmiDataId Extension WmiTime FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId local_database_id )
� 9 A � �� sint32 WmiDataId local_event_name $ C
� � � � ��� � � � string WmiDataId StringTermination NullTerminated Format w local_table_id )
� 7 ? � �� sint32 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� $ , 7 D � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g XT��7 �z XeSqlPkg
C � ��. ; � � � � � � c���� � XeSqlPkg_data_purity_checks_for_dbcompat_130 Description Occurs when an operation that may require a data purity check for dbcompat level 130 occurs. Guid {bf4d2142-c7ca-4f81-8c07-de53ba9dfc64} locale MS\0x409 DisplayName data_purity_checks_for_dbcompat_130 �, X e S q l P k g _ d a t a _ p u r i t y _ c h e c k s _ f o r _ d b c o m p a t _ 1 3 0 YT��7 �$ 6 XeSqlPkg_data_purity_checks_for_dbcompat_130 . ) � ��% 0 > J � p � � W���������������������z � data_purity_checks_for_dbcompat_130 EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid FragmentId 6
� D L W d � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� J R ] j � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g ZT��7 �` XeSqlPkg
C � ��! . � � � � � � c����� � XeSqlPkg_unable_to_verify_trust Description Occurs when SQL Server is unable to perform Authenticode signature verification on binaries. Guid {D27A1483-E562-4863-8148-B81EEB158B58} locale MS\0x409 DisplayName unable_to_verify_trust �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 0�n�^��
͝��C�x J.3�� U � WDMClassesOfDriver ThreadPool C:\Windows\system32\kernelbase.dll[MofResourceName] e] e.dll.mui[MofResourceName] ofResourceName] Platform not NT/Windows 2000 Drive not the same Directory not empty Sharing violation Invalid start file Privilege not held Invalid parameter TakeOwnerShip �A � A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 �? ) 9 �# 4+ O+ � MSFT_CliVerb ChangeSecurityPermissions The ChangeSecurityPermissions method changes the security permissions for the logical file specified in the object path. If the logical file is actually a directory, then ChangeSecurityPermissions will act recursively, changing the security permissions of all the files and sub-directories the directory contains. ChangeSecurityPermissions returns an integer value of 0 if the permissions were changed, and any other number to indicate an error./nIt returns one of the following integer values:/n0 - The request was successful./n2 - Access was denied./n8 - An unspecified failure occurred./n9 - The name specified was invalid./n10 - The object specified already exists./n11 - The file system is not NTFS./n12 - The platform is not Windows NT or Windows 2000./n13 - The drive is not the same./n14 - The directory is not empty./n15 - There has been a sharing violation./n16 - The start file specified was invalid./n17 - A privilege required for the operation is not held./n21 - A parameter specified is invalid./n ChangeSecurityPermissions E E � � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING P 3 � � �
�
� MSFT_CliParam The Option input parameter specifies the actual security privilege to be modified. Change_Owner_Security_Information - Change the owner of the logical file. Change_Group_Security_Information - Change the group of the logical file. Change_Dacl_Security_Information - Change the Access Control List of the logical file. Change_Sacl_Security_Information - Change the System Access Control List of the logical file. Option � � ; W � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ; � MSFT_CliQualifier BitMap / 2 5 8 0 1 2 3 L � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier BitValues 2 U x � Change_Owner_Security_Information Change_Group_Security_Information Change_Dacl_Security_Information Change_Sacl_Security_Information � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING j , � MSFT_CliQualifier CIMTYPE $ uint32 e � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � ) � MSFT_CliQualifier Description ( The Option input parameter specifies the actual security privilege to be modified. Change_Owner_Security_Information - Change the owner of the logical file. Change_Group_Security_Information - Change the group of the logical file. Change_Dacl_Security_Inf � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e " � MSFT_CliQualifier ID 1 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True UINT32 � � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING �
3 Z n � � MSFT_CliParam The SecurityDescriptor input parameter specifies the security information SecurityDescriptor � � Q h � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING j E � MSFT_CliQualifier CIMTYPE $ object:Win32_SecurityDescriptor � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING s � MSFT_CliQualifier Description ( The SecurityDescriptor input parameter specifies the security information � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e " � MSFT_CliQualifier ID 0 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True OBJECT �# F& �' e � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � ) � MSFT_CliQualifier Description ( The ChangeSecurityPermissions method changes the security permissions for the logical file specified in the object path. If the logical file is actually a directory, then ChangeSecurityPermissions will act recursively, changing the security permissions of � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap
U X [ ^ a e i m q u y } � 0 2 8 9 10 11 12 13 14 15 16 17 21 X � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � R � MSFT_CliQualifier Values
S \ k � � � � � � + ? Success Access Denied Unspecified failure Invalid object Object already exists File system not NTFS Platform not NT/Windows 2000 Drive not the same Directory not empty Sharing violation Invalid start file Privilege not held Invalid parameter ChangeSecurityPermissions - � A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 + � � ~ � � � MSFT_CliVerb Copy The Copy method copies the logical file or directory specified in the object path to the location specified by the input parameter. Copy returns an integer value of 0 if the file was successfully copied, and any other number to indicate an error. A copy is not supported if overwriting an existing logical file is required./nIt returns one of the following integer values:/n0 - The request was successful./n2 - Access was denied./n8 - An unspecified failure occurred./n9 - The name specified was invalid./n10 - The object specified already exists./n11 - The file system is not NTFS./n12 - The platform is not Windows NT or Windows 2000./n13 - The drive is not the same./n14 - The directory is not empty./n15 - There has been a sharing violation./n16 - The start file specified was invalid./n17 - A privilege required for the operation is not held./n21 - A parameter specified is invalid./n Copy � �
� ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING 1 3 � � � MSFT_CliParam The FileName input parameter is a string representing the fully qualified name of the copy of the file (or directory). Example: c:\temp\newdirectory FileName � � � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING j , � MSFT_CliQualifier CIMTYPE $ string � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING L � � MSFT_CliQualifier Description ( The FileName input parameter is a string representing the fully qualified name of the copy of the file (or directory). Example: c:\temp\newdirectory � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e " � MSFT_CliQualifier ID 0 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True STRING � � � e � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � ) � MSFT_CliQualifier Description ( The Copy method copies the logical file or directory specified in the object path to the location specified by the input parameter. Copy returns an integer value of 0 if the file was successfully copied, and any other number to indicate an error. A copy i � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap
U X [ ^ a e i m q u y } � 0 2 8 9 10 11 12 13 14 15 16 17 21 X � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � R � MSFT_CliQualifier Values
S \ k � � � � � � + ? Success Access Denied Unspecified failure Invalid object Object already exists File system not NTFS Platform not NT/Windows 2000 Drive not the same Directory not empty Sharing violation Invalid start file Privilege not held Invalid parameter Copy &/ � A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 +- � � � � � � MSFT_CliVerb Rename The Rename method renames the logical file (or directory) specified in the object path. Rename returns an integer value of 0 if the file was successfully renamed, and any other number to indicate an error. A rename is not supported if the destination is on another drive or overwriting an existing logical file is required/nIt returns one of the following integer values:/n0 - The request was successful./n2 - Access was denied./n8 - An unspecified failure occurred./n9 - The name specified was invalid./n10 - The object specified already exists./n11 - The file system is not NTFS./n12 - The platform is not Windows NT or Windows 2000./n13 - The drive is not the same./n14 - The directory is not empty./n15 - There has been a sharing violation./n16 - The start file specified was invalid./n17 - A privilege required for the operation is not held./n21 - A parameter specified is invalid./n RghR� � b �{ � ^�r 1 mVI�< O �ɍ[� � H���v � 4C��& � �l� y �i�F � � �� X e S q l P k g _ d a t a _ m a s k i n g _ t r a f f i c �T��7 �y ' XeSqlPkg_data_masking_traffic ) � �� ! / ; � � � � � Y m � � < L WU��������������������������� � data_masking_traffic EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid component C
� A I � ��T g w string WmiDataId StringTermination NullTerminated Format w FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId is_hekaton_query )
� G N � �� sint8 WmiDataId is_privileged_user )
� � � � �� sint8 WmiDataId RemainingLength 6
� + � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �T��7 �h XeSqlPkg
C � ��+ 8 � � � � � � c����� � XeSqlPkg_data_masking_traffic_masked_only Description Occurs when data masking is applied to a query and the query is actually masked. Guid {73bb54a2-2dc4-4759-aaba-0e7cf7412574} locale MS\0x409 DisplayName data_masking_traffic_masked_only �) X e S q l P k g _ d a t a _ m a s k i n g _ t r a f f i c _ m a s k e d _ o n l y �T��7 �� 3 XeSqlPkg_data_masking_traffic_masked_only + ) � ��" - ; G � � � �
� � W������������������������� � data_masking_traffic_masked_only EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid component C
� M U � ��` s � � string WmiDataId StringTermination NullTerminated Format w FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� _ g r � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �T��7 �' XeSqlPkg
C � �� ( Y _ � � � � c����� � XeSqlPkg_data_masking_rcs Description Fires when result column sources get calculated Guid {432CDE3A-B7F7-4B5B-BE0E-82A979FDDBB4} locale MS\0x409 DisplayName data_masking_rcs � X e S q l P k g _ d a t a _ m a s k i n g _ r c s �T��7 �� # XeSqlPkg_data_masking_rcs ) � �� + 7 � � ] b � z � W�������������������������� � data_masking_rcs EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid FragmentId 6
� 1 9 D Q � �� uint32 WmiDataId Description FragmentId rcs C
� � � � ��� � � � string WmiDataId StringTermination NullTerminated Format w RemainingLength 6
� I Q \ i � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �T��7 �� XeSqlPkg
C � ��4 A � � � � � � c���� � XeSqlPkg_data_classification_ddl_column_definition Description Occurs when a data classification label is applied on a table column definition (ADD or DROP). Guid {011435cb-9778-4d3c-8633-f76f54de0b5f} locale MS\0x409 DisplayName data_classification_ddl_column_definition �2 X e S q l P k g _ d a t a _ c l a s s i f i c a t i o n _ d d l _ c o l u m n _ d e f i n i t i o n �T��7 �+ ) < XeSqlPkg_data_classification_ddl_column_definition 4 ) � ��+ 6
D P � O \ � � � � � ` p � � WU��������������������������������������8 � data_classification_ddl_column_definition EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid column_id )
� < D � �� uint32 WmiDataId column_type $ )
� � � � �� uint8 WmiDataId database_id )
� � � � �� uint32 WmiDataId ddl_operation
% P
� i p
� ��{ / � � � � uint8 WmiDataId XEMapId ValueMap � � � 0 1 2 Values � � � DataClassificationUnknown DataClassificationAdd DataClassificationDrop FragmentId 6
� Y a l y � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength schema_id )
� M U � �� uint32 WmiDataId SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber table_id )
� % - � �� uint32 WmiDataId � X e S q l P k g �T��7 �Q XeSqlPkg
C � ��& 3 x ~ � � � � c����� � XeSqlPkg_data_classification_traffic Description Occurs when a query results column has a data classification label. Guid {588747ae-d5cc-459b-b38d-a11961dbfabb} locale MS\0x409 DisplayName data_classification_traffic �$ X e S q l P k g _ d a t a _ c l a s s i f i c a t i o n _ t r a f f i c �T��7 �J " . XeSqlPkg_data_classification_traffic & ) � �� ( 6 B � � C O � � - � � WU��������������������������������� � data_classification_traffic EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� 0 8 � �� uint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId information_types )
� � �� uint32 WmiDataId RemainingLength 6
� q y � � � �� uint32 WmiDataId Description RemainingLength sensitivity_labels )
� � � � �� uint32 WmiDataId SequenceNumber 6
� T \ g t � �� uint32 WmiDataId Description SequenceNumber �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 1�n�^��
͝��C�� ( J.3�� ] � WDMClassesOfDriver ThreadPoolTrace_V2 C:\Windows\system32\kernelbase.dll[MofResourceName] ename � � � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING 8
3 � � q y � MSFT_CliParam The FileName input parameter is a string representing the new name for the logical file (or directory). The FileName input parameter must be a fully qualified path name. Example: c:\temp\newfile.txt. FileName � C Z � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING j , � MSFT_CliQualifier CIMTYPE $ string - � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � MSFT_CliQualifier Description ( The FileName input parameter is a string representing the new name for the logical file (or directory). The FileName input parameter must be a fully qualified path name. Example: c:\temp\newfile.txt. � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e " � MSFT_CliQualifier ID 0 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True STRING � � e � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � ) � MSFT_CliQualifier Description ( The Rename method renames the logical file (or directory) specified in the object path. Rename returns an integer value of 0 if the file was successfully renamed, and any other number to indicate an error. A rename is not supported if the destination is o � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap
U X [ ^ a e i m q u y } � 0 2 8 9 10 11 12 13 14 15 16 17 21 X � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � R � MSFT_CliQualifier Values
S \ k � � � � � � + ? Success Access Denied Unspecified failure Invalid object Object already exists File system not NTFS Platform not NT/Windows 2000 Drive not the same Directory not empty Sharing violation Invalid start file Privilege not held Invalid parameter Rename � � A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 � � ' �
�
� MSFT_CliVerb Delete The Delete method will delete the logical file (or directory) specified in the object path. Delete returns an integer value of 0 if the file was successfully deleted, and any other number to indicate an error./nIt returns one of the following integer values:/n0 - The request was successful./n2 - Access was denied./n8 - An unspecified failure occurred./n9 - The name specified was invalid./n10 - The object specified already exists./n11 - The file system is not NTFS./n12 - The platform is not Windows NT or Windows 2000./n13 - The drive is not the same./n14 - The directory is not empty./n15 - There has been a sharing violation./n16 - The start file specified was invalid./n17 - A privilege required for the operation is not held./n21 - A parameter specified is invalid./n Delete 7 � 3 f � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � * � MSFT_CliQualifier Description ( The Delete method will delete the logical file (or directory) specified in the object path. Delete returns an integer value of 0 if the file was successfully deleted, and any other number to indicate an error./nIt returns one of the following integer value � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap
U X [ ^ a e i m q u y } � 0 2 8 9 10 11 12 13 14 15 16 17 21 X � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � R � MSFT_CliQualifier Values
S \ k � � � � � � + ? Success Access Denied Unspecified failure Invalid object Object already exists File system not NTFS Platform not NT/Windows 2000 Drive not the same Directory not empty Sharing violation Invalid start file Privilege not held Invalid parameter Delete � � A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 � � ' 1 �
�
� MSFT_CliVerb Compress The Compress method compresses the logical file (or directory) specified in the object path. Compress returns an integer value of 0 if the file was successfully compressed, and any other number to indicate an error./nIt returns one of the following integer values:/n0 - The request was successful./n2 - Access was denied./n8 - An unspecified failure occurred./n9 - The name specified was invalid./n10 - The object specified already exists./n11 - The file system is not NTFS./n12 - The platform is not Windows NT or Windows 2000./n13 - The drive is not the same./n14 - The directory is not empty./n15 - There has been a sharing violation./n16 - The start file specified was invalid./n17 - A privilege required for the operation is not held./n21 - A parameter specified is invalid./n Compress A � = f � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � * � MSFT_CliQualifier Description ( The Compress method compresses the logical file (or directory) specified in the object path. Compress returns an integer value of 0 if the file was successfully compressed, and any other number to indicate an error./nIt returns one of the following integer � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap
U X [ ^ a e i m q u y } � 0 2 8 9 10 11 12 13 14 15 16 17 21 X � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � R � MSFT_CliQualifier Values
S \ k � � � � � � + ? Success Access Denied Unspecified failure Invalid object Object already exists File system not NTFS Platform not NT/Windows 2000 Drive not the same Directory not empty Sharing violation Invalid start file Privilege not held Invalid parameter Compress � A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 � 1 = �
�
� MSFT_CliVerb Uncompress The Uncompress method uncompresses the logical file (or directory) specified in the object path. Uncompress returns an integer value of 0 if the file was successfully decompressed, and any other number to indicate an error./nIt returns one of the following integer values:/n0 - The request was successful./n2 - Access was denied./n8 - An unspecified failure occurred./n9 - The name specified was invalid./n10 - The object specified already exists./n11 - The file system is not NTFS./n12 - The platform is not Windows NT or Windows 2000./n13 - The drive is not the same./n14 - The directory is not empty./n15 - There has been a sharing violation./n16 - The start file specified was invalid./n17 - A privilege required for the operation is not held./n21 - A parameter specified is invalid./n Uncompress M � I f � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � * � MSFT_CliQualifier Description ( The Uncompress method uncompresses the logical file (or directory) specified in the object path. Uncompress returns an integer value of 0 if the file was successfully decompressed, and any other number to indicate an error./nIt returns one of the following � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap
U X [ ^ a e i m q u y } � 0 2 8 9 10 11 12 13 14 15 16 17 21 X � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � R � MSFT_CliQualifier Values
S \ k � � � � � � + ? Success Access Denied Unspecified failure Invalid object Object already exists File system not NTFS Platform not NT/Windows 2000 Drive not the same Directory not empty Sharing violation Invalid start file Privilege not held Invalid parameter Uncompress �~ � A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 �| �6 e> v> � MSFT_CliVerb TakeOwnerShipEx The TakeOwnerShipEx method obtains ownership of the logical file specified in the object path. If the logical file is actually a directory, then this method will act recursively, taking ownership of all the files and sub-directories the directory contains. TakeOwnerShipEx returns an integer value of 0 on success, and any other number to indicate an error. TakeOwnerShipEx is an extended version of the TakeOwnerShip method./nIt returns one of the following integer values:/n0 - The request was successful./n2 - Access was denied./n8 - An unspecified failure occurred./n9 - The name specified was invalid./n10 - The object specified already exists./n11 - The file system is not NTFS./n12 - The platform is not Windows NT or Windows 2000./n13 - The drive is not the same./n14 - The directory is not empty./n15 - There has been a sharing violation./n16 - The start file specified was invalid./n17 - A privilege required for the operation is not held./n21 - A parameter specified is invalid./n TakeOwnerShipEx ! u R( P � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � 3 + � MSFT_CliParam The Recursive input parameter is a boolean that indicates whether the change of ownership will be applied recursively to files and directories within the directory specified by the CIM_LogicalFile instance.Note for file instances the Recursive input parameter is ignored. Recursive C _ � � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING j - � MSFT_CliQualifier CIMTYPE $ boolean e � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � ) � MSFT_CliQualifier Description ( The Recursive input parameter is a boolean that indicates whether the change of ownership will be applied recursively to files and directories within the directory specified by the CIM_LogicalFile instance.Note for file instances the Recursive input param � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e " � MSFT_CliQualifier ID 2 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING k + � MSFT_CliQualifier optional % True BOOLEAN � � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING - 3 � � � � � MSFT_CliParam The StartFileName input parameter is a string that names the child file/directory to use as a starting point for TakeOwnerShipEx.The StartFileName property typically, is the StopFileName parameter specifying the file or directory at which anerror occurred from the previous method call. If this parameter is NULL, the operation is performed on the file ordirectory specified in the ExecMethod call. StartFileName � � K b y � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING j , � MSFT_CliQualifier CIMTYPE $ string e � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � ) � MSFT_CliQualifier Description ( The StartFileName input parameter is a string that names the child file/directory to use as a starting point for TakeOwnerShipEx.The StartFileName property typically, is the StopFileName parameter specifying the file or directory at which anerror occurred � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e " � MSFT_CliQualifier ID 1 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING k + � MSFT_CliQualifier optional % True STRING � � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � 3 � � \ d � MSFT_CliParam The StopFileName output parameter is a string representing the name of the file/directory where TakeOwnerShipEx method failed. StopFileName parameter will be null if the method succeeds. StopFileName � - D � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING j , � MSFT_CliQualifier CIMTYPE $ string � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING r � � MSFT_CliQualifier Description ( The StopFileName output parameter is a string representing the name of the file/directory where TakeOwnerShipEx method failed. StopFileName parameter will be null if the method succeeds. � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e " � MSFT_CliQualifier ID 0 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING f & � MSFT_CliQualifier Out True STRING 7 w9 ; e � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � ) � MSFT_CliQualifier Description ( The TakeOwnerShipEx method obtains ownership of the logical file specified in the object path. If the logical file is actually a directory, then this method will act recursively, taking ownership of all the files and sub-directories the directory contains � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap
U X [ ^ a e i m q u y } � 0 2 8 9 10 11 12 13 14 15 16 17 21 X � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � R � MSFT_CliQualifier Values
S \ k � � � � � � + ? Success Access Denied Unspecified failure Invalid object Object already exists File system not NTFS Platform not NT/Windows 2000 Drive not the same Directory not empty Sharing violation Invalid start file Privilege not held Invalid parameter TakeOwnerShipEx ̋ � A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 щ + } � 3W �^ �^ � MSFT_CliVerb ChangeSecurityPermissionsEx The ChangeSecurityPermissionsEx method changes the security permissions for the logical file specified in the object path. If the logical file is actually a directory, then this method will act recursively, changing the security permissions of all the files and sub-directories the directory contains. ChangeSecurityPermissionsEx returns an integer value of 0 if the permissions were changed, and any other number to indicate an error. The ChangeSecurityPermissionsEx method is an extended version of the ChangeSecurityPermissions method./nIt returns one of the following integer values:/n0 - The request was successful./n2 - Access was denied./n8 - An unspecified failure occurred./n9 - The name specified was invalid./n10 - The object specified already exists./n11 - The file system is not NTFS./n12 - The platform is not Windows NT or Windows 2000./n13 - The drive is not the same./n14 - The directory is not empty./n15 - There has been a sharing violation./n16 - The start file specified was invalid./n17 - A privilege required for the operation is not held./n21 - A parameter specified is invalid./n ChangeSecurityPermissionsEx � � ) �5 �H � � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING S 3 � � �
�
� MSFT_CliParam The Option input parameter specifies the actual security permission to be modified. Change_Owner_Security_Information - Change the owner of the logical file. Change_Group_Security_Information - Change the group of the logical file. Change_Dacl_Security_Information - Change the Access Control List of the logical file. Change_Sacl_Security_Information - Change the System Access Control List of the logical file. Option � � < X � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ; � MSFT_CliQualifier BitMap / 2 5 8 0 1 2 3 L � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier BitValues 2 U x � Change_Owner_Security_Information Change_Group_Security_Information Change_Dacl_Security_Information Change_Sacl_Security_Information � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING j , � MSFT_CliQualifier CIMTYPE $ uint32 e � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � ) � MSFT_CliQualifier Description ( The Option input parameter specifies the actual security permission to be modified. Change_Owner_Security_Information - Change the owner of the logical file. Change_Group_Security_Information - Change the group of the logical file. Change_Dacl_Security_In � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e " � MSFT_CliQualifier ID 1 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True UINT32 S � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � 3 ! , � MSFT_CliParam The Recursive input parameter is a boolean that indicates whether the security permissions will be applied recursively to files and directories within the directory specified by the CIM_LogicalFile instance.Note for file instances the Recursive input parameter is ignored. Recursive D ` � � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING j - � MSFT_CliQualifier CIMTYPE $ boolean e � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � ) � MSFT_CliQualifier Description ( The Recursive input parameter is a boolean that indicates whether the security permissions will be applied recursively to files and directories within the directory specified by the CIM_LogicalFile instance.Note for file instances the Recursive input para � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e " � MSFT_CliQualifier ID 4 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING k + � MSFT_CliQualifier optional % True BOOLEAN � � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING �
3 [ o � � � MSFT_CliParam The SecurityDescriptor input parameter specifies the security information. SecurityDescriptor � � S j � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING j E � MSFT_CliQualifier CIMTYPE $ object:Win32_SecurityDescriptor � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING t � MSFT_CliQualifier Description ( The SecurityDescriptor input parameter specifies the security information. � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e " � MSFT_CliQualifier ID 0 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier in True OBJECT � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING W 3 � � � � � MSFT_CliParam The StartFileName input parameter is a string representing the child file/directory to use as a starting point for ChangeSecurityPermissionsEx.The StartFileName property typically, is the StopFileName parameter specifying the file or directory at which anerror occurred from the previous method call. If this parameter is NULL, the operation is performed on the file ordirectory specified in the ExecMethod call. StartFileName � � Y p � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING j , � MSFT_CliQualifier CIMTYPE $ string e � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � ) � MSFT_CliQualifier Description ( The StartFileName input parameter is a string representing the child file/directory to use as a starting point for ChangeSecurityPermissionsEx.The StartFileName property typically, is the StopFileName parameter specifying the file or directory at which an � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e " � MSFT_CliQualifier ID 3 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING k + � MSFT_CliQualifier optional % True STRING � � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � 3 � � R Z � MSFT_CliParam The StopFileName output parameter is a string representing the name of the file/directory where ChangeSecurityPermissionsEx failed. StopFileName will be null if the method succeeds. StopFileName � # : � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING j , � MSFT_CliQualifier CIMTYPE $ string � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING m � � MSFT_CliQualifier Description ( The StopFileName output parameter is a string representing the name of the file/directory where ChangeSecurityPermissionsEx failed. StopFileName will be null if the method succeeds. � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e " � MSFT_CliQualifier ID 2 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING f & � MSFT_CliQualifier Out True STRING Su�F� i M� ) ` �B
� t �0l� � �K3� [ A�� � �ьܬ
ЁH� � �L� N � [�^�. � �R �
- X e S q l P k g _ d a t a _ c l a s s i f i c a t i o n _ a u d i t i n g _ t r a f f i c �T��7 �� 7 XeSqlPkg_data_classification_auditing_traffic / ) � ��& 1 ? K � L X � � N f � � W����������������������������4 � data_classification_auditing_traffic EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� 9 A � �� uint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� % 0 = � �� uint32 WmiDataId Description RemainingLength sensitivity_attributes )
� � � � �� uint32 WmiDataId SequenceNumber 6
� $ � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �T��7 �8 XeSqlPkg
C � ��& 3 _ e � � � � c����� � XeSqlPkg_dbcc_inputbuffer_initialize Description Used for testing DBCC INPUTBUFFER command. Guid {910AA1BE-F12B-4710-8FBB-B17A4639E4F5} locale MS\0x409 DisplayName dbcc_inputbuffer_initialize �$ X e S q l P k g _ d b c c _ i n p u t b u f f e r _ i n i t i a l i z e �T��7 � . XeSqlPkg_dbcc_inputbuffer_initialize & ) � �� ( 6 B � � h y � � W���������������������r � dbcc_inputbuffer_initialize EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid FragmentId 6
� < D O \ � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� B J U b � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �T��7 �u XeSqlPkg
C � ��3 @ � � � � � � c���� � XeSqlPkg_implied_auth_eligible_connection_request Description Fires when a connection request is found eligible for implied authentication. Guid {062C2D2B-895D-4972-BA2D-155AFD7963A2} locale MS\0x409 DisplayName implied_auth_eligible_connection_request �1 X e S q l P k g _ i m p l i e d _ a u t h _ e l i g i b l e _ c o n n e c t i o n _ r e q u e s t �T��7 �� ; XeSqlPkg_implied_auth_eligible_connection_request 3 ) � ��* 5 C O � u � - � � W�������������������������& � implied_auth_eligible_connection_request EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid FragmentId 6
� I Q \ i � �� uint32 WmiDataId Description FragmentId incoming_login_name C
� � � � ��� string WmiDataId StringTermination NullTerminated Format w RemainingLength 6
� q y � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �T��7 �� XeSqlPkg
C � ��3 @ � � � � � � c���� � XeSqlPkg_implied_auth_security_context_overridden Description Fires when an incoming connection's security context is overridden by implied login's security context. Guid {E8F8AE36-7E36-46C7-819F-4EAF7D479FDB} locale MS\0x409 DisplayName implied_auth_security_context_overridden �1 X e S q l P k g _ i m p l i e d _ a u t h _ s e c u r i t y _ c o n t e x t _ o v e r r i d d e n �T��7 �� ; XeSqlPkg_implied_auth_security_context_overridden 3 ) � ��* 5 C O � u � 0 � � H X W����������������������������� � implied_auth_security_context_overridden EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid FragmentId 6
� I Q \ i � �� uint32 WmiDataId Description FragmentId implied_login_name C
� � � � ��� string WmiDataId StringTermination NullTerminated Format w incoming_login_name C
� � � � ��� � � � string WmiDataId StringTermination NullTerminated Format w RemainingLength 6
� * 7 � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �T��7 �m XeSqlPkg
C � ��2 ? � � � � � � c����� � XeSqlPkg_implied_auth_login_entry_added_to_store Description Fires when an implied login entry is added to implied login hash store. Guid {23700457-5CDF-45C7-AB07-73AC08B93735} locale MS\0x409 DisplayName implied_auth_login_entry_added_to_store �0 X e S q l P k g _ i m p l i e d _ a u t h _ l o g i n _ e n t r y _ a d d e d _ t o _ s t o r e �T��7 �h : XeSqlPkg_implied_auth_login_entry_added_to_store 2 ) � ��) 4 B N � v � � � � . W����������������������������� � implied_auth_login_entry_added_to_store EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid external_user_sid
6
� O W � ��b m object WmiDataId Extension Variant FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId implied_login_name C
� W _ � ��j } � � string WmiDataId StringTermination NullTerminated Format w RemainingLength 6
� � �
� �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� r z � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �T��7 �y XeSqlPkg
C � ��6 C � � � � � � c����
� XeSqlPkg_implied_auth_login_entry_removed_from_store Description Fires when an implied login entry is removed from implied login hash store. Guid {56CFA523-D6F0-4BA7-B563-388C5109EB3F} locale MS\0x409 DisplayName implied_auth_login_entry_removed_from_store �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 2�n�^��
͝��C�} % J.3�� Z � WDMClassesOfDriver TP_V2_CBEnqueue C:\Windows\system32\kernelbase.dll[MofResourceName] eName] ofResourceName] CW �Y >[ e � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � ) � MSFT_CliQualifier Description ( The ChangeSecurityPermissionsEx method changes the security permissions for the logical file specified in the object path. If the logical file is actually a directory, then this method will act recursively, changing the security permissions of all the fil � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap
U X [ ^ a e i m q u y } � 0 2 8 9 10 11 12 13 14 15 16 17 21 X � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � R � MSFT_CliQualifier Values
S \ k � � � � � � + ? Success Access Denied Unspecified failure Invalid object Object already exists File system not NTFS Platform not NT/Windows 2000 Drive not the same Directory not empty Sharing violation Invalid start file Privilege not held Invalid parameter ChangeSecurityPermissionsEx �l � A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 �j � � D sK {K � MSFT_CliVerb CopyEx The CopyEx method copies the logical file or directory specified in the object path to the location specified by the FileName parameter. CopyEx returns an integer value of 0 if the file was successfully copied, and any other number to indicate an error. A copy is not supported if overwriting an existing logical file is required. CopyEx is an extended version of the Copy method./nIt returns one of the following integer values:/n0 - The request was successful./n2 - Access was denied./n8 - An unspecified failure occurred./n9 - The name specified was invalid./n10 - The object specified already exists./n11 - The file system is not NTFS./n12 - The platform is not Windows NT or Windows 2000./n13 - The drive is not the same./n14 - The directory is not empty./n15 - There has been a sharing violation./n16 - The start file specified was invalid./n17 - A privilege required for the operation is not held./n21 - A parameter specified is invalid./n CopyEx � � �" �5 �
� ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING 6 3 � �
� MSFT_CliParam The FileName input parameter is a string representing the fully qualified name of the copy of the file (or directory). Example: c:\temp\newdirectory. FileName � � � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING j , � MSFT_CliQualifier CIMTYPE $ string � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING M � � MSFT_CliQualifier Description ( The FileName input parameter is a string representing the fully qualified name of the copy of the file (or directory). Example: c:\temp\newdirectory. � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e " � MSFT_CliQualifier ID 0 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True STRING # � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING w 3
� MSFT_CliParam The Recursive input parameter is a boolean that indicates whether the copy will be applied recursively to files and directories within the directory specified by the CIM_LogicalFile instance.Note for file instances the Recursive input parameter is ignored. Recursive 4 P � � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING j - � MSFT_CliQualifier CIMTYPE $ boolean e � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � ) � MSFT_CliQualifier Description ( The Recursive input parameter is a boolean that indicates whether the copy will be applied recursively to files and directories within the directory specified by the CIM_LogicalFile instance.Note for file instances the Recursive input parameter is ignored � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e " � MSFT_CliQualifier ID 3 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING k + � MSFT_CliQualifier optional % True BOOLEAN � � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING 3 � � � � � MSFT_CliParam The StartFileName input parameter is a string that names the child file/directory to use as a starting point for CopyEx.The StartFileName property typically, is the StopFileName parameter specifying the file or directory at which anerror occurred from the previous method call. If this parameter is NULL, the operation is performed on the file ordirectory specified in the ExecMethod call. StartFileName � � B Y p � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING j , � MSFT_CliQualifier CIMTYPE $ string e � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � ) � MSFT_CliQualifier Description ( The StartFileName input parameter is a string that names the child file/directory to use as a starting point for CopyEx.The StartFileName property typically, is the StopFileName parameter specifying the file or directory at which anerror occurred from the � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e " � MSFT_CliQualifier ID 2 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING k + � MSFT_CliQualifier optional % True STRING S � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � 3 � � : B � MSFT_CliParam The StopFileName output parameter is a string representing the name of the file/directory where CopyEx failed. This string parameter will be null if the method succeeds. StopFileName � � " � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING j , � MSFT_CliQualifier CIMTYPE $ string � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING a � � MSFT_CliQualifier Description ( The StopFileName output parameter is a string representing the name of the file/directory where CopyEx failed. This string parameter will be null if the method succeeds. � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e " � MSFT_CliQualifier ID 1 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING f & � MSFT_CliQualifier Out True STRING D �F H e � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � ) � MSFT_CliQualifier Description ( The CopyEx method copies the logical file or directory specified in the object path to the location specified by the FileName parameter. CopyEx returns an integer value of 0 if the file was successfully copied, and any other number to indicate an error. A � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap
U X [ ^ a e i m q u y } � 0 2 8 9 10 11 12 13 14 15 16 17 21 X �/t�� � bS�m� o �5}�
| 553w W gEd� X ,[�& � vW(� � ���bR � v�uz�
X e S q l P k g _ f r o n t e n d _ m e m o r y _ u s a g e U��7 �� b ( XeSqlPkg_frontend_memory_usage ) � �� " 0 < � � < L � � � � [ h � � f n � � � � � M ] � � WUUU����������������������������������������������������������������������������������������������P � frontend_memory_usage EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid batch_size = )
� ) 1 � �� uint64 WmiDataId batch_sql_hash
Y 6
� � � � ��� � object WmiDataId Extension Variant database_id )
� � � �� uint32 WmiDataId FragmentId 6
� ^ f q ~ � �� uint32 WmiDataId Description FragmentId frontend_component , P
� � � �� s ! 3 ; uint8 WmiDataId XEMapId ValueMap - 0 1 0 Values G S Algebrizer Parser line_number )
� � � � �� uint64 WmiDataId memory_allocated_kb $ )
� � � �� uint64 WmiDataId object_id )
� S [ � �� sint32 WmiDataId offset
- )
� � �
� �� sint64 WmiDataId offset_end 5 )
� � � �� sint64 WmiDataId RemainingLength 6
� c k v � � �� uint32 WmiDataId Description RemainingLength resource_group_id M )
� � � � �� sint64 WmiDataId resource_pool_id
E )
� : B
� �� sint64 WmiDataId SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber statement_sql_hash
U 6
� ) 1 � ��< G object WmiDataId Extension Variant � X e S q l P k g
U��7 �G XeSqlPkg
C � ��) 6 k q � � � � c����� � XeSqlPkg_failover_proc_execution_status Description XEvent used to indicate execution of failover proc. Guid {9aef8bd4-7af2-4b42-9b48-c539002f95af} locale MS\0x409 DisplayName failover_proc_execution_status �' X e S q l P k g _ f a i l o v e r _ p r o c _ e x e c u t i o n _ s t a t u s U��7 � + 1 XeSqlPkg_failover_proc_execution_status ) ) � �� + 9 E � � G W � � � t � � L Y � � WU�����������������������������������������4 � failover_proc_execution_status EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid error_number )
� 4 < � �� sint32 WmiDataId error_severity )
� � � � �� sint32 WmiDataId error_state $ )
� � � � �� sint32 WmiDataId FragmentId 6
� H P [ h � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength result )
� 9 A � �� sint32 WmiDataId result_desc P
� � � � ��� t � � sint32 WmiDataId XEMapId ValueMap � � � 3 2 4 5 0 1 Values / C U j � � CREATE_PROC_FAILED DROP_PROC_FAILED EXECUTE_PROC_FAILED EXECUTE_PROC_SUCCESS FAILED_TO_GET_SECRET_BLOCK PROPERTY_NOT_FOUND SequenceNumber 6
� $ � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g U��7 �/ XeSqlPkg
C � ��# 0 Y _ � � � � c����� � XeSqlPkg_distinct_query_completed Description Fires when a unique query is completed. Guid {26749f51-d6e4-40b2-ba3c-e9b5976bcf32} locale MS\0x409 DisplayName distinct_query_completed �! X e S q l P k g _ d i s t i n c t _ q u e r y _ c o m p l e t e d
U��7 �� 3 + XeSqlPkg_distinct_query_completed # ) � �� % 3 ? � � � � 2 ? � � * : � � � � ` n � � WUU������������������������������������������������
� distinct_query_completed EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid batch C
� A I � ��T g w string WmiDataId StringTermination NullTerminated Format w data_sensitivity_information , C
� � � � �� ' / string WmiDataId StringTermination NullTerminated Format w database_id )
� v ~ � �� uint32 WmiDataId error_message
( C
� � �
� ��� ' string WmiDataId StringTermination NullTerminated Format w error_severity )
� q y � �� uint32 WmiDataId execution_error_code )
� � � � �� uint32 WmiDataId FragmentId 6
� 4 < G T � �� uint32 WmiDataId Description FragmentId peer_address $ C
� � � � ��� � � � string WmiDataId StringTermination NullTerminated Format w RemainingLength 6
� U ] h u � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g U��7 �q XeSqlPkg
C � ��6 C � � � � � � c���� � XeSqlPkg_bdc_create_external_table_request_completed Description Fires when a request to create external table request is completed. Guid {15C05EBD-3661-45A6-927D-0F0BF4DE1D01} locale MS\0x409 DisplayName bdc_create_external_table_request_completed � X e S q l P k g U��7 �k XeSqlPkg
C � ��4 A � � � � � � c����� � XeSqlPkg_bdc_drop_external_table_request_completed Description Fires when a request to drop external table request is completed. Guid {BB2F56F1-FFC7-4278-9A01-E724CBBA5605} locale MS\0x409 DisplayName bdc_drop_external_table_request_completed � X e S q l P k g �Y��7 �b XeSqlPkg
C � ��/ < � � � � � � c����� � XeSqlPkg_hadr_filestream_message_file_request Description Occurs when HADR FileStream transport traces a file write message. Guid {3620FA1D-853A-475a-BC37-BCF48EA0650C} locale MS\0x409 DisplayName hadr_filestream_message_file_request �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 3�n�^��
͝��C�} % J.3�� Z � WDMClassesOfDriver TP_V2_CBDequeue C:\Windows\system32\kernelbase.dll[MofResourceName] ui[MofResourceName] ] � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � R � MSFT_CliQualifier Values
S \ k � � � � � � + ? Success Access Denied Unspecified failure Invalid object Object already exists File system not NTFS Platform not NT/Windows 2000 Drive not the same Directory not empty Sharing violation Invalid start file Privilege not held Invalid parameter CopyEx �@ � A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 �> [ e �$ �+ , � MSFT_CliVerb DeleteEx The DeleteEx method will delete the logical file (or directory) specified in the object path. DeleteEx returns an integer value of 0 if the file was successfully deleted, and any other number to indicate an error. DeleteEx is an extended version of the Delete method./nIt returns one of the following integer values:/n0 - The request was successful./n2 - Access was denied./n8 - An unspecified failure occurred./n9 - The name specified was invalid./n10 - The object specified already exists./n11 - The file system is not NTFS./n12 - The platform is not Windows NT or Windows 2000./n13 - The drive is not the same./n14 - The directory is not empty./n15 - There has been a sharing violation./n16 - The start file specified was invalid./n17 - A privilege required for the operation is not held./n21 - A parameter specified is invalid./n DeleteEx q 9 � � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING 3 � � � � � MSFT_CliParam The StartFileName input parameter is a string that names the child file/directory to use as a starting point for DeleteEx.The StartFileName property typically, is the StopFileName parameter specifying the file or directory at which anerror occurred from the previous method call. If this parameter is NULL, the operation is performed on the file ordirectory specified in the ExecMethod call. StartFileName � � D [ r � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING j , � MSFT_CliQualifier CIMTYPE $ string e � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � ) � MSFT_CliQualifier Description ( The StartFileName input parameter is a string that names the child file/directory to use as a starting point for DeleteEx.The StartFileName property typically, is the StopFileName parameter specifying the file or directory at which anerror occurred from t � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e " � MSFT_CliQualifier ID 1 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING k + � MSFT_CliQualifier optional % True STRING S � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � 3 � � : B � MSFT_CliParam The StopFileName output parameter is a string representing the name of the file/directory where DeleteEx failed. This string parameter will be null if DeleteEx succeeds. StopFileName � � " � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING j , � MSFT_CliQualifier CIMTYPE $ string � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING a � � MSFT_CliQualifier Description ( The StopFileName output parameter is a string representing the name of the file/directory where DeleteEx failed. This string parameter will be null if DeleteEx succeeds. � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e " � MSFT_CliQualifier ID 0 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING f & � MSFT_CliQualifier Out True STRING �$ ' �( e � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � ) � MSFT_CliQualifier Description ( The DeleteEx method will delete the logical file (or directory) specified in the object path. DeleteEx returns an integer value of 0 if the file was successfully deleted, and any other number to indicate an error. DeleteEx is an extended version of the De � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap
U X [ ^ a e i m q u y } � 0 2 8 9 10 11 12 13 14 15 16 17 21 X � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � R � MSFT_CliQualifier Values
S \ k � � � � � � + ? Success Access Denied Unspecified failure Invalid object Object already exists File system not NTFS Platform not NT/Windows 2000 Drive not the same Directory not empty Sharing violation Invalid start file Privilege not held Invalid parameter DeleteEx ���� � �XG�9 � ���]# ��"w$ �ƍ % � ��+=� � ١�E � W M I E v e n t �jj��� K WMIEvent
4 ! �� � �� � & / 5 ] e � � � � j o � � q � �
� � J T � � � � - > � _UUU�����������������������������������������������������������������������{ � MSMCAEvent_MemoryHierarchyError WMI WmiProv guid {cede75a0-a77f-452b-8f2f-541f926db0f9} Active
� � boolean AdditionalErrors #
� � � uint32 WmiDataId Address
7 +
� (
3 @ uint64 WmiDataId Description The address at which the error occurred. Cpu
� � � uint32 WmiDataId ErrorSeverity 8
�
N X uint8 WmiDataId Values - : A Recoverable Fatal Correctable ValueMap h k n 0 1 2 InstanceName '
� � � �� � �� string LogToEventlog '
� � � uint32 WmiDataId MemoryHierarchyLevel / 8
� f n y � � � uint32 WmiDataId ValueMap � � � � 0 1 2 3 Values � � � � Level 0 Level 1 Level 2 Generic RawRecord C +
� ' . 9 D uint8 WmiDataId WmiSizeIs Size RecordId
� � � uint64 WmiDataId RequestType 3 8
� � � � F N uint32 WmiDataId ValueMap + . 1 4 7 : = @ C 0 1 2 3 4 5 6 7 8 Values v � � � � � � � � Generic Error Generic Read Generic Write Data Read Data Write Instruction Fetch Prefetch Injection Snoop Size ?
� " uint32 WmiDataId TransactionType
+ 8
� � � � � � � uint32 WmiDataId ValueMap � � � 0 1 2 Values � � � Instruction Cache Data Cache Generic Type 8
� F N Y a � � uint32 WmiDataId Values > ] p � � � � � � � 6 M b u � � � � �
9
]
�
�
�
�
5 _ � � � � $ ? W m � � � � � �
-
Q
u
�
�
�
�
�
1 J j ~ MCA_WARNING_CACHE MCA_ERROR_CACHE MCA_WARNING_TLB MCA_ERROR_TLB MCA_WARNING_CPU_BUS MCA_ERROR_CPU_BUS MCA_WARNING_REGISTER_FILE MCA_ERROR_REGISTER_FILE MCA_WARNING_MAS MCA_ERROR_MAS MCA_WARNING_MEM_UNKNOWN MCA_ERROR_MEM_UNKNOWN MCA_WARNING_MEM_1_2 MCA_ERROR_MEM_1_2 MCA_WARNING_MEM_1_2_5 MCA_ERROR_MEM_1_2_5 MCA_WARNING_MEM_1_2_5_4 MCA_ERROR_MEM_1_2_5_4 MCA_WARNING_SYSTEM_EVENT MCA_ERROR_SYSTEM_EVENT MCA_WARNING_PCI_BUS_PARITY MCA_ERROR_PCI_BUS_PARITY MCA_WARNING_PCI_BUS_PARITY_NO_INFO MCA_ERROR_PCI_BUS_PARITY_NO_INFO MCA_WARNING_PCI_BUS_SERR MCA_ERROR_PCI_BUS_SERR MCA_WARNING_PCI_BUS_SERR_NO_INFO MCA_ERROR_PCI_BUS_SERR_NO_INFO MCA_WARNING_PCI_BUS_MASTER_ABORT MCA_ERROR_PCI_BUS_MASTER_ABORT MCA_WARNING_PCI_BUS_MASTER_ABORT_NO_INFO MCA_ERROR_PCI_BUS_MASTER_ABORT_NO_INFO MCA_WARNING_PCI_BUS_TIMEOUT MCA_ERROR_PCI_BUS_TIMEOUT MCA_WARNING_PCI_BUS_TIMEOUT_NO_INFO MCA_ERROR_PCI_BUS_TIMEOUT_NO_INFO MCA_WARNING_PCI_BUS_UNKNOWN MCA_ERROR_PCI_BUS_UNKNOWN MCA_WARNING_PCI_DEVICE MCA_ERROR_PCI_DEVICE MCA_WARNING_SMBIOS MCA_ERROR_SMBIOS MCA_WARNING_PLATFORM_SPECIFIC MCA_ERROR_PLATFORM_SPECIFIC MCA_WARNING_UNKNOWN MCA_ERROR_UNKNOWN MCA_WARNING_UNKNOWN_NO_CPU MCA_ERROR_UNKNOWN_NO_CPU MCA_WARNING_CMC_THRESHOLD_EXCEEDED MCA_WARNING_CPE_THRESHOLD_EXCEEDED MCA_WARNING_CPU_THERMAL_THROTTLED MCA_INFO_CPU_THERMAL_THROTTLING_REMOVED MCA_WARNING_CPU MCA_ERROR_CPU MCA_MEMORYHIERARCHY_ERROR MCA_TLB_ERROR MCA_BUS_ERROR MCA_BUS_TIMEOUT_ERROR MCA_INTERNALTIMER_ERROR MCA_MICROCODE_ROM_PARITY_ERROR MCA_EXTERNAL_ERROR MCA_FRC_ERROR ValueMap > � � � � � � � � � � # / ; G S _ k w � � � � � � � � � � � + 7 C O [ g s � � � � � � � � � � ' 3 ? K W c o 0x8005003C 0xC005003D 0x8005003E 0xC005003F 0x80050040 0xC0050041 0x80050042 0xC0050043 0x80050044 0xC0050045 0x80050046 0xC0050047 0x80050048 0xC0050049 0x8005004A 0xC005004B 0x8005004C 0xC005004D 0x8005004E 0xC005004F 0x80050050 0xC0050051 0x80050052 0xC0050053 0x80050054 0xC0050055 0x80050056 0xC0050057 0x80050058 0xC0050059 0x8005005A 0xC005005B 0x8005005C 0xC005005D 0x8005005E 0xC005005F 0x80050060 0xC0050061 0x80050062 0xC0050063 0x80050064 0xC0050065 0x80050066 0xC0050067 0x80050068 0xC0050069 0x8005006A 0xC005006B 0x8005006D 0x8005006E 0x8005006F 0x40050070 0x80050071 0xC0050072 0xC0050078 0xC0050079 0xC005007A 0xC005007B 0xC005007C 0xC005007D 0xC005007E 0xC005007F � M S N d i s ��jj��� MSNdis A �� � �� � ' - U a i � � � U����������= � MSNdis_EnumerateAdapter WMI WMIProv guid {981f2d7f-b1f3-11d0-8dd7-00c04fc3358c} WmiExpense Active
� � � �� boolean DeviceName )
� � � ��� string WmiDataId InstanceName '
� 5 � �� � �� string ns � W M I E v e n t ��jj��� WMIEvent
A �� � �� � " + 1 Y e m � � � _�����������������������A � MSNdis_NotifyAdapterRemoval WMI WMIProv guid {981f2d80-b1f3-11d0-8dd7-00c04fc3358c} WmiExpense Active
� � � �� boolean DeviceName )
� � � ��� string WmiDataId InstanceName '
� 9 � �� � �� string � W M I E v e n t ��jj��� WMIEvent
A �� � �� � " + 1 Y e m � � � _�����������������������A � MSNdis_NotifyAdapterArrival WMI WMIProv guid {981f2d81-b1f3-11d0-8dd7-00c04fc3358c} WmiExpense Active
� � � �� boolean DeviceName )
� � � ��� string WmiDataId InstanceName '
� 9 � �� � �� string � M S N d i s
��jj��c MSNdis A �� � �� � & , T ` h � � e������� � MSNdis_NdisEnumerateVc WMI WMIProv guid {981f2d82-b1f3-11d0-8dd7-00c04fc3358c} WmiExpense Active
� � � �� boolean InstanceName '
� � � �� � �� string IP � W M I E v e n t ��jj��q WMIEvent
A �� � �� � & , T ` h � � _������������������� � MSNdis_NotifyVcRemoval WMI WMIProv guid {981f2d79-b1f3-11d0-8dd7-00c04fc3358c} WmiExpense Active
� � � �� boolean InstanceName '
� � � �� � �� string � W M I E v e n t ��jj��q WMIEvent
A �� � �� � & , T ` h � � _������������������� � MSNdis_NotifyVcArrival WMI WMIProv guid {182f9e0c-b1f3-11d0-8dd7-00c04fc3358c} WmiExpense Active
� � � �� boolean InstanceName '
� � � �� � �� string �ing �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 F�����
͝��C�� ) ��8��� ^ � WDMClassesOfDriver PortCls_AudioEngine C:\Windows\System32\Drivers\portcls.SYS[PortclsMof] �{ � A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 �y g s �5 2= >= � MSFT_CliVerb CompressEx The CompressEx method compresses the logical file (or directory) specified in the object path. CompressEx returns an integer value of 0 if the file was successfully compressed, and any other number to indicate an error. CompressEx is an extended version of the Compress method./nIt returns one of the following integer values:/n0 - The request was successful./n2 - Access was denied./n8 - An unspecified failure occurred./n9 - The name specified was invalid./n10 - The object specified already exists./n11 - The file system is not NTFS./n12 - The platform is not Windows NT or Windows 2000./n13 - The drive is not the same./n14 - The directory is not empty./n15 - There has been a sharing violation./n16 - The start file specified was invalid./n17 - A privilege required for the operation is not held./n21 - A parameter specified is invalid./n CompressEx � � �' 8 � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � 3 # � MSFT_CliParam The Recursive input parameter is a boolean that indicates whether the compression will be applied recursively to files and directories within the directory specified by the CIM_LogicalFile instance.Note for file instances the Recursive input parameter is ignored. Recursive ; W � � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING j - � MSFT_CliQualifier CIMTYPE $ boolean e � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � ) � MSFT_CliQualifier Description ( The Recursive input parameter is a boolean that indicates whether the compression will be applied recursively to files and directories within the directory specified by the CIM_LogicalFile instance.Note for file instances the Recursive input parameter is � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e " � MSFT_CliQualifier ID 2 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING k + � MSFT_CliQualifier optional % True BOOLEAN � � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING 3 � � � � � MSFT_CliParam The StartFileName input parameter is a string that names the child file/directory to use as a starting point for CompressEx.The StartFileName property typically, is the StopFileName parameter specifying the file or directory at which anerror occurred from the previous method call. If this parameter is NULL, the operation is performed on the file ordirectory specified in the ExecMethod call. StartFileName � � F ] t � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING j , � MSFT_CliQualifier CIMTYPE $ string e � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � ) � MSFT_CliQualifier Description ( The StartFileName input parameter is a string that names the child file/directory to use as a starting point for CompressEx.The StartFileName property typically, is the StopFileName parameter specifying the file or directory at which anerror occurred from � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e " � MSFT_CliQualifier ID 1 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING k + � MSFT_CliQualifier optional % True STRING : � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � 3 � � 0 8 � MSFT_CliParam The StopFileName output parameter is a string representing the name of the file/directory where CompressEx failed. StopFileName will be null if the method succeeds. StopFileName � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING j , � MSFT_CliQualifier CIMTYPE $ string
� @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING \ � � MSFT_CliQualifier Description ( The StopFileName output parameter is a string representing the name of the file/directory where CompressEx failed. StopFileName will be null if the method succeeds. � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e " � MSFT_CliQualifier ID 0 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING f & � MSFT_CliQualifier Out True STRING �5 D8 �9 e � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � ) � MSFT_CliQualifier Description ( The CompressEx method compresses the logical file (or directory) specified in the object path. CompressEx returns an integer value of 0 if the file was successfully compressed, and any other number to indicate an error. CompressEx is an extended version o � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap
U X [ ^ a e i m q u y } � 0 2 8 9 10 11 12 13 14 15 16 17 21 X � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � ���� H `��� v �$�> � �؝�0 � ��v� x �{m�_ T �ᚃ� X e S q l P k g _ v d w _ b a c k e n d _ e x e c u t i o n 1U��7 �� � ( XeSqlPkg_vdw_backend_execution ) � �� " 0 < � � : D � � : R � � � ? Y � � � D _ � � @ J � � 9 I � � W e � � +
;
�
�
�
�
> U � � � ] n � � 7
G
�
�
+ u � � � j ~ WUUUUUUU����������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������� � vdw_backend_execution EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid clr_time
< )
� ' /
� �� uint64 WmiDataId cpu_time )
� { � � �� uint64 WmiDataId distributed_execution_id � C
� � � �� / 7 string WmiDataId StringTermination NullTerminated Format w distributed_query_hash � C
� � � � ��� � � � string WmiDataId StringTermination NullTerminated Format w distributed_query_operator_id � C
� T \ � ��g z � � string WmiDataId StringTermination NullTerminated Format w distributed_request_id � C
� � � �� $ 4 < string WmiDataId StringTermination NullTerminated Format w distributed_scheduler_id � C
� � � � ��� � � � string WmiDataId StringTermination NullTerminated Format w distributed_statement_id � C
� V ^ � ��i | � � string WmiDataId StringTermination NullTerminated Format w distributed_submission_id � C
� � �� ) 9 A string WmiDataId StringTermination NullTerminated Format w distributed_task_group_id � C
� � � � ��� � � � string WmiDataId StringTermination NullTerminated Format w dop D )
� - 5 � �� uint64 WmiDataId duration )
� � � � �� uint64 WmiDataId exception_message � C
� � � �� . 6 string WmiDataId StringTermination NullTerminated Format w exception_type � C
� � � � ��� � � � string WmiDataId StringTermination NullTerminated Format w FragmentId 6
� + 3 > K � �� uint32 WmiDataId Description FragmentId is_recompile t )
� � � � �� sint8 WmiDataId local_query_hash
� 6
�
� ��
"
object WmiDataId Extension Variant log_bytes_used \ )
� r
z
� �� uint64 WmiDataId logical_io_reads $ )
� �
�
� �� uint64 WmiDataId logical_io_writes , )
� + 3 � �� uint64 WmiDataId num_physical_io_reads d )
� � � � �� uint64 WmiDataId physical_io_reads 4 )
� � � � �� uint64 WmiDataId query_max_used_memory L )
� J R � �� uint64 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength rowcount
T )
� $
,
� �� uint64 WmiDataId SequenceNumber 6
� �
�
�
�
� �� uint32 WmiDataId Description SequenceNumber sql_error_number u )
� � �� uint64 WmiDataId sql_error_severity � )
� b j � �� uint64 WmiDataId sql_error_state } )
� � � � �� uint64 WmiDataId status � C
� ) 1 � ��< O _ g string WmiDataId StringTermination NullTerminated Format w temp_db_space_used l )
� � � � �� uint64 WmiDataId � X e S q l P k g 2U��7 �N XeSqlPkg
C � �� ( � � � � � � c����� � XeSqlPkg_vdw_query_phy_op Description Optimizer fires this event when PhyOp tree for the query on VDW frontend is available. Guid {2f5c1a47-ead7-2895-a3a7-3a6ca0130338} locale MS\0x409 DisplayName vdw_query_phy_op � X e S q l P k g _ v d w _ q u e r y _ p h y _ o p 3U��7 �� # XeSqlPkg_vdw_query_phy_op ) � �� + 7 � � ] i � � � W������������������������� � vdw_query_phy_op EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid FragmentId 6
� 1 9 D Q � �� uint32 WmiDataId Description FragmentId phy_op_xml C
� � � � ��� � � � string WmiDataId StringTermination NullTerminated Format w RemainingLength 6
� P X c p � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g 4U��7 �� XeSqlPkg
C � ��' 4 � � � � � c���� � XeSqlPkg_login_request_to_page_server Description Fires when login request is routed to a page server instead of compute. This is fired only for unexpected frontend connections. Guid {f4ce6d74-9c1b-4f4d-a94a-3b1fa0eab402} locale MS\0x409 DisplayName login_request_to_page_server �% X e S q l P k g _ l o g i n _ r e q u e s t _ t o _ p a g e _ s e r v e r 5U��7 � / XeSqlPkg_login_request_to_page_server ' ) � �� ) 7 C � � i z � � W���������������������s � login_request_to_page_server EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid FragmentId 6
� = E P ] � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� C K V c � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g *X��7 �, XeSqlPkg
C � �� + [ a � � � � c����� � XeSqlPkg_calculate_dop_begin Description Degree of Parallelism (DOP) calculation begins Guid {81d5eb0b-acbd-4b23-9abe-bc93d6e3d0f4} locale MS\0x409 DisplayName calculate_dop_begin �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 4�n�^��
͝��C�| $ J.3�� Y � WDMClassesOfDriver TP_V2_CBCancel C:\Windows\system32\kernelbase.dll[MofResourceName] Name] ofResourceName] ication_auditing_traffic � R � MSFT_CliQualifier Values
S \ k � � � � � � + ? Success Access Denied Unspecified failure Invalid object Object already exists File system not NTFS Platform not NT/Windows 2000 Drive not the same Directory not empty Sharing violation Invalid start file Privilege not held Invalid parameter CompressEx A| � A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 Fz u � �5 X= f= � MSFT_CliVerb UncompressEx The UncompressEx method uncompresses the logical file (or directory) specified in the object path. UncompressEx returns an integer value of 0 if the file was successfully decompressed, and any other number to indicate an error. UncompressEx is an extended version of the Uncompress method./nIt returns one of the following integer values:/n0 - The request was successful./n2 - Access was denied./n8 - An unspecified failure occurred./n9 - The name specified was invalid./n10 - The object specified already exists./n11 - The file system is not NTFS./n12 - The platform is not Windows NT or Windows 2000./n13 - The drive is not the same./n14 - The directory is not empty./n15 - There has been a sharing violation./n16 - The start file specified was invalid./n17 - A privilege required for the operation is not held./n21 - A parameter specified is invalid./n UncompressEx � � �' > � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � 3 %
� MSFT_CliParam The Recursive input parameter is a boolean that indicates whether the decompression will be applied recursively to files and directories within the directory specified by the CIM_LogicalFile instance.Note for file instances the Recursive input parameter is ignored. Recursive = Y � � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING j - � MSFT_CliQualifier CIMTYPE $ boolean e � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � ) � MSFT_CliQualifier Description ( The Recursive input parameter is a boolean that indicates whether the decompression will be applied recursively to files and directories within the directory specified by the CIM_LogicalFile instance.Note for file instances the Recursive input parameter i � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e " � MSFT_CliQualifier ID 2 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING k + � MSFT_CliQualifier optional % True BOOLEAN � � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING $ 3 � � � � � MSFT_CliParam The StartFileName input parameter is a string that names the child file/directory to use as a starting point for UncompressEx.The StartFileName property typically, is the StopFileName parameter specifying the file or directory at which anerror occurred from the previous method call. If this parameter is NULL, the operation is performed on the file ordirectory specified in the ExecMethod call. StartFileName � � H _ v � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING j , � MSFT_CliQualifier CIMTYPE $ string e � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � ) � MSFT_CliQualifier Description ( The StartFileName input parameter is a string that names the child file/directory to use as a starting point for UncompressEx.The StartFileName property typically, is the StopFileName parameter specifying the file or directory at which anerror occurred fr � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e " � MSFT_CliQualifier ID 1 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING k + � MSFT_CliQualifier optional % True STRING D � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � 3 � � 4 < � MSFT_CliParam The StopFileName output parameter is a string representing the name of the file/directory where UncompressEx failed. StopFileName will be null if the method succeeds. StopFileName � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING j , � MSFT_CliQualifier CIMTYPE $ string � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING ^ � � MSFT_CliQualifier Description ( The StopFileName output parameter is a string representing the name of the file/directory where UncompressEx failed. StopFileName will be null if the method succeeds. � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e " � MSFT_CliQualifier ID 0 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING f & � MSFT_CliQualifier Out True STRING 6 j8 �9 e � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � ) � MSFT_CliQualifier Description ( The UncompressEx method uncompresses the logical file (or directory) specified in the object path. UncompressEx returns an integer value of 0 if the file was successfully decompressed, and any other number to indicate an error. UncompressEx is an extended � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap
U X [ ^ a e i m q u y } � 0 2 8 9 10 11 12 13 14 15 16 17 21 X � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � R � MSFT_CliQualifier Values
S \ k � � � � � � + ? Success Access Denied Unspecified failure Invalid object Object already exists File system not NTFS Platform not NT/Windows 2000 Drive not the same Directory not empty Sharing violation Invalid start file Privilege not held Invalid parameter UncompressEx �/ � A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 �- & ) � E ] � MSFT_CliVerb GetEffectivePermission The GetEffectivePermission method determines whether the caller has the aggregated permissions specified by the Permission argument not only on the file object, but on the share the file or directory resides on (if it is on a share). GetEffectivePermission 1 � � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � 3 { � I Q � MSFT_CliParam The Permissions input parameter is a bit array of the permissions that the caller wishes to inquire about. Permissions � 6 + G 2
� � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier BitMap W Z ] ` c f i l o r v z ~ � 0 1 2 3 4 5 6 7 8 16 17 18 19 20 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING C � � MSFT_CliQualifier BitValues Z � � $ V u � � � � � � FILE_READ_DATA (file) or FILE_LIST_DIRECTORY (directory) FILE_WRITE_DATA (file) or FILE_ADD_FILE (directory) FILE_APPEND_DATA (file) or FILE_ADD_SUBDIRECTORY (directory) FILE_READ_EA FILE_WRITE_EA FILE_EXECUTE (file) or FILE_TRAVERSE (directory) FILE_DELETE_CHILD (directory) FILE_READ_ATTRIBUTES FILE_WRITE_ATTRIBUTES DELETE READ_CONTROL WRITE_DAC WRITE_OWNER SYNCHRONIZE � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING j , � MSFT_CliQualifier CIMTYPE $ uint32 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING " � � MSFT_CliQualifier Description ( The Permissions input parameter is a bit array of the permissions that the caller wishes to inquire about. � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e " � MSFT_CliQualifier ID 0 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True UINT32 � & O � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � MSFT_CliQualifier Description ( The GetEffectivePermission method determines whether the caller has the aggregated permissions specified by the Permission argument not only on the file object, but on the share the file or directory resides on (if it is on a share). � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING m < � MSFT_CliQualifier Privileges ' SeSecurityPrivilege GetEffectivePermission � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � b p 8 � MSFT_CliProperty Availability The Availability property indicates the availability of the DMA. Availability | � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING k D � MSFT_CliQualifier ValueMap 5 8 ; > A 1 2 3 4 5 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values 3 : C N d Other Unknown Available In Use/Not Available In Use and Available/Shareable 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � S ^ � MSFT_CliProperty BurstMode Indicate whether the DMA channel supports burst mode BurstMode � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier v � � z � MSFT_CliProperty ByteMode Indicates whether DMA may execute in 'count by byte' mode (value=4) or not (value=3). Also, "Other" (1) and "Unknown" (2) may be defined. ByteMode � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING k = � MSFT_CliQualifier ValueMap 1 4 7 : 1 2 3 4 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values / 6 ? d Other Unknown Not execute in 'count by byte' mode Execute in 'count by byte' mode . 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � ! | � F � MSFT_CliProperty ChannelTiming DMA channel timing. For example, "Type A" (value =4) or "Type F" (6) could be specified. ChannelTiming � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING k K � MSFT_CliQualifier ValueMap 9 < ? B E H 1 2 3 4 5 6 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � o � MSFT_CliQualifier Values S� F D 3 B B D 4 C 4 2 A C 2 F 7 F E F 2 6 4 3 4 0 A 9 E B 7 8 A 5 8 1 F E 5 C 2 8 5 6 1 C B 6 3 E D F 7 8 0 B 3 2 9 E A C 2 E E 4 �b��5��͝��C�Õ + G q q !q <q �� � MSFT_CliAlias � F N u � � � � �
U�������������������������4 � MSFT_CliConnection Authority
� > STRING Locale
� m STRING NameSpace
� � STRING Password
� � STRING Server
� � STRING User
� , STRING | � ( + � MSFT_CliConnection ms_409 ROOT\CIMV2 . Group account management. _ j �/ 03 �H �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty r � MSFT_CliFormat table STATUS + � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � i q � � MSFT_CliProperty Status The Status property is a string indicating the current status of the object. Status � � / � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 10 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap A E L V _ j t ~ OK Error Degraded Unknown Pred Fail Starting Stopping Service � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values ? C J T ] h r | OK Error Degraded Unknown Pred Fail Starting Stopping Service V 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � � MSFT_CliProperty Name The Name property indicates the name of the group account on the domain specified by the Domain member of this class. Name s �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � + � MSFT_CliFormat SYSTEM
D � � U � b
�
x � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty __CLASS __CLASS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __DERIVATION __DERIVATION � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __DYNASTY __DYNASTY � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty __GENUS __GENUS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier t � , � MSFT_CliProperty __NAMESPACE __NAMESPACE � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o � " � MSFT_CliProperty __PATH __PATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier y � $ 6 � MSFT_CliProperty __PROPERTY_COUNT __PROPERTY_COUNT � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __RELPATH __RELPATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier q � & � MSFT_CliProperty __SERVER __SERVER � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __SUPERCLASS __SUPERCLASS K �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty X � � MSFT_CliFormat INSTANCE " � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o � " � MSFT_CliProperty __PATH __PATH � �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � �
� MSFT_CliFormat TABLE BRIEF 2 � _ � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier L Q Z } � MSFT_CliProperty Caption The Caption property is a short textual description. Caption b � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 64 E 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � | � � MSFT_CliProperty Domain The Domain property indicates the name of the Windows domain to which the group account belongs. Domain V 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � � MSFT_CliProperty Name The Name property indicates the name of the group account on the domain specified by the Domain member of this class. Name ) 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � c h � MSFT_CliProperty SID The SID property contains the security identifier (SID) for this account. SID A( �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty N' l � MSFT_CliFormat LIST FULL @ z � e ( � 6 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � h u � MSFT_CliProperty Description The Description property provides a textual description of the object. Description E 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � | � � MSFT_CliProperty Domain The Domain property indicates the name of the Windows domain to which the group account belongs. Domain D 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier
� v � � MSFT_CliProperty InstallDate The InstallDate property is datetime value indicating when the object was installed. InstallDate V 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � � MSFT_CliProperty Name The Name property indicates the name of the group account on the domain specified by the Domain member of this class. Name � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � �� � � MSFT_CliProperty LocalAccount The LocalAccount property indicates whether the account is defined on the local machine. To retrieve only accounts defined on the local machine state a query that includes the condition 'LocalAccount=TRUE'. LocalAccount p 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier 6 � � � � MSFT_CliProperty SID The SID property contains the security identifier (SID) for this account. a SID is a string value of variable length used to identify a trustee. SID � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � B K > � MSFT_CliProperty SIDType The SIDType property contains enumerated values that specify the type of security identifier (SID). SIDTypes include:/nSidTypeUser - Indicates a user SID./nSidTypeGroup - Indicates a group SID./nSidTypeDomain - Indicates a domain SID./nSidTypeAlias - Indicates an alias SID./nSidTypeWellKnownGroup - Indicates a SID for a well-known group./nSidTypeDeletedAccount - Indicates a SID for a deleted account./nSidTypeInvalid - Indicates an invalid SID./nSidTypeUnknown - Indicates an unknown SID type./nSidTypeComputer - Indicates a SID for a computer./n SIDType W � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � ` � MSFT_CliQualifier ValueMap E H K N Q T W Z ] 1 2 3 4 5 6 7 8 9 U � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values C P ^ m { � � � � SidTypeUser SidTypeGroup SidTypeDomain SidTypeAlias SidTypeWellKnownGroup SidTypeDeletedAccount SidTypeInvalid SidTypeUnknown SidTypeComputer � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � i q � � MSFT_CliProperty Status The Status property is a string indicating the current status of the object. Status � � / � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 10 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap A E L V _ j t ~ OK Error Degraded Unknown Pred Fail Starting Stopping Service � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values ? C J T ] h r | OK Error Degraded Unknown Pred Fail Starting Stopping Service Group Select * from Win32_Group Dq G$ � A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 L" ? G c k � MSFT_CliVerb Rename The Rename() allows for the renaming of the group name; a key in this class. The functionality to change the key property "Name" is implemented as a method to provide a separate context for the new name distinguishable from the key name associated with the instance to be modified in this class. Rename O �
� ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING 3 � � � � � MSFT_CliParam The Name property indicates the name of the Win32 user account on the domain specified by the Domain member of this class./nExample: thomasw Name � � � � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING j , � MSFT_CliQualifier CIMTYPE $ string � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING D � � MSFT_CliQualifier Description ( The Name property indicates the name of the Win32 user account on the domain specified by the Domain member of this class./nExample: thomasw � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e " � MSFT_CliQualifier ID 0 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � # X � MSFT_CliQualifier MappingStrings + Win32API|Network Management Structures|name STRING � � � e � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � ) � MSFT_CliQualifier Description ( The Rename() allows for the renaming of the group name; a key in this class. The functionality to change the key property "Name" is implemented as a method to provide a separate context for the new name distinguishable from the key name associated with th � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING n . � MSFT_CliQualifier Implemented ( True � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING q # 0 � MSFT_CliQualifier MappingStrings + WMI � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � l � MSFT_CliQualifier Values
G P d w � � � � K \ Success Instance not found Instance required Invalid parameter Group not found Domain not found Operation is allowed only on the primary domain controller of the domain Operation is not allowed on specified special groups; user, admin, local or guest. Other API error Internal error Rename k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING 3 � � � � � MSFT_CliParam The Name property indicates the name of the Win32 user account on the domain specified by the Domain member of this class./nExample: thomasw Name � � � � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING j , � MSFT_CliQualifier CIMTYPE $ string � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING D � � MSFT_CliQualifier Description ( The Name property indicates the name of the Win32 user account on the domain specified by the Domain member of this class./nExample: thomasw � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e " � MSFT_CliQualifier ID 0 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � # X � MSFT_CliQualifier MappingStrings + Win32API|Network Management Structures|name STRING jL F D 3 B B D 4 C 4 2 A C 2 F 7 F E F 2 6 4 3 4 0 A 9 E B 7 8 A 5 8 1 F E 5 C 2 8 5 6 1 C B 6 3 E D F 7 8 0 B 3 2 9 E A C 2 E E 4 �b��5��͝��C��K � + � rK �K �K �K� MSFT_CliAlias � F N u � � � � �
U�������������������������4 � MSFT_CliConnection Authority
� > STRING Locale
� m STRING NameSpace
� � STRING Password
� � STRING Server
� � STRING User
� , STRING | � ( + � MSFT_CliConnection ms_409 ROOT\CIMV2 . The Win32_IDEController class manages the capabilities of an IDE controller device. � � ^! �F � K �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty X � � MSFT_CliFormat INSTANCE " � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o � " � MSFT_CliProperty __PATH __PATH s �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � + � MSFT_CliFormat SYSTEM
D � � U � b
�
x � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty __CLASS __CLASS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __DERIVATION __DERIVATION � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __DYNASTY __DYNASTY � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty __GENUS __GENUS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier t � , � MSFT_CliProperty __NAMESPACE __NAMESPACE � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o � " � MSFT_CliProperty __PATH __PATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier y � $ 6 � MSFT_CliProperty __PROPERTY_COUNT __PROPERTY_COUNT � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __RELPATH __RELPATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier q � & � MSFT_CliProperty __SERVER __SERVER � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __SUPERCLASS __SUPERCLASS �% �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty �$ H � MSFT_CliFormat STATUS $ � � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � � � MSFT_CliProperty Status The Status property is a string indicating the current status of the object. Various operational and non-operational statuses can be defined. Operational statuses are "OK", "Degraded" and "Pred Fail". "Pred Fail" indicates that an element may be functioning properly but predicting a failure in the near future. An example is a SMART-enabled hard drive. Non-operational statuses can also be specified. These are "Error", "Starting", "Stopping" and "Service". The latter, "Service", could apply during mirror-resilvering of a disk, reload of a user permissions list, or other administrative work. Not all such work is on-line, yet the managed element is neither "OK" nor in one of the other states. Status � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 10 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING ` � � MSFT_CliQualifier ValueMap Q U \ f o z � � � � � � OK Error Degraded Unknown Pred Fail Starting Stopping Service Stressed NonRecover No Contact Lost Comm � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING Q � � MSFT_CliQualifier Values O S Z d m x � � � � � � OK Error Degraded Unknown Pred Fail Starting Stopping Service Stressed NonRecover No Contact Lost Comm m 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier 3 � � � � MSFT_CliProperty Name The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property. Name �� �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty �� >� � MSFT_CliFormat LIST FULL | > �* @- ;0 u2 �4 <7 �9 x< �> A �C F MH /T �W �f �w �� �� �� � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � e s � � MSFT_CliProperty Availability The availability and status of the device. For example, the Availability property indicates that the device is running and has full power (value=3), or is in a warning (4), test (5), degraded (10) or power save state (values 13-15 and 17). Regarding the power saving states, these are defined as follows: Value 13 ("Power Save - Unknown") indicates that the device is known to be in a power save mode, but its exact status in this mode is unknown; 14 ("Power Save - Low Power Mode") indicates that the device is in a power save state but still functioning, and may exhibit degraded performance; 15 ("Power Save - Standby") describes that the device is not functioning but could be brought to full power 'quickly'; and value 17 ("Power Save - Warning") indicates that the device is in a warning state, though also in a power save mode. Availability � O � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap u x { ~ � � � � � � � � � � � � � � � � � 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING L � � MSFT_CliQualifier Values s z � � � � � � � � � � 3 I V l t � Other Unknown Running/Full Power Warning In Test Not Applicable Power Off Off Line Off Duty Degraded Not Installed Install Error Power Save - Unknown Power Save - Low Power Mode Power Save - Standby Power Cycle Power Save - Warning Paused Not Ready Not Configured Quiesced � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � q z � � MSFT_CliProperty Caption The Caption property is a short textual description (one-line string) of the object. Caption � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 64 � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � * a y � � MSFT_CliProperty ConfigManagerErrorCode Indicates the Win32 Configuration Manager error code. ConfigManagerErrorCode � 9 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values � � � � � / u � � 0 K ` � � l � � ) � � F � � � 0 ` � This device is working properly. This device is not configured correctly. Windows cannot load the driver for this device. The driver for this device might be corrupted, or your system may be running low on memory or other resources. This device is not working properly. One of its drivers or your registry might be corrupted. The driver for this device needs a resource that Windows cannot manage. The boot configuration for this device conflicts with other devices. Cannot filter. The driver loader for the device is missing. This device is not working properly because the controlling firmware is reporting the resources for the device incorrectly. This device cannot start. This device failed. This device cannot find enough free resources that it can use. Windows cannot verify this device's resources. This device cannot work properly until you restart your computer. This device is not working properly because there is probably a re-enumeration problem. Windows cannot identify all the resources this device uses. This device is asking for an unknown resource type. Reinstall the drivers for this device. Your registry might be corrupted. System failure: Try changing the driver for this device. If that does not work, see your hardware documentation.Windows is removing this device. This device is disabled. System failure: Try changing the driver for this device. If that doesn't work, see your hardware documentation. This device is not present, is not working properly, or does not have all its drivers installed. Windows is still setting up this device. Windows is still setting up this device. This device does not have valid log configuration. The drivers for this device are not installed. This device is disabled because the firmware of the device did not give it the required resources. This device is using an Interrupt Request (IRQ) resource that another device is using. This device is not working properly because Windows cannot load the drivers required for this device. J 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � + p � � MSFT_CliProperty ConfigManagerUserConfig Indicates whether the device is using a user-defined configuration. ConfigManagerUserConfig � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � % # 6 � MSFT_CliProperty CreationClassName CreationClassName indicates the name of the class or the subclass used in the creation of an instance. When used with the other key properties of this class, this property allows all instances of this class and its subclasses to be uniquely identified. CreationClassName 6 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � h u � MSFT_CliProperty Description The Description property provides a textual description of the object. Description _ 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier % � � � � MSFT_CliProperty DeviceID The DeviceID property indicates a string that uniquely identifies the IDE controller with other devices on the system. DeviceID ` 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier & � � � � MSFT_CliProperty ErrorCleared ErrorCleared is a boolean property indicating that the error reported in LastErrorCode property is now cleared. ErrorCleared � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier q � $ � � � MSFT_CliProperty ErrorDescription ErrorDescription is a free-form string supplying more information about the error recorded in LastErrorCode property, and information on any corrective actions that may be taken. ErrorDescription � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier O � � � � MSFT_CliProperty InstallDate The InstallDate property is datetime value indicating when the object was installed. A lack of a value does not indicate that the object is not installed. Install Date = 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � ! m | � MSFT_CliProperty LastErrorCode LastErrorCode captures the last error code reported by the logical device. LastErrorCode C 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � t � � MSFT_CliProperty Manufacturer The Manufacturer property indicates the manufacturer of the IDE controller device. Manufacturer � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier V � ' � � � MSFT_CliProperty MaxNumberControlled Maximum number of directly addressable entities supported by this Controller. A value of 0 should be used if the number is unknown or unlimited. MaxNumberControlled m 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier 3 � � � � MSFT_CliProperty Name The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property. Name D 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier
� v � � MSFT_CliProperty PNPDeviceID Indicates the Win32 Plug and Play device ID of the logical device. Example: *PNP030b PNPDeviceID � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier �
/ � � S � MSFT_CliProperty PowerManagementCapabilities Indicates the specific power-related capabilities of the logical device. The array values, 0="Unknown", 1="Not Supported" and 2="Disabled" are self-explanatory. The value, 3="Enabled" indicates that the power management features are currently enabled but the exact feature set is unknown or the information is unavailable. "Power Saving Modes Entered Automatically" (4) describes that a device can change its power state based on usage or other criteria. "Power State Settable" (5) indicates that the SetPowerState method is supported. "Power Cycling Supported" (6) indicates that the SetPowerState method can be invoked with the PowerState input variable set to 5 ("Power Cycle"). "Timed Power On Supported" (7) indicates that the SetPowerState method can be invoked with the PowerState input variable set to 5 ("Power Cycle") and the Time parameter set to a specific date and time, or interval, for power-on. PowerManagementCapabilities � k � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values ? H W a j � � � Unknown Not Supported Disabled Enabled Power Saving Modes Entered Automatically Power State Settable Power Cycling Supported Timed Power On Supported � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � , � � � MSFT_CliProperty PowerManagementSupported Boolean indicating that the Device can be power managed - ie, put into a power save state. This boolean does not indicate that power management features are currently enabled, or if enabled, what features are supported. Refer to the PowerManagementCapabilities array for this information. If this boolean is false, the integer value 1, for the string, "Not Supported", should be the only entry in the PowerManagementCapabilities array. PowerManagementSupported � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier �
% j } " � MSFT_CliProperty ProtocolSupported The protocol used by the controller to access 'controlled' devices. ProtocolSupported � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING q � � MSFT_CliQualifier ValueMap / � � � � � � � � � � � $ ( , 0 4 8 < @ D H L P T X \ ` d h l p t x | � � � � 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 r � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � R � MSFT_CliQualifier Values / � � � � � � 8 U o � � � � � � � �
% / 6 J ^ q � � � � � � � � � � � 4 K Other Unknown EISA ISA PCI ATA/ATAPI Flexible Diskette 1496 SCSI Parallel Interface SCSI Fibre Channel Protocol SCSI Serial Bus Protocol SCSI Serial Bus Protocol-2 (1394) SCSI Serial Storage Architecture VESA PCMCIA Universal Serial Bus Parallel Protocol ESCON Diagnostic I2C Power HIPPI MultiBus VME IPI IEEE-488 RS232 IEEE 802.3 10BASE5 IEEE 802.3 10BASE2 IEEE 802.3 1BASE5 IEEE 802.3 10BROAD36 IEEE 802.3 100BASEVG IEEE 802.5 Token-Ring ANSI X3T9.5 FDDI MCA ESDI IDE CMD ST506 DSSI QIC2 Enhanced ATA/IDE AGP TWIRP (two-way infrared) FIR (fast infrared) SIR (serial infrared) IrBus � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � � � MSFT_CliProperty Status The Status property is a string indicating the current status of the object. Various operational and non-operational statuses can be defined. Operational statuses are "OK", "Degraded" and "Pred Fail". "Pred Fail" indicates that an element may be functioning properly but predicting a failure in the near future. An example is a SMART-enabled hard drive. Non-operational statuses can also be specified. These are "Error", "Starting", "Stopping" and "Service". The latter, "Service", could apply during mirror-resilvering of a disk, reload of a user permissions list, or other administrative work. Not all such work is on-line, yet the managed element is neither "OK" nor in one of the other states. Status � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 10 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING ` � � MSFT_CliQualifier ValueMap Q U \ f o z � � � � � � OK Error Degraded Unknown Pred Fail Starting Stopping Service Stressed NonRecover No Contact Lost Comm � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING Q � � MSFT_CliQualifier Values O S Z d m x � � � � � � OK Error Degraded Unknown Pred Fail Starting Stopping Service Stressed NonRecover No Contact Lost Comm
9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � + � � MSFT_CliProperty StatusInfo StatusInfo is a string indicating whether the logical device is in an enabled (value = 3), disabled (value = 4) or some other (1) or unknown (2) state. If this property does not apply to the logical device, the value, 5 ("Not Applicable"), should be used. StatusInfo 7 T � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING k D � MSFT_CliQualifier ValueMap 5 8 ; > A 1 2 3 4 5 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � f � MSFT_CliQualifier Values 3 : C L V Other Unknown Enabled Disabled Not Applicable G 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier
� + T m � MSFT_CliProperty SystemCreationClassName The scoping System's CreationClassName. SystemCreationClassName � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier s � : F � MSFT_CliProperty SystemName The scoping System's Name. SystemName � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier Y � # � � � MSFT_CliProperty TimeOfLastReset The TimeOfLastReset property indicates the date and time this controller was last reset. This could mean the controller was powered down, or reinitialized. TimeOfLastReset �> �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty �= �- � MSFT_CliFormat TABLE BRIEF 6 } � � �$ C 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � t � � MSFT_CliProperty Manufacturer The Manufacturer property indicates the manufacturer of the IDE controller device. Manufacturer m 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier 3 � � � � MSFT_CliProperty Name The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property. Name � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier �
% j } " � MSFT_CliProperty ProtocolSupported The protocol used by the controller to access 'controlled' devices. ProtocolSupported � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING q � � MSFT_CliQualifier ValueMap / � � � � � � � � � � � $ ( , 0 4 8 < @ D H L P T X \ ` d h l p t x | � � � � 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 r � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � R � MSFT_CliQualifier Values / � � � � � � 8 U o � � � � � � � �
% / 6 J ^ q � � � � � � � � � � � 4 K Other Unknown EISA ISA PCI ATA/ATAPI Flexible Diskette 1496 SCSI Parallel Interface SCSI Fibre Channel Protocol SCSI Serial Bus Protocol SCSI Serial Bus Protocol-2 (1394) SCSI Serial Storage Architecture VESA PCMCIA Universal Serial Bus Parallel Protocol ESCON Diagnostic I2C Power HIPPI MultiBus VME IPI IEEE-488 RS232 IEEE 802.3 10BASE5 IEEE 802.3 10BASE2 IEEE 802.3 1BASE5 IEEE 802.3 10BROAD36 IEEE 802.3 100BASEVG IEEE 802.5 Token-Ring ANSI X3T9.5 FDDI MCA ESDI IDE CMD ST506 DSSI QIC2 Enhanced ATA/IDE AGP TWIRP (two-way infrared) FIR (fast infrared) SIR (serial infrared) IrBus � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � � � MSFT_CliProperty Status The Status property is a string indicating the current status of the object. Various operational and non-operational statuses can be defined. Operational statuses are "OK", "Degraded" and "Pred Fail". "Pred Fail" indicates that an element may be functioning properly but predicting a failure in the near future. An example is a SMART-enabled hard drive. Non-operational statuses can also be specified. These are "Error", "Starting", "Stopping" and "Service". The latter, "Service", could apply during mirror-resilvering of a disk, reload of a user permissions list, or other administrative work. Not all such work is on-line, yet the managed element is neither "OK" nor in one of the other states. Status � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 10 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING ` � � MSFT_CliQualifier ValueMap Q U \ f o z � � � � � � OK Error Degraded Unknown Pred Fail Starting Stopping Service Stressed NonRecover No Contact Lost Comm � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING Q � � MSFT_CliQualifier Values O S Z d m x � � � � � � OK Error Degraded Unknown Pred Fail Starting Stopping Service Stressed NonRecover No Contact Lost Comm
9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � + � � MSFT_CliProperty StatusInfo StatusInfo is a string indicating whether the logical device is in an enabled (value = 3), disabled (value = 4) or some other (1) or unknown (2) state. If this property does not apply to the logical device, the value, 5 ("Not Applicable"), should be used. StatusInfo 7 T � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING k D � MSFT_CliQualifier ValueMap 5 8 ; > A 1 2 3 4 5 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � f � MSFT_CliQualifier Values 3 : C L V Other Unknown Enabled Disabled Not Applicable IDECONTROLLER Select * from Win32_IDEController
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __DYNASTY __DYNASTY � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty __GENUS __GENUS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier t � , � MSFT_CliProperty __NAMESPACE __NAMESPACE � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o � " � MSFT_CliProperty __PATH __PATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier y � $ 6 � MSFT_CliProperty __PROPERTY_COUNT __PROPERTY_COUNT � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __RELPATH __RELPATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier q � & � MSFT_CliProperty __SERVER __SERVER � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __SUPERCLASS __SUPERCLASS ��� f �W & ���=? R &cM� � �uC� .��� y��� 6 u<�U� ) �N�
9 )u��F � .���� X e S q l P k g �U��7 �> XeSqlPkg
C � �� ) o u � � � � c����� � XeSqlPkg_latch_suspend_end Description Occurs when the executing task is resumed after waiting for a latch. Guid {881a763a-0da3-4b79-a9ed-050f6efb0745} locale MS\0x409 DisplayName latch_suspend_end �# X e S q l P k g _ f l u s h _ f i l e _ b u f f e r s _ e n a b l e d �U��7 �� - XeSqlPkg_flush_file_buffers_enabled % ) � �� ' 5 A � � � � � � W������������������������� � flush_file_buffers_enabled EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid file_name C
� G O � ��Z m } � string WmiDataId StringTermination NullTerminated Format w FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� Y a l y � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �U��7 �* XeSqlPkg
C � �� + Y _ � � � � c����� � XeSqlPkg_make_writes_durable Description Making previous write request ACI(D) durable Guid {A2D2DF09-31B6-4B9D-A803-37715141F072} locale MS\0x409 DisplayName make_writes_durable � X e S q l P k g _ m a k e _ w r i t e s _ d u r a b l e �U��7 �� & XeSqlPkg_make_writes_durable ) � �� . : � � � � � � � W������������������������� � make_writes_durable EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid file_name C
� @ H � ��S f v ~ string WmiDataId StringTermination NullTerminated Format w FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� R Z e r � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �U��7 �� XeSqlPkg
C � �� ! , 2 Z b l y c����� � XeSqlPkg_file_read Description File read Guid {521d231a-85c1-4791-8c35-4c5c0f51d0c0} locale MS\0x409 DisplayName file_read � X e S q l P k g _ f i l e _ r e a d �U��7 �� < XeSqlPkg_file_read ) � �� $ 0 � � 1 > � � � � G S � � � � � � y � � � � WUU���������������������������������������������������������� � file_read EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id $ )
� & � �� uint32 WmiDataId file_handle
4
� � � � ��� �� object WmiDataId Pointer file_id ( )
� � � � �� uint16 WmiDataId filegroup_id
* )
� 4 <
� �� uint16 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId mode P
� ' / � ��: C M _ g uint32 WmiDataId XEMapId ValueMap Y \ 0 1 Values s Contiguous Scatter/Gather offset )
� � � � �� uint64 WmiDataId path 4 C
� 8 @ � ��K ^ n v string WmiDataId StringTermination NullTerminated Format w RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� S [ f s � �� uint32 WmiDataId Description SequenceNumber size , )
� � � � �� uint64 WmiDataId � X e S q l P k g �U��7 � XeSqlPkg
C � �� * > D l t ~ � c����� � XeSqlPkg_file_read_enqueued Description File read enqueued Guid {9785c953-b648-4d45-9ffa-47a99528d93d} locale MS\0x409 DisplayName file_read_enqueued � X e S q l P k g _ f i l e _ r e a d _ e n q u e u e d �U��7 �� < % XeSqlPkg_file_read_enqueued ) � �� - 9 � � : G � � � P \ � � � � � � � � � � WUU���������������������������������������������������������� � file_read_enqueued EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id $ )
� ' / � �� uint32 WmiDataId file_handle
4
� � � � ��� �� object WmiDataId Pointer file_id ( )
� � � � �� uint16 WmiDataId filegroup_id
* )
� = E
� �� uint16 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId mode P
� 0 8 � ��C L V h p uint32 WmiDataId XEMapId ValueMap b e 0 1 Values | � Contiguous Scatter/Gather offset )
� � � � �� uint64 WmiDataId path 4 C
� A I � ��T g w string WmiDataId StringTermination NullTerminated Format w RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� \ d o | � �� uint32 WmiDataId Description SequenceNumber size , )
� � � � �� uint64 WmiDataId � X e S q l P k g �U��7 � XeSqlPkg
C � �� + @ F n v � � c����� � XeSqlPkg_file_read_throttled Description File read throttled Guid {84d65c13-5a5e-4e6a-8717-7e07edf06796} locale MS\0x409 DisplayName file_read_throttled � X e S q l P k g [��7 �c XeSqlPkg
C � ��/ < � � � � � � c����� � XeSqlPkg_column_store_expression_filter_apply Description An expression bitmap filter was applied on a rowgroup column batch. Guid {3a076180-e6a9-4e1f-a173-de7d77876845} locale MS\0x409 DisplayName column_store_expression_filter_apply �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 5�n�^��
͝��C�� + J.3�� ` � WDMClassesOfDriver TP_V2_PoolCreateClose C:\Windows\system32\kernelbase.dll[MofResourceName] ofResourceName] P� F D 3 B B D 4 C 4 2 A C 2 F 7 F E F 2 6 4 3 4 0 A 9 E B 7 8 A 5 8 1 F E 5 C 2 8 5 6 1 C B 6 3 E D F 7 8 0 B 3 2 9 E A C 2 E E 4 �b��5��͝��C��� � + V S� X� k� �� � MSFT_CliAlias � F N u � � � � �
U�������������������������4 � MSFT_CliConnection Authority
� > STRING Locale
� m STRING NameSpace
� � STRING Password
� � STRING Server
� � STRING User
� , STRING | � ( + � MSFT_CliConnection ms_409 ROOT\CIMV2 . Interrupt request line (IRQ) management. n � l1 �4 �� � �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � \ � MSFT_CliFormat table STATUS / �
� 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � i q � � MSFT_CliProperty Status The Status property is a string indicating the current status of the object. Status � � / � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 10 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap A E L V _ j t ~ OK Error Degraded Unknown Pred Fail Starting Stopping Service � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values ? C J T ] h r | OK Error Degraded Unknown Pred Fail Starting Stopping Service � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � q z � � MSFT_CliProperty Caption The Caption property is a short textual description (one-line string) of the object. Caption � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 64 r 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier 8 : H � MSFT_CliProperty Availability Availability of the IRQ. Availability T q � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING k D � MSFT_CliQualifier ValueMap 5 8 ; > A 1 2 3 4 5 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values 3 : C N d Other Unknown Available In Use/Not Available In Use and Available/Shareable s �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � + � MSFT_CliFormat SYSTEM
D � � U � b
�
x � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty __CLASS __CLASS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __DERIVATION __DERIVATION � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __DYNASTY __DYNASTY � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty __GENUS __GENUS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier t � , � MSFT_CliProperty __NAMESPACE __NAMESPACE � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o � " � MSFT_CliProperty __PATH __PATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier y � $ 6 � MSFT_CliProperty __PROPERTY_COUNT __PROPERTY_COUNT � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __RELPATH __RELPATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier q � & � MSFT_CliProperty __SERVER __SERVER � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __SUPERCLASS __SUPERCLASS N �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty [ � � MSFT_CliFormat INSTANCE " � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty IRQNumber IRQNumber �M �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty �L �2 � MSFT_CliFormat TABLE FULL Q � K
� � 7 � � � �( Z0 r 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier 8 : H � MSFT_CliProperty Availability Availability of the IRQ. Availability T q � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING k D � MSFT_CliQualifier ValueMap 5 8 ; > A 1 2 3 4 5 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values 3 : C N d Other Unknown Available In Use/Not Available In Use and Available/Shareable � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier F O W z � MSFT_CliProperty CSName CSName contains the scoping computer system's name. CSName _ � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ( � MSFT_CliQualifier MaxLen # 256 6 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � h u � MSFT_CliProperty Description The Description property provides a textual description of the object. Description � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � / 9 � MSFT_CliProperty Hardware The Hardware property indicates whether the interrupt is hardware or software based. A hardware IRQ is a physical wire from the peripheral to the programmable interrupt controller (PIC) chip through which the CPU can be notified of time critical events. Some IRQ lines are reserved for standard devices such as the keyboard, floppy disk drives, and the system clock. A software interrupt allows applications to get the attention of the processor./nValues: TRUE or FALSE. A value of TRUE indicates the interrupt is hardware based. Hardware � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier O � � � � MSFT_CliProperty InstallDate The InstallDate property is datetime value indicating when the object was installed. A lack of a value does not indicate that the object is not installed. InstallDate # 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � L W � MSFT_CliProperty IRQNumber A part of the object's key value, IRQ Number. IRQNumber m 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier 3 � � � � MSFT_CliProperty Name The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property. Name & 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � O Z � MSFT_CliProperty Shareable Boolean indicating whether the IRQ can be shared Shareable � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � i q � � MSFT_CliProperty Status The Status property is a string indicating the current status of the object. Status � � / � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 10 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap A E L V _ j t ~ OK Error Degraded Unknown Pred Fail Starting Stopping Service � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values ? C J T ] h r | OK Error Degraded Unknown Pred Fail Starting Stopping Service 4 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � � � MSFT_CliProperty TriggerLevel IRQ trigger level indicating whether the interrupt is triggered by the hardware signal going high (value=4) or low (value=3). Also, "Other" (1) and "Unknown" (2) may be defined. TriggerLevel � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING k = � MSFT_CliQualifier ValueMap 1 4 7 : 1 2 3 4 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � X � MSFT_CliQualifier Values / 6 ? K Other Unknown Active Low Active High _ 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier % � � � MSFT_CliProperty TriggerType IRQ trigger type indicating whether edge (value=4) or level triggered (value=3) interrupts occur. Also, "Other" (1) and "Unknown" (2) may be defined. TriggerType � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING k = � MSFT_CliQualifier ValueMap 1 4 7 : 1 2 3 4 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i L � MSFT_CliQualifier Values / 6 ? F Other Unknown Level Edge � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier f � � � � MSFT_CliProperty Vector The Vector property indicates the vector of the IRQ resource. A vector contains the memory address to the function that will execute once the interrupt request is acknowledged by the CPU. Vector �/ �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty �. � � MSFT_CliFormat table BRIEF : 8 _ � �
2 � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � / 9 � MSFT_CliProperty Hardware The Hardware property indicates whether the interrupt is hardware or software based. A hardware IRQ is a physical wire from the peripheral to the programmable interrupt controller (PIC) chip through which the CPU can be notified of time critical events. Some IRQ lines are reserved for standard devices such as the keyboard, floppy disk drives, and the system clock. A software interrupt allows applications to get the attention of the processor./nValues: TRUE or FALSE. A value of TRUE indicates the interrupt is hardware based. Hardware # 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � L W � MSFT_CliProperty IRQNumber A part of the object's key value, IRQ Number. IRQNumber m 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier 3 � � � � MSFT_CliProperty Name The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property. Name & 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � O Z � MSFT_CliProperty Shareable Boolean indicating whether the IRQ can be shared Shareable 4 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � � � MSFT_CliProperty TriggerLevel IRQ trigger level indicating whether the interrupt is triggered by the hardware signal going high (value=4) or low (value=3). Also, "Other" (1) and "Unknown" (2) may be defined. TriggerLevel � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING k = � MSFT_CliQualifier ValueMap 1 4 7 : 1 2 3 4 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � X � MSFT_CliQualifier Values / 6 ? K Other Unknown Active Low Active High _ 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier % � � � MSFT_CliProperty TriggerType IRQ trigger type indicating whether edge (value=4) or level triggered (value=3) interrupts occur. Also, "Other" (1) and "Unknown" (2) may be defined. TriggerType � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING k = � MSFT_CliQualifier ValueMap 1 4 7 : 1 2 3 4 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i L � MSFT_CliQualifier Values / 6 ? F Other Unknown Level Edge IRQ WHERE IRQNumber=# Select * from Win32_IRQResource � � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING 3 � � � � � MSFT_CliParam The StartFileName input parameter is a string that names the child file/directory to use as a starting point for CompressEx.The StartFileName property typically, is the StopFileName parameter specifying the file or directory at which anerror occurred from the previous method call. If this parameter is NULL, the operation is performed on the file ordirectory specified in the ExecMethod call. StartFileName � � F ] t � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING j , � MSFT_CliQualifier CIMTYPE $ string e � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � ) � MSFT_CliQualifier Description ( The StartFileName input parameter i �� F D 3 B B D 4 C 4 2 A C 2 F 7 F E F 2 6 4 3 4 0 A 9 E B 7 8 A 5 8 1 F E 5 C 2 8 5 6 1 C B 6 3 E D F 7 8 0 B 3 2 9 E A C 2 E E 4 �b��5��͝��C�,� + p �� �� ɢ � �� � MSFT_CliAlias � F N u � � � � �
U�������������������������4 � MSFT_CliConnection Authority
� > STRING Locale
� m STRING NameSpace
� � STRING Password
� � STRING Server
� � STRING User
� , STRING | � ( + � MSFT_CliConnection ms_409 ROOT\CIMV2 . Provides access to the jobs scheduled using the schedule service. � �& B F +� �# �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty
# � MSFT_CliFormat table STATUS ; � u � � q � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � * � MSFT_CliProperty Status The Status property is a string indicating the current status of the object. Various operational and non-operational statuses can be defined. Operational statuses are "OK", "Degraded" and "Pred Fail". "Pred Fail" indicates that an element may be functioning properly but predicting a failure in the near future. An example is a SMART-enabled hard drive. Non-operational statuses can also be specified. These are "Error", "Starting", "Stopping" and "Service". The latter, "Service", could apply during mirror-resilvering of a disk, reload of a user permissions list, or other administrative work. Not all such work is on-line, yet the managed element is neither "OK" nor in one of the other states. Status � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 10 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap A E L V _ j t ~ OK Error Degraded Unknown Pred Fail Starting Stopping Service � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values ? C J T ] h r | OK Error Degraded Unknown Pred Fail Starting Stopping Service v 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier < � � � � MSFT_CliProperty JobId The JobId property indicates the identifier number of the job. It is used by methods as a handle to a single job being scheduled on this computer. JobId " 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � � � MSFT_CliProperty JobStatus The JobStatus property indicates whether a scheduled service executed successfully the last time this job was supposed to run. JobStatus � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i 9 � MSFT_CliQualifier Values ' 0 Success Failure * 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � O \ � MSFT_CliProperty ElapsedTime Length of time that the job has been executing ElapsedTime � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier j � � � � MSFT_CliProperty StartTime The StartTime property represents the UTC time to run the job, in the form of YYYYMMDDHHMMSS.MMMMMM(+-)OOO, where YYYYMMDD must be replaced by ********. The replacement is necessary because the scheduling service only allows jobs to be configured on a day of the month, day of the week, or run once. A job cannot be run on a specific date./nExample: ********123000.000000-420 which implies 12:30 pm PST with daylight savings time in effect. StartTime � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier n � 6 = � MSFT_CliProperty Owner User that submitted the job Owner s �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � + � MSFT_CliFormat SYSTEM
D � � U � b
�
x � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty __CLASS __CLASS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __DERIVATION __DERIVATION � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __DYNASTY __DYNASTY � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty __GENUS __GENUS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier t � , � MSFT_CliProperty __NAMESPACE __NAMESPACE � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o � " � MSFT_CliProperty __PATH __PATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier y � $ 6 � MSFT_CliProperty __PROPERTY_COUNT __PROPERTY_COUNT � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __RELPATH __RELPATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier q � & � MSFT_CliProperty __SERVER __SERVER � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __SUPERCLASS __SUPERCLASS �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty % � � MSFT_CliFormat INSTANCE " v 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier < � � � � MSFT_CliProperty JobId The JobId property indicates the identifier number of the job. It is used by methods as a handle to a single job being scheduled on this computer. JobId K �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty J m0 � MSFT_CliFormat list FULL h N � � H � G m � � [ � �! �% �, F. � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier [ � � � � MSFT_CliProperty Command The Command property contains the name of the command, batch program, or binary file (along with command line arguments) that the schedule service will use to invoke the job. Command I 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � { � � MSFT_CliProperty DaysOfMonth The DaysOfMonth property indicates the days of the month when the job is scheduled to run. DaysOfMonth E 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � x � � MSFT_CliProperty DaysOfWeek The DaysOfWeek property indicates the days of the week when the job is scheduled to run. DaysOfWeek 6 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � h u � MSFT_CliProperty Description The Description property provides a textual description of the object. Description + 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � P ] � MSFT_CliProperty ElapsedTime Length of time that the job has been executing. ElapsedTime D 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier
� v � � MSFT_CliProperty InstallDate The InstallDate property is datetime value indicating when the object was installed. InstallDate � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier G � ' � � � MSFT_CliProperty InteractWithDesktop This property allows the specified job to be interactive (meaning a user can give input to a scheduled job while it is executing). InteractWithDesktop v 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier < � � � � MSFT_CliProperty JobId The JobId property indicates the identifier number of the job. It is used by methods as a handle to a single job being scheduled on this computer. JobId " 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � � � MSFT_CliProperty JobStatus The JobStatus property indicates whether a scheduled service executed successfully the last time this job was supposed to run. JobStatus � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i 9 � MSFT_CliQualifier Values ' 0 Success Failure # 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � \ b � MSFT_CliProperty Name The Name property defines the label by which the object is known. Name 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � N V � MSFT_CliProperty Notify User to be notified upon job completion or failure Notify � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier n � 6 = � MSFT_CliProperty Owner User that submitted the job Owner , 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � a k � MSFT_CliProperty Priority Priority indicates the urgency or importance of execution of a job. Priority n 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier 4 � ! � � � MSFT_CliProperty RunRepeatedly The RunRepeatedly property indicates whether the scheduled job should run repeatedly on the days that the job is scheduled. RunRepeatedly � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier j � � � � MSFT_CliProperty StartTime The StartTime property represents the UTC time to run the job, in the form of YYYYMMDDHHMMSS.MMMMMM(+-)OOO, where YYYYMMDD must be replaced by ********. The replacement is necessary because the scheduling service only allows jobs to be configured on a day of the month, day of the week, or run once. A job cannot be run on a specific date./nExample: ********123000.000000-420 which implies 12:30 pm PST with daylight savings time in effect. StartTime � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � i q � � MSFT_CliProperty Status The Status property is a string indicating the current status of the object. Status � � / � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 10 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap A E L V _ j t ~ OK Error Degraded Unknown Pred Fail Starting Stopping Service � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values ? C J T ] h r | OK Error Degraded Unknown Pred Fail Starting Stopping Service � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier v � ! B Q � MSFT_CliProperty TimeSubmitted Time that the job was submitted TimeSubmitted # 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � W b � MSFT_CliProperty UntilTime Time after which the job is invalid or should be stopped UntilTime � �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � I � MSFT_CliFormat TABLE BRIEF 6 � � � � v 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier < � � � � MSFT_CliProperty JobId The JobId property indicates the identifier number of the job. It is used by methods as a handle to a single job being scheduled on this computer. JobId 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � Y _ � MSFT_CliProperty Name The Name property defines the label by which the job is known. Name � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier n � 6 = � MSFT_CliProperty Owner User that submitted the job Owner , 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � a k � MSFT_CliProperty Priority Priority indicates the urgency or importance of execution of a job. Priority � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier [ � � � � MSFT_CliProperty Command The Command property contains the name of the command, batch program, or binary file (along with command line arguments) that the schedule service will use to invoke the job. Command Job WHERE jobid=# Select * from Win32_ScheduledJob �� ԥ � � A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 � � B J R � MSFT_CliVerb Delete The Delete method deletes a scheduled job. Delete Delete K � A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 %I � � �$ �$ � MSFT_CliVerb Create The Create function submits a job to the operating system for execution at a specified future time and date. This function requires that the schedule service be started at the computer towhich the job is submitted. Create � �
+ � � , � � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING # 3 � � � � � MSFT_CliParam The Command parameter contains the name of the command, batch program, or binary file (along with command line parameters) that the schedule service will use to invoke the job. Command � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True STRING � � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � 3 � � � � � MSFT_CliParam The DaysOfMonth parameter indicates the days of the month when the job is scheduled to run, and is used only when the RunRepeatedly parameter is TRUE. DaysOfMonth � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True UINT32 � � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � 3 � � � � � MSFT_CliParam The DaysOfWeek parameter indicates the days of the week when the job is scheduled to run, and is used only when the RunRepeatedly parameter is TRUE. DaysOfWeek � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True UINT32 � � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING 3 * ? ^ g � MSFT_CliParam The InteractWithDesktop parameter indicates whether the specified job should be interactive (meaning a user can give input to the scheduled job while it is executing)./nValues TRUE or FALSE. If TRUE, then the job will be interactive. The default value of this parameter is FALSE. InteractWithDesktop G � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True BOOLEAN � � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING # 3 > M l u � MSFT_CliParam The RunRepeatedly parameter indicates whether the scheduled job should run repeatedly on the days that the job is scheduled./nValues: TRUE or FALSE. If TRUE, then the job is run repeatedly according to the DaysOfWeek and DaysOfMonth parameter. If no value is supplied the parameter defaults to FALSE. RunRepeatedly U � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True BOOLEAN y � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � 3 ? I � MSFT_CliParam The StartTime parameter represents the UTC time to run the job. This is of the form YYYYMMDDHHMMSS.MMMMMM(+-)OOO, where YYYYMMDD must be replaced by ********./nExample: ********123000.000000-420 which implies 12:30 pm PST with daylight savings time in effect. StartTime ( � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True DATETIME ~ � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � 3 � � � � � MSFT_CliParam The JobId parameter indicates the identifier number of the job. This parameter is a handle to the job being scheduled on this computer. JobId � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING f & � MSFT_CliQualifier Out True UINT32 Create �S F D 3 B B D 4 C 4 2 A C 2 F 7 F E F 2 6 4 3 4 0 A 9 E B 7 8 A 5 8 1 F E 5 C 2 8 5 6 1 C B 6 3 E D F 7 8 0 B 3 2 9 E A C 2 E E 4 �b��5��͝��C�IS � + o �R �R �R S � MSFT_CliAlias � F N u � � � � �
U�������������������������4 � MSFT_CliConnection Authority
� > STRING Locale
� m STRING NameSpace
� � STRING Password
� � STRING Server
� � STRING User
� , STRING | � ( + � MSFT_CliConnection ms_409 ROOT\CIMV2 . Management of system services that define execution dependencies. � T �/ 3 �; � �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � 7 � MSFT_CliFormat table STATUS + � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � h p � � MSFT_CliProperty Status The Status property is a string indicating the current status of the object. Status � � . � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 10 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap A E L V _ j t ~ OK Error Degraded Unknown Pred Fail Starting Stopping Service � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values ? C J T ] h r | OK Error Degraded Unknown Pred Fail Starting Stopping Service 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � W ] � MSFT_CliProperty Name The Name property indicates the name of the load order group. Name s �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � + � MSFT_CliFormat SYSTEM
D � � U � b
�
x � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty __CLASS __CLASS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __DERIVATION __DERIVATION � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __DYNASTY __DYNASTY � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty __GENUS __GENUS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier t � , � MSFT_CliProperty __NAMESPACE __NAMESPACE � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o � " � MSFT_CliProperty __PATH __PATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier y � $ 6 � MSFT_CliProperty __PROPERTY_COUNT __PROPERTY_COUNT � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __RELPATH __RELPATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier q � & � MSFT_CliProperty __SERVER __SERVER � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __SUPERCLASS __SUPERCLASS K �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty X � � MSFT_CliFormat INSTANCE " � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o � " � MSFT_CliProperty __PATH __PATH � �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � � � MSFT_CliFormat TABLE BRIEF * � e 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier + � � � � MSFT_CliProperty GroupOrder The GroupOrder property indicates the sequence in which this group of services will be loaded onto the operating system. GroupOrder 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � W ] � MSFT_CliProperty Name The Name property indicates the name of the load order group. Name � �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � MSFT_CliFormat TABLE FULL 1 � % e 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier + � ! � � � MSFT_CliProperty DriverEnabled The DriverEnabled property indicates whether this load order group can include drivers along with system services. DriverEnabled e 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier + � � � � MSFT_CliProperty GroupOrder The GroupOrder property indicates the sequence in which this group of services will be loaded onto the operating system. GroupOrder 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � W ] � MSFT_CliProperty Name The Name property indicates the name of the load order group. Name � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � h p � � MSFT_CliProperty Status The Status property is a string indicating the current status of the object. Status � � . � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 10 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap A E L V _ j t ~ OK Error Degraded Unknown Pred Fail Starting Stopping Service � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values ? C J T ] h r | OK Error Degraded Unknown Pred Fail Starting Stopping Service LoadOrder Select * from Win32_LoadOrderGroup � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � q z � � MSFT_CliProperty Caption The Caption property is a short textual description (one-line string) of the object. �/ F D 3 B B D 4 C 4 2 A C 2 F 7 F E F 2 6 4 3 4 0 A 9 E B 7 8 A 5 8 1 F E 5 C 2 8 5 6 1 C B 6 3 E D F 7 8 0 B 3 2 9 E A C 2 E E 4 �b��5��͝��C�E/ + M | | %| F| /� MSFT_CliAlias � F N u � � � � �
U�������������������������4 � MSFT_CliConnection Authority
� > STRING Locale
� m STRING NameSpace
� � STRING Password
� � STRING Server
� � STRING User
� , STRING | � ( + � MSFT_CliConnection ms_409 ROOT\CIMV2 . Local storage device management. e { 1F X\ !` �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty �� � MSFT_CliFormat FULL $ � j � S � � �* - U/ �1 �6 89 �; b> �@ IB �D G 7J oR �T �W &Z f �h Dk fm �o |r %u �v �� �� � ݔ � � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � Y � MSFT_CliProperty Access The Access property describes whether the media is readable (value=1), writable (value=2), or both (value=3). "Unknown" (0) can also be defined. Access � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � b � MSFT_CliQualifier Values / 8 B L Unknown Readable Writable Read/Write Supported C
9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier e s U � MSFT_CliProperty Availability The availability and status of the device. For example, the Availability property indicates that the device is running and has full power (value=3), or is in a warning (4), test (5), degraded (10) or power save state (values 13-15 and 17). Regarding the power saving states, these are defined as follows: Value 13 ("Power Save - Unknown") indicates that the device is known to be in a power save mode, but its exact status in this mode is unknown; 14 ("Power Save - Low Power Mode") indicates that the device is in a power save state but still functioning, and may exhibit degraded performance; 15 ("Power Save - Standby") describes that the device is not functioning but could be brought to full power 'quickly'; and value 17 ("Power Save - Warning") indicates that the device is in a warning state, though also in a power save mode. Availability ! � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap e h k n q t w z } � � � � � � � � 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 0 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � \ � MSFT_CliQualifier Values c j s � � � � � � � � � � # 9 F Other Unknown Running/Full Power Warning In Test Not Applicable Power Off Off Line Off Duty Degraded Not Installed Install Error Power Save - Unknown Power Save - Low Power Mode Power Save - Standby Power Cycle Power Save - Warning � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier d � � � � MSFT_CliProperty BlockSize Size in bytes of the blocks which form this storage extent. If unknown or if a block concept is not valid (for example, for aggregate extents, memory or logical disks), enter a 1. BlockSize � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier L Q Z } � MSFT_CliProperty Caption The Caption property is a short textual description. Caption b � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 64 � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � � MSFT_CliProperty Compressed The Compressed property indicates whether the logical volume exists as a single compressed entity, such as a DoubleSpace volume. If file based compression is supported (such as on NTFS), this property will be FALSE. Compressed # 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � * [ s � � MSFT_CliProperty ConfigManagerErrorCode Indicates the Configuration Manager error code. ConfigManagerErrorCode { 9 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values � � � � � / u � � 0 K ` � � l � � ) � � F � � � 0 ` � This device is working properly. This device is not configured correctly. Windows cannot load the driver for this device. The driver for this device might be corrupted, or your system may be running low on memory or other resources. This device is not working properly. One of its drivers or your registry might be corrupted. The driver for this device needs a resource that Windows cannot manage. The boot configuration for this device conflicts with other devices. Cannot filter. The driver loader for the device is missing. This device is not working properly because the controlling firmware is reporting the resources for the device incorrectly. This device cannot start. This device failed. This device cannot find enough free resources that it can use. Windows cannot verify this device's resources. This device cannot work properly until you restart your computer. This device is not working properly because there is probably a re-enumeration problem. Windows cannot identify all the resources this device uses. This device is asking for an unknown resource type. Reinstall the drivers for this device. Your registry might be corrupted. System failure: Try changing the driver for this device. If that does not work, see your hardware documentation.Windows is removing this device. This device is disabled. System failure: Try changing the driver for this device. If that doesn't work, see your hardware documentation. This device is not present, is not working properly, or does not have all its drivers installed. Windows is still setting up this device. Windows is still setting up this device. This device does not have valid log configuration. The drivers for this device are not installed. This device is disabled because the firmware of the device did not give it the required resources. This device is using an Interrupt Request (IRQ) resource that another device is using. This device is not working properly because Windows cannot load the drivers required for this device. J 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � + p � � MSFT_CliProperty ConfigManagerUserConfig Indicates whether the device is using a user-defined configuration. ConfigManagerUserConfig 6 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � h u � MSFT_CliProperty Description The Description property provides a textual description of the object. Description X 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � � MSFT_CliProperty DeviceID The DeviceID property contains a string uniquely identifying the logical disk from other devices on the system. DeviceID 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � � � MSFT_CliProperty DriveType The DriveType property contains a numeric value corresponding to the type of disk drive this logical disk represents. Please refer to the Platform SDK documentation for additional information. DriveType � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values ; D W g s � � Unknown No Root Directory Removable Disk Local Disk Network Drive Compact Disc RAM Disk ` 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier & � � � � MSFT_CliProperty ErrorCleared ErrorCleared is a boolean property indicating that the error reported in LastErrorCode property is now cleared. ErrorCleared � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier q � $ � � � MSFT_CliProperty ErrorDescription ErrorDescription is a free-form string supplying more information about the error recorded in LastErrorCode property, and information on any corrective actions that may be taken. ErrorDescription w 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier = � $ � � � MSFT_CliProperty ErrorMethodology ErrorMethodology is a free-form string describing the type of error detection and correction supported by this storage extent. ErrorMethodology 3 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � f r � MSFT_CliProperty FileSystem The FileSystem property indicates the file system on the logical disk. FileSystem � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty FreeSpace FreeSpace � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier O � � � � MSFT_CliProperty InstallDate The InstallDate property is datetime value indicating when the object was installed. A lack of a value does not indicate that the object is not installed. InstallDate = 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � ! m | � MSFT_CliProperty LastErrorCode LastErrorCode captures the last error code reported by the logical device. LastErrorCode 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � * C [ � MSFT_CliProperty MaximumComponentLength The MaximumComponentLength property contains the maximum length of a filename component supported by the drive. A filename component is that portion of a filename between backslashes. The value can be used to indicate that long names are supported by the specified file system. MaximumComponentLength 4 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � > I < � MSFT_CliProperty MediaType The MediaType property indicates the type of media currently present in the logical drive. This value will be one of the values of the MEDIA_TYPE enumeration defined in winioctl.h./n<B>Note:</B> The value may not be exact for removable drives if currently there is no media in the drive. MediaType Q � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING 9 k � MSFT_CliQualifier Values { � � � � � � ! 6 K ` � � � � � � - B W Format is unknown 5�-Inch Floppy Disk 3�-Inch Floppy Disk 3�-Inch Floppy Disk 3�-Inch Floppy Disk 3�-Inch Floppy Disk 5�-Inch Floppy Disk 5�-Inch Floppy Disk 5�-Inch Floppy Disk 5�-Inch Floppy Disk 5�-Inch Floppy Disk Removable media other than floppy Fixed hard disk media 3�-Inch Floppy Disk 3�-Inch Floppy Disk 5�-Inch Floppy Disk 5�-Inch Floppy Disk 3�-Inch Floppy Disk 3�-Inch Floppy Disk 5�-Inch Floppy Disk 3�-Inch Floppy Disk 3�-Inch Floppy Disk 8-Inch Floppy Disk # 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � \ b � MSFT_CliProperty Name The Name property defines the label by which the object is known. Name Z 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � " � � � MSFT_CliProperty NumberOfBlocks Total number of consecutive blocks, each block the size of the value contained in the BlockSize property, which form this storage extent. Total size of the storage extent can be calculated by multiplying the value of the BlockSize property by the value of this property. If the value of BlockSize is 1, this property is the total size of the storage extent. NumberOfBlocks . 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � ` m � MSFT_CliProperty PNPDeviceID Indicates the Plug and Play device ID of the logical device. PNPDeviceID � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier �
/ � � S � MSFT_CliProperty PowerManagementCapabilities Indicates the specific power-related capabilities of the logical device. The array values, 0="Unknown", 1="Not Supported" and 2="Disabled" are self-explanatory. The value, 3="Enabled" indicates that the power management features are currently enabled but the exact feature set is unknown or the information is unavailable. "Power Saving Modes Entered Automatically" (4) describes that a device can change its power state based on usage or other criteria. "Power State Settable" (5) indicates that the SetPowerState method is supported. "Power Cycling Supported" (6) indicates that the SetPowerState method can be invoked with the PowerState input variable set to 5 ("Power Cycle"). "Timed Power On Supported" (7) indicates that the SetPowerState method can be invoked with the PowerState input variable set to 5 ("Power Cycle") and the Time parameter set to a specific date and time, or interval, for power-on. PowerManagementCapabilities � k � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values ? H W a j � � � Unknown Not Supported Disabled Enabled Power Saving Modes Entered Automatically Power State Settable Power Cycling Supported Timed Power On Supported � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � , 2 � MSFT_CliProperty PowerManagementSupported Indicates that the device can be power managed - i.e. can be put into suspend mode, etc. This boolean does not indicate that power management features are currently enabled, only that the logical device is capable of power management. PowerManagementSupported A 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � r � � MSFT_CliProperty ProviderName The ProviderName property indicates the network path name to the logical device. ProviderName 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � T ] � MSFT_CliProperty Purpose A free form string describing the media and/or its use. Purpose O 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier �~ " � � MSFT_CliProperty QuotasDisabled The QuotasDisabled property indicates that Quota management is not enabled on this volume. QuotasDisabled � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � �� $ � � MSFT_CliProperty QuotasIncomplete The QuotasIncomplete property indicates that Quota management was used but has been disabled. Incomplete refers to the information left in the file system after quota management has been disabled. QuotasIncomplete � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier k �� $ � � MSFT_CliProperty QuotasRebuilding The QuotasRebuilding property indicates an active state signifying that the file system is in process of compiling information and setting the disk up for quota management. QuotasRebuilding � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier m � � MSFT_CliProperty Size Size � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � * � MSFT_CliProperty Status The Status property is a string indicating the current status of the object. Various operational and non-operational statuses can be defined. Operational statuses are "OK", "Degraded" and "Pred Fail". "Pred Fail" indicates that an element may be functioning properly but predicting a failure in the near future. An example is a SMART-enabled hard drive. Non-operational statuses can also be specified. These are "Error", "Starting", "Stopping" and "Service". The latter, "Service", could apply during mirror-resilvering of a disk, reload of a user permissions list, or other administrative work. Not all such work is on-line, yet the managed element is neither "OK" nor in one of the other states. Status � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 10 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap A E L V _ j t ~ OK Error Degraded Unknown Pred Fail Starting Stopping Service � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values ? C J T ] h r | OK Error Degraded Unknown Pred Fail Starting Stopping Service
9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � + � � MSFT_CliProperty StatusInfo StatusInfo is a string indicating whether the logical device is in an enabled (value = 3), disabled (value = 4) or some other (1) or unknown (2) state. If this property does not apply to the logical device, the value, 5 ("Not Applicable"), should be used. StatusInfo 7 T � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING k D � MSFT_CliQualifier ValueMap 5 8 ; > A 1 2 3 4 5 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � f � MSFT_CliQualifier Values 3 : C L V Other Unknown Enabled Disabled Not Applicable O 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier �z & � � MSFT_CliProperty SupportsDiskQuotas The SupportsDiskQuotas property indicates whether this volume supports disk Quotas SupportsDiskQuotas � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � 0 $ � MSFT_CliProperty SupportsFileBasedCompression The SupportsFileBasedCompression property indicates whether the logical disk partition supports file based compression, such as is the case with NTFS. This property is FALSE, when the Compressed property is TRUE. SupportsFileBasedCompression 3 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � f r � MSFT_CliProperty VolumeName The VolumeName property indicates the volume name of the logical disk. VolumeName x 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier > � & � � � MSFT_CliProperty VolumeSerialNumber The VolumeSerialNumber property indicates the volume serial number of the logical disk./nConstraints: Maximum 11 characters VolumeSerialNumber �+ �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty �* �% � MSFT_CliFormat table STATUS 3 � : � � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � * � MSFT_CliProperty Status The Status property is a string indicating the current status of the object. Various operational and non-operational statuses can be defined. Operational statuses are "OK", "Degraded" and "Pred Fail". "Pred Fail" indicates that an element may be functioning properly but predicting a failure in the near future. An example is a SMART-enabled hard drive. Non-operational statuses can also be specified. These are "Error", "Starting", "Stopping" and "Service". The latter, "Service", could apply during mirror-resilvering of a disk, reload of a user permissions list, or other administrative work. Not all such work is on-line, yet the managed element is neither "OK" nor in one of the other states. Status � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 10 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap A E L V _ j t ~ OK Error Degraded Unknown Pred Fail Starting Stopping Service � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values ? C J T ] h r | OK Error Degraded Unknown Pred Fail Starting Stopping Service C
9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier e s U � MSFT_CliProperty Availability The availability and status of the device. For example, the Availability property indicates that the device is running and has full power (value=3), or is in a warning (4), test (5), degraded (10) or power save state (values 13-15 and 17). Regarding the power saving states, these are defined as follows: Value 13 ("Power Save - Unknown") indicates that the device is known to be in a power save mode, but its exact status in this mode is unknown; 14 ("Power Save - Low Power Mode") indicates that the device is in a power save state but still functioning, and may exhibit degraded performance; 15 ("Power Save - Standby") describes that the device is not functioning but could be brought to full power 'quickly'; and value 17 ("Power Save - Warning") indicates that the device is in a warning state, though also in a power save mode. Availability ! � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap e h k n q t w z } � � � � � � � � 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 0 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � \ � MSFT_CliQualifier Values c j s � � � � � � � � � � # 9 F Other Unknown Running/Full Power Warning In Test Not Applicable Power Off Off Line Off Duty Degraded Not Installed Install Error Power Save - Unknown Power Save - Low Power Mode Power Save - Standby Power Cycle Power Save - Warning X 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � � MSFT_CliProperty DeviceID The DeviceID property contains a string uniquely identifying the logical disk from other devices on the system. DeviceID
9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � + � � MSFT_CliProperty StatusInfo StatusInfo is a string indicating whether the logical device is in an enabled (value = 3), disabled (value = 4) or some other (1) or unknown (2) state. If this property does not apply to the logical device, the value, 5 ("Not Applicable"), should be used. StatusInfo 7 T � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING k D � MSFT_CliQualifier ValueMap 5 8 ; > A 1 2 3 4 5 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � f � MSFT_CliQualifier Values 3 : C L V Other Unknown Enabled Disabled Not Applicable # �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty 0 � � MSFT_CliFormat TABLE BRIEF : � # h � X 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � � MSFT_CliProperty DeviceID The DeviceID property contains a string uniquely identifying the logical disk from other devices on the system. DeviceID � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier O � � : � MSFT_CliProperty DriveType The DriveType property contains a numeric value corresponding to the type of disk drive this logical disk represents. DriveType � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values ; D W g s � � Unknown No Root Directory Removable Disk Local Disk Network Drive Compact Disc RAM Disk A 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � r � � MSFT_CliProperty ProviderName The ProviderName property indicates the network path name to the logical device. ProviderName � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty FreeSpace FreeSpace � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier m � � MSFT_CliProperty Size Size 3 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � f r � MSFT_CliProperty VolumeName The VolumeName property indicates the volume name of the logical disk. VolumeName � �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � I � MSFT_CliFormat INSTANCE " # 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � \ b � MSFT_CliProperty Name The Name property defines the label by which the object is known. Name � �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � w � MSFT_CliFormat WRITEABLE ' � � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � " ~ � � � MSFT_CliProperty QuotasDisabled The QuotasDisabled property indicates that Quota management is not enabled on this volume. QuotasDisabled � � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING j - � MSFT_CliQualifier CIMTYPE $ boolean � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING g ' � MSFT_CliQualifier read ! True � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING h ( � MSFT_CliQualifier write " True � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier F � � � � MSFT_CliProperty VolumeName The VolumeName property indicates the volume name of the logical disk./nConstraints: Maximum 32 characters VolumeName � � u � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING j , � MSFT_CliQualifier CIMTYPE $ string � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � # l � MSFT_CliQualifier MappingStrings / 7 string Win32API|File System Functions|GetVolumeInformation � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING g ' � MSFT_CliQualifier read ! True � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING h ( � MSFT_CliQualifier write " True LogicalDisk WHERE Name='#' Select * from Win32_LogicalDisk V| 4� � �_ � A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 �] � � cL �R �R � MSFT_CliVerb Chkdsk This method invokes the chkdsk operation on the disk. The method is applicable to only those instances of logical disk that represent a physical disk in the machine. It is not applicable to mapped logical drives. The return value of the method will indicate one of the following - Success - Chkdsk completed, Success - Locked and chkdsk scheduled on reboot, Failure - Unknown file system, Failure - Unknown error. Chkdsk � � � $% �2 �?
� ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING ] 3 z � � � � MSFT_CliParam This parameter indicates what should be done to errors found on the disk. If true, then errors are fixed. FixErrors � � � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING j - � MSFT_CliQualifier CIMTYPE $ boolean � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING ! � � MSFT_CliQualifier Description ( This parameter indicates what should be done to errors found on the disk. If true, then errors are fixed. � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e " � MSFT_CliQualifier ID 0 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier in True BOOLEAN � � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING 3 i x � � � MSFT_CliParam This parameter indicates whether the drive should be forced to dismount before checking. ForceDismount � � j � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING j - � MSFT_CliQualifier CIMTYPE $ boolean � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � MSFT_CliQualifier Description ( This parameter indicates whether the drive should be forced to dismount before checking. � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e " � MSFT_CliQualifier ID 3 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier in True BOOLEAN v � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � 3 � � x � � MSFT_CliParam This parameter indicates whether the chkdsk operation should be performed at next boot up time, in case the operation could not be performed because the disk was locked at time the method was called. OkToRunAtBootUp � J a � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING j - � MSFT_CliQualifier CIMTYPE $ boolean - � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � MSFT_CliQualifier Description ( This parameter indicates whether the chkdsk operation should be performed at next boot up time, in case the operation could not be performed because the disk was locked at time the method was called. � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e " � MSFT_CliQualifier ID 5 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier in True BOOLEAN �
� ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING 3 � � � � MSFT_CliParam This parameter indicates whether the bad sectors should be located and the readable information should be recovered from these sectors. RecoverBadSectors � � � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING j - � MSFT_CliQualifier CIMTYPE $ boolean � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING ? � � MSFT_CliQualifier Description ( This parameter indicates whether the bad sectors should be located and the readable information should be recovered from these sectors. � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e " � MSFT_CliQualifier ID 4 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier in True BOOLEAN � � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING 3 e v � � � MSFT_CliParam This parameter indicates whether the folder cycle checking should be skipped or not. SkipFolderCycle � � d { � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING j - � MSFT_CliQualifier CIMTYPE $ boolean � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING ~ � MSFT_CliQualifier Description ( This parameter indicates whether the folder cycle checking should be skipped or not. � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e " � MSFT_CliQualifier ID 2 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier in True BOOLEAN � � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING 3 h | � � � MSFT_CliParam This parameter indicates whether a vigorous check of index entries should be performed. VigorousIndexCheck � � m � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING j - � MSFT_CliQualifier CIMTYPE $ boolean � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � MSFT_CliQualifier Description ( This parameter indicates whether a vigorous check of index entries should be performed. � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e " � MSFT_CliQualifier ID 1 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier in True BOOLEAN wL �N P #Q e � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � ) � MSFT_CliQualifier Description ( This method invokes the chkdsk operation on the disk. The method is applicable to only those instances of logical disk that represent a physical disk in the machine. It is not applicable to mapped logical drives. The return value of the method will indica � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING n . � MSFT_CliQualifier Implemented ( True � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING q # O � MSFT_CliQualifier MappingStrings + Fmifs.dll | Method ChkDskExRoutine � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � MSFT_CliQualifier Values / K | � Success - Chkdsk completed Success - Locked and chkdsk scheduled on reboot Failure - Unknown file system Failure - Unknown error Chkdsk �% � A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 �# ! 2 � ' 8 � MSFT_CliVerb ScheduleAutoChk This method is used schedule chkdsk to be run at the next reboot if the dirty bit has been set. The method is applicable to only those instances of logical disk that represent a physical disk in the machine. It is not applicable to mapped logical drives. ScheduleAutoChk : | � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � 3 � � J [ � MSFT_CliParam This parameter is used to specify the list of drives that should be scheduled for autochk at next reboot. The string syntax consists of the the drive letter for the logical disk. LogicalDisk � 3 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING j , � MSFT_CliQualifier CIMTYPE $ string � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING j � � MSFT_CliQualifier Description ( This parameter is used to specify the list of drives that should be scheduled for autochk at next reboot. The string syntax consists of the the drive letter for the logical disk. � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e " � MSFT_CliQualifier ID 0 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier in True ARRAY OF STRING � ; [ ~ � e � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � ) � MSFT_CliQualifier Description ( This method is used schedule chkdsk to be run at the next reboot if the dirty bit has been set. The method is applicable to only those instances of logical disk that represent a physical disk in the machine. It is not applicable to mapped logical drives. � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING n . � MSFT_CliQualifier Implemented ( True � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING q # 8 � MSFT_CliQualifier MappingStrings + Chkntfs.exe � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ) � MSFT_CliQualifier Static # True � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values 3 = S l � No Error Error - Remote Drive Error - Removable Drive Error - Drive Not Root Directory Error - Unknown Drive ScheduleAutoChk ;- � A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 @+ " � x � � MSFT_CliVerb ExcludeFromAutochk This method is used exclude disks from the chkdsk operation to be run at the next reboot. If not excluded, chkdsk is performed on the disk if the dirty bit has been set for the disk. Note that the calls to exclude disks are not cumulative. That is, if a call is made to excluded some disks, then the new list is not added to the list of ones that were already marked for exclusion, instead the new list of disks overwrites the previous one. The method is applicable to only those instances of logical disk that represent a physical disk in the machine and is not applicable to mapped logical drives. /nFor example, a valid specification of drives would be "C:", "d:","G:" Note that the colon is required with the drive letter. ExcludeFromAutochk � � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING E
3 � � r � � MSFT_CliParam This parameter is used to specify the list of drives that should be excluded from autochk at next reboot. The string syntax consists of the the drive letter followed by a colon for the logical disk. LogicalDisk � D [ � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING j , � MSFT_CliQualifier CIMTYPE $ string , � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING ~ � � MSFT_CliQualifier Description ( This parameter is used to specify the list of drives that should be excluded from autochk at next reboot. The string syntax consists of the the drive letter followed by a colon for the logical disk. � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e " � MSFT_CliQualifier ID 0 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier in True ARRAY OF STRING $ � � � � e � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � ) � MSFT_CliQualifier Description ( This method is used exclude disks from the chkdsk operation to be run at the next reboot. If not excluded, chkdsk is performed on the disk if the dirty bit has been set for the disk. Note that the calls to exclude disks are not cumulative. That is, if a c � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING n . � MSFT_CliQualifier Implemented ( True � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING q # 8 � MSFT_CliQualifier MappingStrings + Chkntfs.exe � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ) � MSFT_CliQualifier Static # True � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values 3 < R k � Success Error - Remote Drive Error - Removable Drive Error - Drive Not Root Directory Error - Unknown Drive ExcludeFromAutochk v 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier < � � � � MSFT_CliProperty JobId The JobId property indicates the identifier number of the job. It is used by methods as a handle to a single job being scheduled on this computer. JobId " 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � � � MSFT_CliProperty JobStatus The JobStatus property indicates whether a scheduled service executed successfully the last time this job was supposed to run. JobStatus � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i 9 � MSFT_CliQualifier Values ' 0 Success Failure * 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � O \ � MSFT_CliProperty ElapsedTime Length of time that the job has been executing ElapsedTime � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier j � � � � MSFT_CliProperty StartTime The StartTime property represents the UTC time to run the job, in the form of YYYYMMDDHHMMSS.MMMMMM(+-)OOO, where YYYYMMDD must be replaced by ********. The replacement is necessary because the scheduling service only allows jobs to be configured on a day of the month, day of the week, or run once. A job can �� F D 3 B B D 4 C 4 2 A C 2 F 7 F E F 2 6 4 3 4 0 A 9 E B 7 8 A 5 8 1 F E 5 C 2 8 5 6 1 C B 6 3 E D F 7 8 0 B 3 2 9 E A C 2 E E 4 �b��5��͝��C� � � + � �� �� �� Ղ � MSFT_CliAlias � F N u � � � � �
U�������������������������4 � MSFT_CliConnection Authority
� > STRING Locale
� m STRING NameSpace
� � STRING Password
� � STRING Server
� � STRING User
� , STRING | � ( + � MSFT_CliConnection ms_409 ROOT\CIMV2 . The Win32_LogonSession class describes the logon session or sessions associated with a user who has logged on to Windows NT or Windows 2000. � �! f7 N� K �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty X � � MSFT_CliFormat INSTANCE " � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o � " � MSFT_CliProperty __PATH __PATH s �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � + � MSFT_CliFormat SYSTEM
D � � U � b
�
x � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty __CLASS __CLASS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __DERIVATION __DERIVATION � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __DYNASTY __DYNASTY � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty __GENUS __GENUS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier t � , � MSFT_CliProperty __NAMESPACE __NAMESPACE � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o � " � MSFT_CliProperty __PATH __PATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier y � $ 6 � MSFT_CliProperty __PROPERTY_COUNT __PROPERTY_COUNT � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __RELPATH __RELPATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier q � & � MSFT_CliProperty __SERVER __SERVER � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __SUPERCLASS __SUPERCLASS � �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � � � MSFT_CliFormat STATUS $ � � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o � " � MSFT_CliProperty __PATH __PATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � � � MSFT_CliProperty Status The Status property is a string indicating the current status of the object. Various operational and non-operational statuses can be defined. Operational statuses are "OK", "Degraded" and "Pred Fail". "Pred Fail" indicates that an element may be functioning properly but predicting a failure in the near future. An example is a SMART-enabled hard drive. Non-operational statuses can also be specified. These are "Error", "Starting", "Stopping" and "Service". The latter, "Service", could apply during mirror-resilvering of a disk, reload of a user permissions list, or other administrative work. Not all such work is on-line, yet the managed element is neither "OK" nor in one of the other states. Status � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 10 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING ` � � MSFT_CliQualifier ValueMap Q U \ f o z � � � � � � OK Error Degraded Unknown Pred Fail Starting Stopping Service Stressed NonRecover No Contact Lost Comm � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING Q � � MSFT_CliQualifier Values O S Z d m x � � � � � � OK Error Degraded Unknown Pred Fail Starting Stopping Service Stressed NonRecover No Contact Lost Comm �I �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty �H `, � MSFT_CliFormat BRIEF 3 � - v � b 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier ( � ) � � � MSFT_CliProperty AuthenticationPackage The AuthenticationPackage is the name of the subsystem used to authenticate the logon session. AuthenticationPackage � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier V � � � � MSFT_CliProperty LogonId The LogonId is the ID assigned to the logon session. The application that initiated the session should have called AllocateLocallyUniqueId in order to generate this ID. LogonId � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � : E l
� MSFT_CliProperty LogonType The LogonType is a numeric value indicating what type of logon session this is. /nSystem - Interactive - This logon type is intended for users who will be interactively using the machine, such as a user being logged on by a terminal server, remote shell, or similar process. /nNetwork - This logon type is intended for high performance servers to authenticate clear text passwords. LogonUser does not cache credentials for this logon type. /nBatch - This logon type is intended for batch servers, where processes may be executing on behalf of a user without their direct intervention; or for higher performance servers that process many clear-text authentication attempts at a time, such as mail or web servers. LogonUser does not cache credentials for this logon type./nService - Indicates a service-type logon. The account provided must have the service privilege enabled./nProxy - Proxy logon. This logon type is not supported./nUnlock - This logon type is intended for GINA DLLs logging on users who will be interactively using the machine. This logon type allows a unique audit record to be generated that shows when the workstation was unlocked. /nNetwork Cleartext - Windows 2000: This logon type preserves the name and password in the authentication packages, allowing the server to make connections to other network servers while impersonating the client. This allows a server to accept clear text credentials from a client, call LogonUser, verify that the user can access the system across the network, and still communicate with other servers. /nNew Credentials - Windows 2000: This logon type allows the caller to clone its current token and specify new credentials for outbound connections. The new logon session has the same local identify, but uses different credentials for other network connections. /n LogonType Q � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � R � MSFT_CliQualifier ValueMap = @ C F I L O 2 3 4 5 7 8 9 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values ; H Q X a i { Interactive Network Batch Service Unlock NetworkCleartext NewCredentials m 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier 3 � � � � MSFT_CliProperty Name The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property. Name 3 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � g r � MSFT_CliProperty StartTime The StartTime property represents the time at which the session started. StartTime � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � � � MSFT_CliProperty Status The Status property is a string indicating the current status of the object. Various operational and non-operational statuses can be defined. Operational statuses are "OK", "Degraded" and "Pred Fail". "Pred Fail" indicates that an element may be functioning properly but predicting a failure in the near future. An example is a SMART-enabled hard drive. Non-operational statuses can also be specified. These are "Error", "Starting", "Stopping" and "Service". The latter, "Service", could apply during mirror-resilvering of a disk, reload of a user permissions list, or other administrative work. Not all such work is on-line, yet the managed element is neither "OK" nor in one of the other states. Status � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 10 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING ` � � MSFT_CliQualifier ValueMap Q U \ f o z � � � � � � OK Error Degraded Unknown Pred Fail Starting Stopping Service Stressed NonRecover No Contact Lost Comm � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING Q � � MSFT_CliQualifier Values O S Z d m x � � � � � � OK Error Degraded Unknown Pred Fail Starting Stopping Service Stressed NonRecover No Contact Lost Comm X �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty e 0 � MSFT_CliFormat LIST FULL LOGON Select * from Win32_LogonSession �n F D 3 B B D 4 C 4 2 A C 2 F 7 F E F 2 6 4 3 4 0 A 9 E B 7 8 A 5 8 1 F E 5 C 2 8 5 6 1 C B 6 3 E D F 7 8 0 B 3 2 9 E A C 2 E E 4 �b��5��͝��C�fn � + E �m �m n 2n � MSFT_CliAlias � F N u � � � � �
U�������������������������4 � MSFT_CliConnection Authority
� > STRING Locale
� m STRING NameSpace
� � STRING Password
� � STRING Server
� � STRING User
� , STRING | � ( + � MSFT_CliConnection ms_409 ROOT\CIMV2 . Cache memory management. e � - ~" R) 7 |R X �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty e � MSFT_CliFormat list FULL h �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty u t � MSFT_CliFormat BRIEF ? � � P � � _
�
� 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty BlockSize BlockSize � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier s � * � MSFT_CliProperty CacheSpeed CacheSpeed � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty CacheType CacheType � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier q � & � MSFT_CliProperty DeviceID DeviceID � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier v � ! 0 � MSFT_CliProperty InstalledSize InstalledSize � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier n � � MSFT_CliProperty Level Level � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty MaxCacheSize MaxCacheSize � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier w � " 2 � MSFT_CliProperty NumberOfBlocks NumberOfBlocks � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o � " � MSFT_CliProperty Status Status M �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty Z � � MSFT_CliFormat INSTANCE " � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier q � & � MSFT_CliProperty DeviceID DeviceID � �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � � � MSFT_CliFormat ERROR # � � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier q � & � MSFT_CliProperty DeviceID DeviceID � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier y � $ 6 � MSFT_CliProperty ErrorCorrectType ErrorCorrectType �
�
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � � � MSFT_CliFormat STATUS , � � ; � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty Availability Availability � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier q � & � MSFT_CliProperty DeviceID DeviceID � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o � " � MSFT_CliProperty Status Status � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier s � * � MSFT_CliProperty StatusInfo StatusInfo w �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � + � MSFT_CliFormat CONFIG
D � � U � d
�
y � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty BlockSize BlockSize � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier s � * � MSFT_CliProperty CacheSpeed CacheSpeed � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty CacheType CacheType � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier q � & � MSFT_CliProperty DeviceID DeviceID � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier v � ! 0 � MSFT_CliProperty InstalledSize InstalledSize � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier n � � MSFT_CliProperty Level Level � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty MaxCacheSize MaxCacheSize � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier w � " 2 � MSFT_CliProperty NumberOfBlocks NumberOfBlocks � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o � " � MSFT_CliProperty Status Status � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier t � , � MSFT_CliProperty WritePolicy WritePolicy s �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � + � MSFT_CliFormat SYSTEM
D � � U � b
�
x � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty __CLASS __CLASS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __DERIVATION __DERIVATION � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __DYNASTY __DYNASTY � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty __GENUS __GENUS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier t � , � MSFT_CliProperty __NAMESPACE __NAMESPACE � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o � " � MSFT_CliProperty __PATH __PATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier y � $ 6 � MSFT_CliProperty __PROPERTY_COUNT __PROPERTY_COUNT � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __RELPATH __RELPATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier q � & � MSFT_CliProperty __SERVER __SERVER � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __SUPERCLASS __SUPERCLASS MEMCACHE WHERE DeviceID='#' Select * from WIN32_CACHEMEMORY 65DD7E05BFBAFD92E46.919.1.39586 IL_49645A7E73D822346D709311ADBAC1C95851F17A85507279169A1C26AD7A76DF.924.1.104721 IL_109FF4DB06F1B7E43B4FFA991E46E1AC64566587215453FAD438A316C11699CC.937.1.74580 IL_5F52E98B4905E86733B57BDB8229A4CEC75FA5749D918B5DBC7157473B48B71F.956.1.13002 IL_60E5E385E51F7170564DC3A25AAA1E35C0C27B9240E9CAF9E2086D795B396162.974.1.8675 IL_4F28049B29ED0162FE0090B43C7F9ACB02BB2A7DA2E5515A9A1D50C0DC210D88.976.1.48287 IL_74CF1EDBEB2A88AE2B7F2B31226DC6989203AD486527D338B157184A36F210BE.982.1.23321 IL_897EACA2347FBC71DC0E8FBFE21FA1F13FC9EAEDDE7A34C1DE772DFD6AAE17B6.985.1.15604 IL_2FD8DCDD9272028411CDB92D628888781F863A853FD409FF5C59AF68D5452AC6.987.1.101109 IL_4CD34998191B7D33C77F03D776D618320C603FD3921842E1B0BD47475C056851.1000.1.51109 IL_4C10C5441FCE04BC41DDEC512892264D846021BB7D560E4EBF1E528C17B43826.1007.1.31956 IL_6EACF9EBFCA10986AA504ECF943BEA549FB8DE4850FBADD0F165D6E5FD0E4DBB.1011.1.30190 IL_C59E83547F1BC933FE30770D4EDB5077AA988B54FE242F5F66DA214D449E875A.321.1.62809 IL_43E62AB0AD3F0F54666953AC95C414EE36B3A6541513F8BFD8A755EEC9A7E6E5.329.1.65559 IL_55BA3B97EE945A5FFAA048F94EB0B1F3BCDC2B26C8F2588BFFB42050A21365DE.338.1.27578 IL_6E3B4399FA4EDE750602EAE85FB276C1B64644E78344F6BB3EF3F442D17FE8D8.353.1.287457 IL_BF593FDA4BA33F9ED167DAD655EB0DCA41D164E127B57BF7155EB8BC36FD4AEB.399.1.150684 IL_C004F31EED0C3389D3663FFEDC2379761F7F253446DFB3E07A859B8D44F5D78E.418.1.15778 IL_BC62D2F1A8964BE05CE3C8E4A92D6196F3ABA9FF68221E9970F3291305AD53F0.420.1.28222 IL_5619F5F895C3D573343163A85231441998067CF9B7F0925D97380D29EEA3F575.424.1.33645 IL_A9B77B6FB8EEFAA0386ECE3D9F763120D7E0B46CF98ACF71EF752F98F67AAC11.429.1.32140 IL_5DF699F99654C2DBF66C5FDB8987B09A99F1CFAA95812890C5421B937233B9AB.433.1.100514 IL_BD93AFD54A2CBC0AAE6AC538B824779A9A1273B2B91BB9D43D9256B804C5A7BC.446.1.30870 IL_A652C2031A398BA1BCC19829AA29BBA940B833717CFD10EB3A678C370F38E883.450.1.60127 IL_53CE600361D9DC049AB7920A4B0095959C43531AA0DA3E5EEA49EBF699C0A9D2.458.1.47278 IL_AA1B5BB8A762366D711DCFE877B29E175333778C99FBCFF14D33452DE7A9A746.464.1.297697 IL_3E5C71F597B81038891F6DBE304274708E2BB2389008548AA6B8A0CCE07BBFD8.501.1.38483 IL_8DD5B4325D414AEB9A2E89B2A9012972DB466402E099F6F23B86F048D798271C.506.1.85098 IL_663060429A6938D1B4C13319904DC9CB4D95E1E1D71EE9B0A8EA8DACAE58E45C.517.1.45904 IL_133AE77889577C41679A67ADB2FE6AD9A47EDBC4C9E19AA735345C392697BF03.523.1.61884 IL_CA599D6A29EF58E9CC298260942301AFE42CF6FFCEB9502DACD0BAA50DED4DEE.531.1.21465 IL_993D150D0C9C8AECC30617FB0FF207B447C72B60CB9837CA152ECAA0421F80ED.534.1.143317
� o STRING � � � MSFT_CliQualifier Values ; D W g s � � Unknown No Root Directory Removable Disk Local Disk Network Drive Compact Disc RAM Disk ` 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier & � � � � MSFT_CliProperty ErrorCleared ErrorCleared is a boolean property indicating that the error reported in LastErrorCode property is now cleared. ErrorCleared � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier q � $ � � � MSFT_CliProperty ErrorDescription ErrorDescription is a free-form string supplying more information about the error recorded in LastErrorCode property, and information on any corrective actions that may be taken. ErrorDescription F D 3 B B D 4 C 4 2 A C 2 F 7 F E F 2 6 4 3 4 0 A 9 E B 7 8 A 5 8 1 F E 5 C 2 8 5 6 1 C B 6 3 E D F 7 8 0 B 3 2 9 E A C 2 E E 4 �b��5��͝��C�� � + D 2 V� MSFT_CliAlias � F N u � � � � �
U�������������������������4 � MSFT_CliConnection Authority
� > STRING Locale
� m STRING NameSpace
� � STRING Password
� � STRING Server
� � STRING User
� , STRING | � ( + � MSFT_CliConnection ms_409 ROOT\CIMV2 . Memory Chip information \ � (! �? �^ K �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty X � � MSFT_CliFormat INSTANCE " � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o � " � MSFT_CliProperty __PATH __PATH y �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � - � MSFT_CliFormat SYSTEM
F � � W � d
�
z � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty __CLASS __CLASS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __DERIVATION __DERIVATION � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __DYNASTY __DYNASTY � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty __GENUS __GENUS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier t � , � MSFT_CliProperty __NAMESPACE __NAMESPACE � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o � " � MSFT_CliProperty __PATH __PATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier y � $ 6 � MSFT_CliProperty __PROPERTY_COUNT __PROPERTY_COUNT � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __RELPATH __RELPATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier q � & � MSFT_CliProperty __SERVER __SERVER � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __SUPERCLASS __SUPERCLASS � �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � � � MSFT_CliFormat table STATUS + �
[
9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier ! � � � � MSFT_CliProperty Status The Status property is a string indicating the current status of the object. Various operational and non-operational statuses can be defined. Status � � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 10 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING ` � � MSFT_CliQualifier ValueMap Q U \ f o z � � � � � � OK Error Degraded Unknown Pred Fail Starting Stopping Service Stressed NonRecover No Contact Lost Comm � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING Q � � MSFT_CliQualifier Values O S Z d m x � � � � � � OK Error Degraded Unknown Pred Fail Starting Stopping Service Stressed NonRecover No Contact Lost Comm # 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � \ b � MSFT_CliProperty Name The Name property defines the label by which the object is known. Name � �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � � � MSFT_CliFormat table BRIEF : \ � ' N t 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � S ] � MSFT_CliProperty Capacity The total capacity of this physical memory, in bytes. Capacity X 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � ! � � � MSFT_CliProperty DeviceLocator The DeviceLocator property indicates the label of the socket or circuit board that holds this memory. DeviceLocator k 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier 1 < H � � MSFT_CliProperty MemoryType The type of physical memory. MemoryType P J � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � MSFT_CliQualifier Values s | � � � � � � � � � � � � � � � � �
Unknown Other DRAM Synchronous DRAM Cache DRAM EDO EDRAM VRAM SRAM RAM ROM Flash EEPROM FEPROM EPROM CDRAM 3DRAM SDRAM SGRAM RDRAM DDR # 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � \ b � MSFT_CliProperty Name The Name property defines the label by which the object is known. Name " 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � � � MSFT_CliProperty Tag The Tag property contains a string that uniquely identifies the physical memory device represented by an instance of Win32_PhysicalMemory. Tag � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ( � MSFT_CliQualifier MaxLen # 256 E 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � x � � MSFT_CliProperty TotalWidth Total width, in bits, of the physical memory, including check or error correction bits. TotalWidth �� �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty �� �^ � MSFT_CliFormat LIST FULL � � � Q � �
M Q / � �! & �) �+ >. F2 w4 �6 q9 �; �? 'C ?E �R [V Y M[ 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � � � MSFT_CliProperty BankLabel A string identifying the physically labeled bank where the memory is located - for example, 'Bank 0' or 'Bank A'. BankLabel � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 64 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � S ] � MSFT_CliProperty Capacity The total capacity of this physical memory, in bytes. Capacity � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier U � � � � MSFT_CliProperty DataWidth Data width of the physical memory, in bits. A data width of 0 and a total width of 8 would indicate that the memory is solely used to provide error correction bits. DataWidth 6 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � h u � MSFT_CliProperty Description The Description property provides a textual description of the object. Description X 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � ! � � � MSFT_CliProperty DeviceLocator The DeviceLocator property indicates the label of the socket or circuit board that holds this memory. DeviceLocator b 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier ( � � � MSFT_CliProperty FormFactor The implementation form factor for the chip.For example, values such as SIMM (7), TSOP (9) or PGA (10) can be specified. FormFactor � _ � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � MSFT_CliQualifier Values � � � � � � � � � � � � � � � � � � � � Unknown Other SIP DIP ZIP SOJ Proprietary SIMM DIMM TSOP PGA RIMM SODIMM SRIMM SMD SSMP QFP TQFP SOIC LCC PLCC BGA FPBGA LGA � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier ~ � � � � MSFT_CliProperty HotSwappable A physical component can be hot swapped if it is possible to replace the element with a physically different but equivalent one while the containing package has power applied to it (i.e., is 'on'). HotSwappable D 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier
� v � � MSFT_CliProperty InstallDate The InstallDate property is datetime value indicating when the object was installed. InstallDate � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � ' � MSFT_CliProperty InterleaveDataDepth The InterleaveDataDepth property indicates the maximum number of consecutive rows of data that are accessed in a single interleaved transfer from the memory device. If the value is 0, then the memory is not interleaved. InterleaveDataDepth � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier X � & � � � MSFT_CliProperty InterleavePosition The position of this physical memory in an interleave. 0 indicates non-interleaved. 1 indicates the first position, 2 the second position and so on. InterleavePosition � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � o } � � MSFT_CliProperty Manufacturer The name of the organization responsible for producing the physical element. Manufacturer � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ( � MSFT_CliQualifier MaxLen # 256 k 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier 1 < H � � MSFT_CliProperty MemoryType The type of physical memory. MemoryType P J � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � MSFT_CliQualifier Values s | � � � � � � � � � � � � � � � � �
Unknown Other DRAM Synchronous DRAM Cache DRAM EDO EDRAM VRAM SRAM RAM ROM Flash EEPROM FEPROM EPROM CDRAM 3DRAM SDRAM SGRAM RDRAM DDR � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier P U \ � MSFT_CliProperty Model The name by which the physical element is generally known. Model d � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 64 # 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � \ b � MSFT_CliProperty Name The Name property defines the label by which the object is known. Name � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier G � ( � � � MSFT_CliProperty OtherIdentifyingInfo OtherIdentifyingInfo captures additional data, beyond asset tag information, that could be used to identify a physical element. OtherIdentifyingInfo 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � � � MSFT_CliProperty PartNumber The part number assigned by the organization responsible for producing or manufacturing the physical element. PartNumber � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ( � MSFT_CliQualifier MaxLen # 256 - 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � ! ] l � MSFT_CliProperty PositionInRow Specifies the position of the physical memory in a 'row'. PositionInRow J 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � ~ � � MSFT_CliProperty PoweredOn Boolean indicating that the physical element is powered on (TRUE), or is currently off (FALSE). PoweredOn � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier n � � � � MSFT_CliProperty Removable A physical component is removable if it is designed to be taken in and out of the physical container in which it is normally found, without impairing the function of the overall packaging. Removable p 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier 6 � � � � MSFT_CliProperty Replaceable A physical component is replaceable if it is possible to replace (FRU or upgrade) the element with a physically different one. Replaceable � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � g u � � MSFT_CliProperty SerialNumber A manufacturer-allocated number used to identify the PhysicalElement. SerialNumber } � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 64 ~ 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier D Q V y � MSFT_CliProperty SKU The stock keeping unit number for this physical element. SKU ^ � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 64 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � L S � MSFT_CliProperty Speed The speed of the physical memory, in nanoseconds. Speed X
9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � � MSFT_CliProperty Status The Status property is a string indicating the current status of the object. Various operational and non-operational statuses can be defined. Status � � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 10 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING ` � � MSFT_CliQualifier ValueMap Q U \ f o z � � � � � � OK Error Degraded Unknown Pred Fail Starting Stopping Service Stressed NonRecover No Contact Lost Comm � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING Q � � MSFT_CliQualifier Values O S Z d m x � � � � � � OK Error Degraded Unknown Pred Fail Starting Stopping Service Stressed NonRecover No Contact Lost Comm � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � p u � � MSFT_CliProperty Tag The Tag property contains a string that uniquely identifies the physical memory device. Tag } � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ( � MSFT_CliQualifier MaxLen # 256 � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � � � MSFT_CliProperty TotalWidth Total width, in bits, of the physical memory, including check or error correction bits. If there are no error correction bits, the value in this property should match that specified for the DataWidth property. TotalWidth , 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � _ k � MSFT_CliProperty TypeDetail The TypeDetail property indicates the type of physical memory. TypeDetail � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier T U ^ � � MSFT_CliProperty Version A string indicating the version of the physical element. Version f � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 64 MemoryChip Where Tag = '#' Select * from Win32_PhysicalMemory �� F D 3 B B D 4 C 4 2 A C 2 F 7 F E F 2 6 4 3 4 0 A 9 E B 7 8 A 5 8 1 F E 5 C 2 8 5 6 1 C B 6 3 E D F 7 8 0 B 3 2 9 E A C 2 E E 4 �b��5��͝��C�]� � + [ �� �� � )� � MSFT_CliAlias � F N u � � � � �
U�������������������������4 � MSFT_CliConnection Authority
� > STRING Locale
� m STRING NameSpace
� � STRING Password
� � STRING Server
� � STRING User
� , STRING | � ( + � MSFT_CliConnection ms_409 ROOT\CIMV2 . Computer system's physical memory management. s & �A �D � �# �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty �" � � MSFT_CliFormat table STATUS 3 � � � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � * � MSFT_CliProperty Status The Status property is a string indicating the current status of the object. Various operational and non-operational statuses can be defined. Operational statuses are "OK", "Degraded" and "Pred Fail". "Pred Fail" indicates that an element may be functioning properly but predicting a failure in the near future. An example is a SMART-enabled hard drive. Non-operational statuses can also be specified. These are "Error", "Starting", "Stopping" and "Service". The latter, "Service", could apply during mirror-resilvering of a disk, reload of a user permissions list, or other administrative work. Not all such work is on-line, yet the managed element is neither "OK" nor in one of the other states. Status � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 10 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap A E L V _ j t ~ OK Error Degraded Unknown Pred Fail Starting Stopping Service � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values ? C J T ] h r | OK Error Degraded Unknown Pred Fail Starting Stopping Service # 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � \ b � MSFT_CliProperty Name The Name property defines the label by which the object is known. Name n 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier 4 � � � � MSFT_CliProperty Replaceable A physical package is replaceable if it is possible to replace (FRU or upgrade) the element with a physically different one. Replaceable H 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier h r ' � MSFT_CliProperty Location The Location property indicates the physical location of the memory array. Location z � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � k � MSFT_CliQualifier Values [ e l u � � � � � � " 9 N Reserved Other Unknown System board or motherboard ISA add-on card EISA add-on card PCI add-on card MCA add-on card PCMCIA add-on card Proprietary add-on card NuBus PC-98/C20 add-on card PC-98/C24 add-on card PC-98/E add-on card PC-98/Local bus add-on card s �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � + � MSFT_CliFormat SYSTEM
D � � U � b
�
x � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty __CLASS __CLASS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __DERIVATION __DERIVATION � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __DYNASTY __DYNASTY � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty __GENUS __GENUS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier t � , � MSFT_CliProperty __NAMESPACE __NAMESPACE � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o � " � MSFT_CliProperty __PATH __PATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier y � $ 6 � MSFT_CliProperty __PROPERTY_COUNT __PROPERTY_COUNT � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __RELPATH __RELPATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier q � & � MSFT_CliProperty __SERVER __SERVER � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __SUPERCLASS __SUPERCLASS K �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty X � � MSFT_CliFormat INSTANCE " � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o � " � MSFT_CliProperty __PATH __PATH 5~ �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty B} �_ � MSFT_CliFormat LIST FULL � � � � c
� <
� � -$ �& 2* :. �0 _5 �8 �< 5@ �O �S �W Y[ w] 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � G N � MSFT_CliProperty Depth The depth of the physical package in inches. Depth 6 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � h u � MSFT_CliProperty Description The Description property provides a textual description of the object. Description 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � I Q � MSFT_CliProperty Height The height of the physical package in inches. Height i 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier / � � � � MSFT_CliProperty HotSwappable A physical package can be hot swapped if it is possible to replace the element with a physically different but equivalent one while the containing package has power applied to it (i.e., is 'on'). For example, a disk drive package inserted using SCA connectors is removable and can be hot swapped. All packages that can be hot swapped are inherently removable and replaceable. HotSwappable � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier O � � � � MSFT_CliProperty InstallDate The InstallDate property is datetime value indicating when the object was installed. A lack of a value does not indicate that the object is not installed. InstallDate H 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier h r ' � MSFT_CliProperty Location The Location property indicates the physical location of the memory array. Location z � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � k � MSFT_CliQualifier Values [ e l u � � � � � � " 9 N Reserved Other Unknown System board or motherboard ISA add-on card EISA add-on card PCI add-on card MCA add-on card PCMCIA add-on card Proprietary add-on card NuBus PC-98/C20 add-on card PC-98/C24 add-on card PC-98/E add-on card PC-98/Local bus add-on card � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � n | � � MSFT_CliProperty Manufacturer The name of the organization responsible for producing the physical element. Manufacturer � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ( � MSFT_CliQualifier MaxLen # 256 � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier d � � � � MSFT_CliProperty MaxCapacity The MaxCapacity property indicates the maximum memory size (in bytes) installable for this particular memory array. If the size is unknown, the property is given a value of 0. MaxCapacity _ 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier % � ! � � � MSFT_CliProperty MemoryDevices The MemoryDevices property indicates the number of physical slots or sockets available in this memory array. MemoryDevices � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier R ) � � 8 � MSFT_CliProperty MemoryErrorCorrection The MemoryErrorCorrection property indicates the type of error correction used by the memory array. MemoryErrorCorrection � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values ? I P Y _ g w � Reserved Other Unknown None Parity Single-bit ECC Multi-bit ECC CRC � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier P U \ � MSFT_CliProperty Model The name by which the physical element is generally known. Model d � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 64 m 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier 3 � � � � MSFT_CliProperty Name The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property. Name � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier V � ( � � � MSFT_CliProperty OtherIdentifyingInfo OtherIdentifyingInfo captures additional data, beyond asset tag information, that could be used to identify a physical element. One example is bar code data associated with an element that also has an asset tag. Note that if only bar code data is available and is unique/able to be used as an element key, this property would be NULL and the bar code data used as the class key, in the tag property. OtherIdentifyingInfo 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � � � MSFT_CliProperty PartNumber The part number assigned by the organization responsible for producing or manufacturing the physical element. PartNumber � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ( � MSFT_CliQualifier MaxLen # 256 J 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � ~ � � MSFT_CliProperty PoweredOn Boolean indicating that the physical element is powered on (TRUE), or is currently off (FALSE). PoweredOn � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � MSFT_CliProperty Removable A physical package is removable if it is designed to be taken in and out of the physical container in which it is normally found, without impairing the function of the overall packaging. A package can still be removable if power must be 'off' in order to perform the removal. If power can be 'on' and the package removed, then the element is removable and can be hot swapped. For example, an extra battery in a laptop is removable, as is a disk drive package inserted using SCA connectors. However, the latter can be hot swapped. A laptop's display is not removable, nor is a non-redundant power supply. Removing these components would impact the function of the overall packaging or is impossible due to the tight integration of the package. Removable � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier T � � � � MSFT_CliProperty Replaceable A physical package is replaceable if it is possible to replace (FRU or upgrade) the element with a physically different one. For example, some computer systems allow the main processor chip to be upgraded to one of a higher clock rating. In this case, the processor is said to be replaceable . Another example is a power supply package mounted on sliding rails. All removable packages are inherently replaceable . Replaceable � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � h v � � MSFT_CliProperty SerialNumber A manufacturer-allocated number used to identify the physical element. SerialNumber ~ � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 64 ~ 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier D Q V y � MSFT_CliProperty SKU The stock keeping unit number for this physical element. SKU ^ � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 64 � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � * � MSFT_CliProperty Status The Status property is a string indicating the current status of the object. Various operational and non-operational statuses can be defined. Operational statuses are "OK", "Degraded" and "Pred Fail". "Pred Fail" indicates that an element may be functioning properly but predicting a failure in the near future. An example is a SMART-enabled hard drive. Non-operational statuses can also be specified. These are "Error", "Starting", "Stopping" and "Service". The latter, "Service", could apply during mirror-resilvering of a disk, reload of a user permissions list, or other administrative work. Not all such work is on-line, yet the managed element is neither "OK" nor in one of the other states. Status � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 10 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap A E L V _ j t ~ OK Error Degraded Unknown Pred Fail Starting Stopping Service � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values ? C J T ] h r | OK Error Degraded Unknown Pred Fail Starting Stopping Service � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � o t � � MSFT_CliProperty Tag The Tag property contains a string that uniquely identifies the physical memory array. Tag | � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ( � MSFT_CliQualifier MaxLen # 256 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � b g � � MSFT_CliProperty Use The Use property indicates how the memory is used in the computer system. Use o � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values ? I P Y h v � � Reserved Other Unknown System memory Video memory Flash memory Non-volatile RAM Cache memory � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier T U ^ � � MSFT_CliProperty Version A string indicating the version of the physical element. Version f � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 64 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � I Q � MSFT_CliProperty Weight The weight of the physical package in pounds. Weight 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � G N � MSFT_CliProperty Width The width of the physical package in inches. Width � �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � �
� MSFT_CliFormat TABLE BRIEF 2 � � � � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier P U \ � MSFT_CliProperty Model The name by which the physical element is generally known. Model d � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 64 # 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � \ b � MSFT_CliProperty Name The Name property defines the label by which the object is known. Name � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier d � � � � MSFT_CliProperty MaxCapacity The MaxCapacity property indicates the maximum memory size (in bytes) installable for this particular memory array. If the size is unknown, the property is given a value of 0. MaxCapacity _ 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier % � ! � � � MSFT_CliProperty MemoryDevices The MemoryDevices property indicates the number of physical slots or sockets available in this memory array. MemoryDevices MemPhysical Select * from Win32_PhysicalMemoryArray �D F D 3 B B D 4 C 4 2 A C 2 F 7 F E F 2 6 4 3 4 0 A 9 E B 7 8 A 5 8 1 F E 5 C 2 8 5 6 1 C B 6 3 E D F 7 8 0 B 3 2 9 E A C 2 E E 4 �b��5��͝��C��C � + G C �C �C �C � MSFT_CliAlias � F N u � � � � �
U�������������������������4 � MSFT_CliConnection Authority
� > STRING Locale
� m STRING NameSpace
� � STRING Password
� � STRING Server
� � STRING User
� , STRING | � ( + � MSFT_CliConnection ms_409 ROOT\CIMV2 . Network Client management. _ ) �$ ( �
�
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � � � MSFT_CliFormat list FULL 4 � � K � � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier t � , � MSFT_CliProperty Description Description � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier t � , � MSFT_CliProperty InstallDate InstallDate � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty Manufacturer Manufacturer � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier m � � MSFT_CliProperty Name Name � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o � " � MSFT_CliProperty Status Status � �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � � � MSFT_CliFormat table STATUS + � � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier m � � MSFT_CliProperty Name Name � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o � " � MSFT_CliProperty Status Status �
�
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � � � MSFT_CliFormat table BRIEF 2 � � E � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty Caption Caption � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier t � , � MSFT_CliProperty InstallDate InstallDate � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty Manufacturer Manufacturer � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier m � � MSFT_CliProperty Name Name I �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty V � � MSFT_CliFormat INSTANCE " � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier m � � MSFT_CliProperty Name s �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � + � MSFT_CliFormat SYSTEM
D � � U � b
�
x � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty __CLASS __CLASS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __DERIVATION __DERIVATION � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __DYNASTY __DYNASTY � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty __GENUS __GENUS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier t � , � MSFT_CliProperty __NAMESPACE __NAMESPACE � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o � " � MSFT_CliProperty __PATH __PATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier y � $ 6 � MSFT_CliProperty __PROPERTY_COUNT __PROPERTY_COUNT � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __RELPATH __RELPATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier q � & � MSFT_CliProperty __SERVER __SERVER � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __SUPERCLASS __SUPERCLASS NetClient WHERE Name='#' Select * from WIN32_NetworkClient � F D 3 B B D 4 C 4 2 A C 2 F 7 F E F 2 6 4 3 4 0 A 9 E B 7 8 A 5 8 1 F E 5 C 2 8 5 6 1 C B 6 3 E D F 7 8 0 B 3 2 9 E A C 2 E E 4 �b��5��͝��C��� � + j � "� 2� [� � MSFT_CliAlias � F N u � � � � �
U�������������������������4 � MSFT_CliConnection Authority
� > STRING Locale
� m STRING NameSpace
� � STRING Password
� � STRING Server
� � STRING User
� , STRING | � ( + � MSFT_CliConnection ms_409 ROOT\CIMV2 . Network login information (of a particular user) management. ~ � e# �� s �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � + � MSFT_CliFormat SYSTEM
D � � U � b
�
x � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty __CLASS __CLASS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __DERIVATION __DERIVATION � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __DYNASTY __DYNASTY � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty __GENUS __GENUS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier t � , � MSFT_CliProperty __NAMESPACE __NAMESPACE � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o � " � MSFT_CliProperty __PATH __PATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier y � $ 6 � MSFT_CliProperty __PROPERTY_COUNT __PROPERTY_COUNT � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __RELPATH __RELPATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier q � & � MSFT_CliProperty __SERVER __SERVER � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __SUPERCLASS __SUPERCLASS l �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty y � � MSFT_CliFormat INSTANCE " � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � v | � � MSFT_CliProperty Name The Name property specifies the name of the user account on a particular domain or machine. Name � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ( � MSFT_CliQualifier MaxLen # 256 /� �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty <� ga � MSFT_CliFormat LIST FULL � h � V �
� W � < � � �# �* �- �0 �4 �7 }: $= �? aB =F I �K qO R WT �V �^ � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � " � � MSFT_CliProperty AccountExpires The AccountExpires property specifies when the account will expire. This value is calculated from the number of seconds elapsed since 00:00:00, January 1, 1970, and is set in this format: yyyymmddhhmmss.mmmmmm sutc. AccountExpires v 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier < � & � � � MSFT_CliProperty AuthorizationFlags The AuthorizationFlags property contains a set of flags that specify the resources a user is authorized to use or modify. AuthorizationFlags p 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier 6 � $ � � � MSFT_CliProperty BadPasswordCount The BadPasswordCount property indicates the number of times the user enters a bad password when logging on to a system. BadPasswordCount 5 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � k t � MSFT_CliProperty Comment The Comment property contains a comment or description for this login profile. Comment L 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � ~ � � MSFT_CliProperty CountryCode The CountryCode property specifies the country/region code for the user's language of choice. CountryCode 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � E R � MSFT_CliProperty Description A textual description of the object. Description P 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � � MSFT_CliProperty Flags The Flags property indicates the properties available to this network profile. Properties that can be set include:/nUF_SCRIPT - A logon script executed./nUF_ACCOUNTDISABLE - The user's account is disabled./nUF_HOMEDIR_REQUIRED - A home directory is required. /nUF_PASSWD_NOTREQD - No password is required./nUF_PASSWD_CANT_CHANGE - The user cannot change the password./nUF_LOCKOUT - The account is currently locked out. For NetUserSetInfo, this value can be cleared to unlock a previously locked account. This value cannot be used to lock a previously unlocked account./nUF_DONT_EXPIRE_PASSWD - password should never expire on the account./nThe following properties describe the account type. Only one value can be set:/nUF_NORMAL_ACCOUNT - Default account type that represents a typical user./nUF_TEMP_DUPLICATE_ACCOUNT - An account for users whose primary account is in another domain. This account provides user access to this domain, but not to any domain that trusts this domain. The User Manager refers to this account type as a local user account./nUF_WORKSTATION_TRUST_ACCOUNT - A computer account for a workstation or a server that is a member of this domain./nUF_SERVER_TRUST_ACCOUNT - A computer account for a backup domain controller that is a member of this domain./nUF_INTERDOMAIN_TRUST_ACCOUNT - A permit to trust account for a domain that trusts other domains. Flags K 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � � MSFT_CliProperty FullName The FullName property indicates the full name of the user belonging to the network login profile. FullName � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier X � ! � � � MSFT_CliProperty HomeDirectory The HomeDirectory property specifies the path to the home directory of the user. This string may be empty if the user chooses not to specify a home directory. HomeDirectory r 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier 8 � & � � � MSFT_CliProperty HomeDirectoryDrive The HomeDirectoryDrive property specifies the drive letter assigned to the user's home directory for logon purposes. HomeDirectoryDrive 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � J V � MSFT_CliProperty LastLogoff The LastLogoff property specifies the date and time the user last logged off the system. This value is calculated from the number of seconds elapsed since 00:00:00, January 1, 1970. A value of zero means that the last logoff time is unknown. The format of this value is yyyymmddhhmmss.mmmmmm sutc. LastLogoff � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � MSFT_CliProperty LastLogon The LastLogon property indicates the date and time the user last logged on to the system. This value is calculated from the number of seconds elapsed since 00:00:00, January 1, 1970. The format of this value is yyyymmddhhmmss.mmmmmm sutc. LastLogon 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � C � MSFT_CliProperty LogonHours The LogonHours property specifies the times during the week when the user can log on. Each bit represents a unit of time specified by the UnitsPerWeek member. For instance, if the unit of time is hourly, the first bit (bit 0, word 0) is Sunday, 0:00 to 0:59; the second bit (bit 1, word 0) is Sunday, 1:00 to 1:59; and so on. If this member is set to NULL, then there is no time restriction. The time is set to GMT and must be adjusted for other time zones (for example, GMT minus 8 hours for PST). LogonHours ( � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ( � MSFT_CliQualifier MaxLen # 147 7 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � i v � MSFT_CliProperty LogonServer The LogonServer property contains the name of the server to which logon requests are sent. Server names should be preceded by two backslashes (\\). A server name with an asterisk (\\*) indicates that the logon request can be handled by any logon server. A null string indicates that requests are sent to the domain controller. LogonServer � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � " � � � MSFT_CliProperty MaximumStorage The MaximumStorage property specifies the maximum amount of disk space available to the user. If MaximumStorage is set to USER_MAXSTORAGE_UNLIMITED the user is allowed to use all available disk space. MaximumStorage � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � v | � � MSFT_CliProperty Name The Name property specifies the name of the user account on a particular domain or machine. Name � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ( � MSFT_CliQualifier MaxLen # 256 J 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � " y � � MSFT_CliProperty NumberOfLogons The NumberOfLogons property indicates the number of successful times the user tried to log on to this account. A value of 0xFFFFFFFF indicates that the value is unknown. This property is maintained separately on each backup domain controller (BDC) in the domain. To get an accurate value only the largest value from all BDCs should be used. NumberOfLogons � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier e � � � � MSFT_CliProperty Parameters The Parameters property contains space set aside for use by applications. This string can be null, or it can have any number of characters before the terminating null character. Parameters � 9 0�� � I I S _ R e w r i t e _ T r a n s �5h�b �� # IIS_Rewrite_Trans ] � �� " 7 D Z e t � � � � � X g - 4 � � � %
_U���������������������������������� � ConditionEvaluation DisplayName ConditionEvaluation Description Condition evaluation EventType EventTypeName CONDITION_EVALUATION EventLevel locale MS\0x409 ContextId
N
� " / ; F L �� � �� object WmiDataId Description Context ID extension Guid ActivityID ExpandedInput P
� � � � � � " * � �� string WmiDataId Description The expanded input value StringTermination NullTerminated Format w Input P
� � � � � � � � � � �� string WmiDataId Description The input value format StringTermination NullTerminated Format w MatchType j
� { � � � � � ! + D L z � � �� uint32 WmiDataId Description The condition match type to evaluate ValueDescriptions � � Pattern match. Is file condition. Is directory condition. ValueMap ; > A 0 1 2 Values \ e m Pattern IsFile IsDirectory ValueType index Negate 6
� � � � � � �� boolean WmiDataId Description True if the match will be negated Pattern P
� � � � � � � � � � �� string WmiDataId Description The pattern to use if the match type is Pattern StringTermination NullTerminated Format w Succeeded 6
� Q Z e r � �� boolean WmiDataId Description True if the condition evaluation succeeded �� string WmiDataId Description The pattern to use if the match type is Pattern StringTermination NullTerminated Format w Succeeded 6
� Q Z e r � �� boolean WmiDataId Description True if the condition evaluation succeeded � �� string WmiDataId Description The pattern to use if the match type is Pattern StringTermination NullTerminated Format w Succeeded 6
� Q Z e r � �� boolean WmiDataId Description True if the condition evaluation succeeded � string WmiDataId Description The pattern to use if the match type is Pattern StringTermination NullTerminated Format w Succeeded 6
� Q Z e r � �� boolean WmiDataId Description True if the condition evaluation succeeded � �� string WmiDataId Description The pattern to use if the match type is Pattern StringTermination NullTerminated Format w Succeeded 6
� Q Z e r � �� boolean WmiDataId Description True if the condition evaluation succeeded � �� string WmiDataId Description The pattern to use if the match type is Pattern StringTermination NullTerminated Format w Succeeded 6
� Q Z e r � �� boolean WmiDataId Description True if the condition evaluation succeeded � string WmiDataId Description The pattern to use if the match type is Pattern StringTermination NullTerminated Format w Succeeded 6
� Q Z e r � �� boolean WmiDataId Description True if the condition evaluation succeeded � �� string WmiDataId Description The pattern to use if the match type is Pattern StringTermination NullTerminated Format w Succeeded 6
� Q Z e r � �� boolean WmiDataId Description True if the condition evaluation succeeded � � �� string WmiDataId Description The pattern to use if the match type is Pattern StringTermination NullTerminated Format w Succeeded 6
� Q Z e r � �� boolean WmiDataId Description True if the condition evaluation succeeded � �� string WmiDataId Description The pattern to use if the match type is Pattern StringTermination NullTerminated Format w Succeeded 6
� Q Z e r � �� boolean WmiDataId Description True if the condition evaluation succeeded �� string WmiDataId Description The pattern to use if the match type is Pattern StringTermination NullTerminated Format w Succeeded 6
� Q Z e r � �� boolean WmiDataId Description True if the condition evaluation succeeded � � �� string WmiDataId Description The pattern to use if the match type is Pattern StringTermination NullTerminated Format w Succeeded 6
� Q Z e r � �� boolean WmiDataId Description True if the condition evaluation succeeded � � �� string WmiDataId Description The pattern to use if the match type is Pattern StringTermination NullTerminated Format w Succeeded 6
� Q Z e r � �� boolean WmiDataId Description True if the condition evaluation succeeded � � � �� string WmiDataId Description The pattern to use if the match type is Pattern StringTermination NullTerminated Format w Succeeded 6
� Q Z e r � �� boolean WmiDataId Description True if the condition evaluation succeeded �� string WmiDataId Description The pattern to use if the match type is Pattern StringTermination NullTerminated Format w Succeeded 6
� Q Z e r � �� boolean WmiDataId Description True if the condition evaluation succeeded �� string WmiDataId Description The pattern to use if the match type is Pattern StringTermination NullTerminated Format w Succeeded 6
� Q Z e r � �� boolean WmiDataId Description True if the condition evaluation succeeded � � �� string WmiDataId Description The pattern to use if the match type is Pattern StringTermination NullTerminated Format w Succeeded 6
� Q Z e r � �� boolean WmiDataId Description True if the condition evaluation succeeded �ing WmiDataId Description The pattern to use if the match type is Pattern StringTermination NullTerminated Format w Succeeded 6
� Q Z e r � �� boolean WmiDataId Description True if the condition evaluation succeeded ��� string WmiDataId Description The pattern to use if the match type is Pattern StringTermination NullTerminated Format w Succeeded 6
� Q Z e r � �� boolean WmiDataId Description True if the condition evaluation succeeded � � � �� string WmiDataId Description The pattern to use if the match type is Pattern StringTermination NullTerminated Format w Succeeded 6
� Q Z e r � �� boolean WmiDataId Description True if the condition evaluation succeeded �string WmiDataId Description The pattern to use if the match type is Pattern StringTermination NullTerminated Format w Succeeded 6
� Q Z e r � �� boolean WmiDataId Description True if the condition evaluation succeeded ��� � �� object WmiDataId extension Guid ActivityID �ResourceName] E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier i � � � � MSFT_CliProperty PasswordAge The PasswordAge property indicates the length of time a password has been in effect. This value is measured from the number of seconds elapsed since the password was last changed. PasswordAge � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier P � # � � � MSFT_CliProperty PasswordExpires The PasswordExpires property indicates the date and time when the password will expire. The value is set in this format: yyyymmddhhmmss.mmmmmm sutc PasswordExpires � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier q � " � � � MSFT_CliProperty PrimaryGroupId The PrimaryGroupId property specifies the relative ID (RID) of the Primary Global Group for this user. The identifier verifies the primary group to which the user's profile belongs. PrimaryGroupId � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � w � � � MSFT_CliProperty Privileges The privileges property specifies the level of privilege assigned to the name property. Privileges � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i G � MSFT_CliQualifier Values + 2 8 Guest User Administrator � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � MSFT_CliProperty Profile The Profile property specifies a directory path to the user's profile. This value can be a null string, a local absolute path, or a UNC path. A user profile contains settings that are customizable for each user such as the desktop colors. Profile � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier b � � � � MSFT_CliProperty ScriptPath The ScriptPath property indicates the directory path to the user's logon script. A logon script automatically executes a set of commands each time a user logs on to a system. ScriptPath � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier } K V y � MSFT_CliProperty SettingID The identifier by which the object is known. SettingID ^ � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ( � MSFT_CliQualifier MaxLen # 256 � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier \ � � � � MSFT_CliProperty UnitsPerWeek The UnitsPerWeek property indicates the number of time units the week is divided into. It is used with the LogonHours property to limit user access to the computer. UnitsPerWeek H 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � z � � MSFT_CliProperty UserComment The UserComment property contains a user defined comment or description for this profile. UserComment q 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier 7 � � � � MSFT_CliProperty UserId The UserId property specifies the relative ID (RID) of the user. The identifier verifies that the user exists and is unique to this domain. UserId � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � n x � � MSFT_CliProperty UserType The UserType property indicates the type of account the user has privileges to. UserType � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap 9 I \ w � � Normal Account Duplicate Account Workstation Trust Account Server Trust Account Interdomain Trust Account Unknown � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values 7 G Z u � � Normal Account Duplicate Account Workstation Trust Account Server Trust Account Interdomain Trust Account Unknown � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier i � � � � MSFT_CliProperty Workstations The Workstations property contains the names of workstations from which the user can log on. Up to eight workstations can be specified; a null string indicates no restrictions. Workstations 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �5h�b �
͝��C�� 4 �r��t � s � WDMClassesOfDriver WmiMonitorColorCharacteristics C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] [MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �5h�b �
͝��C�� 4 �r��t � s � WDMClassesOfDriver WmiMonitorColorCharacteristics C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] i[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �5h�b �
͝��C�� 4 �r��t � s � WDMClassesOfDriver WmiMonitorColorCharacteristics C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] sourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �5h�b �
͝��C�� 4 �r��t � s � WDMClassesOfDriver WmiMonitorColorCharacteristics C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] ui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �5h�b �
͝��C�� 4 �r��t � s � WDMClassesOfDriver WmiMonitorColorCharacteristics C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] rceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �5h�b �
͝��C�� 4 �r��t � s � WDMClassesOfDriver WmiMonitorColorCharacteristics C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �5h�b �
͝��C�� ) �r��t � h � WDMClassesOfDriver VideoModeDescriptor C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �5h�b �
͝��C�� ) �r��t � h � WDMClassesOfDriver VideoModeDescriptor C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] rceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �5h�b �
͝��C�� ) �r��t � h � WDMClassesOfDriver VideoModeDescriptor C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] e] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �5h�b �
͝��C�� ) �r��t � h � WDMClassesOfDriver VideoModeDescriptor C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] Name] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �5h�b �
͝��C�� ) �r��t � h � WDMClassesOfDriver VideoModeDescriptor C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] sourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �5h�b �
͝��C�� ) �r��t � h � WDMClassesOfDriver VideoModeDescriptor C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] ] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �5h�b �
͝��C�� ) �r��t � h � WDMClassesOfDriver VideoModeDescriptor C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] e] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �5h�b �
͝��C�� ) �r��t � h � WDMClassesOfDriver VideoModeDescriptor C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] me] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �5h�b �
͝��C�� ) �r��t � h � WDMClassesOfDriver VideoModeDescriptor C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] e] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �5h�b �
͝��C�� ) �r��t � h � WDMClassesOfDriver VideoModeDescriptor C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] ResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �5h�b �
͝��C�� ) �r��t � h � WDMClassesOfDriver VideoModeDescriptor C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] [MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �5h�b �
͝��C�� ) �r��t � h � WDMClassesOfDriver VideoModeDescriptor C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] eName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �5h�b �
͝��C�� ) �r��t � h � WDMClassesOfDriver VideoModeDescriptor C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �5h�b �
͝��C�� ) �r��t � h � WDMClassesOfDriver VideoModeDescriptor C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] e] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �5h�b �
͝��C�� ) �r��t � h � WDMClassesOfDriver VideoModeDescriptor C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] ] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �5h�b �
͝��C�� ) �r��t � h � WDMClassesOfDriver VideoModeDescriptor C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �5h�b �
͝��C�� ) �r��t � h � WDMClassesOfDriver VideoModeDescriptor C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �5h�b �
͝��C�� ) �r��t � h � WDMClassesOfDriver VideoModeDescriptor C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] ceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �5h�b �
͝��C�� ) �r��t � h � WDMClassesOfDriver VideoModeDescriptor C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] ceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �5h�b �
͝��C�� ) �r��t � h � WDMClassesOfDriver VideoModeDescriptor C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] ceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �5h�b �
͝��C�� ) �r��t � h � WDMClassesOfDriver VideoModeDescriptor C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] Source File Name Text
� 5 = J string Description Text � � �n ID � |, �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty �+ . � MSFT_CliFormat TABLE BRIEF : m 7 i � � / 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � 9 B e � MSFT_CliProperty Caption A short textual description. Caption J � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 64 � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � n z � � MSFT_CliProperty Privileges The privileges property specifies the level of privilege assigned to the user. Privileges � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i G � MSFT_CliQualifier Values + 2 8 Guest User Administrator . 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � d m � MSFT_CliProperty Profile The Profile property specifies a directory path to the user's profile. Profile & 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � ] e � MSFT_CliProperty UserId The UserId property specifies the relative ID (RID) of the user. UserId � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � n x � � MSFT_CliProperty UserType The UserType property indicates the type of account the user has privileges to. UserType � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap 9 I \ w � � Normal Account Duplicate Account Workstation Trust Account Server Trust Account Interdomain Trust Account Unknown � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values 7 G Z u � � Normal Account Duplicate Account Workstation Trust Account Server Trust Account Interdomain Trust Account Unknown � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier i � � � � MSFT_CliProperty Workstations The Workstations property contains the names of workstations from which the user can log on. Up to eight workstations can be specified; a null string indicates no restrictions. Workstations NetLogin WHERE Name='#' Select * from Win32_NetworkLoginProfile # 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � \ b � MSFT_CliProperty Name The Name property defines the label by which the object is known. Name n 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier 4 � � � � MSFT_CliProperty Replaceable A physical package is replaceable if it is possible to replace (FRU or upgrade) the element with a physically different one. Replaceable H 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier h r ' � MSFT_CliProperty Location The Location property indicates the physical location of the memory array. Location z � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � k � MSFT_CliQualifier Values [ e l u � � � � � � " 9 N Reserved Other Unknown System board or motherboard ISA add-on card EISA add-on card PCI add-on card MCA add-on card PCMCIA add-on card Proprietary add-on card NuBus PC-98/C20 add-on card PC-98/C24 add-on card PC-98/E add-on card PC-98/Local bus add-on card �" F D 3 B B D 4 C 4 2 A C 2 F 7 F E F 2 6 4 3 4 0 A 9 E B 7 8 A 5 8 1 F E 5 C 2 8 5 6 1 C B 6 3 E D F 7 8 0 B 3 2 9 E A C 2 E E 4 �b��5��͝��C�" � + f �! �! �! �!� MSFT_CliAlias � F N u � � � � �
U�������������������������4 � MSFT_CliConnection Authority
� > STRING Locale
� m STRING NameSpace
� � STRING Password
� � STRING Server
� � STRING User
� , STRING | � ( + � MSFT_CliConnection ms_409 ROOT\CIMV2 . Protocols (and their network characteristics) management. � � H! !q W� �� s �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � + � MSFT_CliFormat SYSTEM
D � � U � b
�
x � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty __CLASS __CLASS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __DERIVATION __DERIVATION � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __DYNASTY __DYNASTY � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty __GENUS __GENUS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier t � , � MSFT_CliProperty __NAMESPACE __NAMESPACE � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o � " � MSFT_CliProperty __PATH __PATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier y � $ 6 � MSFT_CliProperty __PROPERTY_COUNT __PROPERTY_COUNT � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __RELPATH __RELPATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier q � & � MSFT_CliProperty __SERVER __SERVER � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __SUPERCLASS __SUPERCLASS K �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty X � � MSFT_CliFormat INSTANCE " � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o � " � MSFT_CliProperty __PATH __PATH �O �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty �N �> � MSFT_CliFormat LIST FULL x � � (
� ~ � s � � L 9# �% 3( �*
- �/ W3 36 �8 +; f 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier , � ) � � � MSFT_CliProperty ConnectionlessService The ConnectionlessService property indicates whether the protocol supports connectionless service. ConnectionlessService 6 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � h u � MSFT_CliProperty Description The Description property provides a textual description of the object. Description ~ 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier D � & � � � MSFT_CliProperty GuaranteesDelivery The GuaranteesDelivery property indicates whether the protocol guarantees that all data sent will reach the intended destination. GuaranteesDelivery � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier L � ( � � � MSFT_CliProperty GuaranteesSequencing The GuaranteesSequencing property indicates whether the protocol guarantees that data will arrive in the order in which it was sent. GuaranteesSequencing � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier O � � � � MSFT_CliProperty InstallDate The InstallDate property is datetime value indicating when the object was installed. A lack of a value does not indicate that the object is not installed. InstallDate � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � & � � MSFT_CliProperty MaximumAddressSize The MaximumAddressSize property indicates the maximum length of a socket address supported by the protocol. Socket addresses may be items like URLs (www.microsoft.com) or IP addresses (130.215.24.1). MaximumAddressSize [ 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier ! � & � � � MSFT_CliProperty MaximumMessageSize The MaximumMessageSize property indicates the maximum message size supported by the protocol. MaximumMessageSize � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier X � # � � � MSFT_CliProperty MessageOriented The MessageOriented property indicates whether the protocol is message-oriented. A message-oriented protocol uses packets of data to transfer information. MessageOriented i 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier / � & � � � MSFT_CliProperty MinimumAddressSize The MinimumAddressSize property specifies the minimum length of a socket address supported by the protocol. MinimumAddressSize 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � O U � MSFT_CliProperty Name The Name property contains the name for the protocol. Name N 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � ( w � � MSFT_CliProperty PseudoStreamOriented The PseudoStreamOriented property indicates whether the protocol is a message-oriented protocol that can receive variable-length data packets or streamed data for all receive operations. This optional capability is useful when an application does not want the protocol to frame messages, and requires stream-oriented characteristics. PseudoStreamOriented � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � i q � � MSFT_CliProperty Status The Status property is a string indicating the current status of the object. Status � � / � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 10 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap A E L V _ j t ~ OK Error Degraded Unknown Pred Fail Starting Stopping Service � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values ? C J T ] h r | OK Error Degraded Unknown Pred Fail Starting Stopping Service � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier J � ( � � � MSFT_CliProperty SupportsBroadcasting The SupportsBroadcasting property indicates whether the protocol supports a mechanism for broadcasting messages across the network. SupportsBroadcasting n 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier 4 � ' � � � MSFT_CliProperty SupportsConnectData The SupportsConnectData property indicates whether the protocol allows data to be connected across the network. SupportsConnectData z 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier @ � * � � � MSFT_CliProperty SupportsDisconnectData The SupportsDisconnectData property indicates whether the protocol allows data to be disconnected across the network. SupportsDisconnectData U 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � & � � � MSFT_CliProperty SupportsEncryption The SupportsEncryption property indicates whether the protocol supports data encryption. SupportsEncryption � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � ) " � MSFT_CliProperty SupportsExpeditedData The SupportsExpeditedData property indicates whether the protocol supports expedited data (also known as urgent data) across the network. Expedited data can bypass flow control and receive priority over normal data packets./ SupportsExpeditedData b 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier ( � ) � � � MSFT_CliProperty SupportsFragmentation The SupportsFragmentation property indicates whether the protocol supports transmitting the data in fragments. Physical network Maximum Transfer Unit (MTU) is hidden from applications. Each media type has a maximum frame size that cannot be exceeded. The link layer is responsible for discovering the MTU and reporting it to the protocols being used. SupportsFragmentation � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � + � � MSFT_CliProperty SupportsGracefulClosing The SupportsGracefulClosing property indicates whether the protocol supports two-phase close operations - also known as graceful close operations. If not, the protocol supports only abortive close operations. SupportsGracefulClosing � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier ^ � / � � � MSFT_CliProperty SupportsGuaranteedBandwidth The SupportsGuaranteedBandwidth property indicates whether the protocol has a mechanism to establish and maintain a guaranteed bandwidth. SupportsGuaranteedBandwidth X 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � ( � � � MSFT_CliProperty SupportsMulticasting The SupportsMulticasting property indicates whether the protocol supports multicasting. SupportsMulticasting � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier w � , � � � MSFT_CliProperty SupportsQualityofService The SupportsQualityofService property indicates whether the protocol is capable of Quality of Service (QOS) support via the underlying layered service provider or transport carrier. QOS is a collection of components that enable differentiation and preferential treatment for subsets of data transmitted over the network. QOS loosely means subsets of data get higher priority or guaranteed service when traversing a network. SupportsQualityofService 2] �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty ?\ �M � MSFT_CliFormat LIST FULL x K
� o 8 � t � ^" 2 �4 7 �9 �; �> <B E �G J � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier [ � ) � � � MSFT_CliProperty ConnectionlessService The ConnectionlessService property indicates whether the protocol supports connectionless service. A connectionless (datagram) service describes a communications protocol or transport in which data packets are routed independently of each other and may follow different routes and arrive in a different order from that in which they were sent. Conversely, a connection-oriented service provides a virtual circuit through which data packets are received in the same order they were transmitted. If the connection between machines fails, the application is notified./nValues: TRUE or FALSE. A value of TRUE indicates the protocol uses a connectionless service. ConnectionlessService 6 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � h u � MSFT_CliProperty Description The Description property provides a textual description of the object. Description � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier x � & � � � MSFT_CliProperty GuaranteesDelivery The GuaranteesDelivery property indicates whether the protocol guarantees that all data sent will reach the intended destination. If this flag is FALSE, there is no such guarantee. GuaranteesDelivery � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � ( � MSFT_CliProperty GuaranteesSequencing The GuaranteesSequencing property indicates whether the protocol guarantees that data will arrive in the order in which it was sent. Note that this characteristic does not guarantee delivery of the data, only its order. GuaranteesSequencing � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier O � � � � MSFT_CliProperty InstallDate The InstallDate property is datetime value indicating when the object was installed. A lack of a value does not indicate that the object is not installed. InstallDate � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � & � � MSFT_CliProperty MaximumAddressSize The MaximumAddressSize property indicates the maximum length of a socket address supported by the protocol. Socket addresses may be items like URLs (www.microsoft.com) or IP addresses (130.215.24.1). MaximumAddressSize N 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � & y � � MSFT_CliProperty MaximumMessageSize The MaximumMessageSize property indicates the maximum message size supported by the protocol. This is the maximum size of a message that can be sent from or received by the host. For protocols that do not support message framing, the actual maximum size of a message that can be sent to a given address may be less than this value. There are two special values defined for this property:/n0 - The protocol is stream-oriented; the concept of message size is not relevant./n1 - The maximum outbound (send) message size is dependent on the underlying network MTU (maximum sized transmission unit) and hence cannot be known until after a socket is bound. Applications should use getsockopt to retrieve the value of SO_MAX_MSG_SIZE after the socket has been bound to a local address./n 0xFFFFFFFF - There is no specified maximum message size defined./n MaximumMessageSize � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � # % � MSFT_CliProperty MessageOriented The MessageOriented property indicates whether the protocol is message-oriented. A message-oriented protocol uses packets of data to transfer information. Conversely, stream-oriented protocols transfer data as a continuous stream of bytes. MessageOriented i 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier / � & � � � MSFT_CliProperty MinimumAddressSize The MinimumAddressSize property specifies the minimum length of a socket address supported by the protocol. MinimumAddressSize ' 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � ` f � MSFT_CliProperty Name The Name property contains the name for the protocol./nExample: TCP/IP Name N 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � ( w � � MSFT_CliProperty PseudoStreamOriented The PseudoStreamOriented property indicates whether the protocol is a message-oriented protocol that can receive variable-length data packets or streamed data for all receive operations. This optional capability is useful when an application does not want the protocol to frame messages, and requires stream-oriented characteristics. PseudoStreamOriented � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � * � MSFT_CliProperty Status The Status property is a string indicating the current status of the object. Various operational and non-operational statuses can be defined. Operational statuses are "OK", "Degraded" and "Pred Fail". "Pred Fail" indicates that an element may be functioning properly but predicting a failure in the near future. An example is a SMART-enabled hard drive. Non-operational statuses can also be specified. These are "Error", "Starting", "Stopping" and "Service". The latter, "Service", could apply during mirror-resilvering of a disk, reload of a user permissions list, or other administrative work. Not all such work is on-line, yet the managed element is neither "OK" nor in one of the other states. Status � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 10 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap A E L V _ j t ~ OK Error Degraded Unknown Pred Fail Starting Stopping Service � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values ? C J T ] h r | OK Error Degraded Unknown Pred Fail Starting Stopping Service � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier J � ( � � � MSFT_CliProperty SupportsBroadcasting The SupportsBroadcasting property indicates whether the protocol supports a mechanism for broadcasting messages across the network. SupportsBroadcasting n 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier 4 � ' � � � MSFT_CliProperty SupportsConnectData The SupportsConnectData property indicates whether the protocol allows data to be connected across the network. SupportsConnectData z 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier @ � * � � � MSFT_CliProperty SupportsDisconnectData The SupportsDisconnectData property indicates whether the protocol allows data to be disconnected across the network. SupportsDisconnectData U 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � & � � � MSFT_CliProperty SupportsEncryption The SupportsEncryption property indicates whether the protocol supports data encryption. SupportsEncryption � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � ) " � MSFT_CliProperty SupportsExpeditedData The SupportsExpeditedData property indicates whether the protocol supports expedited data (also known as urgent data) across the network. Expedited data can bypass flow control and receive priority over normal data packets./ SupportsExpeditedData b 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier ( � ) � � � MSFT_CliProperty SupportsFragmentation The SupportsFragmentation property indicates whether the protocol supports transmitting the data in fragments. Physical network Maximum Transfer Unit (MTU) is hidden from applications. Each media type has a maximum frame size that cannot be exceeded. The link layer is responsible for discovering the MTU and reporting it to the protocols being used. SupportsFragmentation � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � + � � MSFT_CliProperty SupportsGracefulClosing The SupportsGracefulClosing property indicates whether the protocol supports two-phase close operations - also known as graceful close operations. If not, the protocol supports only abortive close operations. SupportsGracefulClosing � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier ^ � / � � � MSFT_CliProperty SupportsGuaranteedBandwidth The SupportsGuaranteedBandwidth property indicates whether the protocol has a mechanism to establish and maintain a guaranteed bandwidth. SupportsGuaranteedBandwidth X 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � ( � � � MSFT_CliProperty SupportsMulticasting The SupportsMulticasting property indicates whether the protocol supports multicasting. SupportsMulticasting � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier w � , � � � MSFT_CliProperty SupportsQualityofService The SupportsQualityofService property indicates whether the protocol is capable of Quality of Service (QOS) support via the underlying layered service provider or transport carrier. QOS is a collection of components that enable differentiation and preferential treatment for subsets of data transmitted over the network. QOS loosely means subsets of data get higher priority or guaranteed service when traversing a network. SupportsQualityofService v �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � � MSFT_CliFormat TABLE BRIEF : ' `
� � � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � q z � � MSFT_CliProperty Caption The Caption property is a short textual description (one-line string) of the object. Caption � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 64 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � & J ^ � MSFT_CliProperty GuaranteesDelivery The GuaranteesDelivery property indicates whether the protocol guarantees that all data sent will reach the intended destination. If this flag is FALSE, there is no such guarantee. /nValues: TRUE or FALSE. A value of TRUE indicates the protocol supports guaranteed delivery of data packets. GuaranteesDelivery 5 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � ( ^ t � MSFT_CliProperty GuaranteesSequencing The GuaranteesSequencing property indicates whether the protocol guarantees that data will arrive in the order in which it was sent. Note that this characteristic does not guarantee delivery of the data, only its order. /nValues: TRUE or FALSE. A value of TRUE indicates the order of data sent is guaranteed. GuaranteesSequencing � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier [ � ) � � � MSFT_CliProperty ConnectionlessService The ConnectionlessService property indicates whether the protocol supports connectionless service. A connectionless (datagram) service describes a communications protocol or transport in which data packets are routed independently of each other and may follow different routes and arrive in a different order from that in which they were sent. Conversely, a connection-oriented service provides a virtual circuit through which data packets are received in the same order they were transmitted. If the connection between machines fails, the application is notified./nValues: TRUE or FALSE. A value of TRUE indicates the protocol uses a connectionless service. ConnectionlessService � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � i q � � MSFT_CliProperty Status The Status property is a string indicating the current status of the object. Status � � / � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 10 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap A E L V _ j t ~ OK Error Degraded Unknown Pred Fail Starting Stopping Service � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values ? C J T ] h r | OK Error Degraded Unknown Pred Fail Starting Stopping Service 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � O U � MSFT_CliProperty Name The Name property contains the name for the protocol. Name �7 �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty �6 % � MSFT_CliFormat TABLE STATUS S m Z � T � + x T � L! 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � O U � MSFT_CliProperty Name The Name property contains the name for the protocol. Name � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � i q � � MSFT_CliProperty Status The Status property is a string indicating the current status of the object. Status � � / � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 10 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap A E L V _ j t ~ OK Error Degraded Unknown Pred Fail Starting Stopping Service � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values ? C J T ] h r | OK Error Degraded Unknown Pred Fail Starting Stopping Service � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier J � ( � � � MSFT_CliProperty SupportsBroadcasting The SupportsBroadcasting property indicates whether the protocol supports a mechanism for broadcasting messages across the network. SupportsBroadcasting n 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier 4 � ' � � � MSFT_CliProperty SupportsConnectData The SupportsConnectData property indicates whether the protocol allows data to be connected across the network. SupportsConnectData z 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier @ � * � � � MSFT_CliProperty SupportsDisconnectData The SupportsDisconnectData property indicates whether the protocol allows data to be disconnected across the network. SupportsDisconnectData U 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � & � � � MSFT_CliProperty SupportsEncryption The SupportsEncryption property indicates whether the protocol supports data encryption. SupportsEncryption � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � ) " � MSFT_CliProperty SupportsExpeditedData The SupportsExpeditedData property indicates whether the protocol supports expedited data (also known as urgent data) across the network. Expedited data can bypass flow control and receive priority over normal data packets./ SupportsExpeditedData b 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier ( � ) � � � MSFT_CliProperty SupportsFragmentation The SupportsFragmentation property indicates whether the protocol supports transmitting the data in fragments. Physical network Maximum Transfer Unit (MTU) is hidden from applications. Each media type has a maximum frame size that cannot be exceeded. The link layer is responsible for discovering the MTU and reporting it to the protocols being used. SupportsFragmentation � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � + � � MSFT_CliProperty SupportsGracefulClosing The SupportsGracefulClosing property indicates whether the protocol supports two-phase close operations - also known as graceful close operations. If not, the protocol supports only abortive close operations. SupportsGracefulClosing � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier ^ � / � � � MSFT_CliProperty SupportsGuaranteedBandwidth The SupportsGuaranteedBandwidth property indicates whether the protocol has a mechanism to establish and maintain a guaranteed bandwidth. SupportsGuaranteedBandwidth X 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � ( � � � MSFT_CliProperty SupportsMulticasting The SupportsMulticasting property indicates whether the protocol supports multicasting. SupportsMulticasting � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier w � , � � � MSFT_CliProperty SupportsQualityofService The SupportsQualityofService property indicates whether the protocol is capable of Quality of Service (QOS) support via the underlying layered service provider or transport carrier. QOS is a collection of components that enable differentiation and preferential treatment for subsets of data transmitted over the network. QOS loosely means subsets of data get higher priority or guaranteed service when traversing a network. SupportsQualityofService NetProtocol Select * from Win32_NetworkProtocol
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty X � � MSFT_CliFormat INSTANCE " � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o � " � MSFT_CliProperty __PATH __PATH 5~ �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty B} �_ � MSFT_CliFormat LIST FULL � � � � c
� <
� � -$ �& 2* :. �0 _5 �8 �< 5@ �O �S �W Y[ w] 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � G N � MSFT_CliProperty Depth The depth of the physical package in inches. Depth 6 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � h u � MSFT_CliProperty Description The Description property provides a textual description of the object. Description 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � I Q � MSFT_CliProperty Height The height of the physical package in inches. Height i 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier / � � � � MSFT_CliProperty HotSwappable A physical package can be hot swapped if it is possible to replace the element with a physically different but equivalent one while the containing package has power applied to it (i.e., is 'on'). For example, a disk drive package inserted using SCA connectors is removable and can be hot swapped. All packages that can be hot swapped are inherently removable and replaceable. HotSwappable � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier O � � � � MSFT_CliProperty InstallDate The InstallDate property is datetime value indicating when the object was installed. A lack of a value does not indicate that the object is not installed. InstallDate H 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier h r ' � MSFT_CliProperty Location The Location property indicates the physical location of the memory array. Location z � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � k � MSFT_CliQualifier Values [ e l u � � � � � � " 9 N Reserved Other Unknown System board or motherboard ISA add-on card EISA add-on card PCI add-on card MCA add-on card PCMCIA add-on card Proprietary add-on card NuBus PC-98/C20 add-on card PC-98/C24 add-on card PC-98/E add-on card PC-98/Local bus add-on card � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � n | � � MSFT_CliProperty Manufacturer The name of the organization responsible for producing the physical element. Manufacturer � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ( � MSFT_CliQualifier MaxLen # 256 � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier d � � � � MSFT_CliProperty MaxCapacity The MaxCapacity property indicates the maximum memory size (in bytes) installable for this particular memory array. If the size is unknown, the property is given a value of �� F D 3 B B D 4 C 4 2 A C 2 F 7 F E F 2 6 4 3 4 0 A 9 E B 7 8 A 5 8 1 F E 5 C 2 8 5 6 1 C B 6 3 E D F 7 8 0 B 3 2 9 E A C 2 E E 4 �b��5��͝��C�*� � + R �� �� Ϲ �� � MSFT_CliAlias � F N u � � � � �
U�������������������������4 � MSFT_CliConnection Authority
� > STRING Locale
� m STRING NameSpace
� � STRING Password
� � STRING Server
� � STRING User
� , STRING | � ( + � MSFT_CliConnection ms_409 ROOT\CIMV2 . Active network connection management. j + �O fk Go �( �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty �' � � MSFT_CliFormat table STATUS 7 � ) � � � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � * � MSFT_CliProperty Status The Status property is a string indicating the current status of the object. Various operational and non-operational statuses can be defined. Operational statuses are "OK", "Degraded" and "Pred Fail". "Pred Fail" indicates that an element may be functioning properly but predicting a failure in the near future. An example is a SMART-enabled hard drive. Non-operational statuses can also be specified. These are "Error", "Starting", "Stopping" and "Service". The latter, "Service", could apply during mirror-resilvering of a disk, reload of a user permissions list, or other administrative work. Not all such work is on-line, yet the managed element is neither "OK" nor in one of the other states. Status � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 10 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap A E L V _ j t ~ OK Error Degraded Unknown Pred Fail Starting Stopping Service � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values ? C J T ] h r | OK Error Degraded Unknown Pred Fail Starting Stopping Service . 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � # x � � � MSFT_CliProperty ConnectionState The ConnectionState property indicates the current state of the network connection. ConnectionState � � D � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 20 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � { � MSFT_CliQualifier ValueMap 9 D K S a m Connected Error Paused Disconnected Connecting Reconnecting � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � y � MSFT_CliQualifier Values 7 B I Q _ k Connected Error Paused Disconnected Connecting Reconnecting t 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier : � � � � MSFT_CliProperty Persistent The Persistent property determines whether this connection will be reconnected automatically by the operating system on the next logon. Persistent ; 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � o z � MSFT_CliProperty LocalName The LocalName property indicates the local name of the connected network device. LocalName � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � MSFT_CliProperty RemoteName The RemoteName property contains the remote network resource name for a network resource. For a current or persistent connection, RemoteName contains the network name associated with the name of the value in the LocalName property. RemoteName �$ �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty �# � � MSFT_CliFormat table BRIEF 2 q � � ; 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � o z � MSFT_CliProperty LocalName The LocalName property indicates the local name of the connected network device. LocalName G 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier
� z � � MSFT_CliProperty RemoteName The RemoteName property contains the remote network resource name for a network resource. RemoteName . 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � # x � � � MSFT_CliProperty ConnectionState The ConnectionState property indicates the current state of the network connection. ConnectionState � � D � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 20 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � { � MSFT_CliQualifier ValueMap 9 D K S a m Connected Error Paused Disconnected Connecting Reconnecting � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � y � MSFT_CliQualifier Values 7 B I Q _ k Connected Error Paused Disconnected Connecting Reconnecting � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � h p � � MSFT_CliProperty Status The Status property is a string indicating the current status of the object. Status � � . � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 10 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap A E L V _ j t ~ OK Error Degraded Unknown Pred Fail Starting Stopping Service � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values ? C J T ] h r | OK Error Degraded Unknown Pred Fail Starting Stopping Service �K�v0 T ��KA� � ���� � ��� D /�X� o :ZR�Z #T�Za
T �e��� ) �ᆼ� 2 �zT� ^ vp��n p {� � x 9� V
&�~c � b���, 7 _o�uc � S�]�b < wd��� R S O P _ I E F a v o r i t e O r L i n k I t e m G���j��
' # RSOP_IEFavoriteOrLinkItem ) Q W � � � � � 8 C �W�������������������������������������j � RSOP_IEFavoriteItem Locale folderItem
� H boolean name @
� � � �� string parentPath
� � string rsopID
� � � �� string rsopPrecedence
� 0 � �� uint32 shortName
� b string � R S O P _ I E F a v o r i t e O r L i n k I t e m H���j��J # RSOP_IEFavoriteOrLinkItem Q Y � � ���������������������������� � RSOP_IELinkItem Locale name @
� I � �� string rsopID
� � � �� string rsopPrecedence
� � � �� uint32 � I���j��w )
S \ � � � � S ] � � � � D X � � ����� � ������� � ������� � RSOP_GPO Locale accessDenied
� J � �� boolean enabled
� � � �� boolean extensionIds
"
� � � �� string fileSystemPath
� � �� string filterAllowed
� J � �� boolean filterId
� � � �� string guidName
� � � �� string id '
� � �� � �� string name
� < � �� string securityDescriptor
� � � �� uint8 version
� � � �� uint32 � J���j��, �� - 6 � � %��������� � RSoP_PolicySettingLink Locale Association setting f '
� k � �� � �� ref:RSOP_PolicySetting status f '
� � � �� � �� ref:RSoP_PolicySettingStatus � K���j��W 7 ^ y � � � � 3 Z u � � U��������������������������� � RSOP_IEPrivacySettings Locale firstPartyPrivacyType
� V uint32 firstPartyPrivacyTypeText
� � string rsopID
� � � �� string rsopPrecedence
� � �� sint32 thirdPartyPrivacyType
� R uint32 thirdPartyPrivacyTypeText
� � string useAdvancedSettings
� � boolean � R S O P _ I E P r i v a c y S e t t i n g s L���j��� RSOP_IEPrivacySettings # / �����������������������������W � RSOP_IEESCPrivacySettings Locale EscEnabled
� N boolean sc � M���j��< % - �� : J � � 5��������� � RSOP_IEConnectionDialUpSettingsLink Locale Association dialUpSettings f
� t � �� ref:RSOP_IEConnectionDialUpSettings policySetting f
� � � �� ref:RSOP_IEAKPolicySetting � N���j�� H P � � ����������� � RSOP_IEESC Locale EscEnabled
� ? boolean rsopID
� z � �� string rsopPrecedence
� � � �� sint32 �0 B 7 1 4 A 2 3 0 7 5 6 0 2 7 C B 9 D 9 4 4 F 3 C 1 0 1 E 5 4 8 5 E 8 2 B 4 6 9 3 6 1 8 4 6 E 7 4 3 5 8 E 5 E E B A 5 C 0 5 B 7 P���j����j��� � N 1 v � RSOP_ExtensionStatus 20211027194420.000000+000 Group Policy Infrastructure {00000000-0000-0000-0000-000000000000} 2 7 2 E 5 7 5 3 D C 3 E E C D D 6 0 5 7 0 3 8 D B 6 F 2 6 1 7 0 E 7 D 1 C D 5 6 5 B 9 5 4 C 6 C 4 A 4 0 6 C B 1 B C 2 D 0 2 3 E Q���j������j��� f � � RSOP_ExtensionEventSourceLink RSOP_ExtensionEventSource.id="{40D10267-9BFF-4BC0-83E7-225AA5FE877C}" RSOP_ExtensionStatus.extensionGuid="{00000000-0000-0000-0000-000000000000}" : R O O T \ R s o p \ U s e r \ S _ 1 _ 5 _ 2 1 _ 1 2 8 0 8 0 9 0 8 _ 2 2 3 8 0 6 1 4 2 4 _ 1 4 9 3 6 7 4 4 9 _ 5 0 0 R S O P _ E x t e n s i o n E v e n t S o u r c e L i n k e v e n t S o u r c e � N S _ 9 F 5 8 1 7 9 4 B F 0 E F 2 3 2 0 0 7 7 8 7 9 A 5 1 1 3 E E 4 7 3 1 D F 3 2 1 7 B B 9 D C 4 7 B 1 D B 4 E 6 5 8 5 2 3 9 1 F 8 B \ K I _ 2 7 2 E 5 7 5 3 D C 3 E E C D D 6 0 5 7 0 3 8 D B 6 F 2 6 1 7 0 E 7 D 1 C D 5 6 5 B 9 5 4 C 6 C 4 A 4 0 6 C B 1 B C 2 D 0 2 3 E \ I _ 2 5 C C 4 0 9 0 A 3 0 9 8 C F F 3 3 0 4 4 D 2 7 8 3 0 9 1 9 1 4 4 B 7 9 F 3 9 B F 8 0 D 6 4 7 9 3 7 0 6 2 5 6 0 9 1 F D 8 2 0 3 ��������: R O O T \ R s o p \ U s e r \ S _ 1 _ 5 _ 2 1 _ 1 2 8 0 8 0 9 0 8 _ 2 2 3 8 0 6 1 4 2 4 _ 1 4 9 3 6 7 4 4 9 _ 5 0 0 R S O P _ E x t e n s i o n E v e n t S o u r c e L i n k e x t e n s i o n S t a t u s � N S _ 9 F 5 8 1 7 9 4 B F 0 E F 2 3 2 0 0 7 7 8 7 9 A 5 1 1 3 E E 4 7 3 1 D F 3 2 1 7 B B 9 D C 4 7 B 1 D B 4 E 6 5 8 5 2 3 9 1 F 8 B \ K I _ 2 7 2 E 5 7 5 3 D C 3 E E C D D 6 0 5 7 0 3 8 D B 6 F 2 6 1 7 0 E 7 D 1 C D 5 6 5 B 9 5 4 C 6 C 4 A 4 0 6 C B 1 B C 2 D 0 2 3 E \ I _ 2 5 C C 4 0 9 0 A 3 0 9 8 C F F 3 3 0 4 4 D 2 7 8 3 0 9 1 9 1 4 4 B 7 9 F 3 9 B F 8 0 D 6 4 7 9 3 7 0 6 2 5 6 0 9 1 F D 8 2 0 3 ng D 6 F 2 3 A C 5 C C B E B 4 7 E C C F 7 B F 1 2 9 5 2 3 2 5 8 8 7 9 F D E D 9 D 2 8 2 F 5 5 8 0 4 3 F F 8 0 2 4 9 A 7 E D 5 9 6 R���j��E���j��} 6 ( ^ � RSOP_ExtensionEventSource Application Group Policy {40D10267-9BFF-4BC0-83E7-225AA5FE877C} 0 4 5 4 D D D A 9 A B 9 9 9 B 5 E 0 5 A 2 F 4 6 8 B A 8 8 8 F 0 D 0 7 9 4 E 6 B A 1 E B D C C F 2 A 4 4 6 3 E C 0 3 2 5 8 C C 6 T���j����j��9
� RSOP_SOM Local E 7 0 6 F F 8 5 8 6 C 5 2 A 7 1 7 6 A C A 4 8 D 7 7 0 2 E C 2 A 6 5 5 0 5 6 4 F 0 E 4 2 B 0 C 0 9 A E 3 F D 1 C C E A 6 2 C D 4 U���j��I���j��� J T 6 ��h 4 ��
l � RSOP_GPO C:\Windows\System32\GroupPolicy\User Local Group Policy LocalGPO Local Group Policy B 0 F E 4 3 D 7 F 9 B D B F B 5 8 0 A 0 C A 5 5 2 7 E F 2 5 F 6 B 3 6 E C 4 B 6 7 1 B A 1 4 3 B 3 3 8 B 3 8 0 B 1 F 4 5 C 2 7 D V���j�����j��o %
�� C � RSOP_GPLink RSOP_GPO.id="LocalGPO" RSOP_SOM.id="Local",reason=1 : R O O T \ R s o p \ U s e r \ S _ 1 _ 5 _ 2 1 _ 1 2 8 0 8 0 9 0 8 _ 2 2 3 8 0 6 1 4 2 4 _ 1 4 9 3 6 7 4 4 9 _ 5 0 0 R S O P _ G P L i n k G P O � N S _ 9 F 5 8 1 7 9 4 B F 0 E F 2 3 2 0 0 7 7 8 7 9 A 5 1 1 3 E E 4 7 3 1 D F 3 2 1 7 B B 9 D C 4 7 B 1 D B 4 E 6 5 8 5 2 3 9 1 F 8 B \ K I _ B 0 F E 4 3 D 7 F 9 B D B F B 5 8 0 A 0 C A 5 5 2 7 E F 2 5 F 6 B 3 6 E C 4 B 6 7 1 B A 1 4 3 B 3 3 8 B 3 8 0 B 1 F 4 5 C 2 7 D \ I _ 9 D B B 4 C 3 B F 3 B 3 0 B A E 5 D 6 C 9 2 6 F 4 0 F 2 D D 5 5 3 8 1 A 6 2 6 2 8 1 9 D B C 8 0 F 2 4 8 2 8 3 8 0 5 2 C 4 0 4 D B F A D C 2 0 D 4 B 0 2 1 E 0 A F F B 6 1 E 5 D 9 0 A 8 A D 1 A 9 4 9 C B A 9 4 8 B 6 E D 6 C 5 0 6 F D 3 F 6 2 3 4 7 7 D E 2 D D F 5 D U(^�Im�B���j�� ) " % 3 D � RSOP_Session 20211027194420.000000+000 Session1
k � � � � � � � � � � S-1-5-21-128080908-2238061424-149367449-513 S-1-1-0 S-1-5-114 S-1-5-32-544 S-1-5-32-545 S-1-5-14 S-1-5-4 S-1-5-11 S-1-5-15 S-1-5-113 S-1-2-0 S-1-5-64-10 S-1-16-12288 Local WIN-F6NF7R6I6PJ\Administrator s �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � + � MSFT_CliFormat SYSTEM
D � � U � b
�
x � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty __CLASS __CLASS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __DERIVATION __DERIVATION � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __DYNASTY __DYNASTY � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty __GENUS __GENUS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier t � , � MSFT_CliProperty __NAMESPACE __NAMESPACE � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o � " � MSFT_CliProperty __PATH __PATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier y � $ 6 � MSFT_CliProperty __PROPERTY_COUNT __PROPERTY_COUNT � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __RELPATH __RELPATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier q � & � MSFT_CliProperty __SERVER __SERVER � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __SUPERCLASS __SUPERCLASS � �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � a � MSFT_CliFormat INSTANCE " ; 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � o z � MSFT_CliProperty LocalName The LocalName property indicates the local name of the connected network device. LocalName gJ �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty tI q< � MSFT_CliFormat list FULL ` 4 f � 0 ~ J w" �$ r' K* �, ,3 : � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier b � � � � MSFT_CliProperty AccessMask The AccessMask property is a bit array representing the access rights as set remotely on the network share held by the user or group on whose behalf the instance is returned. AccessMask 0 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � f o � MSFT_CliProperty Comment The Comment property contains a comment supplied by the network provider. Comment . 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � # x � � � MSFT_CliProperty ConnectionState The ConnectionState property indicates the current state of the network connection. ConnectionState � � D � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 20 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � { � MSFT_CliQualifier ValueMap 9 D K S a m Connected Error Paused Disconnected Connecting Reconnecting � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � y � MSFT_CliQualifier Values 7 B I Q _ k Connected Error Paused Disconnected Connecting Reconnecting � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier R " � � 9 � MSFT_CliProperty ConnectionType The ConnectionType property indicates the persistence type of the connection used for connecting to the network. ConnectionType � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � R � MSFT_CliQualifier Values ' ; Current Connection Persistent Connection 6 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � h u � MSFT_CliProperty Description The Description property provides a textual description of the object. Description J 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � � MSFT_CliProperty DisplayType The DisplayType property indicates how the network object should be displayed in a network browsing user interface. DisplayType � ; � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � Q � MSFT_CliQualifier ValueMap 1 9 B J Domain Generic Server Share � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � O � MSFT_CliQualifier Values / 7 @ H Domain Generic Server Share � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier O � � � � MSFT_CliProperty InstallDate The InstallDate property is datetime value indicating when the object was installed. A lack of a value does not indicate that the object is not installed. InstallDate ; 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � o z � MSFT_CliProperty LocalName The LocalName property indicates the local name of the connected network device. LocalName ) 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � b h � MSFT_CliProperty Name The Name property indicates the name of the current network connection. Name t 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier : � � � � MSFT_CliProperty Persistent The Persistent property determines whether this connection will be reconnected automatically by the operating system on the next logon. Persistent 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier E � � � � MSFT_CliProperty ProviderName The ProviderName property contains the name of the provider that owns the resource. This property can be NULL if the provider name is unknown. ProviderName � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � MSFT_CliProperty RemoteName The RemoteName property contains the remote network resource name for a network resource. For a current or persistent connection, RemoteName contains the network name associated with the name of the value in the LocalName property. RemoteName 4 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � g s � MSFT_CliProperty RemotePath The RemotePath property contains the full path to the network resource. RemotePath � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier k w � � � MSFT_CliProperty ResourceType The ResourceType property identifies the type of resource to enumerate or connect to. ResourceType � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING k ? � MSFT_CliQualifier ValueMap - 3 : Disk Print Any � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i = � MSFT_CliQualifier Values + 1 8 Disk Print Any � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � h p � � MSFT_CliProperty Status The Status property is a string indicating the current status of the object. Status � � . � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 10 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap A E L V _ j t ~ OK Error Degraded Unknown Pred Fail Starting Stopping Service � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values ? C J T ] h r | OK Error Degraded Unknown Pred Fail Starting Stopping Service W 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � � MSFT_CliProperty UserName The UserName property contains the user name or the default user name used to establish a network connection. UserName NetUse WHERE LocalName='#' Select * from Win32_NetworkConnection E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � ( � � � MSFT_CliProperty SupportsMulticasting The SupportsMulticasting property indicates whether the protocol supports multicasting. SupportsMulticasting � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier w � , � � � MSFT_CliProperty SupportsQualityofService The SupportsQualityofService property indicates whether the protocol is capable of Quality of Service (QOS) support via the underlying layered service provider or transport carrier. QOS is a collection of components that enable differentiation and preferential treatment for subsets of data transmitted over the network. QOS lo z� F D 3 B B D 4 C 4 2 A C 2 F 7 F E F 2 6 4 3 4 0 A 9 E B 7 8 A 5 8 1 F E 5 C 2 8 5 6 1 C B 6 3 E D F 7 8 0 B 3 2 9 E A C 2 E E 4 �b��5��͝��C�� � + [ {� �� �� ��� MSFT_CliAlias � F N u � � � � �
U�������������������������4 � MSFT_CliConnection Authority
� > STRING Locale
� m STRING NameSpace
� � STRING Password
� � STRING Server
� � STRING User
� , STRING | � ( + � MSFT_CliConnection ms_409 ROOT\CIMV2 . Network Interface Controller (NIC) management. s �N 4j 5n Im FL �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty SK �% � MSFT_CliFormat table STATUS 7 � �
l }# J 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier M [ = � MSFT_CliProperty Availability The availability and status of the device. Availability g � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap e h k n q t w z } � � � � � � � � 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 0 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � \ � MSFT_CliQualifier Values c j s � � � � � � � � � � # 9 F Other Unknown Running/Full Power Warning In Test Not Applicable Power Off Off Line Off Duty Degraded Not Installed Install Error Power Save - Unknown Power Save - Low Power Mode Power Save - Standby Power Cycle Power Save - Warning # 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � \ b � MSFT_CliProperty Name The Name property defines the label by which the object is known. Name � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � * � MSFT_CliProperty Status The Status property is a string indicating the current status of the object. Various operational and non-operational statuses can be defined. Operational statuses are "OK", "Degraded" and "Pred Fail". "Pred Fail" indicates that an element may be functioning properly but predicting a failure in the near future. An example is a SMART-enabled hard drive. Non-operational statuses can also be specified. These are "Error", "Starting", "Stopping" and "Service". The latter, "Service", could apply during mirror-resilvering of a disk, reload of a user permissions list, or other administrative work. Not all such work is on-line, yet the managed element is neither "OK" nor in one of the other states. Status � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 10 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap A E L V _ j t ~ OK Error Degraded Unknown Pred Fail Starting Stopping Service � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values ? C J T ] h r | OK Error Degraded Unknown Pred Fail Starting Stopping Service
9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � + � � MSFT_CliProperty StatusInfo StatusInfo is a string indicating whether the logical device is in an enabled (value = 3), disabled (value = 4) or some other (1) or unknown (2) state. If this property does not apply to the logical device, the value, 5 ("Not Applicable"), should be used. StatusInfo 7 T � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING k D � MSFT_CliQualifier ValueMap 5 8 ; > A 1 2 3 4 5 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � f � MSFT_CliQualifier Values 3 : C L V Other Unknown Enabled Disabled Not Applicable [ 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier ! � � � � MSFT_CliProperty DeviceID The DeviceID property contains a string uniquely identifying the network adapter from other devices on the system. DeviceID s �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � + � MSFT_CliFormat SYSTEM
D � � U � b
�
x � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty __CLASS __CLASS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __DERIVATION __DERIVATION � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __DYNASTY __DYNASTY � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty __GENUS __GENUS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier t � , � MSFT_CliProperty __NAMESPACE __NAMESPACE � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o � " � MSFT_CliProperty __PATH __PATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier y � $ 6 � MSFT_CliProperty __PROPERTY_COUNT __PROPERTY_COUNT � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __RELPATH __RELPATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier q � & � MSFT_CliProperty __SERVER __SERVER � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __SUPERCLASS __SUPERCLASS � �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty
� � MSFT_CliFormat INSTANCE " [ 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier ! � � � � MSFT_CliProperty DeviceID The DeviceID property contains a string uniquely identifying the network adapter from other devices on the system. DeviceID � �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � "� � MSFT_CliFormat list FULL � . �
� ( a* �, �. _1 4 _6 �8 4; u= �@ �B }E �G �I �M !P �\ �` �b �n �q �s -v �x � ؈ �
9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier T � � � MSFT_CliProperty AdapterType The AdapterType property reflects the network medium in use. This property may not be applicable to all types of network adapters listed within this class. AdapterType � � # � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING u 6 � MSFT_CliQualifier ValueMap Y i { � � � � � $ ) 0 Ethernet 802.3 Token Ring 802.5 Fiber Distributed Data Interface (FDDI) Wide Area Network (WAN) LocalTalk Ethernet using DIX header format ARCNET ARCNET (878.2) ATM Wireless Infrared Wireless Bpc CoWan 1394 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING o 4 � MSFT_CliQualifier Values W g y � � � � � " ' . Ethernet 802.3 Token Ring 802.5 Fiber Distributed Data Interface (FDDI) Wide Area Network (WAN) LocalTalk Ethernet using DIX header format ARCNET ARCNET (878.2) ATM Wireless Infrared Wireless Bpc CoWan 1394 l 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier 2 � � � � MSFT_CliProperty AutoSense A boolean indicating whether the network adapter is capable of automatically determining the speed of the attached/network media. AutoSense J 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier M [ = � MSFT_CliProperty Availability The availability and status of the device. Availability g � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap e h k n q t w z } � � � � � � � � 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 0 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � \ � MSFT_CliQualifier Values c j s � � � � � � � � � � # 9 F Other Unknown Running/Full Power Warning In Test Not Applicable Power Off Off Line Off Duty Degraded Not Installed Install Error Power Save - Unknown Power Save - Low Power Mode Power Save - Standby Power Cycle Power Save - Warning # 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � * [ s � � MSFT_CliProperty ConfigManagerErrorCode Indicates the Configuration Manager error code. ConfigManagerErrorCode { 9 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values � � � � � / u � � 0 K ` � � l � � ) � � F � � � 0 ` � This device is working properly. This device is not configured correctly. Windows cannot load the driver for this device. The driver for this device might be corrupted, or your system may be running low on memory or other resources. This device is not working properly. One of its drivers or your registry might be corrupted. The driver for this device needs a resource that Windows cannot manage. The boot configuration for this device conflicts with other devices. Cannot filter. The driver loader for the device is missing. This device is not working properly because the controlling firmware is reporting the resources for the device incorrectly. This device cannot start. This device failed. This device cannot find enough free resources that it can use. Windows cannot verify this device's resources. This device cannot work properly until you restart your computer. This device is not working properly because there is probably a re-enumeration problem. Windows cannot identify all the resources this device uses. This device is asking for an unknown resource type. Reinstall the drivers for this device. Your registry might be corrupted. System failure: Try changing the driver for this device. If that does not work, see your hardware documentation.Windows is removing this device. This device is disabled. System failure: Try changing the driver for this device. If that doesn't work, see your hardware documentation. This device is not present, is not working properly, or does not have all its drivers installed. Windows is still setting up this device. Windows is still setting up this device. This device does not have valid log configuration. The drivers for this device are not installed. This device is disabled because the firmware of the device did not give it the required resources. This device is using an Interrupt Request (IRQ) resource that another device is using. This device is not working properly because Windows cannot load the drivers required for this device. J 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � + p � � MSFT_CliProperty ConfigManagerUserConfig Indicates whether the device is using a user-defined configuration. ConfigManagerUserConfig 7 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � i v � MSFT_CliProperty Description The Description property provides a textual description of the adapter. Description [ 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier ! � � � � MSFT_CliProperty DeviceID The DeviceID property contains a string uniquely identifying the network adapter from other devices on the system. DeviceID ` 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier & � � � � MSFT_CliProperty ErrorCleared ErrorCleared is a boolean property indicating that the error reported in LastErrorCode property is now cleared. ErrorCleared � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier q � $ � � � MSFT_CliProperty ErrorDescription ErrorDescription is a free-form string supplying more information about the error recorded in LastErrorCode property, and information on any corrective actions that may be taken. ErrorDescription M 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � � MSFT_CliProperty Index The Index property indicates the network adapter's index number, which is stored in the system registry. Index � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier O � � � � MSFT_CliProperty InstallDate The InstallDate property is datetime value indicating when the object was installed. A lack of a value does not indicate that the object is not installed. InstallDate D 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier
� x � � MSFT_CliProperty Installed The Installed property determines whether the network adapter is installed in the system. Installed = 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � ! m | � MSFT_CliProperty LastErrorCode LastErrorCode captures the last error code reported by the logical device. LastErrorCode 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � < H � MSFT_CliProperty MACAddress The MACAddress property indicates the media access control address for this network adapter. A MAC address is a unique 48-bit number assigned to the network adapter by the manufacturer. It uniquely identifies this network adapter and is used for mapping TCP/IP network communications. MACAddress D 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier
� u � � MSFT_CliProperty Manufacturer The Manufacturer property indicates the name of the network adapter's manufacturer. Manufacturer � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � ' � � � MSFT_CliProperty MaxNumberControlled The MaxNumberControlled property indicates the maximum number of directly addressable ports supported by this network adapter. A value of zero is used if the number is unknown. MaxNumberControlled ( 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � ] g � MSFT_CliProperty MaxSpeed The maximum speed, in bits per second, for the network adapter. MaxSpeed # 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � \ b � MSFT_CliProperty Name The Name property defines the label by which the object is known. Name � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � $ j | � � MSFT_CliProperty NetworkAddresses An array of strings indicating the network addresses for an adapter. NetworkAddresses � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 64 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier E �� # � � MSFT_CliProperty NetConnectionID The NetConnectionID property specifies the name of the network connection as it appears in the 'Network and Dial-up Connections' applet. NetConnectionID � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier m � ' � � � MSFT_CliProperty NetConnectionStatus NetConnectionStatus is a string indicating the state of the network adapter's connection to the network. The value of the property is to be interpreted as follows:/n0 - Disconnected/n1 - Connecting/n2 - Connected/n3 - Disconnecting/n4 - Hardware not present/n5 - Hardware disabled/n6 - Hardware malfunction/n7 - Media disconnected/n8 - Authenticating/n9 - Authentication succeeded/n10 - Authentication failed � ] � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � o � MSFT_CliQualifier ValueMap M P S V Y \ _ b e h k 0 1 2 3 4 5 6 7 8 9 10 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � MSFT_CliQualifier Values K Y e p � � � � � � Disconnected Connecting Connected Disconnecting Hardware Not Present Hardware Disabled Hardware Malfunction Media Disconnected Authenticating Authentication Succeeded Authentication Failed NetConnectionStatus � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � $ p � � � MSFT_CliProperty PermanentAddress PermanentAddress defines the network address hard coded into an adapter. PermanentAddress � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 64 - 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � _ l � MSFT_CliProperty PNPDeviceID Indicates the Plug and Play device ID of the logical device. PNPDeviceID � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier �
/ � � S � MSFT_CliProperty PowerManagementCapabilities Indicates the specific power-related capabilities of the logical device. The array values, 0="Unknown", 1="Not Supported" and 2="Disabled" are self-explanatory. The value, 3="Enabled" indicates that the power management features are currently enabled but the exact feature set is unknown or the information is unavailable. "Power Saving Modes Entered Automatically" (4) describes that a device can change its power state based on usage or other criteria. "Power State Settable" (5) indicates that the SetPowerState method is supported. "Power Cycling Supported" (6) indicates that the SetPowerState method can be invoked with the PowerState input variable set to 5 ("Power Cycle"). "Timed Power On Supported" (7) indicates that the SetPowerState method can be invoked with the PowerState input variable set to 5 ("Power Cycle") and the Time parameter set to a specific date and time, or interval, for power-on. PowerManagementCapabilities � k � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values ? H W a j � � � Unknown Not Supported Disabled Enabled Power Saving Modes Entered Automatically Power State Settable Power Cycling Supported Timed Power On Supported � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � , 2 � MSFT_CliProperty PowerManagementSupported Indicates that the device can be power managed - i.e. can be put into suspend mode, etc. This boolean does not indicate that power management features are currently enabled, only that the logical device is capable of power management. PowerManagementSupported : 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � l y � MSFT_CliProperty ProductName The ProductName property indicates the product name of the network adapter. ProductName ; 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � m z � MSFT_CliProperty ServiceName The ServiceName property indicates the service name of the network adapter. ServiceName � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � � � � MSFT_CliProperty Speed An estimate of the current bandwidth in bits per second. For endpoints which vary in bandwidth or for those where no accurate estimation can be made, this property should contain the nominal bandwidth. Speed � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � h p � � MSFT_CliProperty Status The Status property is a string indicating the current status of the object. Status � � . � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 10 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap A E L V _ j t ~ OK Error Degraded Unknown Pred Fail Starting Stopping Service � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values ? C J T ] h r | OK Error Degraded Unknown Pred Fail Starting Stopping Service
9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � + � � MSFT_CliProperty StatusInfo StatusInfo is a string indicating whether the logical device is in an enabled (value = 3), disabled (value = 4) or some other (1) or unknown (2) state. If this property does not apply to the logical device, the value, 5 ("Not Applicable"), should be used. StatusInfo 7 T � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING k D � MSFT_CliQualifier ValueMap 5 8 ; > A 1 2 3 4 5 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � f � MSFT_CliQualifier Values 3 : C L V Other Unknown Enabled Disabled Not Applicable F 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � # t � � MSFT_CliProperty TimeOfLastReset The TimeOfLastReset property indicates when the network adapter was last reset. TimeOfLastReset C�T z
B a s e S t a t u s Y��C�N � BaseStatus ) � �� � - ? 5 F x � � � � B T � � � � 9 m � � � �
? ^ � � � � * 6 s � � H i � � � 7 D v � � � � D ^ � � � � ! 8 k ~ � � �
y � �
<
N
�
�
�
�
% L g � � �
9
K
�
�
�
% Y t � � / b } � � � A M � � � � 6 D v � � � / a � � � � F e � � @P @ @� �� � � � ��� ����� ����� ������������ � ���� �������� � ��� �
� � ���� � � � MSFT_MpComputerStatus ProtectionManagement locale AMEngineVersion i
� p � �� string AMProductVersion
� � � �� string AMRunningMode
� � � �� string AMServiceEnabled m
� 9 � �� boolean AMServiceVersion
� ~ � �� string AntispywareEnabled % w
� � � �� boolean AntispywareSignatureAge
� � �� uint32 AntispywareSignatureLastUpdated e
$
� c � �� datetime AntispywareSignatureVersion
� � string AntivirusEnabled $ u
� � � �� boolean AntivirusSignatureAge ,
� 7 � �� uint32 AntivirusSignatureLastUpdated e
0
� � � �� datetime AntivirusSignatureVersion (
� � � �� string BehaviorMonitorEnabled # s
� ! � �� boolean ComputerID '
� k � �� � �� string ComputerState )
� � � � � �� uint32 BitMap � � � � � � 0 1 2 4 8 16 DefenderSignaturesOutOfDate
� ? � �� boolean DeviceControlDefaultEnforcement 2 �
� � � �� string DeviceControlPoliciesLastUpdated e 3 �
� � � �� datetime DeviceControlState 1 �
� / � �� string FullScanAge H
� n � �� uint32 FullScanEndTime e D
� � � �� datetime FullScanOverdue Q
� � � �� boolean FullScanRequired S
� ; � �� boolean FullScanSignatureVersion M
� � � �� string FullScanStartTime e @
� � � �� datetime InitializationProgress > �
� � �� string IoavProtectionEnabled " q
� b � �� boolean IsTamperProtected ' {
� � � �� boolean IsVirtualMachine & y
� � � �� boolean LastFullScanSource L )
� A H R � �� uint8 ValueMap j m p s v 0 1 2 3 4 LastQuickScanSource b )
� � � � � �� uint8 ValueMap � � � � � 0 1 2 3 4 NISEnabled + �
� 3
� �� boolean NISEngineVersion * �
� x
� �� string NISSignatureAge 8
� �
� �� uint32 NISSignatureLastUpdated e <
� � �� datetime NISSignatureVersion 4
� D string OnAccessProtectionEnabled ! o
� � � �� boolean ProductStatus
)
� � � � � �� uint32 BitMap \ _ b e h k o s w | � � � � � � � � � � � � � � � � 0 1 2 4 8 16 32 64 128 256 512 1024 2048 4096 8192 16384 32768 65536 131072 262144 524288 1048576 2097152 4194304 8388608 16777216 QuickScanAge ^
� 1
� �� uint32 QuickScanEndTime e Z
� u
� �� datetime QuickScanOverdue g
� �
� �� boolean QuickScanSignatureVersion c
� � �� string QuickScanStartTime e V
� O � �� datetime RealTimeProtectionEnabled ) �
� � � �� boolean RealTimeScanDirection U )
� � � � �� uint8 ValueMap 0 1 2 RebootRequired
� Y � �� boolean SmartAppControlExpiration = �
� � � �� string SmartAppControlState < �
� � � �� string TamperProtectionSource ( }
� 9 � �� string TDTCapable 0 �
� w � �� string TDTMode . �
� � � �� string TDTSiloType / �
� � � �� string TDTStatus , �
� . � �� string TDTTelemetry - �
� n � �� string TroubleShootingDailyMaxQuota : �
� � � �� string TroubleShootingDailyQuotaLeft 8 �
� � �� string TroubleShootingEndTime 6 �
� Y � �� string TroubleShootingExpirationLeft 7 �
� � � �� string TroubleShootingMode 4 �
� � � �� string TroubleShootingModeSource ; �
� > � �� string TroubleShootingQuotaResetTime 9 �
� � � �� string TroubleShootingStartTime 5 �
� � � �� string �gModeSource ; �
� > � �� string TroubleShootingQuotaResetTime 9 �
� � � �� string TroubleShootingStartTime 5 �
� � � �� string �ofResourceName] ResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �.h�b �
͝��C�� / )ߝ�t � d � WDMClassesOfDriver DriverMajorFunctionReturn C:\Windows\system32\kernelbase.dll[MofResourceName] ame] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �.h�b �
͝��C�� / )ߝ�t � d � WDMClassesOfDriver DriverMajorFunctionReturn C:\Windows\system32\kernelbase.dll[MofResourceName] ourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �.h�b �
͝��C�� / )ߝ�t � d � WDMClassesOfDriver DriverMajorFunctionReturn C:\Windows\system32\kernelbase.dll[MofResourceName] ourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �.h�b �
͝��C�� / )ߝ�t � d � WDMClassesOfDriver DriverMajorFunctionReturn C:\Windows\system32\kernelbase.dll[MofResourceName] fResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �.h�b �
͝��C�� / )ߝ�t � d � WDMClassesOfDriver DriverMajorFunctionReturn C:\Windows\system32\kernelbase.dll[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �.h�b �
͝��C�� / )ߝ�t � d � WDMClassesOfDriver DriverMajorFunctionReturn C:\Windows\system32\kernelbase.dll[MofResourceName] � � �n ID � .- �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty ;, � MSFT_CliFormat TABLE BRIEF > } � � ^ � S ; 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � m z � MSFT_CliProperty ServiceName The ServiceName property indicates the service name of the network adapter. ServiceName 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � < H � MSFT_CliProperty MACAddress The MACAddress property indicates the media access control address for this network adapter. A MAC address is a unique 48-bit number assigned to the network adapter by the manufacturer. It uniquely identifies this network adapter and is used for mapping TCP/IP network communications. MACAddress q 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier 7 ^ k � � MSFT_CliProperty AdapterType The AdapterType property reflects the network medium in use. AdapterType w � # � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING u 6 � MSFT_CliQualifier ValueMap Y i { � � � � � $ ) 0 Ethernet 802.3 Token Ring 802.5 Fiber Distributed Data Interface (FDDI) Wide Area Network (WAN) LocalTalk Ethernet using DIX header format ARCNET ARCNET (878.2) ATM Wireless Infrared Wireless Bpc CoWan 1394 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING o 4 � MSFT_CliQualifier Values W g y � � � � � " ' . Ethernet 802.3 Token Ring 802.5 Fiber Distributed Data Interface (FDDI) Wide Area Network (WAN) LocalTalk Ethernet using DIX header format ARCNET ARCNET (878.2) ATM Wireless Infrared Wireless Bpc CoWan 1394 [ 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier ! � � � � MSFT_CliProperty DeviceID The DeviceID property contains a string uniquely identifying the network adapter from other devices on the system. DeviceID # 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � \ b � MSFT_CliProperty Name The Name property defines the label by which the object is known. Name � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � $ j | � � MSFT_CliProperty NetworkAddresses An array of strings indicating the network addresses for an adapter. NetworkAddresses � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 64 � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � � � � MSFT_CliProperty Speed An estimate of the current bandwidth in bits per second. For endpoints which vary in bandwidth or for those where no accurate estimation can be made, this property should contain the nominal bandwidth. Speed NIC WHERE DeviceID=# Select * from Win32_NetworkAdapter uaranteedBandwidth X 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � ( � � � MSFT_CliProperty SupportsMulticasting The SupportsMulticasting property indicates whether the protocol supports multicasting. SupportsMulticasting � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier w � , � � � MSFT_CliProperty SupportsQualityofService The S �) F D 3 B B D 4 C 4 2 A C 2 F 7 F E F 2 6 4 3 4 0 A 9 E B 7 8 A 5 8 1 F E 5 C 2 8 5 6 1 C B 6 3 E D F 7 8 0 B 3 2 9 E A C 2 E E 4 �b��5��͝��C�6) + I �� �� �� � )� MSFT_CliAlias � F N u � � � � �
U�������������������������4 � MSFT_CliConnection Authority
� > STRING Locale
� m STRING NameSpace
� � STRING Password
� � STRING Server
� � STRING User
� , STRING | � ( + � MSFT_CliConnection ms_409 ROOT\CIMV2 . Network adapter management. q � �! �* �] �q � -� � s �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � + � MSFT_CliFormat SYSTEM
D � � U � b
�
x � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty __CLASS __CLASS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __DERIVATION __DERIVATION � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __DYNASTY __DYNASTY � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty __GENUS __GENUS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier t � , � MSFT_CliProperty __NAMESPACE __NAMESPACE � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o � " � MSFT_CliProperty __PATH __PATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier y � $ 6 � MSFT_CliProperty __PROPERTY_COUNT __PROPERTY_COUNT � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __RELPATH __RELPATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier q � & � MSFT_CliProperty __SERVER __SERVER � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __SUPERCLASS __SUPERCLASS � �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � ] � MSFT_CliFormat INSTANCE " 7 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � o v � MSFT_CliProperty Index The Index property specifies the index number of the network adapter configuration. Index � �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � � � MSFT_CliFormat STATUS ( � � � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier w � $ � � � MSFT_CliProperty DHCPLeaseExpires The DHCPLeaseExpires property indicates the expiration date and time for a leased IP address that was assigned to the computer by the dynamic host configuration protocol (DHCP) server. DHCPLeaseExpires � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier n � � MSFT_CliProperty Index Index ! 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � F S � MSFT_CliProperty Description A textual description of the adapter. Description $3 �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty 12 h� � MSFT_CliFormat list FULL : � Y �
)
' � � K � 1 �! �$ �' 6* +- �/ �2 b5 �; �= &@ �B E H �J :M �O �R �T �W jZ �\ �d l �n Nq �s Ov �x f{ 5~ � �� ΅ h� �� D� �� ϖ �� �� P� �� � { 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier A � ( � � � MSFT_CliProperty ArpAlwaysSourceRoute The ArpAlwaysSourceRoute property indicates whether the Address Resolution Protocol (ARP) must always use source routing. ArpAlwaysSourceRoute z 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier @ � # � � � MSFT_CliProperty ArpUseEtherSNAP The ArpUseEtherSNAP property indicates whether Ethernet packets follow the IEEE 802.3 Sub-Network Access Protocol (SNAP) encoding. ArpUseEtherSNAP P 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � ' z � � MSFT_CliProperty DeadGWDetectEnabled The DeadGWDetectEnabled property indicates whether dead gateway detection occurs. DeadGWDetectEnabled g 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier - � $ � � � MSFT_CliProperty DefaultIPGateway The DefaultIPGateway property contains a list of IP addresses of default gateways used by the computer system. DefaultIPGateway a 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier ' � � � � MSFT_CliProperty DefaultTOS The DefaultTOS property indicates the default Type Of Service (TOS) value set in the header of outgoing IP packets. DefaultTOS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � MSFT_CliProperty DefaultTTL The DefaultTTL property indicates the default Time To Live (TTL) value set in the header of outgoing IP packets. The TTL specifies the number of routers an IP packet may pass through to reach its destination before being discarded. DefaultTTL ! 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � F S � MSFT_CliProperty Description A textual description of the adapter. Description � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier z � � � � MSFT_CliProperty DHCPEnabled The DHCPEnabled property indicates whether the dynamic host configuration protocol (DHCP) server automatically assigns an IP address to the computer system when establishing a network connection. DHCPEnabled � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier w � $ � � � MSFT_CliProperty DHCPLeaseExpires The DHCPLeaseExpires property indicates the expiration date and time for a leased IP address that was assigned to the computer by the dynamic host configuration protocol (DHCP) server. DHCPLeaseExpires � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier y � % � � � MSFT_CliProperty DHCPLeaseObtained The DHCPLeaseObtained property indicates the date and time the lease was obtained for the IP address assigned to the computer by the dynamic host configuration protocol (DHCP) server. DHCPLeaseObtained W 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � � MSFT_CliProperty DHCPServer The DHCPServer property indicates the IP address of the dynamic host configuration protocol (DHCP) server. DHCPServer � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier M � � � � MSFT_CliProperty DNSDomain The DNSDomain property indicates an organization name followed by a period and an extension that indicates the type of organization, such as microsoft.com. DNSDomain � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier ] � . � � � MSFT_CliProperty DNSDomainSuffixSearchOrder The DNSDomainSuffixSearchOrder property specifies the DNS domain suffixes to be appended to the end of host names during name resolution. DNSDomainSuffixSearchOrder � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � / � � � MSFT_CliProperty DNSEnabledForWINSResolution The DNSEnabledForWINSResolution property indicates whether the Domain Name System (DNS) is enabled for name resolution over Windows Internet Naming Service (WINS) resolution. DNSEnabledForWINSResolution % 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � W d � MSFT_CliProperty DNSHostName The DNSHostName property indicates the host name used to identify the local computer for authentication by some utilities. Other TCP/IP-based utilities can use this value to acquire the name of the local computer. Host names are stored on DNS servers in a table that maps names to IP addresses for use by DNS. DNSHostName { 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier A � ( � � � MSFT_CliProperty DNSServerSearchOrder The DNSServerSearchOrder property indicates an ordered list of server IP addresses to be used in querying for DNS Servers. DNSServerSearchOrder � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � 0 0 � MSFT_CliProperty DomainDNSRegistrationEnabled The DomainDNSRegistrationEnabled property specifies whether the IP addresses for this connection are registered in DNS under the domain name of this connection, in addition to registering under the computer's full DNS name. DomainDNSRegistrationEnabled x 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier > � ' � � � MSFT_CliProperty ForwardBufferMemory The ForwardBufferMemory property indicates how much memory IP allocates to store packet data in the router packet queue. ForwardBufferMemory 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � . 7 S � MSFT_CliProperty FullDNSRegistrationEnabled The FullDNSRegistrationEnabled property specifies whether the IP addresses for this connection are registered in DNS under the computer's full DNS name. The full DNS name of the computer is displayed on the Network Identification tab of the System Control Panel. FullDNSRegistrationEnabled � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Descr�Z�x �ٝ��C�� & ) + � �� � A E R b � � � @ Q � � � P o � � � V w � � # D � � � � ; _ � � � X w � � 9 v � � � $ 8 u � � � L � � �
D
b
�
�
- j � � � 8 N � � � � <
H
z
�
�
�
U j � � T r � � W n � � � U p � � " _ z � �
* g � � 5 r � � � > { � � O } � � 1 n � � � . UUUUUUUUUUUUUUUUU�������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������k � MDM_Policy_Result01_Update02 InPartition 3 local-system DMWmiBridgeProv ActiveHoursEnd '
� � � �� � sint32 ActiveHoursMaxRange '
� � � �� � sint32 ActiveHoursStart '
� 8 � �� � sint32 AllowAutoUpdate '
� � � �� � sint32 AllowAutoWindowsUpdateDownloadOverMeteredNetwork '
� � � �� � sint32 AllowMUUpdateService '
� H � �� � sint32 AllowNonMicrosoftSignedUpdate '
� � � �� � sint32 AllowUpdateService $ '
� � � �� � sint32 AutomaticMaintenanceWakeUp
( '
� N � �� � sint32 AutoRestartDeadlinePeriodInDays , '
� � � �� � sint32 AutoRestartDeadlinePeriodInDaysForFeatureUpdates 0 '
� � �� � sint32 AutoRestartNotificationSchedule
4 '
� y � �� � sint32 AutoRestartRequiredNotificationDismissal 8 '
� � � �� � sint32 BranchReadinessLevel < '
� 3 � �� � sint32 ConfigureDeadlineForFeatureUpdates @ '
� � � �� � sint32 ConfigureDeadlineForQualityUpdates D '
� � � �� � sint32 ConfigureDeadlineGracePeriod H '
� P � �� � sint32 ConfigureDeadlineNoAutoReboot L '
� � � �� � sint32 ConfigureFeatureUpdateUninstallPeriod P '
� � �� � sint32 DeferFeatureUpdatesPeriodInDays T '
� n � �� � sint32 DeferQualityUpdatesPeriodInDays X '
� � � �� � sint32 DeferUpdatePeriod \ '
� � �� � sint32 DeferUpgradePeriod ` '
� m � �� � sint32 DetectionFrequency d '
� � � �� � sint32 DisableDualScan h '
� � �� � sint32 DoNotEnforceEnterpriseTLSCertPinningForUpdateDetection $ � '
� � � �� � sint32 EngagedRestartDeadline l '
� � � �� � sint32 EngagedRestartDeadlineForFeatureUpdates p '
� <
� �� � sint32 EngagedRestartSnoozeSchedule t '
� �
� �� � sint32 EngagedRestartSnoozeScheduleForFeatureUpdates x '
� � �� � sint32 EngagedRestartTransitionSchedule | '
� b � �� � sint32 EngagedRestartTransitionScheduleForFeatureUpdates � '
� � � �� � sint32 ExcludeWUDriversInQualityUpdate ! � '
� 0 � �� � sint32 FillEmptyContentUrls " � '
� � � �� � sint32 IgnoreMOAppDownloadLimit ) � '
� � � �� � sint32 IgnoreMOUpdateDownloadLimit * � '
� 4
� �� � sint32 InstanceID
� r
� �� string ManagePreviewBuilds + � '
� �
� �� � sint32 ParentID
� � �� string PauseDeferrals , � '
� M � �� � sint32 PauseFeatureUpdates - � '
� � � �� � sint32 PauseFeatureUpdatesStartTime . � '
� � � �� � string PauseQualityUpdates / � '
� L � �� � sint32 PauseQualityUpdatesStartTime 0 � '
� � � �� � string PhoneUpdateRestrictions 1 � '
� � � �� � sint32 RequireDeferUpgrade 2 � '
� O � �� � sint32 RequireUpdateApproval 3 � '
� � � �� � sint32 ScheduledInstallDay 4 � '
� � � �� � sint32 ScheduledInstallEveryWeek 5 � '
� M � �� � sint32 ScheduledInstallFirstWeek 6 � '
� � � �� � sint32 ScheduledInstallFourthWeek 7 � '
� � � �� � sint32 ScheduledInstallSecondWeek 8 � '
� W � �� � sint32 ScheduledInstallThirdWeek 9 � '
� � � �� � sint32 ScheduledInstallTime : � '
� � �� � sint32 ScheduleImminentRestartWarning ; � '
� _ � �� � sint32 ScheduleRestartWarning < � '
� � � �� � sint32 SetAutoRestartNotificationDisable = � '
� � �� � sint32 SetDisablePauseUXAccess > � '
� j � �� � sint32 SetDisableUXWUAccess ? � '
� � � �� � sint32 SetEDURestart @ '
� � �� � sint32 SetPolicyDrivenUpdateSourceForDriverUpdates ' � '
� s � �� � sint32 SetPolicyDrivenUpdateSourceForFeatureUpdates % � '
� � � �� � sint32 SetPolicyDrivenUpdateSourceForOtherUpdates ( � '
� G � �� � sint32 SetPolicyDrivenUpdateSourceForQualityUpdates & � '
� � � �� � sint32 SetProxyBehaviorForUpdateDetection # � '
� � �� � sint32 TargetReleaseVersion A '
� f � �� � string UpdateNotificationLevel B '
� � � �� � sint32 UpdateServiceUrl C '
� � �� � string UpdateServiceUrlAlternate D '
� c � �� � string �ing �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �S����
͝��C�� / ��픶� n � WDMClassesOfDriver KernelThermalPolicyChange C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �S����
͝��C�� * ��픶� i � WDMClassesOfDriver ProcessorPerformance C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] sourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �S����
͝��C�� * ��픶� i � WDMClassesOfDriver ProcessorPerformance C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] � iption
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier e � % � � � MSFT_CliProperty GatewayCostMetric The GatewayCostMetric reflects an integer cost metric (ranging from 1 to 9999) to be used in calculating the fastest, most reliable, and/or least expensive routes. GatewayCostMetric ( 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � h � MSFT_CliProperty IGMPLevel The IGMPLevel property indicates the extent to which the system supports IP multicast and participates in the Internet Group Management Protocol. At level 0, the system provides no multicast support. At level 1, the system may only send IP multicast packets. At level 2, the system may send IP multicast packets and fully participate in IGMP to receive multicast packets. Default: 2 IGMPLevel � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING k 6 � MSFT_CliQualifier ValueMap - 0 3 0 1 2 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � \ � MSFT_CliQualifier Values + 9 G No Multicast IP Multicast IP & IGMP multicast 7 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � o v � MSFT_CliProperty Index The Index property specifies the index number of the network adapter configuration. Index Y 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � � MSFT_CliProperty IPAddress The IPAddress property contains a list of all of the IP addresses associated with the current network adapter. IPAddress � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier j � & � � � MSFT_CliProperty IPConnectionMetric The IPConnectionMetric indicates the cost of using the configured routes for this IP bound adapter and is the weighted value for those routes in the IP routing table. IPConnectionMetric F 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � z � � MSFT_CliProperty IPEnabled The IPEnabled property indicates whether TCP/IP is bound and enabled on this network adapt. IPEnabled � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � + 8 � MSFT_CliProperty IPFilterSecurityEnabled The IPFilterSecurityEnabled property indicates whether IP port security is enabled globally across all IP-bound network adapters. This property is used in conjunction with IPSecPermitTCPPorts, IPSecPermitUDPPorts, and IPSecPermitIPProtocols. IPFilterSecurityEnabled � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier I � ) � � � MSFT_CliProperty IPPortSecurityEnabled The IPPortSecurityEnabled property indicates whether IP port security is enabled globally across all IP-bound network adapters. IPPortSecurityEnabled � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier ` � * � � � MSFT_CliProperty IPSecPermitIPProtocols The IPSecPermitIPProtocols property lists the protocols permitted to run over the IP. The list of protocols is defined using the EnableIPSec method. IPSecPermitIPProtocols � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier e � ' � � � MSFT_CliProperty IPSecPermitTCPPorts The IPSecPermitTCPPorts property lists the ports that will be granted access permission for TCP. The list of protocols is defined using the EnableIPSec method. IPSecPermitTCPPorts � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier z � ' � � � MSFT_CliProperty IPSecPermitUDPPorts The IPSecPermitUDPPorts property lists the ports that will be granted User Datagram Protocol (UDP) access permission. The list of protocols is defined using the EnableIPSec method. IPSecPermitUDPPorts S 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � � MSFT_CliProperty IPSubnet The IPSubnet property contains a list of all the subnet masks associated with the current network adapter. IPSubnet � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � & � � MSFT_CliProperty IPUseZeroBroadcast The IPUseZeroBroadcast property indicates whether IP zeros-broadcasts are used. If this parameter is set TRUE, then IP uses zeros-broadcasts (0.0.0.0), and the system uses ones-broadcasts (255.255.255.255). IPUseZeroBroadcast � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � � � � MSFT_CliProperty IPXAddress The IPXAddress property indicates the Internetworking Packet Exchange (IPX) address of the network adapter. The IPX address identifies a computer system on a network using the IPX protocol. IPXAddress q 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier 7 � � � � MSFT_CliProperty IPXEnabled The IPXEnabled property determines whether the or Internetwork Packet Exchange (IPX) protocol is bound and enabled for this adapter. IPXEnabled � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � � � MSFT_CliProperty IPXFrameType The IPXFrameType property represents an integer array of frame type identifiers. The values in this array correspond to the elements in the IPXNetworkNumber. IPXFrameType � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING k F � MSFT_CliQualifier ValueMap 5 8 ; > A 0 1 2 3 255 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � u � MSFT_CliQualifier Values 3 @ P ` o Ethernet II Ethernet 802.3 Ethernet 802.2 Ethernet SNAP AUTO E 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � K � MSFT_CliProperty IPXMediaType The IPXMediaType property represents an Internetworking Packet Exchange (IPX) media type identifier. IPXMediaType � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING k = � MSFT_CliQualifier ValueMap 1 4 7 : 1 2 3 8 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � S � MSFT_CliQualifier Values / 9 E K Ethernet Token ring FDDI ARCNET � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier T � $ � � � MSFT_CliProperty IPXNetworkNumber The IPXNetworkNumber property represents an array of characters that uniquely identifies a frame/network adapter combination on the computer system. IPXNetworkNumber � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier e � ' � � � MSFT_CliProperty IPXVirtualNetNumber The IPXVirtualNetNumber property uniquely identifies the computer system on the network. It is represented in the form of an eight-character hexadecimal digit. IPXVirtualNetNumber t 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier : � % � � � MSFT_CliProperty KeepAliveInterval The KeepAliveInterval property indicates the interval separating Keep Alive Retransmissions until a response is received. KeepAliveInterval � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier K � ! � � � MSFT_CliProperty KeepAliveTime The KeepAliveTime property indicates how often the TCP attempts to verify that an idle connection is still intact by sending a Keep Alive Packet. KeepAliveTime N 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � � MSFT_CliProperty MACAddress The MACAddress property indicates the Media Access Control (MAC) address of the network adapter. MACAddress � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � � MSFT_CliProperty MTU The MTU property overrides the default Maximum Transmission Unit (MTU) for a network interface. The MTU is the maximum packet size (including the transport header) that the transport will transmit over the underlying network. MTU � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � % �
� MSFT_CliProperty NumForwardPackets The NumForwardPackets property indicates the number of IP packet headers allocated for the router packet queue. When all headers are in use, the router will begin to discard packets from the queue at random. NumForwardPackets � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � ' $ � MSFT_CliProperty PMTUBHDetectEnabled The PMTUBHDetectEnabled property indicates whether detection of black hole routers occurs. Setting this parameter to TRUE causes TCP to try to detect black hole routers while discovering the path of the Maximum Transmission Unit. PMTUBHDetectEnabled m 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier 3 � ( � � � MSFT_CliProperty PMTUDiscoveryEnabled The PMTUDiscoveryEnabled property indicates whether the Maximum Transmission Unit (MTU) path is discovered. PMTUDiscoveryEnabled ; 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � m z � MSFT_CliProperty ServiceName The ServiceName property indicates the service name of the network adapter. ServiceName � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier \ W b � � MSFT_CliProperty SettingID The identifier by which the CIM_Setting object is known. SettingID j � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ( � MSFT_CliQualifier MaxLen # 256 k 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier 1 � ' � � � MSFT_CliProperty TcpipNetbiosOptions The TcpipNetbiosOptions property specifies a bitmap of the possible settings related to NetBIOS over TCP/IP. TcpipNetbiosOptions � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier s � 0 � � � MSFT_CliProperty TcpMaxConnectRetransmissions The TcpMaxConnectRetransmissions property indicates the number of times TCP will attempt to retransmit a Connect Request before terminating the connection. TcpMaxConnectRetransmissions � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier ~ � - � � � MSFT_CliProperty TcpMaxDataRetransmissions The TcpMaxDataRetransmissions property indicates the number of times TCP will retransmit an individual data segment (non-connect segment) before terminating the connection. TcpMaxDataRetransmissions m 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier 3 � % � � � MSFT_CliProperty TcpNumConnections The TcpNumConnections property indicates the maximum number of connections that TCP can have open simultaneously. TcpNumConnections 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � . 9 U � MSFT_CliProperty TcpUseRFC1122UrgentPointer The TcpUseRFC1122UrgentPointer property indicates whether TCP uses the RFC 1122 specification or the mode used by Berkeley Software Design (BSD) derived systems, for urgent data. The two mechanisms interpret the urgent pointer differently and are not interoperable. TcpUseRFC1122UrgentPointer ) 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � ! Y h � MSFT_CliProperty TcpWindowSize The TcpWindowSize property contains the maximum TCP Receive Window size offered by the system. The Receive Window specifies the number of bytes a sender may transmit without receiving an acknowledgment. In general, larger receiving windows will improve performance over high delay and high bandwidth networks. TcpWindowSize � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � + 4 � MSFT_CliProperty WINSEnableLMHostsLookup The WINSEnableLMHostsLookup property indicates whether local lookup files are used. Lookup files will contain a map of IP addresses to host names. If they exist on the local system, they will be found in %SystemRoot%\system32\drivers\etc. WINSEnableLMHostsLookup W 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � & � � � MSFT_CliProperty WINSHostLookupFile The WINSHostLookupFile property contains a path to a WINS lookup file on the local system. This file will contain a map of IP addresses to host names. If the file specified in this property is found, it will be copied to the %SystemRoot%\system32\drivers\etc folder of the local system. Valid only if the WINSEnableLMHostsLookup property is TRUE. WINSHostLookupFile P 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � % | � � MSFT_CliProperty WINSPrimaryServer The WINSPrimaryServer property indicates the IP address for the primary WINS server. WINSPrimaryServer d 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier * � � � � MSFT_CliProperty WINSScopeID The WINSScopeID property provides a way to isolate a group of computer systems that communicate with each other only. WINSScopeID X 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � ' � � � MSFT_CliProperty WINSSecondaryServer The WINSSecondaryServer property indicates the IP address for the secondary WINS server. WINSSecondaryServer � �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � � � MSFT_CliFormat TABLE BRIEF > � S � 6
u � � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier z � � � � MSFT_CliProperty DHCPEnabled The DHCPEnabled property indicates whether the dynamic host configuration protocol (DHCP) server automatically assigns an IP address to the computer system when establishing a network connection. DHCPEnabled Y 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � � MSFT_CliProperty IPAddress The IPAddress property contains a list of all of the IP addresses associated with the current network adapter. IPAddress k 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier 1 � $ � � � MSFT_CliProperty DefaultIPGateway The DefaultIPGateway property contains a list of IP addresses of the default gateways used by the computer system. DefaultIPGateway p 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier 6 � � � � MSFT_CliProperty DNSDomain The DNSDomain property indicates an organization name followed by a period and an extension that indicates the type of organization. DNSDomain ; 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � m z � MSFT_CliProperty ServiceName The ServiceName property indicates the service name of the network adapter. ServiceName ! 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � F S � MSFT_CliProperty Description A textual description of the adapter. Description 7 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � o v � MSFT_CliProperty Index The Index property specifies the index number of the network adapter configuration. Index 6 �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty C � MSFT_CliFormat DHCP 2 W � {
� ! 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � F S � MSFT_CliProperty Description A textual description of the adapter. Description � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier z � � � � MSFT_CliProperty DHCPEnabled The DHCPEnabled property indicates whether the dynamic host configuration protocol (DHCP) server automatically assigns an IP address to the computer system when establishing a network connection. DHCPEnabled � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier w � $ � � � MSFT_CliProperty DHCPLeaseExpires The DHCPLeaseExpires property indicates the expiration date and time for a leased IP address that was assigned to the computer by the dynamic host configuration protocol (DHCP) server. DHCPLeaseExpires � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier y � % � � � MSFT_CliProperty DHCPLeaseObtained The DHCPLeaseObtained property indicates the date and time the lease was obtained for the IP address assigned to the computer by the dynamic host configuration protocol (DHCP) server. DHCPLeaseObtained W 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � � MSFT_CliProperty DHCPServer The DHCPServer property indicates the IP address of the dynamic host configuration protocol (DHCP) server. DHCPServer 7 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � o v � MSFT_CliProperty Index The Index property specifies the index number of the network adapter configuration. Index I1 �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty V0 : � MSFT_CliFormat DNS = b � � J
s
� � � ! 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � F S � MSFT_CliProperty Description A textual description of the adapter. Description � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier M � � � � MSFT_CliProperty DNSDomain The DNSDomain property indicates an organization name followed by a period and an extension that indicates the type of organization, such as microsoft.com. DNSDomain � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier ] � . � � � MSFT_CliProperty DNSDomainSuffixSearchOrder The DNSDomainSuffixSearchOrder property specifies the DNS domain suffixes to be appended to the end of host names during name resolution. DNSDomainSuffixSearchOrder � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � / � � � MSFT_CliProperty DNSEnabledForWINSResolution The DNSEnabledForWINSResolution property indicates whether the Domain Name System (DNS) is enabled for name resolution over Windows Internet Naming Service (WINS) resolution. DNSEnabledForWINSResolution % 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � W d � MSFT_CliProperty DNSHostName The DNSHostName property indicates the host name used to identify the local computer for authentication by some utilities. Other TCP/IP-based utilities can use this value to acquire the name of the local computer. Host names are stored on DNS servers in a table that maps names to IP addresses for use by DNS. DNSHostName { 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier A � ( � � � MSFT_CliProperty DNSServerSearchOrder The DNSServerSearchOrder property indicat��� @ �Rԕ\ b ���
R O O T \ c i m v 2 \ m d m \ d m m a p _ _ M e t h o d P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 0 6 3 4 B E A A A 6 D 4 7 E 6 3 7 1 9 9 9 A D 4 0 5 E 0 D D A F D A 3 B D A B 3 6 5 9 C 4 8 5 8 F 5 6 5 9 3 6 A 4 9 0 9 9 8 1 F \ K I _ 7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D \ I _ 0 2 E 3 B 8 C 8 2 4 F D 0 B 9 C 1 5 B 4 D 4 9 A B 8 4 C F 0 2 F A 3 8 E 0 2 C A F 6 9 9 D C 3 C B D C B B 2 D 7 9 F 3 0 2 5 D F C ;ٝ��C�� ) 3 @ � �� � V h { � �
H W � � � � U������������������������� � MDM_EnterpriseModernAppManagement_AppManagement01 InPartition H local-system DMWmiBridgeProv1 AppInventoryQuery '
� � � �� � �� string AppInventoryResults '
� � �� � string InstanceID
� @ � �� string LastScanError '
� � � �� � sint32 ParentID
� � � �� string RemovePackage '
� � �� � string � . 2 � � � � r � UpdateScanMethod ! �� implemented � WIN-F6NF7R6I6PJ ROOT\cimv2\mdm\dmmap ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � RemovePackageMethod � �� implemented � WIN-F6NF7R6I6PJ ROOT\cimv2\mdm\dmmap ���� � �� �� * � ����� � __PARAMETERS abstract param string
� 1 In
� 1 X �� ID )
� � X ��� string __ �� WIN-F6NF7R6I6PJ ROOT\cimv2\mdm\dmmap ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � =ٝ��C�� D ) 6 C � �� � Y k y � � N Z � � � � , i q � � � = G y � � � Z a � � UUUU����������������������������������������������������������������� � MDM_EnterpriseModernAppManagement_AppManagement01_03 InPartition K local-system DMWmiBridgeProv1 Architecture '
� � � �� � string InstallDate $ '
� � � �� � string InstallLocation '
� F � �� � string InstanceID
� � � �� string IsBundle '
� � � �� � sint32 IsFramework '
� � �� � sint32 IsProvisioned 8 '
� a � �� � sint32 IsStub < '
� � � �� � sint32 Name '
� � � �� � string PackageStatus , '
� 5 � �� � sint32 ParentID
� q � �� string Publisher '
� � � �� � string RequiresReinstall 0 '
� � �� � sint32 ResourceID
( '
� R � �� � string Users
4 '
� � � �� � string Version '
� � � �� � string �uiresReinstall 0 '
� � �� � sint32 ResourceID
( '
� R � �� � string Users
4 '
� � � �� � string Version '
� � � �� � string �tring RequiresReinstall 0 '
� � �� � sint32 ResourceID
( '
� R � �� � string Users
4 '
� � � �� � string Version '
� � � �� � string � __ �� �� � string PackageStatus , '
� D � �� � sint32 ParentID
� � � �� string Publisher '
� � � �� � string RequiresReinstall 0 '
� � �� � sint32 ResourceID
( '
� a � �� � string Users
4 '
� � � �� � string Version '
� � � �� � string � R O O T \ c i m v 2 \ m d m \ d m m a p _ _ M e t h o d P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 0 6 3 4 B E A A A 6 D 4 7 E 6 3 7 1 9 9 9 A D 4 0 5 E 0 D D A F D A 3 B D A B 3 6 5 9 C 4 8 5 8 F 5 6 5 9 3 6 A 4 9 0 9 9 8 1 F \ K I _ 7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D \ I _ 0 2 E 3 B 8 C 8 2 4 F D 0 B 9 C 1 5 B 4 D 4 9 A B 8 4 C F 0 2 F A 3 8 E 0 2 C A F 6 9 9 D C 3 C B D C B B 2 D 7 9 F 3 0 2 5 D F C
͝��C�� ) ��픶� h � WDMClassesOfDriver IdleStateAccounting C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] [MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �S����
͝��C�� ) ��픶� h � WDMClassesOfDriver IdleStateAccounting C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] .mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �S����
͝��C�� ) ��픶� h � WDMClassesOfDriver IdleStateAccounting C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] [MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �S����
͝��C�� ) ��픶� h � WDMClassesOfDriver IdleStateAccounting C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] ourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �S����
͝��C�� ) ��픶� h � WDMClassesOfDriver IdleStateAccounting C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] .dll.mui[MofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �S����
͝��C�� ) ��픶� h � WDMClassesOfDriver IdleStateAccounting C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] sourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �S����
͝��C�� ) ��픶� h � WDMClassesOfDriver IdleStateAccounting C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] Name] es an ordered list of server IP addresses to be used in querying for DNS Servers. DNSServerSearchOrder � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � 0 0 � MSFT_CliProperty DomainDNSRegistrationEnabled The DomainDNSRegistrationEnabled property specifies whether the IP addresses for this connection are registered in DNS under the domain name of this connection, in addition to registering under the computer's full DNS name. DomainDNSRegistrationEnabled 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � . 7 S � MSFT_CliProperty FullDNSRegistrationEnabled The FullDNSRegistrationEnabled property specifies whether the IP addresses for this connection are registered in DNS under the computer's full DNS name. The full DNS name of the computer is displayed on the Network Identification tab of the System Control Panel. FullDNSRegistrationEnabled 7 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � o v � MSFT_CliProperty Index The Index property specifies the index number of the network adapter configuration. Index � �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � � � MSFT_CliFormat TABLE IP 7 \ � � � � ! 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � F S � MSFT_CliProperty Description A textual description of the adapter. Description 7 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � o v � MSFT_CliProperty Index The Index property specifies the index number of the network adapter configuration. Index Y 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � � MSFT_CliProperty IPAddress The IPAddress property contains a list of all of the IP addresses associated with the current network adapter. IPAddress � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier j � & � � � MSFT_CliProperty IPConnectionMetric The IPConnectionMetric indicates the cost of using the configured routes for this IP bound adapter and is the weighted value for those routes in the IP routing table. IPConnectionMetric F 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � z � � MSFT_CliProperty IPEnabled The IPEnabled property indicates whether TCP/IP is bound and enabled on this network adapt. IPEnabled � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � + 8 � MSFT_CliProperty IPFilterSecurityEnabled The IPFilterSecurityEnabled property indicates whether IP port security is enabled globally across all IP-bound network adapters. This property is used in conjunction with IPSecPermitTCPPorts, IPSecPermitUDPPorts, and IPSecPermitIPProtocols. IPFilterSecurityEnabled � �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � � MSFT_CliFormat WINS 6 [ � � �
>
� ! 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � F S � MSFT_CliProperty Description A textual description of the adapter. Description 7 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � o v � MSFT_CliProperty Index The Index property specifies the index number of the network adapter configuration. Index � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � + 4 � MSFT_CliProperty WINSEnableLMHostsLookup The WINSEnableLMHostsLookup property indicates whether local lookup files are used. Lookup files will contain a map of IP addresses to host names. If they exist on the local system, they will be found in %SystemRoot%\system32\drivers\etc. WINSEnableLMHostsLookup W 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � & � � � MSFT_CliProperty WINSHostLookupFile The WINSHostLookupFile property contains a path to a WINS lookup file on the local system. This file will contain a map of IP addresses to host names. If the file specified in this property is found, it will be copied to the %SystemRoot%\system32\drivers\etc folder of the local system. Valid only if the WINSEnableLMHostsLookup property is TRUE. WINSHostLookupFile P 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � % | � � MSFT_CliProperty WINSPrimaryServer The WINSPrimaryServer property indicates the IP address for the primary WINS server. WINSPrimaryServer d 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier * � � � � MSFT_CliProperty WINSScopeID The WINSScopeID property provides a way to isolate a group of computer systems that communicate with each other only. WINSScopeID X 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � ' � � � MSFT_CliProperty WINSSecondaryServer The WINSSecondaryServer property indicates the IP address for the secondary WINS server. WINSSecondaryServer NICConfig Where Index=# Select * from Win32_NetworkAdapterConfiguration * �� A� h� �� S� � - >) VT _ �i �s �� �� � !� 4� S� � � � : �D DP C[ e n x ߂ �� j� *� d� �� �� X� � �� �� H � { � A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 � � " / 9 C � MSFT_CliVerb ipconfig /FlushDns Flushes DNS FlushDns FlushDns # � A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 ( � � � � � MSFT_CliVerb RenewDHCPLease The RenewDHCPLease method renews the IP address on specific DHCP-enabled network adapters. The lease for the IP address assigned via a DHCP server has an expiration date that the client must renew if it intends to continue use of the assigned IP address. The method returns an integer value of 0 on successful completion, and any other number to indicate an error. RenewDHCPLease RenewDHCPLease ) � A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 . � ! � � � � MSFT_CliVerb RenewDHCPLeaseAll The RenewDHCPLeaseAll method renews the IP addresses on all DHCP-enabled network adapters. The lease for the IP address assigned via a DHCP server has an expiration date that the client must renew if it intends to continue use of the assigned IP address. The method returns an integer value of 0 on successful completion, and any other number to indicate an error. RenewDHCPLeaseAll RenewDHCPLeaseAll � � A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 � � ! 3 E � MSFT_CliVerb ReleaseDHCPLease The ReleaseDHCPLease method releases the IP address bound to a specific DHCP enabled network adapter. WARNING: If DHCP is enabled on this local computer system, the option disables TCP/IP on this specific network adapter. Unless you have an alternate path ReleaseDHCPLease ReleaseDHCPLease � � A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 � � # � % � MSFT_CliVerb ReleaseDHCPLeaseAll The ReleaseDHCPLeaseAll method releases the IP addresses bound to all DHCP enabled network adapters. WARNING: If DHCP is enabled on this local computer system, the option will terminate all DHCP TCP/IP connections. ReleaseDHCPLeaseAll ReleaseDHCPLeaseAll ; � A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 @ *
� MSFT_CliVerb EnableStatic The EnableStatic method enables static TCP/IP addressing for the target network adapter. As a result, DHCP for this network adapter is disabled. The method returns an integer value of 0 on successful completion, and any other number to indicate an error. EnableStatic 6 � Y � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � 3 � � � � � MSFT_CliParam The IPAddress parameter lists all of the static IP addresses for the current network adapter. /nExample: 155.34.22.0 IPAddress � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True ARRAY OF STRING p � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � 3 � � � � � MSFT_CliParam The SubnetMask parameter contains the subnet masks that complement the values in the IPAddress parameter./nExample: 255.255.0.0 SubnetMask � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True ARRAY OF STRING EnableStatic
� A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 ^ k
� MSFT_CliVerb SetGateways The SetGateways method is used to specify a list of gateways for routing packets destined for a different subnet than the one this adapter is connected to. A more specific route should not exist for this subnet. The method returns an integer value of 0 on successful completion and any other number to indicate an error. SetGateways w + � � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING 3 � � � � � MSFT_CliParam The DefaultIPGateway is an input parameter to the SetGateways method. It contains a list of IP addresses to gateways where network packets should be routed. DefaultIPGateway � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True ARRAY OF STRING � � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING % 3 = P o � � MSFT_CliParam The GatewayCostMetric parameter assigns an value ranging from 1 to 9999, used to calculate fastest and most reliable routes. The values of this parameter correspondence with the values in the DefaultIPGateway[] parameter. The default value for a gateway is 1. This parameter is for Windows 2000 only. GatewayCostMetric X � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True ARRAY OF UINT16 SetGateways + � A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 ) � � � � � MSFT_CliVerb EnableDNS The EnableDNS method enables the Domain Name System (DNS) for service on this TCP/IP-bound network adapter. The method returns an integer value of 0 on successful completion, and any other number to indicate an error. EnableDNS . � ? � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING k 3 � � � MSFT_CliParam The DNSDomain parameter specifies the DNS's domain. This parameter is represented by an organization name followed by a period, then an extension that indicates the type of organization./n Example: microsoft.com DNSDomain � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True STRING � � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING 3 � � � � � MSFT_CliParam The DNSDomainSuffixSearchOrder parameter specifies the DNS domain suffixes that is appended to the host names during name resolution. When attempting to resolve a fully qualified domain name (FQDN) from a host only name, the system appends the local domain name. If this is not successful, the system uses the domain suffix list to create additional FQDNs in the order listed, and queries DNS servers for each one. DNSDomainSuffixSearchOrder � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True ARRAY OF STRING K � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � 3 } � � � � MSFT_CliParam The DNSHostName parameter specifies the name of the DNS host to be enabled by this method./nExample: corpdns DNSHostName � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True STRING H � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � 3 w � � � � MSFT_CliParam The DNSServerSearchOrder parameter specifies the list of server IP addresses to query for DNS servers. DNSServerSearchOrder � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True ARRAY OF STRING EnableDNS �
� A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 � x � � � � MSFT_CliVerb SetDNSDomain The SetDNSDomain method allows for the setting of the DNS domain. The method returns an integer value of 0 on successful completion, and any other number to indicate an error. This is an instance dependent method call that applies on a per adapter basis. On Windows 2000 the setting applies to the targeted adapter. On NT4 this setting is global. SetDNSDomain � # � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING w 3 � � � MSFT_CliParam The DNSDomain parameter indicates the domain the DNSis associated with and is represented by an organization name followed by a period and an extension that indicates the type of organization./nExample: microsoft.com. DNSDomain � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True STRING SetDNSDomain �
� A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 � ' � � a z � MSFT_CliVerb SetDNSServerSearchOrder The SetDNSServerSearchOrder method allows for the setting of the server search order as a array of elements. The method returns an integer value of 0 on successful completion, and any other number to indicate an error. This is an instance dependent method call that applies on a per adapter basis. On Windows 2000 the setting applies to the targeted adapter. On NT4 this setting is global. SetDNSServerSearchOrder � � � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � 3 � � � � � MSFT_CliParam The DNSServerSearchOrder parameter indicates the list of server IP addresses to query for DNS Servers./nExample:130.215.24.1 157.54.164.1 DNSServerSearchOrder � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True ARRAY OF STRING SetDNSServerSearchOrder #
� A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 ( ' c | . G � MSFT_CliVerb SetDNSSuffixSearchOrder The SetDNSSuffixSearchOrder method allows for the setting of the suffix search order as a array of elements. The method returns an integer value of 0 on successful completion, and any other number to indicate an error. This is an instance independent method call that applies across all adapters. Windows NT only. SetDNSSuffixSearchOrder � � � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � 3 � � � � � MSFT_CliParam The DNSServerSearchOrder parameter indicates the list of server IP addresses suffixes to query for DNS Servers./nExample:130.215.24.1 157.54.164.1 DNSDomainSuffixSearchOrder � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True ARRAY OF STRING SetDNSSuffixSearchOrder � � A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 � ) | � � MSFT_CliVerb SetDynamicDNSRegistration The SetDynamicDNSRegistration method is used to indicate dynamic DNS registration of IP addresses for this IP bound adapter. The method returns 0 on success, and any other number to indicate an error.Windows 2000 only. SetDynamicDNSRegistration , � � � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � 3 6 U ^ � MSFT_CliParam The DomainDNSRegistrationEnabled parameter specifies whether the IP addresses for this connection are registered in DNS under the domain name of this connection, in addition to registering under the computer's full DNS name. The domain name of this connection is either set via the method SetDNSDomain() or assigned by DHCP. The registered name is the host name of the computer with the domain name appended. This parameter has meaning only when FullDNSRegistrationEnabled is enabled. Default: FALSE. Windows 2000 only. DomainDNSRegistrationEnabled > � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True BOOLEAN � � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING
3 + G f o � MSFT_CliParam The FullDNSRegistrationEnabled parameter specifies whether the IP addresses for this connection are registered in DNS under the computer's full DNS name. The full DNS name of the computer is displayed on the Network Identification tab of the System Control Panel. Windows 2000 only. FullDNSRegistrationEnabled O � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True BOOLEAN SetDynamicDNSRegistration �
� A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 % � ~ � � MSFT_CliVerb SetIPConnectionMetric The SetIPConnectionMetric method is used to set the routing metric associated with this IP bound adapter. The method returns 0 on success, and any other number to indicate an error.Windows 2000 only. SetIPConnectionMetric l � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � 3 � � � � � MSFT_CliParam The IPConnectionMetric parameter assigns an value ranging from 1 to 9999, and indicates the cost of using the configured routes for this IP bound adapter and is the weighted value for those routes in the IP routing table. If there are multiple routes to a destination in the IP routing table, the route with the lowest metric is used. The default value is 1. Windows 2000 only. IPConnectionMetric � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True UINT32 SetIPConnectionMetric 7 � A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 < V e � � � MSFT_CliVerb SetWINSServer The SetWINSServer method sets the primary and secondary Windows Internet Naming Service (WINS) servers on this TCP/IP-bound network adapter. This method is applied independently of the network adapter. The method returns an integer value of 0 on successful completion, and any other number to indicate an error. SetWINSServer q � ! � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING u 3 e x � � � MSFT_CliParam The WINSPrimaryServer parameter specifies the IP address of the primary WINS server. WINSPrimaryServer � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True STRING + � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING 3 i ~ � � � MSFT_CliParam The WINSSecondaryServer parameter specifies the IP address of the secondary WINS server. WINSSecondaryServer � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True STRING SetWINSServer .' � A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 3% l x � MSFT_CliVerb EnableWINS The EnableWINS method enables Windows Internet Naming Service (WINS) settings specific to TCP/IP, but independent of the network adapter. The method returns an integer value of 0 on successful completion, and any other number to indicate an error. EnableWINS 3 � �
� � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � 3 � � � � � MSFT_CliParam The DNSEnabledForWINSResolution parameter specifies whether the Domain Name System (DNS) is enabled for name resolution over WINS resolution. DNSEnabledForWINSResolution � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True BOOLEAN � � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � 3 � � � � � MSFT_CliParam The WINSEnableLMHostsLookup parameter specifies whether local lookup files are used. Lookup files will contain mappings of IP addresses to host names. WINSEnableLMHostsLookup � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True BOOLEAN � � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING L 3 � � � MSFT_CliParam The WINSEnableLMHostsLookup parameter specifies the lookup files containing mappings of IP addresses to host names. If available, the files will be found in %SystemRoot%\system32\drivers\etc. WINSHostLookupFile � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True STRING � � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING = 3 � � � � MSFT_CliParam The WINSScopeID parameter specifies the Scope ID value that will be appended to the end of the computer's NetBIOS name. Systems using the same Scope ID can communicate with this computer. WINSScopeID � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True STRING EnableWINS � A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 � � � > � MSFT_CliVerb SetTcpipNetbios The SetTcpipNetbios method is used to set the default operation of NetBIOS over TCP/IP. Windows 2000 only. SetTcpipNetbios � P � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � 3 ~ � b j � MSFT_CliParam The TcpipNetbiosOptions parameter specifies a bitmap of the possible settings related to NetBIOS over TCP/IP. TcpipNetbiosOptions � � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING k 6 � MSFT_CliQualifier ValueMap - 0 3 0 1 2 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � ` � MSFT_CliQualifier Values + A P EnableNetbiosViaDhcp EnableNetbios DisableNetbios UINT32 SetTcpipNetbios [EnableNetbiosViaDhcp|EnableNetbios|DisableNetbios] � A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 : G � MSFT_CliVerb EnableIPSec The EnableIPSec method is used to enable IP security on this specific TCP/IP-enabled network adapter. The method returns an integer value of 0 on successful completion, and any other number to indicate an error. Ports are secured only when the IPFilterSecurityEnabled property is TRUE. EnableIPSec W � v � � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � 3 . M ^ � MSFT_CliParam The IPSecPermitIPProtocols parameter specifies the list of protocols permitted to run over the IP. A numeric value of zero indicates access permission is granted for all protocols. An empty string indicates that no protocols should be granted access permission. IPSecPermitIPProtocols 6 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True ARRAY OF STRING � � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � 3 0 O ` � MSFT_CliParam The IPSecPermitTCPPorts parameter specifies the list of ports that should be granted access permission for TCP. A numeric value of zero indicates access permission is granted for all ports. An empty string indicates that no ports should be granted access permission. IPSecPermitTCPPorts 8 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True ARRAY OF STRING � � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � 3 0 O ` � MSFT_CliParam The IPSecPermitUDPPorts parameter specifies the list of ports that should be granted access permission for UDP. A numeric value of zero indicates access permission is granted for all ports. An empty string indicates that no ports should be granted access permission. IPSecPermitUDPPorts 8 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True ARRAY OF STRING EnableIPSec � A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 � � � � � MSFT_CliVerb DisableIPSec The DisableIPSec method is used to disable IP security on this TCP/IP-enabled network adapter. The method returns an integer value of 0 on successful completion, and any other number to indicate an error. DisableIPSec DisableIPSec � � A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 � �
2 &
� MSFT_CliVerb EnableDHCP EnableDHCP EnableDHCP > � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING 0 X � MSFT_CliQualifier ValueMap ' � � � � � � � � � � � � � � � � � � # ' + / 3 7 ; ? C G K O T 0 1 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 100 .. � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING 6 & � MSFT_CliQualifier Values ' � � 5 F [ � � � � U j } � � � � � > Z x � � � � � 1 @ O _ � � � Successful completion, no reboot required Successful completion, reboot required Method not supported on this platform Unknown failure Invalid subnet mask An error occurred while processing an Instance that was returned Invalid input parameter More than 5 gateways specified Invalid IP address Invalid gateway IP address An error occurred while accessing the Registry for the requested information Invalid domain name Invalid host name No primary/secondary WINS server defined Invalid file Invalid system path File copy failed Invalid security parameter Unable to configure TCP/IP service Unable to configure DHCP service Unable to renew DHCP lease Unable to release DHCP lease IP not enabled on adapter IPX not enabled on adapter Frame/network number bounds error Invalid frame type Invalid network number Duplicate network number Parameter out of bounds Access denied Out of memory Already exists Path, file or object not found Unable to notify service Unable to notify DNS service Interface not configurable Not all DHCP leases could be released/renewed DHCP not enabled on adapter Other The EnableDHCP method enables the Dynamic Host Configuration Protocol (DHCP) for service with this network adapter. DHCP allows IP addresses to be dynamic allocated. The method returns an integer value that can be interpretted as follows: /n0 - Successful
� A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 * . c � MSFT_CliVerb SetIPXVirtualNetworkNumber The SetIPXVirtualNetworkNumber method is used to set the Internetworking Packet Exchange (IPX) virtual network number on the target computer system. Windows 2000 and Windows NT 3.51 or greater uses an internal network number for internal routing. The internal network number is also known as a virtual network number. It uniquely identifies the computer system on the network. The method returns an integer value of 0 on successful completion, and any other number to indicate an error. SetIPXVirtualNetworkNumber 6 ) � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING } 3 h } � � � MSFT_CliParam The IPXVirtualNetNumber parameter specifies the virtual network number for this system. IPXVirtualNetNumber � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True STRING SetIPXVirtualNetworkNumber E" � A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 J + � � Y v � MSFT_CliVerb SetIPXFrameTypeNetworkPairs The SetIPXFrameTypeNetworkPairs method is used to set Internetworking Packet Exchange (IPX) network number/frame pairs for this network adapter. Windows 2000 and Windows NT 3.51 and higher use an IPX network number for routing purposes. It is assigned to each configured frame type/network adapter combination on your computer system. This number is sometimes referred to as the "external network number." It must be unique for each network segment. If the frame type is set to AUTO, the network number should to zero. The method returns an integer value of 0 on successful completion, and any other number to indicate an error. SetIPXFrameTypeNetworkPairs � �
� � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING = 3 � � � � � MSFT_CliParam The IPXFrameType parameter specifies an integer array of frame type identifiers. The values in this array correspond to the elements in the IPXNetworkNumber parameter. IPXFrameType � �
� @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING k F � MSFT_CliQualifier ValueMap 5 8 ; > A 0 1 2 3 255 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � u � MSFT_CliQualifier Values 3 @ P ` o Ethernet II Ethernet 802.3 Ethernet 802.2 Ethernet SNAP AUTO ARRAY OF UINT32 � � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � 3 $ 6 U f � MSFT_CliParam The IPXNetworkNumber parameter specifies an array of characters that uniquely identify an adapter on the computer system. The NetWare Link (NWLink) IPX/SPX-compatible transport in Windows 2000 and Windows NT 3.51 or higher, uses two different types of network numbers. This number is sometimes referred to as the External Network Number. It must be unique for each network segment. The values in this string list must have a corresponding value in the IPXFrameType parameter identifying the packet frame type used for this network. IPXNetworkNumber > � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True ARRAY OF STRING SetIPXFrameTypeNetworkPairs }
� A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 � _ p � � � MSFT_CliVerb SetDatabasePath The SetDatabasePath method sets the path to the standard Internet database files (HOSTS, LMHOSTS, NETWORKS, PROTOCOLS). It is used by the Windows Sockets interface. The method returns an integer value of 0 on successful completion, and any other number to indicate an error. Default: %SystemRoot%\system32\drivers\etc. SetDatabasePath x � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING l 3 � � � MSFT_CliParam The DatabasePath parameter specifies a valid Windows 2000 and Windows NT 3.51 or higher file path to standard Internet database files (HOSTS, LMHOSTS, NETWORKS, PROTOCOLS) used by the Windows Sockets interface. DatabasePath � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True STRING SetDatabasePath � � A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 � % 5 & � MSFT_CliVerb SetIPUseZeroBroadcast The SetIPUseZeroBroadcast method is used to set IP zero broadcast usage. If this parameter is set to TRUE, then IP will use zeros-broadcasts (0.0.0.0) instead of ones-broadcasts (255.255.255.255). Most systems use ones-broadcasts, but systems derived from BSD implementations use zeros-broadcasts. Systems that use different broadcasts will not interoperate on the same network. Default: FALSE. The method returns an integer value of 0 on successful completion and any other number to indicate an error. SetIPUseZeroBroadcast = � � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING " 3 � � � � � MSFT_CliParam The IPUseZeroBroadcast parameter specifies the value indicating whether IP zero broadcast is used. Setting the parameter to TRUE indicates that IP zero broadcast is used. IPUseZeroBroadcast � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True BOOLEAN SetIPUseZeroBroadcast �
� A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 ' � r � � MSFT_CliVerb SetArpAlwaysSourceRoute The SetArpAlwaysSourceRoute method is used to set the transmission of ARP queries by the TCP/IP. The method returns an integer value of 0 on successful completion, and any other number to indicate an error. SetArpAlwaysSourceRoute V � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � 3 ~ � � � � MSFT_CliParam The ArpAlwaysSourceRoute parameter specifies a value that indicates if TCP/IP transmits ARP queries. Setting this parameter to TRUE will force TCP/IP to transmit ARP queries with source routing enabled on Token Ring networks. By default, the stack transmits ARP queries without source routing first, then retries with source routing enabled if no reply is received. ArpAlwaysSourceRoute � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True BOOLEAN SetArpAlwaysSourceRoute � � A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 � " j ~ � � � MSFT_CliVerb SetArpUseEtherSNAP The SetArpUseEtherSNAP method is used to enable ethernet packets to use 802.3 SNAP encoding. By default, the stack transmits packets in Digital, Intel, Xerox(DIX) Ethernet format. It will always receive both formats. The method returns an integer value of 0 on successful completion, and any other number to indicate an error. SetArpUseEtherSNAP � K � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � 3 { � � � � MSFT_CliParam The ArpUseEtherSNAP parameter enables (TRUE)TCP/IP to transmit Ethernet packets using 802.3 SNAP encoding. ArpUseEtherSNAP � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True BOOLEAN SetArpUseEtherSNAP � A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32
� � � � � MSFT_CliVerb SetDefaultTOS The SetDefaultTOS method is used to set the default Type of Service (TOS) value in the header of outgoing IP packets. The method returns 0 on success, and any other number to indicate an error. SetDefaultTOS � � � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � 3 � � � � � MSFT_CliParam The DefaultTOS parameter specifies the Type of Service (TOS) value put in the header of outgoing IP packets. See RFC 791 for a definition of the values. DefaultTOS � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True UINT8 SetDefaultTOS � � A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 � � � � � � MSFT_CliVerb SetDefaultTTL The SetDefaultTTL method is used to set the default Time to Live (TTL) value in the header of outgoing IP packets. The TTL specifies the number of routers an IP packet may pass through to reach its destination before being discarded. Each router decrements the TTL count of a packet by one and discards the packets with a TTL of 0. Default: 32, Valid Range: 1 - 255 SetDefaultTTL � 8 � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � 3 t � � � � MSFT_CliParam The DefaultTTL parameter specifies the Time to Live value set in the header of outgoing IP packets. DefaultTTL � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True UINT8 SetDefaultTTL �
� A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 � � � � � � MSFT_CliVerb SetDeadGWDetect The SetDeadGWDetect method is used to enable Dead Gateway detection. Setting this parameter to TRUE causes TCP to perform Dead Gateway Detection. With this feature enabled, TCP asks IP to change to a backup gateway if it retransmits a segment several times without receiving a response. The method returns an integer value of 0 on successful completion, and any other number to indicate an error. SetDeadGWDetect � � � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING 3 � � � � � MSFT_CliParam The DeadGWDetectEnabled parameter specifies a value that can enable the TCP to perform dead gateway detection. If TRUE, the method will enable dead gateway detection. DeadGWDetectEnabled � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True BOOLEAN SetDeadGWDetect � � A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 �
� 6 G � MSFT_CliVerb SetPMTUBHDetect The SetPMTUBHDetect method is used to enable detection of Black Hole routers. Setting this parameter to TRUE causes TCP to try to detect Black Hole routers while doing Path MTU Discovery. A Black Hole router does not return the Internet Control Message Protocol (ICMP) Destination Unreachable messages when it needs to fragment an IP datagram with the Don't Fragment bit set. TCP depends on receiving these messages to perform Path MTU Discovery. With this feature enabled, TCP will try to send segments without the Don't Fragment bit set if several retransmissions of a segment go unacknowledged. If the segment is acknowledged as a result, the maximum segment size (MSS) will be decreased and the Don't Fragment bit will be set in future packets on the connection. Enabling black hole detection increases the maximum number of retransmissions performed for a given segment. The method returns an integer value of 0 on successful completion, and any other number to indicate an error. SetPMTUBHDetect � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING s 3 � � � MSFT_CliParam The PMTUBHDetectEnabled parameter specifies whether the detection of "Black Hole" routers is enabled. If TRUE, the method makes TCP attempt to discover "Black Hole" and route packets in different network paths. PMTUBHDetectEnabled � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True BOOLEAN SetPMTUBHDetect �
� A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 � � M _ � MSFT_CliVerb SetPMTUDiscovery The SetPMTUDiscovery method is used to enable Maximum Transmission Unit (MTU) discovery. Setting this parameter to TRUE causes TCP to attempt to discover the MTU (or largest packet size) over the path to a remote host. By discovering the Path MTU and limiting TCP segments to this size, TCP can eliminate fragmentation at routers along the path that connect networks with different MTUs. Fragmentation adversely affects TCP throughput and network congestion. Setting this parameter to FALSE causes an MTU of 576 bytes to be used for all connections that are not to machines on the local subnet. Default: TRUE. The method returns an integer value of 0 on successful completion, and any other number to indicate an error. SetPMTUDiscovery > � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � 3 � ' 0 � MSFT_CliParam The PMTUDiscoveryEnabled parameter can enable TCP to attempt to discover the Maximum Transmission Unit (MTU) or largest packet size over the path to a remote host. If TRUE, the method makes TCP to attempt to discover the MTU. PMTUDiscoveryEnabled � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True BOOLEAN SetPMTUDiscovery � � A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 �
& � � O g � MSFT_CliVerb SetForwardBufferMemory The SetForwardBufferMemory method is used to specify how much memory IP allocates to store packet data in the router packet queue. When this buffer space is filled, the router begins discarding packets at random from its queue. Packet queue data buffers are 256 bytes in length, so the value of this parameter should be a multiple of 256. Multiple buffers are chained together for larger packets. The IP header for a packet is stored separately. This parameter is ignored and no buffers are allocated if the IP router is not enabled. The buffer size can range from the network MTU to the a value smaller than 0xFFFFFFFF. Default: 74240 (fifty 1480-byte packets, rounded to a multiple of 256). SetForwardBufferMemory � O � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � 3 { � � � � MSFT_CliParam The ForwardBufferMemory parameter specifies the size of the router packet queue used to store packet data. ForwardBufferMemory � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True UINT32 SetForwardBufferMemory 6 � A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 ; & 4 � � � MSFT_CliVerb SetIGMPLevel The SetIGMPLevel method is used to set the extent to which the system supports IP multicasting and participates in the Internet Group Management Protocol. The method returns an integer value of 0 on successful completion, and any other number to indicate an error. SetIGMPLevel < I � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � 3 { � @ G � MSFT_CliParam The IGMPLevel parameter sets the level that the system supports IP multicast and participates in the Internet Group Management Protocol. At level 0, the system provides no multicast support. At level 1, the system may only send IP multicast packets. At level 2, the system may send IP multicast packets and fully participate in IGMP to receive multicast packets. IGMPLevel � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � \ � MSFT_CliQualifier Values + 9 G No Multicast IP Multicast IP & IGMP multicast UINT8 SetIGMPLevel h � A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 m $ - � � � MSFT_CliVerb SetKeepAliveInterval The SetKeepAliveInterval method is used to set the interval separating Keep Alive Retransmissions until a response is received. Once a response is received, the delay until the next Keep Alive Transmission is again controlled by the value of KeepAliveTime. The connection will be terminated after the number of retransmissions specified by TcpMaxDataRetransmissions have gone unanswered. The method returns an integer value of 0 on successful completion, and any other number to indicate an error. SetKeepAliveInterval 5 � � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � 3 � � � � � MSFT_CliParam The KeepAliveInterval parameter specifies the value for the interval separating Keep Alive Retransmissions until a response is received. KeepAliveInterval � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True UINT32 SetKeepAliveInterval �
� A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 �
x � � MSFT_CliVerb SetKeepAliveTime The SetKeepAliveTime method is used to set how often TCP attempts to verify that an idle connection is still available by sending a Keep Alive packet. If the remote system is still reachable and functioning, it will acknowledge the Keep Alive transmission. Keep Alive packets are not sent by default. This feature may be enabled in a connection by an application. The method returns an integer value of 0 on successful completion, and any other number to indicate an error. SetKeepAliveTime _ � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � 3 � � � � � MSFT_CliParam The KeepAliveTime parameter specifies the interval the TCP waits to check that an idle connection is still available. KeepAliveTime � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True UINT32 SetKeepAliveTime � � A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 �
q y � � � MSFT_CliVerb SetMTU The SetMTU method is used to set the default Maximum Transmission Unit (MTU) for a network interface. The MTU is the maximum packet size (in bytes) that the transport will transmit over the underlying network. The size includes the transport header. Note that an IP datagram may span multiple packets. Values larger than the default for the underlying network will result in the transport using the network default MTU. Values smaller than 68 will result in the transport using an MTU of 68. The method returns an integer value of 0 on successful completion, and any other number to indicate an error. SetMTU � � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING _ 3 � �
� MSFT_CliParam The MTU input parameter specifies the default Maximum Transmission Unit (MTU) for a network interface The range of this value spans the minimum packet size (68) to the MTU supported by the underlying network. MTU � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True UINT32 SetMTU �
� A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 � $ � *
@
� MSFT_CliVerb SetNumForwardPackets The SetNumForwardPackets method is used to set the number of IP packet headers allocated for the router packet queue. When all headers are in use, the router will begin to discard packets from the queue at random. SetNumForwardPackets
� ? L s } � � � � U�����������������������F � MSFT_CliParam De���q` � Ԑ�Z� � �F�s� � ��^Xu 0 ��.�� H UuR|�C�l ) )
d ��o w � @ I � � | � 0 ? � � r | � � � � 7 K ( UU��������������������������������������� � RSOP_GPO Description The RSOP_GPO class is an abstraction for a Group Policy Container or Object AMENDMENT LOCALE accessDenied +
� � � � ! . boolean Description Flag to indicate that a GPO is found but inaccessible for security reasons. DisplayName Is Access Denied enabled +
� � � � � � boolean Description Flag to indicate whether this GPO is enabled DisplayName Is Enabled extensionIds
" +
� & . ; ` m string Description Array of Client side extension Ids. DisplayName Extension Ids fileSystemPath +
� � � � string Description Path to the file system, i.e. sysvol part of the GPO. DisplayName File System Path filterAllowed +
� x � � � � boolean Description Flag to indicate whether a GPO passed the filter check. DisplayName Is Filter Allowed filterId +
� * 2 ? Y f string Description Id of WQL filter on GPO. DisplayName WQL Filter guidName +
� � � � � � string Description GPO Name as a guid. DisplayName GPO GUID id 6
� > � ��F S � � string Description This is the GP container path as retrieved from the DS. DisplayName ID name +
� � � � $ 1 string Description A user friendly name. This name may not be unique DisplayName Name securityDescriptor +
� � � � �
uint8 Description Array of bytes containing the security descriptor associated with this GPO in self-relative format. DisplayName Security Descriptor version +
� a i v � � uint32 Description Version Number of this GPO. DisplayName Version � VuR|�C�� )
j ��u } � A J � � � � > J � � � � U������������������������F � RSOP_GPLink Description This class represents the links from a domain, OU, site or local scope to GPOs AMENDMENT LOCALE appliedOrder +
� � � � % 2 uint32 Description Overall Order of the Applied GPO Links found acrossall the applicable SOMs DisplayName Applied Order enabled +
� � � � � � boolean Description Indicates whether this link is enabled or disabled DisplayName Is Enabled GPO f 6
� / � ��= J v � ref:RSOP_GPO Description Reference to GPO associated with this link DisplayName GPO linkOrder +
� � � � % 2 uint32 Description Overall Order of the GPO Links found acrossall the applicable SOMs DisplayName Link Order noOverride +
� � � � � � boolean Description Indicates whether this link is enforced down the SOM hierarchy DisplayName Force SOM f 6
� 6 � ��D Q � � ref:RSOP_SOM Description Reference to the SOM or scope of management associated with this link DisplayName SOM somOrder 6
� � � ��
. ; uint32 Description Order of the GPO within the SOM DisplayName SOM Order � WuR|�C�� ) ! � ��� � � P W { Y _ � � � � U�������������������������� � RSOP_PolicySetting Description The RSOP_PolicySetting class is the abstract parent object from which client-side extensions' policy objects are inherited AMENDMENT LOCALE creationTime e +
� � 4 A datetime Description Time this policy object was created. DisplayName Creation Time GPOID +
� � � � f s string Description Identifies the GPO that contains this Policy Object.A client-side extension obtains this value fromPGROUP_POLICY_OBJECT->lpDSPath. The prefixLDAP://CN=Machine from lpDSPath should be stripped DisplayName GPO ID id +
� � � � H U string Description Unique identifier for objects of this class.
Note: Classes deriving from RSOP_PolicySetting must redefine 'id' as a key DisplayName ID name +
� � � � � � string Description User friendly name of this policy object DisplayName Name precedence +
� / 7 D � � uint32 Description The order or precedence in which this Policy Object is applied.The winning policy is contained in the Policy Object whose precedence is 1. Precedence greater that 1 means that the policy contained in this Policy Object is a conflicting value that did not 'win'.
Note: Classes deriving from RSOP_PolicySetting must redefine 'precedence' as a key DisplayName Precedence SOMID +
� � � � string Description The SOM associated with the GPLink that references the GPOthat contains this Policy Object. A client-side extensionobtains this value from PGROUP_POLICY_OBJECT->lpLink.The prefix LDAP:// from lpLink should be stripped DisplayName SOM � XuR|�C� ) ' � ��� � � g p � � � � � � U����������������������������� � RSoP_PolicySettingStatus Description The RSoP_PolicySettingStatus class provides information about a specific error that occured when trying to apply a policy setting. AMENDMENT LOCALE errorCode +
�
N [ uint32 Description A Win32 error code that indicates the actual failure. DisplayName Error Code eventID +
� � � � � uint32 Description A number that identifies the event in the event log. DisplayName Event ID eventLogName +
� R Z g � � string Description The name of the event log type where the event was logged. E.g. Application, System. DisplayName Event Log Name eventSource +
� ( 5 g t string Description The name of the source that generated the event. DisplayName Event Source eventTime e +
� � � � datetime Description The time at which the event was logged. DisplayName Time id 6
� a � ��i v � � string Description Unique ID. DisplayName ID status 8
� � � � B O k x sint32 Values ( 0 Unspecified Applied Ignored Failed SubsettingFailed Description The status of this setting DisplayName Status � YuR|�C�0 ) % ^ ��i q z & u��������� � RSoP_PolicySettingLink Description An association between a policy setting and its status. AMENDMENT LOCALE setting f 6
� � � ��� � ref:RSOP_PolicySetting Description Reference to the RSOP_PolicySetting DisplayName Setting status f 6
� j � ��� � � � ref:RSoP_PolicySettingStatus Description Reference to the RSoP_PolicySettingStatus DisplayName Status ng �tus ng �9 A B 5 3 8 0 6 E 8 8 6 6 5 C 0 4 7 8 2 4 D 5 3 6 9 B 2 7 1 C 5 3 B 2 3 3 B B E A C 7 C 1 5 B E 3 B A 9 B D 2 1 4 E 5 2 7 5 0 0 =�4 � ͝��C�n ��� D��� M � WMIBinaryMofResource C:\Windows\System32\drivers\ACPI.sys[ACPIMOFResource] UX�� �ٝ��C�� & ) + � �� � A E R b � � � @ Q � � � P o � � � V w � � # D � � � � ; _ � � � X w � � 9 v � � � $ 8 u � � � L � � �
D
b
�
�
- j � � � 8 N � � � � <
H
z
�
�
�
U j � � T r � � W n � � � U p � � " _ z � �
* g � � 5 r � � � > { � � O } � � 1 n � � � . UUUUUUUUUUUUUUUUU�������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������k � MDM_Policy_Config01_Update02 InPartition 3 local-system DMWmiBridgeProv ActiveHoursEnd '
� � � �� � �� sint32 ActiveHoursMaxRange '
� � � �� � �� sint32 ActiveHoursStart '
� 8 � �� � �� sint32 AllowAutoUpdate '
� � � �� � �� sint32 AllowAutoWindowsUpdateDownloadOverMeteredNetwork '
� � � �� � �� sint32 AllowMUUpdateService '
� H � �� � �� sint32 AllowNonMicrosoftSignedUpdate '
� � � �� � �� sint32 AllowUpdateService $ '
� � � �� � �� sint32 AutomaticMaintenanceWakeUp
( '
� N � �� � �� sint32 AutoRestartDeadlinePeriodInDays , '
� � � �� � �� sint32 AutoRestartDeadlinePeriodInDaysForFeatureUpdates 0 '
� � �� � �� sint32 AutoRestartNotificationSchedule
4 '
� y � �� � �� sint32 AutoRestartRequiredNotificationDismissal 8 '
� � � �� � �� sint32 BranchReadinessLevel < '
� 3 � �� � �� sint32 ConfigureDeadlineForFeatureUpdates @ '
� � � �� � �� sint32 ConfigureDeadlineForQualityUpdates D '
� � � �� � �� sint32 ConfigureDeadlineGracePeriod H '
� P � �� � �� sint32 ConfigureDeadlineNoAutoReboot L '
� � � �� � �� sint32 ConfigureFeatureUpdateUninstallPeriod P '
� � �� � �� sint32 DeferFeatureUpdatesPeriodInDays T '
� n � �� � �� sint32 DeferQualityUpdatesPeriodInDays X '
� � � �� � �� sint32 DeferUpdatePeriod \ '
� � �� � �� sint32 DeferUpgradePeriod ` '
� m � �� � �� sint32 DetectionFrequency d '
� � � �� � �� sint32 DisableDualScan h '
� � �� � �� sint32 DoNotEnforceEnterpriseTLSCertPinningForUpdateDetection $ � '
� � � �� � �� sint32 EngagedRestartDeadline l '
� � � �� � �� sint32 EngagedRestartDeadlineForFeatureUpdates p '
� <
� �� � �� sint32 EngagedRestartSnoozeSchedule t '
� �
� �� � �� sint32 EngagedRestartSnoozeScheduleForFeatureUpdates x '
� � �� � �� sint32 EngagedRestartTransitionSchedule | '
� b � �� � �� sint32 EngagedRestartTransitionScheduleForFeatureUpdates � '
� � � �� � �� sint32 ExcludeWUDriversInQualityUpdate ! � '
� 0 � �� � �� sint32 FillEmptyContentUrls " � '
� � � �� � �� sint32 IgnoreMOAppDownloadLimit ) � '
� � � �� � �� sint32 IgnoreMOUpdateDownloadLimit * � '
� 4
� �� � �� sint32 InstanceID
� r
� �� string ManagePreviewBuilds + � '
� �
� �� � �� sint32 ParentID
� � �� string PauseDeferrals , � '
� M � �� � �� sint32 PauseFeatureUpdates - � '
� � � �� � �� sint32 PauseFeatureUpdatesStartTime . � '
� � � �� � �� string PauseQualityUpdates / � '
� L � �� � �� sint32 PauseQualityUpdatesStartTime 0 � '
� � � �� � �� string PhoneUpdateRestrictions 1 � '
� � � �� � �� sint32 RequireDeferUpgrade 2 � '
� O � �� � �� sint32 RequireUpdateApproval 3 � '
� � � �� � �� sint32 ScheduledInstallDay 4 � '
� � � �� � �� sint32 ScheduledInstallEveryWeek 5 � '
� M � �� � �� sint32 ScheduledInstallFirstWeek 6 � '
� � � �� � �� sint32 ScheduledInstallFourthWeek 7 � '
� � � �� � �� sint32 ScheduledInstallSecondWeek 8 � '
� W � �� � �� sint32 ScheduledInstallThirdWeek 9 � '
� � � �� � �� sint32 ScheduledInstallTime : � '
� � �� � �� sint32 ScheduleImminentRestartWarning ; � '
� _ � �� � �� sint32 ScheduleRestartWarning < � '
� � � �� � �� sint32 SetAutoRestartNotificationDisable = � '
� � �� � �� sint32 SetDisablePauseUXAccess > � '
� j � �� � �� sint32 SetDisableUXWUAccess ? � '
� � � �� � �� sint32 SetEDURestart @ '
� � �� � �� sint32 SetPolicyDrivenUpdateSourceForDriverUpdates ' � '
� s � �� � �� sint32 SetPolicyDrivenUpdateSourceForFeatureUpdates % � '
� � � �� � �� sint32 SetPolicyDrivenUpdateSourceForOtherUpdates ( � '
� G � �� � �� sint32 SetPolicyDrivenUpdateSourceForQualityUpdates & � '
� � � �� � �� sint32 SetProxyBehaviorForUpdateDetection # � '
� � �� � �� sint32 TargetReleaseVersion A '
� f � �� � �� string UpdateNotificationLevel B '
� � � �� � �� sint32 UpdateServiceUrl C '
� � �� � �� string UpdateServiceUrlAlternate D '
� c � �� � �� string �ing �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �S����
͝��C�� $ ��픶� c � WDMClassesOfDriver IdleAccounting C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �S����
͝��C�� ' ��픶� f � WDMClassesOfDriver IdleStateBucketEx C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] ofResourceName] 4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 �S����
͝��C�� + ��픶� j � WDMClassesOfDriver IdleStateAccountingEx C:\Windows\system32\en-US\kernelbase.dll.mui[MofResourceName] ame] __ � __ � fault
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING a 3 � �
� MSFT_CliParam The NumForwardPackets parameter specifies the number of IP packet headers allocated for the router packet queue. This should be at least as large as the value of the ForwardBufferMemory property divided by the maximum IP data size of the networks connected to the router. It should be no larger than the ForwardBufferMemory value divided by 256, since at least 256 bytes of forward buffer memory are required by each packet. The optimal number of forward packets for a given ForwardBufferMemory size depends on the type of traffic carried on the network, and will be somewhere between these two values. If the router is disabled, this parameter is ignored and no headers are allocated. Valid Range: 1 - 0xFFFFFFFE. NumForwardPackets � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True UINT32 SetNumForwardPackets � � A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 � / ' � � MSFT_CliVerb SetTcpMaxConnectRetransmissions The SetTcpMaxConnectRetransmissions method is used to set the number of attempts TCP will retransmit a Connect Request before aborting. The initial retransmission timeout is 3 seconds and doubles for each attempt. SetTcpMaxConnectRetransmissions / � � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING 3 � � � � � MSFT_CliParam The TcpMaxConnectRetransmissions parameter specifies the number of attempts TCP will retransmit a connect request before aborting. Valid Range: 0 - 0xFFFFFFFF. TcpMaxConnectRetransmissions � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True UINT32 SetTcpMaxConnectRetransmissions � � A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 � , > - K � MSFT_CliVerb SetTcpMaxDataRetransmissions The SetTcpMaxDataRetransmissions method is used to set the number of times TCP will retransmit an individual data segment before aborting the connection. The retransmission timeout doubles with each successive retransmission on a connection. SetTcpMaxDataRetransmissions F � � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING 7 3 � � � � MSFT_CliParam The TcpMaxDataRetransmissions parameter specifies the number of times TCP will retransmit an individual data segment before aborting the connection. Valid Range: 0 - 0xFFFFFFFF. TcpMaxDataRetransmissions � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True UINT32 SetTcpMaxDataRetransmissions ~ � A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 � $ � � R h � MSFT_CliVerb SetTcpNumConnections The SetTcpNumConnections method is used to set the maximum number of connections that TCP may have open simultaneously. SetTcpNumConnections � � � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � 3 � � � � � MSFT_CliParam The TcpNumConnections parameter specifies the maximum number of connections that TCP may have open simultaneously. Valid Range: 0 - 0xFFFFFE. TcpNumConnections � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True UINT32 SetTcpNumConnections 1 � A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 6
- / N j � � MSFT_CliVerb SetTcpUseRFC1122UrgentPointer The SetTcpUseRFC1122UrgentPointer method is used to specify whether TCP uses the RFC 1122 specification for urgent data, or the mode used by Berkeley Software Design (BSD) derived systems. The two mechanisms interpret the urgent pointer in the TCP header and the length of the urgent data differently. They are not interoperable. Windows 2000 and Windows NT version 3.51 or higher defaults to BSD mode. The method returns an integer value of 0 on successful completion, and any other number to indicate an error. SetTcpUseRFC1122UrgentPointer V � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING d 3 � � � MSFT_CliParam The TcpUseRFC1122UrgentPointer parameter specifies whether TCP uses the RFC 1122 specification or the mode used by BSD-derived systems, for urgent data. If TRUE, urgent data is sent in RFC 1122 mode. TcpUseRFC1122UrgentPointer � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True BOOLEAN SetTcpUseRFC1122UrgentPointer b � A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 g * < � � � MSFT_CliVerb SetTcpWindowSize The SetTcpWindowSize method is used to set the maximum TCP Receive Window size offered by the system. The Receive Window specifies the number of bytes a sender can transmit without receiving an acknowledgment. In general, larger receive windows improve performance over high delay and high bandwidth networks. For efficiency, the receive window should be an even multiple of the TCP Maximum Segment Size (MSS). The method returns an integer value of 0 on successful completion, and any other number to indicate an error. SetTcpWindowSize D e � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � 3 � � � � � MSFT_CliParam The TcpWindowSize parameter specifies the maximum TCP receive window size offered by the system. Valid Range: 0 - 65535. TcpWindowSize � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True UINT16 SetTcpWindowSize P � A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 U
! � � � � MSFT_CliVerb EnableIPFilterSec The EnableIPFilterSec method is used to enable IP security globally across all IP-bound network adapters. With security enabled, the operational security characteristics for any single network adapter can be controlled using the network adapter specific EnableIPSec method. The EnableIPFilterSec method returns an integer value of 0 on successful completion, a 1 when a reboot is required, and any other value to indicate an error. EnableIPFilterSec � � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING U 3 R k � � � MSFT_CliParam The IPFilterSecurityEnabled parameter specifies whether IP security is enabled globally across all IP-bound network adapters. If the input parameter IPFilterSecurityEnabled is TRUE, security is enabled. If the input parameter IPFilterSecurityEnabled is FALSE, all port and protocol traffic are allowed to flow unfiltered. IPFilterSecurityEnabled s � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True BOOLEAN EnableIPFilterSec ˎ F D 3 B B D 4 C 4 2 A C 2 F 7 F E F 2 6 4 3 4 0 A 9 E B 7 8 A 5 8 1 F E 5 C 2 8 5 6 1 C B 6 3 E D F 7 8 0 B 3 2 9 E A C 2 E E 4 !�b��5��͝��C�;� � + � ɍ Ӎ � � � MSFT_CliAlias � F N u � � � � �
U�������������������������4 � MSFT_CliConnection Authority
� > STRING Locale
� m STRING NameSpace
� � STRING Password
� � STRING Server
� � STRING User
� , STRING | � ( + � MSFT_CliConnection ms_409 ROOT\CIMV2 . The Win32_NTDomain class represents a NT Domain. A domain is a single security boundary of a Windows NT computer network. Active Directory is made up of one or more domains. On a standalone workstation, the domain is the computer itself. A domain can span more than one physical location. Every domain has its own security policies and security relationships with other domains. When multiple domains are connected by trust relationships and share a common schema, configuration, and global catalog, you have a domain tree. Multiple domain trees can be connected together into a forest. All the domains in a forest also share a common schema, configuration, and global catalog. � �$ *J (u yx ܀ �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty & � � MSFT_CliFormat INSTANCE " w 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier = � � � � MSFT_CliProperty DomainName The DomainName property indicates the name of the domain. The DNS-style name (for example, microsoft.com.) will be returned if available. DomainName s �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � + � MSFT_CliFormat SYSTEM
D � � U � b
�
x � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty __CLASS __CLASS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __DERIVATION __DERIVATION � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __DYNASTY __DYNASTY � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty __GENUS __GENUS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier t � , � MSFT_CliProperty __NAMESPACE __NAMESPACE � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o � " � MSFT_CliProperty __PATH __PATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier y � $ 6 � MSFT_CliProperty __PROPERTY_COUNT __PROPERTY_COUNT � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __RELPATH __RELPATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier q � & � MSFT_CliProperty __SERVER __SERVER � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __SUPERCLASS __SUPERCLASS �% �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty �$ R � MSFT_CliFormat STATUS $ � � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � � � MSFT_CliProperty Status The Status property is a string indicating the current status of the object. Various operational and non-operational statuses can be defined. Operational statuses are "OK", "Degraded" and "Pred Fail". "Pred Fail" indicates that an element may be functioning properly but predicting a failure in the near future. An example is a SMART-enabled hard drive. Non-operational statuses can also be specified. These are "Error", "Starting", "Stopping" and "Service". The latter, "Service", could apply during mirror-resilvering of a disk, reload of a user permissions list, or other administrative work. Not all such work is on-line, yet the managed element is neither "OK" nor in one of the other states. Status � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 10 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING ` � � MSFT_CliQualifier ValueMap Q U \ f o z � � � � � � OK Error Degraded Unknown Pred Fail Starting Stopping Service Stressed NonRecover No Contact Lost Comm � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING Q � � MSFT_CliQualifier Values O S Z d m x � � � � � � OK Error Degraded Unknown Pred Fail Starting Stopping Service Stressed NonRecover No Contact Lost Comm w 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier = � � � � MSFT_CliProperty DomainName The DomainName property indicates the name of the domain. The DNS-style name (for example, microsoft.com.) will be returned if available. DomainName �* �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty * �& � MSFT_CliFormat TABLE BRIEF F x T � - �
� y � . 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � " ] m � MSFT_CliProperty ClientSiteName The ClientSiteName property indicates the name of the site where the domain controller is configured to be in. This value may be NULL if the site that the computer named by ComputerName cannot be found (for example, if the DS administrator has not associated the subnet that the computer is in with a valid site). ClientSiteName � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � MSFT_CliProperty DcSiteName The DcSiteName property indicates the name of the site where the domain controller is located. This value may be NULL if the domain controller is not in a site (for example, the domain controller is a Windows NT 4.0 domain controller). DcSiteName 6 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � h u � MSFT_CliProperty Description The Description property provides a textual description of the object. Description � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier a � ! � � � MSFT_CliProperty DnsForestName The DnsForestName property indicates the name of the domain at the root of the DS tree. The DNS-style name (for example, microsoft.com.) will be returned if available. DnsForestName f 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier , � + � � � MSFT_CliProperty DomainControllerAddress The DomainControllerAddress property indicates the address of the discovered domain controller. DomainControllerAddress c 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier ) � ( � � � MSFT_CliProperty DomainControllerName The DomainControllerName property indicates the computer name of the discovered domain controller. DomainControllerName w 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier = � � � � MSFT_CliProperty DomainName The DomainName property indicates the name of the domain. The DNS-style name (for example, microsoft.com.) will be returned if available. DomainName p 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier 6 � � � � MSFT_CliProperty Roles An array (bag) of strings that specify the roles this System plays in the IT-environment. Subclasses of System may override this property to define explicit Roles values. Alternately, a Working Group may describe the heuristics, conventions and guidelines for specifying Roles. For example, for an instance of a networking system, the Roles property might contain the string, 'Switch' or 'Bridge'. Roles � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � � � MSFT_CliProperty Status The Status property is a string indicating the current status of the object. Various operational and non-operational statuses can be defined. Operational statuses are "OK", "Degraded" and "Pred Fail". "Pred Fail" indicates that an element may be functioning properly but predicting a failure in the near future. An example is a SMART-enabled hard drive. Non-operational statuses can also be specified. These are "Error", "Starting", "Stopping" and "Service". The latter, "Service", could apply during mirror-resilvering of a disk, reload of a user permissions list, or other administrative work. Not all such work is on-line, yet the managed element is neither "OK" nor in one of the other states. Status � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 10 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING ` � � MSFT_CliQualifier ValueMap Q U \ f o z � � � � � � OK Error Degraded Unknown Pred Fail Starting Stopping Service Stressed NonRecover No Contact Lost Comm � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING Q � � MSFT_CliQualifier Values O S Z d m x � � � � � � OK Error Degraded Unknown Pred Fail Starting Stopping Service Stressed NonRecover No Contact Lost Comm M �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty Z � � MSFT_CliFormat LIST FULL $ � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier s � * � MSFT_CliProperty DomainGuid DomainGuid _ �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty l N � MSFT_CliFormat GUID " � w 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier = � � � � MSFT_CliProperty DomainName The DomainName property indicates the name of the domain. The DNS-style name (for example, microsoft.com.) will be returned if available. DomainName � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier s � * � MSFT_CliProperty DomainGuid DomainGuid � �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � l � MSFT_CliFormat WRITEABLE # E 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier
� � � MSFT_CliProperty Roles An array (bag) of strings that specify the roles this System plays in the IT-environment. Subclasses of System may override this property to define explicit Roles values. Alternately, a Working Group may describe the heuristics, conventions and guidelines for specifying Roles. For example, for an instance of a networking system, the Roles property might contain the string, 'Switch' or 'Bridge'. Roles � � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING j , � MSFT_CliQualifier CIMTYPE $ string � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING g ' � MSFT_CliQualifier read ! True � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING h ( � MSFT_CliQualifier write " True NTDOMAIN WHERE DomainName='#' Select * from Win32_NTDomain M �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty Z � � MSFT_CliFormat LIST FULL $ � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier s � * � MSFT_CliProperty DomainGuid DomainGuid _ �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty l N � MSFT_CliFormat GUID " � w 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier = � � � � MSFT_CliProperty DomainName The DomainName property indicates the name of the domain. The DNS-style name (for example, microsoft.com.) will be returned if available. DomainName � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier s � * � MSFT_CliProperty DomainGuid DomainGuid �~ F D 3 B B D 4 C 4 2 A C 2 F 7 F E F 2 6 4 3 4 0 A 9 E B 7 8 A 5 8 1 F E 5 C 2 8 5 6 1 C B 6 3 E D F 7 8 0 B 3 2 9 E A C 2 E E 4 "�b��5��͝��C�U~ � + l �} �} ~ !~ � MSFT_CliAlias � F N u � � � � �
U�������������������������4 � MSFT_CliConnection Authority
� > STRING Locale
� m STRING NameSpace
� � STRING Password
� � STRING Server
� � STRING User
� , STRING | � ( + � MSFT_CliConnection ms_409 ROOT\CIMV2 . This class is used to translate instances from the NT Eventlog. � � F! = K �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty X � � MSFT_CliFormat INSTANCE " � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o � " � MSFT_CliProperty __PATH __PATH s �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � + � MSFT_CliFormat SYSTEM
D � � U � b
�
x � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty __CLASS __CLASS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __DERIVATION __DERIVATION � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __DYNASTY __DYNASTY � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty __GENUS __GENUS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier t � , � MSFT_CliProperty __NAMESPACE __NAMESPACE � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o � " � MSFT_CliProperty __PATH __PATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier y � $ 6 � MSFT_CliProperty __PROPERTY_COUNT __PROPERTY_COUNT � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __RELPATH __RELPATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier q � & � MSFT_CliProperty __SERVER __SERVER � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __SUPERCLASS __SUPERCLASS � �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � � � MSFT_CliFormat TABLE BRIEF : � m � / � � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier c � # � � � MSFT_CliProperty EventIdentifier Identifies the event. This is specific to the source that generated the event log entry, and is used, together with SourceName, to uniquely identify an NT event type. EventIdentifier � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier T M X � MSFT_CliProperty EventType The Type property specifies the type of event. TypeEvent d � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING k D � MSFT_CliQualifier ValueMap 5 8 ; > A 1 2 3 4 5 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values 3 : C P h error warning information security audit success security audit failure 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � P Y � MSFT_CliProperty Message The event message as it appears in the NT Eventlog. Message � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier f � � � � MSFT_CliProperty RecordNumber Identifies the event within the NT Eventlog logfile. This is specific to the logfile and is used together with the logfile name to uniquely identify an instance of this class. RecordNumber } 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier C � � � � MSFT_CliProperty SourceName The variable-length null-terminated string specifying the name of the source (application, service, driver, subsystem) that generated the entry. SourceName . 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � ! ^ m � MSFT_CliProperty TimeGenerated Specifies the time at which the source generated the event. TimeGenerated �@ �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty �? �* � MSFT_CliFormat LIST FULL ` � � � A �
{
L � A � � (" �( 5 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � j t � MSFT_CliProperty Category Specifies a subcategory for this event. This subcategory is source specific. Category F 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � " u � � MSFT_CliProperty CategoryString Specifies the translation of the subcategory. The translation is source specific. CategoryString � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � > L � MSFT_CliProperty ComputerName Specifies the computer name. ComputerName � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier m � ) / � MSFT_CliProperty Data The event data. Data � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier F � � � � MSFT_CliProperty EventCode This property has the value of the lower 16-bits of the EventIdentifier property. It is present to match the value displayed in the NT Event Viewer. EventCode � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier x � # ; L � MSFT_CliProperty EventIdentifier Identifies the event. EventIdentifier � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier T M X � MSFT_CliProperty EventType The Type property specifies the type of event. TypeEvent d � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING k D � MSFT_CliQualifier ValueMap 5 8 ; > A 1 2 3 4 5 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values 3 : C P h error warning information security audit success security audit failure ; 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � $ h z � MSFT_CliProperty InsertionStrings The insertion strings that accompanied the report of the NT event. InsertionStrings � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � = F � MSFT_CliProperty Logfile The name of NT Eventlog logfile. LogFile 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � P Y � MSFT_CliProperty Message The event message as it appears in the NT Eventlog. Message % 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � V d � MSFT_CliProperty RecordNumber Identifies the event within the NT Eventlog logfile. RecordNumber } 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier C � � � � MSFT_CliProperty SourceName The variable-length null-terminated string specifying the name of the source (application, service, driver, subsystem) that generated the entry. SourceName . 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � ! ^ m � MSFT_CliProperty TimeGenerated Specifies the time at which the source generated the event. TimeGenerated 0 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � b o � MSFT_CliProperty TimeWritten Specifies the time at which the event was written to the logfile. TimeWritten � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier W S Y
� MSFT_CliProperty Type Specifies the type of event. This is an enumerated string Type e � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING k E � MSFT_CliQualifier ValueMap 5 8 ; > A 1 2 4 8 16 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � n � MSFT_CliQualifier Values 3 : C P _ error warning information audit success audit failure 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � U _ � MSFT_CliProperty User The user name of the logged on user when the event ocurred. UserName NTEvent WHERE EventType=# Select * from Win32_NTLogEvent � F D 3 B B D 4 C 4 2 A C 2 F 7 F E F 2 6 4 3 4 0 A 9 E B 7 8 A 5 8 1 F E 5 C 2 8 5 6 1 C B 6 3 E D F 7 8 0 B 3 2 9 E A C 2 E E 4 #�b��5��͝��C�S + J % < ` � MSFT_CliAlias � F N u � � � � �
U�������������������������4 � MSFT_CliConnection Authority
� > STRING Locale
� m STRING NameSpace
� � STRING Password
� � STRING Server
� � STRING User
� , STRING | � ( + � MSFT_CliConnection ms_409 ROOT\CIMV2 . NT eventlog file management. f f% .5 �P �S �� �" �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty " � � MSFT_CliFormat STATUS ( � � � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � * � MSFT_CliProperty Status The Status property is a string indicating the current status of the object. Various operational and non-operational statuses can be defined. Operational statuses are "OK", "Degraded" and "Pred Fail". "Pred Fail" indicates that an element may be functioning properly but predicting a failure in the near future. An example is a SMART-enabled hard drive. Non-operational statuses can also be specified. These are "Error", "Starting", "Stopping" and "Service". The latter, "Service", could apply during mirror-resilvering of a disk, reload of a user permissions list, or other administrative work. Not all such work is on-line, yet the managed element is neither "OK" nor in one of the other states. Status � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 10 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap A E L V _ j t ~ OK Error Degraded Unknown Pred Fail Starting Stopping Service � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values ? C J T ] h r | OK Error Degraded Unknown Pred Fail Starting Stopping Service � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier t � , � MSFT_CliProperty LogfileName LogfileName 4 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � m s � MSFT_CliProperty Name The Name property serves as a key of a logical file instance within a file system. Name � �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � � MSFT_CliFormat table BRIEF 2 ` J * 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � _ i � MSFT_CliProperty FileSize The FileSize property represents the size of the file (in bytes). FileSize � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier t � , � MSFT_CliProperty LogfileName LogfileName 4 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � m s � MSFT_CliProperty Name The Name property serves as a key of a logical file instance within a file system. Name � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier x � # 4 � MSFT_CliProperty NumberOfRecords NumberOfRecords s �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty � + � MSFT_CliFormat SYSTEM
D � � U � b
�
x � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty __CLASS __CLASS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __DERIVATION __DERIVATION � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __DYNASTY __DYNASTY � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty __GENUS __GENUS � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier t � , � MSFT_CliProperty __NAMESPACE __NAMESPACE � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o � " � MSFT_CliProperty __PATH __PATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier y � $ 6 � MSFT_CliProperty __PROPERTY_COUNT __PROPERTY_COUNT � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier r � ( � MSFT_CliProperty __RELPATH __RELPATH � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier q � & � MSFT_CliProperty __SERVER __SERVER � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier u � . � MSFT_CliProperty __SUPERCLASS __SUPERCLASS P �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty ] � � MSFT_CliFormat INSTANCE " � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier t � , � MSFT_CliProperty LogfileName LogfileName Ε �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty ۔ gM � MSFT_CliFormat list FULL � 6 u � � ` � Z � � - [ � ! �# �% %( �) , �- g0 2 �3 �9 �; 3> �? �F I (K � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier \ � � � � MSFT_CliProperty AccessMask The AccessMask property is a bit array representing the access rights to the given file or directory held by the user or group on whose behalf the instance is returned. AccessMask ; 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � q z � MSFT_CliProperty Archive The Archive property is a boolean value indicating that the file should be archived. Archive 6 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � h u � MSFT_CliProperty Description The Description property provides a textual description of the object. Description ? 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � w ~ � MSFT_CliProperty Drive The Drive property is a string representing the drive letter (including colon) of the file. Drive j 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier 0 � ) � � � MSFT_CliProperty EightDotThreeFileName The EightDotThreeFileName property is a string representing the DOS-compatible file name for this file. EightDotThreeFileName ; 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � o z � MSFT_CliProperty Encrypted The Encrypted property is a boolean value indicating that the file is encrypted. Encrypted p 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier 6 � $ � � � MSFT_CliProperty EncryptionMethod The EncryptionMethod property is a free form string indicating the algorithm or tool used to encrypt the logical file. EncryptionMethod C 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � w � � MSFT_CliProperty Extension The Extension property is a string representing the file's extension (without the dot). Extension F 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � { � � MSFT_CliProperty FileName The FileName property is a string representing the filename (without extension) of the file. FileName * 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � _ i � MSFT_CliProperty FileSize The FileSize property represents the size of the file (in bytes). FileSize W 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � � MSFT_CliProperty FileType The FileType property is a string descriptor representing the file type (indicated by the Extension property). FileType * 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � a i � MSFT_CliProperty FSName The FSName property is string indicating the name of the file system. FSName - 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � d l � MSFT_CliProperty Hidden The Hidden property is a boolean value indicating if the file is hidden. Hidden � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier O � � � � MSFT_CliProperty InstallDate The InstallDate property is datetime value indicating when the object was installed. A lack of a value does not indicate that the object is not installed. InstallDate d 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier * � � � � MSFT_CliProperty InUseCount The InUseCount property is an integer indicating the number of 'file opens' that are currently active against the file. InUseCount N 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � MSFT_CliProperty LastAccessed The LastAccessed property is a datetime value indicating the time the file was last accessed. LastAccessed N 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � � MSFT_CliProperty LastModified The LastModified property is a datetime value indicating the time the file was last modified. LastModified � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier t � , � MSFT_CliProperty LogfileName LogfileName - 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � ^ l � MSFT_CliProperty Manufacturer Manufacturer string from version resource if one is present. Manufacturer � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier t � , � MSFT_CliProperty MaxFileSize MaxFileSize � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier o � � � � MSFT_CliProperty Name The Name property is a string representing the inherited name that serves as a key of a logical file instance within a file system. Full path names should be provided. Example: c:\winnt\system\win.ini Name � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier x � # 4 � MSFT_CliProperty NumberOfRecords NumberOfRecords � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier z � % 8 � MSFT_CliProperty OverwriteOutDated OverwriteOutDated � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier x # 4 x � MSFT_CliProperty OverWritePolicy OverWritePolicy @ ] � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING k D � MSFT_CliQualifier ValueMap - 0 8 0 1..365 4294967295 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i H � MSFT_CliQualifier Values + 7 A WhenNeeded OutDated Never k 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier 1 � � � � MSFT_CliProperty Path The Path property is a string representing the path of the file. This includes leading and trailing backslashes. Example: \windows\system\ Path 5 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � j t � MSFT_CliProperty Readable The Readable property is a boolean value indicating if the file can be read. Readable � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier p � $ � MSFT_CliProperty Sources Sources � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � i q � � MSFT_CliProperty Status The Status property is a string indicating the current status of the object. Status � � / � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING i ' � MSFT_CliQualifier MaxLen # 10 � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier ValueMap A E L V _ j t ~ OK Error Degraded Unknown Pred Fail Starting Stopping Service � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING � � � MSFT_CliQualifier Values ? C J T ] h r | OK Error Degraded Unknown Pred Fail Starting Stopping Service 4 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � k s � MSFT_CliProperty System The system property is a boolean value indicating if the file is a system file. System 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � � T ] � MSFT_CliProperty Version Version string from version resource if one is present. Version ; 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier � o z � MSFT_CliProperty Writeable The Writeable property is a boolean value indicating if the file can be written. Writeable & C I M _ E n a b l e d L o g i c a l E l e m e n t \ҝ��C�� � # CIM_EnabledLogicalElement 6 �� & - 5 ; c { � � . A � � � � \ n � � � � � � U r @ Z � � r
~
s �
� � ���^UUU���������������������������������� ���� ����������������������������������������������������������������������������?
� CIM_LogicalDevice Abstract Version 2.8.0 Locale UUID {220b1188-a358-4be7-aa64-13f8033eb07a} AdditionalAvailability l +
� � � � i ~ uint16 ValueMap ! $ ' * - 0 3 6 9 = A E I M Q U Y ] a e 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 ModelCorrespondence � CIM_LogicalDevice.Availability Availability F E
� � � ] m � � uint16 Deprecated + \ � CIM_AssociatedPowerManagementService.PowerState CIM_ManagedSystemElement.OperationalStatus CIM_EnabledLogicalElement.EnabledState ValueMap ! $ ' * - 1 5 9 = A E I M Q U Y 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 MappingStrings } � � MIF.DMTF|Operational State|006.5 MIB.IETF|HOST-RESOURCES-MIB.hrDeviceStatus MIF.DMTF|Host Device|001.5 ModelCorrespondence CIM_LogicalDevice.AdditionalAvailability CreationClassName 8 )
� x � ��� string MaxLen DeviceID < )
� � � ��� @ string MaxLen ErrorCleared R
� ( boolean Deprecated 0 CIM_ManagedSystemElement.OperationalStatus ErrorDescription N
� � � � string Deprecated � CIM_DeviceErrorData.ErrorDescription IdentifyingDescriptions h +
� . 6 A J _ string ArrayType Indexed ModelCorrespondence g CIM_LogicalDevice.OtherIdentifyingInfo LastErrorCode J
� � � � uint32 Deprecated � CIM_DeviceErrorData.LastErrorCode MaxQuiesceTime p +
� R Z f x uint64 Deprecated n No value Units MilliSeconds OtherIdentifyingInfo T 8
� � � �
" string MaxLen ArrayType Indexed ModelCorrespondence * CIM_LogicalDevice.IdentifyingDescriptions PowerManagementCapabilities B +
� � � � � uint16 Deprecated � CIM_PowerManagementCapabilities.PowerCapabilities ValueMap ( + . 1 4 7 : = 0 1 2 3 4 5 6 7 PowerManagementSupported @
� � � � boolean Deprecated � CIM_PowerManagementCapabilities PowerOnHours X 6
�
*
[
b
i
�� uint64 Deprecated 2
CIM_PoweredStatisticalData.PowerOnHours Units Hours Counter StatusInfo H 8
� �
�
�
9 I uint16 Deprecated �
CIM_EnabledLogicalElement.EnabledState ValueMap * - 0 3 6 1 2 3 4 5 MappingStrings Q MIF.DMTF|Operational State|006.4 SystemCreationClassName 0 6
� � � ��� � string Propagated CIM_System.CreationClassName MaxLen SystemName 4 6
� Z � ��b n string Propagated CIM_System.Name MaxLen TotalPowerOnHours ` 6
� � � � (
/
6
�� uint64 Deprecated � CIM_PoweredStatisticalData.TotalPowerOnHours Units Hours Counter ^ � e l p t � U U �
�
6 3
� � � � � � ~ � � � d � SetPowerState , Deprecated 4 CIM_PowerManagementService.SetPowerState � ae442007200009F ROOT\Hardware ���� � �- �� * � \ � ������� � __PARAMETERS abstract PowerState uint16
� 6 IN
� 6 ] �� � � � � � � 1 2 3 4 5 6 ValueMap )
� 6 ] ��� � ID 6
� B ] ��� � � uint16 e Time datetime e
� b IN e
� b � �� ID e )
� � � ��� datetime __ �| ae442007200009F ROOT\Hardware ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � Reset | ae442007200009F ROOT\Hardware ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � EnableDevice Deprecated ' CIM_EnabledLogicalElement.RequestStateChange � ae442007200009F ROOT\Hardware ���� � �� �� * � ��� � __PARAMETERS abstract Enabled boolean
� 3 IN
� 3 [ �� ID )
� � [ ��� boolean __ �| ae442007200009F ROOT\Hardware ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � OnlineDevice �
Deprecated CIM_EnabledLogicalElement.RequestStateChange � ae442007200009F ROOT\Hardware ���� � �� �� * � ��� � __PARAMETERS abstract Online boolean
� 2 IN
� 2 Z �� ID )
� � Z ��� boolean __ �| ae442007200009F ROOT\Hardware ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � QuiesceDevice � � Deprecated � CIM_EnabledLogicalElement.RequestStateChange � ae442007200009F ROOT\Hardware ���� � �� �� * � ��� � __PARAMETERS abstract Quiesce boolean
� 3 IN
� 3 [ �� ID )
� � [ ��� boolean __ �| ae442007200009F ROOT\Hardware ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � SaveProperties � � Deprecated � CIM_ConfigurationData.ConfigurationInformation | ae442007200009F ROOT\Hardware ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � RestoreProperties � � Deprecated � CIM_ConfigurationData.ApplyConfiguration | ae442007200009F ROOT\Hardware ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ �47709ECAB1D7F037756AC8CE7 I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1164.1209647730.368 KI_64659AB9F8F1C4B568DB6438BAE11B26EE8F93CB5F8195E21E8C383D6C44CC41 I_724155B2CA7FBBC304551F8A171392C3CA07A2D9AD12D47C6D2D987EFBFD727B.1164.1613626581.187 I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1164.1769139781.180 NS_FAD236DC88D4A39D9B808B598227AC32F45800A0F09FB4E10AAE80BE63A63AD1 CD_229F3CD4638E22D422843A148AD2ADA2C95B3802ED7FA9E6E4113BE6A1D690E2.1166.1306034966.1049 CD_3CDC4183D44F52048CE0039132A93204204F5A3326DCB27DE7954C1D3930FD11.1166.1101029878.318 CD_49777012274A486E8E2DA653CCC9FE3C0BAFC8CB49FF0E373F8540A5B458A655.1167.4081882368.3715 CD_8348E5895FE4B45964F288F6208DF14CD383D0A357608E0BFF28F226F0190D45.1166.2698031722.1603 CD_94250441BCE05715192D37120EDEE5CCA50FD2B2134EFE3C9E35BB834F26457D.1166.2883001541.3667 CD_BC8A5D3527D1BDCB19AA2B963526E673CF7D0B41B579C91C1089F6FC06405DFC.1164.3051673611.413 CD_ED6C3A2F6CC04DF3DD2F991B72C978A94559E5D3850ACCDF521D9DB88CF8E809.1166.4168789395.698 IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1165.213390791.368 CI_57E5F3ADD9E242C4E9F9EDF79AA97F79E7911C5A8B902EC150D6442E3B85A5AA IL_59543DA79A0A83C48BB9222B5916E17BBA9A5688C362D35DD3F13589A2596294.1060.2213083100.328 CI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD IL_9F79CC9E07BFC5EC416BFC61E17D76D6387C16B055C0398D995353255C542258.1154.3304675761.247 CI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C IL_9F79CC9E07BFC5EC416BFC61E17D76D6387C16B055C0398D995353255C542258.1086.3673822206.271 IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1165.3476372172.180 CR_229F3CD4638E22D422843A148AD2ADA2C95B3802ED7FA9E6E4113BE6A1D690E2 C_ED6C3A2F6CC04DF3DD2F991B72C978A94559E5D3850ACCDF521D9DB88CF8E809 CR_3CDC4183D44F52048CE0039132A93204204F5A3326DCB27DE7954C1D3930FD11 C_94250441BCE05715192D37120EDEE5CCA50FD2B2134EFE3C9E35BB834F26457D CR_8348E5895FE4B45964F288F6208DF14CD383D0A357608E0BFF28F226F0190D45 C_3CDC4183D44F52048CE0039132A93204204F5A3326DCB27DE7954C1D3930FD11 CR_94250441BCE05715192D37120EDEE5CCA50FD2B2134EFE3C9E35BB834F26457D C_229F3CD4638E22D422843A148AD2ADA2C95B3802ED7FA9E6E4113BE6A1D690E2 CR_BC8A5D3527D1BDCB19AA2B963526E673CF7D0B41B579C91C1089F6FC06405DFC C_8348E5895FE4B45964F288F6208DF14CD383D0A357608E0BFF28F226F0190D45 CR_E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 C_BC8A5D3527D1BDCB19AA2B963526E673CF7D0B41B579C91C1089F6FC06405DFC I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1165.213390791.368 KI_7010B213179D98B16AF38723EE1D750E86F808F341EE215AD8783D29EA117262 IR_59543DA79A0A83C48BB9222B5916E17BBA9A5688C362D35DD3F13589A2596294 R_241ED574CEA1CE45C178048218C62F092191B3FEDB2EDBBB00DA39363C5BD5B2.1164.4042741439.526 R_DA290273C5C5246EBD4AD92A0C51323EC9F3405D662C9D949CD09183391AA1F8.1151.2082543601.530 I_59543DA79A0A83C48BB9222B5916E17BBA9A5688C362D35DD3F13589A2596294.1060.2213083100.328 KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD I_9F79CC9E07BFC5EC416BFC61E17D76D6387C16B055C0398D995353255C542258.1154.3304675761.247 KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C I_9F79CC9E07BFC5EC416BFC61E17D76D6387C16B055C0398D995353255C542258.1086.3673822206.271 I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1165.3476372172.180 C_49777012274A486E8E2DA653CCC9FE3C0BAFC8CB49FF0E373F8540A5B458A655 CD_878D5D30666EBFE440F941E45E7884E8AFCA7A1478E4D09AB57DC26571C8B7A6.1167.1104238718.272 C_878D5D30666EBFE440F941E45E7884E8AFCA7A1478E4D09AB57DC26571C8B7A6 CD_3D10A0A77CAA5B54D6D0F826577C9C9001B09013C6D023D93A420AB24027FBBB.1167.377069244.348 � 9�0 h �X� i r��a � +z��� " ^�� Y U�x}l
Z \��}� � Sm��
4 vij�� h B�<X i ��!�� � �h�� ( Ls�� ^ 4�^;9 _ X#�� � � xߐ : �2��� m ��k7 � B i d 2 E t w _ M S D A S Q L _ 1 _ T r a c e �ҝ��C�" ! Bid2Etw_MSDASQL_1_Trace C � �� , L W f m u � � � u��������� � Bid2Etw_MSDASQL_1_Trace_TextA Description MSDASQL_1 formatted output (A) EventType EventTypeName TextA locale MS\0x409 ModID 6
� � � � � � �� uint32 WmiDataId Description Module ID msgStr
C
� N V a n | � � �� object WmiDataId Description Text StringA extension RString ID � B i d 2 E t w _ M S D A S Q L _ 1 _ T r a c e �ҝ��C�# ! Bid2Etw_MSDASQL_1_Trace C � �� , L W f m u � � � u��������� � Bid2Etw_MSDASQL_1_Trace_TextW Description MSDASQL_1 formatted output (W) EventType EventTypeName TextW locale MS\0x409 ModID 6
� � � � � � �� uint32 WmiDataId Description Module ID msgStr
C
� N V a n | � � �� object WmiDataId Description Text StringW extension RWString �
E v e n t T r a c e �ҝ��C�� EventTrace 6 � �� % + S [ e � Bid2Etw_ODBC_1 Description ODBC.1 Guid {F34765F6-A1BE-4B9D-1400-B8A12921F704} locale MS\0x409 B � B i d 2 E t w _ O D B C _ 1 �ҝ��C�� Bid2Etw_ODBC_1 C � �� # + 1 Y f l t ~ � Bid2Etw_ODBC_1_Trace Description ODBC.1 Guid {F34765F7-A1BE-4B9D-1400-B8A12921F704} DisplayName ODBC locale MS\0x409 � B i d 2 E t w _ O D B C _ 1 _ T r a c e �ҝ��C� Bid2Etw_ODBC_1_Trace C � �� ) F Q ` g o y � � � u��������� � Bid2Etw_ODBC_1_Trace_TextA Description ODBC.1 formatted output (A) EventType EventTypeName TextA locale MS\0x409 ModID 6
� � � � � � �� uint32 WmiDataId Description Module ID msgStr
C
� H P [ h v � � �� object WmiDataId Description Text StringA extension RString r � B i d 2 E t w _ O D B C _ 1 _ T r a c e �ҝ��C� Bid2Etw_ODBC_1_Trace C � �� ) F Q ` g o y � � � u��������� � Bid2Etw_ODBC_1_Trace_TextW Description ODBC.1 formatted output (W) EventType EventTypeName TextW locale MS\0x409 ModID 6
� � � � � � �� uint32 WmiDataId Description Module ID msgStr
C
� H P [ h v � � �� object WmiDataId Description Text StringW extension RWString
�
E v e n t T r a c e �ҝ��C�� EventTrace 6 � �� + 1 Y a k � Bid2Etw_ODBCBCP_1 Description ODBCBCP.1 Guid {932B59F1-90C2-D8BA-0956-3975C344AE2B} locale MS\0x409 B � B i d 2 E t w _ O D B C B C P _ 1 ӝ��C�� Bid2Etw_ODBCBCP_1 C � �� & 1 7 _ l u } � � Bid2Etw_ODBCBCP_1_Trace Description ODBCBCP.1 Guid {932B59F2-90C2-D8BA-0956-3975C344AE2B} DisplayName ODBCBCP locale MS\0x409 � B i d 2 E t w _ O D B C B C P _ 1 _ T r a c e ӝ��C�" ! Bid2Etw_ODBCBCP_1_Trace C � �� , L W f m u � � � u��������� � Bid2Etw_ODBCBCP_1_Trace_TextA Description ODBCBCP.1 formatted output (A) EventType EventTypeName TextA locale MS\0x409 ModID 6
� � � � � � �� uint32 WmiDataId Description Module ID msgStr
C
� N V a n | � � �� object WmiDataId Description Text StringA extension RString ID � B i d 2 E t w _ O D B C B C P _ 1 _ T r a c e ӝ��C�# ! Bid2Etw_ODBCBCP_1_Trace C � �� , L W f m u � � � u��������� � Bid2Etw_ODBCBCP_1_Trace_TextW Description ODBCBCP.1 formatted output (W) EventType EventTypeName TextW locale MS\0x409 ModID 6
� � � � � � �� uint32 WmiDataId Description Module ID msgStr
C
� N V a n | � � �� object WmiDataId Description Text StringW extension RWString �
E v e n t T r a c e ӝ��C�� EventTrace 6 � �� ' - U ] g � Bid2Etw_OLEDB_1 Description OLEDB.1 Guid {0DD082C4-66F2-271F-74BA-2BF1F9F65C66} locale MS\0x409 B � B i d 2 E t w _ O L E D B _ 1 ӝ��C�� Bid2Etw_OLEDB_1 C � �� $ - 3 [ h o w � � Bid2Etw_OLEDB_1_Trace Description OLEDB.1 Guid {0DD082C5-66F2-271F-74BA-2BF1F9F65C66} DisplayName OLEDB locale MS\0x409 � B i d 2 E t w _ O L E D B _ 1 _ T r a c e ӝ��C� Bid2Etw_OLEDB_1_Trace C � �� * H S b i q { � � � u��������� � Bid2Etw_OLEDB_1_Trace_TextA Description OLEDB.1 formatted output (A) EventType EventTypeName TextA locale MS\0x409 ModID 6
� � � � � � �� uint32 WmiDataId Description Module ID msgStr
C
� J R ] j x � � �� object WmiDataId Description Text StringA extension RString gS � B i d 2 E t w _ O L E D B _ 1 _ T r a c e ӝ��C� Bid2Etw_OLEDB_1_Trace C � �� * H S b i q { � � � u��������� � Bid2Etw_OLEDB_1_Trace_TextW Description OLEDB.1 formatted output (W) EventType EventTypeName TextW locale MS\0x409 ModID 6
� � � � � � �� uint32 WmiDataId Description Module ID msgStr
C
� J R ] j x � � �� object WmiDataId Description Text StringW extension RWString tr �
E v e n t T r a c e ӝ��C�� EventTrace 6 � �� ! - 3 [ c m � Bid2Etw_SQLOLEDB_1 Description SQLOLEDB_1 Guid {C5BFFE2E-9D87-D568-A09E-08FC83D0C7C2} locale MS\0x409 B � B i d 2 E t w _ S Q L O L E D B _ 1 ӝ��C�� Bid2Etw_SQLOLEDB_1 C � �� ' 3 9 a n x � � � Bid2Etw_SQLOLEDB_1_Trace Description SQLOLEDB_1 Guid {C5BFFE2F-9D87-D568-A09E-08FC83D0C7C2} DisplayName SQLOLEDB locale MS\0x409 � B i d 2 E t w _ S Q L O L E D B _ 1 _ T r a c e ӝ��C�% " Bid2Etw_SQLOLEDB_1_Trace C � �� - N Y h o w � � � � ���������� � Bid2Etw_SQLOLEDB_1_Trace_TextA Description SQLOLEDB_1 formatted output (A) EventType EventTypeName TextA locale MS\0x409 ModID 6
� � � � � � �� uint32 WmiDataId Description Module ID msgStr
C
� P X c p ~ � � �� object WmiDataId Description Text StringA extension RString le �6 4 6 5 9 A B 9 F 8 F 1 C 4 B 5 6 8 D B 6 4 3 8 B A E 1 1 B 2 6 E E 8 F 9 3 C B 5 F 8 1 9 5 E 2 1 E 8 C 3 8 3 D 6 C 4 4 C C 4 1 �vR|�C�ȝ��C�,
� __NAMESPACE MS_409 ��{�` ��}�q � �3�6 # n��{Y �
c�� � E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C lѝ��C� ȝ��C�� �� �� �� T � __InstanceProviderRegistration \\.\ROOT\CIMV2:__Win32Provider.Name="Win32_WinSAT" _ _ E x t r i n s i c E v e n t �˝��C�� __ExtrinsicEvent ) ) = ��H P [ r � _���������������� � Win32_PowerManagementEvent Description The Win32_PowerManagementEvent class represents power management events resulting from power state changes. These state changes are associated with either the Advanced Power Management(APM) or the Advanced Configuration and Power Interface(ACPI) system management protocols. AMENDMENT LOCALE EventType +
� � � � � uint16 Description The EventType property indicates the type of change in the system power state. Values + @ U ` Entering Suspend Resume from Suspend Power Status Change OEM Event Resume Automatic OEMEventCode
� � � � uint16 Description The OEMEventCode property indicates the system power state defined by the original equipment manufacturer (OEM) when the EventType property of this class is set to "OEM Event", otherwise, this property is set to NULL. OEM events are generated when an APM BIOS signals an APM OEM event. OEM event codes are in the range 0x0200h - 0x02FFh. te � C I M _ K e y b o a r d ]tR|�C�� = CIM_Keyboard ) � ��� � � �������������������������������������������������������������Z � Win32_Keyboard Description The Win32_Keyboard class represents a keyboard installed on a Win32 system.
Example: A Microsoft Natural(R) keyboard AMENDMENT LOCALE DeviceID @ )
� � � � � �� string Description DeviceID is an address or other identifying information to uniquely name the logical device. � C I M _ P o i n t i n g D e v i c e ctR|�C��
b CIM_PointingDevice ) # T ��_
g q 1 B � � � � � � g u 1 � � �
�
����UU�������������������������������������������������������������������������������������������v � Win32_PointingDevice Description The Win32_PointingDevice class represents an input device used to point to and select regions on the display of a Win32 computer system. Any device used to manipulate a pointer, or point to the display on a Win32 computer system is a member of this class.
Example: A mouse, touch pad, or stylus/tablet. AMENDMENT LOCALE DeviceID @ )
� � � � � �� string Description The DeviceID property contains a string uniquely identifying the pointing device with other devices on the system. DeviceInterface 9 +
� { � � � � uint16 Description The DeviceInterface property indicates the type of interface used for the pointing device. Values $ + 4 < B L T _ x � � Other Unknown Serial PS/2 Infrared HP-HIL Bus mouse ADB (Apple Desktop Bus) Bus mouse DB-9 Bus mouse micro-DIN USB DoubleSpeedThreshold ; +
� � � � uint32 Description The DoubleSpeedThreshold property contains one of two acceleration values. The sensitivity of the pointing device doubles (toggles from the first to the second value) when the pointing device moves a distance greater than this threshold value. Units mickeys HardwareType ?
� E M Z string Description The HardwareType property indicates the type of hardware type used for the Win32 pointing device.
Example: MICROSOFT PS2 MOUSE InfFileName C
� ) string Description The InfFileName property indicates the name of the .inf file for the Win32 pointing device.
Example: ab.inf InfSection G
� � � � string Description The InfSection property indicates the section of the .inf file that holds configuration information for the Win32 pointing device. Manufacturer K
� � � � string Description The Manufacturer property specifies the name of the processor's manufacturer.
Example: GenuineSilicon QuadSpeedThreshold O +
� j r � � uint32 Description The QuadSpeedThreshold property contains the one of two acceleration threshold values. The system doubles the speed of the pointer movement when the pointer device moves a distance greater than this value. Since this speed increase occurs after the DoubleSpeedThreshold has been met, pointer effectively moves at four times it original speed Units mickeys SampleRate S +
� -
5
B
�
�
uint32 Description The SampleRate property indicates the rate at which the pointing device is polled for input information. Units hertz Synch W +
� �
^ e uint32 Description The Synch property specifies the length of time after which the next interrupt is assumed to indicate the start of a new device packet (partial packets are discarded). In the event that an interrupt is lost, this allows the pointing device driver to synchronize its internalrepresentation of the packet state with the hardware state. Units 100 nanoseconds � C I M _ B a t t e r y mtR|�C�R t CIM_Battery
) $ ��" * > W a � � B S ������_������������������������������������������������������������������������������������������������������������[ � Win32_PortableBattery Description T h e W i n 3 2 _ P o r t a b l e B a t t e r y c l a s s c o n t a i n s t h e t h e p o p u l a t i o n o f t h e D M T F | P o r t a b l e B a t t e r y g r o u p , a s d e f i n e d i n t h e D M T F M o b i l e S u p p l e m e n t t o S t a n d a r d G r o u p s , v 1 . 0 ( s e c t i o n 3 . 3 . 2 3 o f t h e S M B I O S s p e c ) a n d d e s c r i b e s t h e a t t r i b u t e s o f t h e p o r t a b l e b a t t e r y ( s ) f o r t h e s y s t e m . T h e c l a s s c o n t a i n s t h e s t a t i c a t t r i b u t e s f o r t h e g r o u p a n d d e s c r i b e s a s i n g l e b a t t e r y p a c k s a t t r i b u t e s . AMENDMENT LOCALE CapacityMultiplier \
� j r uint16 Description The CapacityMultiplier property contains the multiplication factor of the Design Capacity value to ensure that the milliwatt hour value does not overflow for Smart Battery Data Specification (SBDS) implementations. DeviceID @ )
� � � � � �� string Description The DeviceID property contains a string identifying the portable battery.
Example: Portable Battery Location ^
� H P ] string Description The Location property indicates the physical location of the battery. This property is filled by the computer manufacturer.
Example: In the back, on the left-hand side ManufactureDate b
� C K X string Description The ManufactureDate property identifies the date when the battery was manufactured. Manufacturer f
� � � � string Description The Manufacturer property indicates the manufacturer of the battery. MaxBatteryError j +
� � � � K R uint16 Description The MaxBatteryError property indicates the difference between the highest estimated amount of energy left in the battery and the current amount reported by the battery. Units percent �oseconds �l device. �0x02FFh. te � � � � � ster is being upgraded. Cannot connect to the storage provider. The storage provider cannot connect to the storage subsystem. This operation is not supported for local file servers. # a42c9160500003S ROOT\Microsoft\Windows\Storage\MS_409 ���� � �� �� * � ����� � __PARAMETERS abstract FriendlyName string
� 8 In
� 8 _ �� ID )
� � _ ��� string __ �� a42c9160500003S ROOT\Microsoft\Windows\Storage\MS_409 ���� � �X �� * D � � ��������( � __PARAMETERS abstract
ExtendedStatus object
� : Out
� : a �� ExtendedStatus allows the storage provider to return extended (implementation specific) error information. Description
)
� : a ��� � ID
6
� � a ��� � @ object:MSFT_StorageExtendedStatus ReturnValue uint32
� � uint32 out
� � � �� __ �8C49611E4A1C3BBE.2127.1.24509 CD_68988603F70E94DB41A96D6CCAF4C1247D2A19BC8932E751AE8871C31295C890.2126.271352732.249 CD_68F60BCE5ED1CEFD06D072F2C79847AF4A3C52BA9A8E9F51041AA990EA82C70E.2126.3037036092.247 CD_6A87D660F0F6A66279CF024432941A2BC16A9043D5A3CF26ADC36D1DFFEBF2B9.2126.1182784249.234 CD_6AD386ADF7788A35467E769D3EC3DE89211503B8A449E2B53EAB5B8CCD719DFD.2126.2313539670.245 CD_7E8FAF5FFDD42234424D10D1B6504179D220FC453A0ED3C78C0356F01FFA929D.2119.1.14291 CD_7FCF3928CE1A9575028B7746073AE3C5F6F2163882EECBCF60F66F9FAFB60664.2126.796826228.231 CD_832531694CC32AEF12EEFA0D2DDA8BF782C32F932BED169759F268D0FEAF39B8.2126.4182407855.203 CD_896B6F9A9E07C666B49D000879A54E67F9CE0EAF2B8B7EF7BCA31E7303EC222A.2126.3528081928.2476 CD_99526796DD78031C7C2FAD6BF8D8F64825A2F3F58DED87A8E35BA27BB08D1659.2126.3255643085.225 CD_9E6BE90DCA6B96CBA3BF12EFB579708613DA0A405A49EA5E6B87A7FDB2747D9E.2126.1402340033.251 CD_A3CFA2EA2CF7EBAE83315F59909BFC6F8978ACBDBD24E7ACA6B979B7B86A9975.2126.4025671525.197 CD_AA0B4A55EEE4C1E476A0BDD0D3A0653497872B02CC12BE52258AE7DCEF46F38E.2126.3446376957.241 CD_AC74BA8CCBB8B7653E84CC3AAB6F43C1B7147F57F54B0A2F4FF0A55FCB7892BB.2126.4206185942.257 CD_B4204F4CD845FAF261673483B3D9C407E18AF7773A24D7B43C66C3052F5D6AAB.148.530263875.346 CD_EA9A1A204A0FA59819F57AD1F744E0CAB4BE1F06A46B3D439B85E87A7B3A09A6.2126.3401711369.243 CD_FBBE075DD8BF09CF56F5E18528E64829DF169227E061EAB31220ED102922500C.2126.2143282626.219 CI_41C53E6DB1ACF2453CEFD41398198E613F10DFF47709ECAB1D7F037756AC8CE7 IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.138.1173398803.368 CI_FD1C1D414B71B5082C266A650E31EF6D5019382724244B685F217C0AAE00A921 IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.107.2306698938.180 CR_7E8FAF5FFDD42234424D10D1B6504179D220FC453A0ED3C78C0356F01FFA929D C_B4204F4CD845FAF261673483B3D9C407E18AF7773A24D7B43C66C3052F5D6AAB CR_E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 C_3E11F2867F2D534D95C0593A0AA32ECA612C606596AA91228C49611E4A1C3BBE C_68988603F70E94DB41A96D6CCAF4C1247D2A19BC8932E751AE8871C31295C890 C_68F60BCE5ED1CEFD06D072F2C79847AF4A3C52BA9A8E9F51041AA990EA82C70E C_6A87D660F0F6A66279CF024432941A2BC16A9043D5A3CF26ADC36D1DFFEBF2B9 C_7E8FAF5FFDD42234424D10D1B6504179D220FC453A0ED3C78C0356F01FFA929D C_7FCF3928CE1A9575028B7746073AE3C5F6F2163882EECBCF60F66F9FAFB60664 C_832531694CC32AEF12EEFA0D2DDA8BF782C32F932BED169759F268D0FEAF39B8 C_896B6F9A9E07C666B49D000879A54E67F9CE0EAF2B8B7EF7BCA31E7303EC222A C_6AD386ADF7788A35467E769D3EC3DE89211503B8A449E2B53EAB5B8CCD719DFD CD_8688B6B3A5AFA46698CC5C2A2A938F01175B6D9F4A0E5E74F0C3AA6D73897983.2126.1030327628.239 C_8688B6B3A5AFA46698CC5C2A2A938F01175B6D9F4A0E5E74F0C3AA6D73897983 CD_4AC7D53B353FF907A3871574884AE20E2C77DD82D160B77856929A17F6C699D4.2126.1987723824.249 C_4AC7D53B353FF907A3871574884AE20E2C77DD82D160B77856929A17F6C699D4 CD_8519F629D57644187514674C7FCF7F8B0B70EEA799638913C1E17DC7E507CB73.2400.795705153.1805 C_8519F629D57644187514674C7FCF7F8B0B70EEA799638913C1E17DC7E507CB73 CD_5997589696FB2E4597FC4CE1E1612FCF4F0EAE5655998B39A34DFA12CA0BE14A.2401.832104219.2361 C_5997589696FB2E4597FC4CE1E1612FCF4F0EAE5655998B39A34DFA12CA0BE14A CD_3AA9C8A0942F537FDAE95E548CCBAD1AD1FFA8F4AD1AFE2EE57031F74E67B391.2402.1.63562 CR_5997589696FB2E4597FC4CE1E1612FCF4F0EAE5655998B39A34DFA12CA0BE14A C_3AA9C8A0942F537FDAE95E548CCBAD1AD1FFA8F4AD1AFE2EE57031F74E67B391 CD_3FDA482EEA11D105F777BB4C0E86194FDFA63901845D94A245BC2172A88E5638.2401.4139591043.2531 C_3FDA482EEA11D105F777BB4C0E86194FDFA63901845D94A245BC2172A88E5638 CD_169484918492FC0AC4886BF1A48556EDC1984793E915C243C1C0A4B8E678F4FD.2401.3837005109.228 C_169484918492FC0AC4886BF1A48556EDC1984793E915C243C1C0A4B8E678F4FD CD_9A0DB23B4C5307A117BBF9E162F8E0A10B387D66AA6B5AEFE4F2996B31F1D028.2401.4102264388.224 CD_00637C6FCCC93CC75F9D988B459EA167A80BFD4782DA6DB5BC1F63F5A3F73F9B.2401.2675363690.174 C_00637C6FCCC93CC75F9D988B459EA167A80BFD4782DA6DB5BC1F63F5A3F73F9B CD_297B009625C3BEC5F682DA65A87D7971BDE24BF0C5093DE7BD3ABBE18CF35D09.2125.2481444781.6773 /��� ) ij�m� D�� 4 3z*� � e�_�� �
I�C7_ # &Xv�� �
C I M _ C o m p o n e n t :̝��C�� CIM_Component 6 � �� � ' - S c � � e��������| � Win32_UserInDomain CIMWin32a Locale UUID B38813CF-0673-495C-A12F-384D47BDF1ED GroupComponent f@ 4
� � � �� � ��� � ref:Win32_NTDomain MappingStrings � WMI|Win32_NTDomain PartComponent f@ 4
� 6 � �� � ��M ] ref:Win32_UserAccount MappingStrings e WMI|Win32_UserAccount �
C I M _ C o m p o n e n t ;̝��C�� CIM_Component 6 � �� � ( . T d � � e��������q � Win32_GroupInDomain CIMWin32a Locale UUID C1717231-5F16-4AE6-966F-6CA856B7AAF6 GroupComponent f@ 4
� � � �� � ��� � ref:Win32_NTDomain MappingStrings � WMI|Win32_NTDomain PartComponent f@ 4
� 7 � �� � ��H X ref:Win32_Group MappingStrings ` WMI|Win32_Group pi � M S V 1 _ 0 T r a c e ҝ��C� MSV1_0Trace
C � �� : @ h u � � � � NtlmValidateUser Description NTLM Validate Credentials Guid {34d84181-c28a-41d8-bb9e-995190df83df} DisplayName NtlmValidateUser locale MS\0x409 �
W i n 3 2 _ A c c o u n t �tR|�C�� Win32_Account )
� ��� � � � � ����������������N � Win32_Group Description The Win32_Group class represents data about a group account. A group account allows access privileges to be changed for a list of users.
Example: Marketing2. AMENDMENT LOCALE Domain @
� string Description The Domain property indicates the name of the Windows domain to which the group account belongs.
Example: NA-SALES Name @
� � � � string Description The Name property indicates the name of the Win32 group account on the domain specified by the Domain member of this class. � � � � Rename & 3 \ d Description The Rename() allows for the renaming of the group name; a key in this class. The functionality to change the key property "Name" is implemented as a method to provide a separate context for the new name distinguishable from the key name associated with the instance to be modified in this class. Values
� � � � � � � @ � � Success Instance not found Instance required Invalid parameter Group not found Domain not found Operation is allowed only on the primary domain controller of the domain Operation is not allowed on specified special groups; user, admin, local or guest. Other API error Internal error I a42c9160500003S ROOT\CIMV2\ms_409 ���� � �� �� * Z ����� � __PARAMETERS abstract Name string
� 0 In
� 0 W �� The Name property indicates the name of the Win32 user account on the domain specified by the Domain member of this class.
Example: thomasw Description )
� 0 W �� � ID 6
� � W �� � V string __ �� a42c9160500003S ROOT\CIMV2\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � C I M _ L o g i c a l E l e m e n t �tR|�C��
CIM_LogicalElement ) A ��L T \ ( : @
� � U����������������
� Win32_Account Description The Win32_Account class contains information about user accounts and group accounts known to the Win32 system. User or group names recognized by a Windows NT domain are descendents (or members) of this class. The Win32_Account class is not included in a default hardware inventory operation. AMENDMENT LOCALE Domain )
� � � � � �� string Description The Domain property indicates the name of the Windows domain to which a group or user belongs.
Example: NA-SALES LocalAccount
� T ] j Boolean Description The LocalAccount property indicates whether the account is defined on the local machine. To retrieve only accounts defined on the local machine state a query that includes the condition 'LocalAccount=TRUE'. Name )
� w � � �� string Description The Name property indicates the name of the Win32 system account on the domain specified by the Domain member of this class. SID
� ; C P string Description The SID property contains the security identifier (SID) for this account. a SID is a string value of variable length used to identify a trustee. Each account has a unique SID issued by an authority (such as a Windows domain), stored in a security database. When a user logs on, the system retrieves the user's SID from the database and places it in the user's access token. The system uses the SID in the user's access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot be used again to identify another user or group. SIDType +
� : B uint8 Description The SIDType property contains enumerated values that specify the type of security identifier (SID). SIDTypes include:
SidTypeUser - Indicates a user SID.
SidTypeGroup - Indicates a group SID.
SidTypeDomain - Indicates a domain SID.
SidTypeAlias - Indicates an alias SID.
SidTypeWellKnownGroup - Indicates a SID for a well-known group.
SidTypeDeletedAccount - Indicates a SID for a deleted account.
SidTypeInvalid - Indicates an invalid SID.
SidTypeUnknown - Indicates an unknown SID type.
SidTypeComputer - Indicates a SID for a computer.
Values j w � � � � � � � SidTypeUser SidTypeGroup SidTypeDomain SidTypeAlias SidTypeWellKnownGroup SidTypeDeletedAccount SidTypeInvalid SidTypeUnknown SidTypeComputer in � W i n 3 2 _ S y s t e m M e m o r y R e s o u r c e �tR|�C�� " $ Win32_SystemMemoryResource ) ( � ��� � � $ 5 ����������������������������������C � Win32_DeviceMemoryAddress Description The Win32_DeviceMemoryAddress class represents a device memory address on a Win32 system.
Example: ScsiPort0 device memory address. AMENDMENT LOCALE MemoryType +
�
� � string Description The MemoryType property indicates the characteristics of the memory resource on the Win32 system.
Example: ReadWrite. Values � � � � � � ReadWrite ReadOnly WriteOnly Prefetchable CombinedWrite Type24 Cacheable WindowDecode Bar StartingAddress @ )
� l t � � �� uint64 Description The StartingAddress property contains the starting address of memory mapped I/O. The hardware resource identifier property should be set to this value to construct the mapped I/O resource key. �6 4 6 5 9 A B 9 F 8 F 1 C 4 B 5 6 8 D B 6 4 3 8 B A E 1 1 B 2 6 E E 8 F 9 3 C B 5 F 8 1 9 5 E 2 1 E 8 C 3 8 3 D 6 C 4 4 C C 4 1 wR|�C�ȝ��C�,
� __NAMESPACE MS_409
� ^ uint32 out
� ^ f �� __ � J' �
? E l x ������������� � MSFT_CliFormat Format
� 7 STRING Name
� d STRING Properties
� � object:MSFT_CliProperty W& � MSFT_CliFormat WRITEABLE ' � � 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier ^ � MSFT_CliProperty MaxFileSize The MaxFileSize property indicates the maximum size (in bytes) permitted for the log file. If the file exceeds its maximum size, its contents are moved to another file and the primary file is emptied. A value of zero indicates no size limit. MaxFileSize 0 L e � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING j , � MSFT_CliQualifier CIMTYPE $ uint32 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING g ' � MSFT_CliQualifier read ! True � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING h ( � MSFT_CliQualifier write " True G 9 E R y � � U����������������� � MSFT_CliProperty Derivation
� = STRING Description
� q String Name
� � STRING Qualifiers
� � object:MSFT_CliQualifier
% . A � � MSFT_CliProperty OverwriteOutDated Number of days after which an event can be overwritten. Values are:/n0 = Any entry can be overwritten when necessary.1..365 = Events that have been in the log file for one year (365 days) or less can be overwritten.4294967295 = Nothing can be ever be overwritten. /nThere is an interdependence between the OverWriteOutDated property (which is writable) value and the OverWritePolicy property (which is not writable) value./nIf one changes the OverWriteOutDated property value to 0, the OverWritePolicy property value will be 'henNeeded' /nIf one changes the OverWriteOutDated property value to 1-365, the OverWritePolicy property value will be 'outDated' /nIf one changes the OverWriteOutDated property value to 4294967295, the OverWritePolicy property value will be 'Never'. OverwriteOutDated Y u � � � � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING j , � MSFT_CliQualifier CIMTYPE $ uint32 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING h 6 � MSFT_CliQualifier Range " 0-365 | 4294967295 � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING g ' � MSFT_CliQualifier read ! True � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING h ( � MSFT_CliQualifier Units " Days � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING h ( � MSFT_CliQualifier write " True �# C I M _ L o g i c a l D e v i c e htR|�C� ? CIM_LogicalDevice ) U ��` h s � � � � � � % � � � ���_U����������������������������������������������������������F � CIM_USBDevice Description The management characterisitics of a USB Device. These AMENDMENT LOCALE ClassCode .
� � � � uint8 Description Indicates the USB class code. CurrentAlternateSettings /
� , uint8 Description An array of USB 'alternate settings' for each interface in the currently selected configuration (indicated by the CurrentConfigValue property). This array has one entry for each interface in the configuration. If the property, CurrentConfigValue, is zero (indicating the Device is not configured), the array is undefined. To understand how to parse this octet string, refer to the USB Specification. CurrentConfigValue 3
� � uint8 Description Indicates the configuration currently selected for the Device. If this value is zero, the Device is unconfigured. NumberOfConfigs 4
� � � � uint8 Description Number of device configurations that are defined for the Device. ProtocolCode 5
� Q X e uint8 Description Indicates the USB protocol code. SubclassCode 6
� � � � uint8 Description Indicates the USB subclass code. USBVersion 7
� / 7 D uint16 Description Indicates the latest USB Version supported by the USB Device. The property is expressed as a Binary-Coded Decimal (BCD) where a decimal point is implied between the 2nd and 3rd digits. For example, a value of 0x201 indicates that version 2.01 is supported. U � 1 � GetDescriptor - Description This method returns the USBDevice Descriptor as specified by the input parameters. Each parameter is briefly described here with more detail in its Qualifier list. RequestType is an input parameter that defines whether the request is for standard, class or vendor-specific information, as well as specifying the recipient. RequestValue is also an input parameter and defines the USB Descriptor Type and Index. RequestIndex is an input parameter which describes the language used to return a string Descriptor. RequestLength is both an input and output parameter. It specifies the length of the Descriptor that should be returned (on input) and what is actually returned in the Buffer parameter (on output). Buffer is an output parameter, containing the Descriptor data. The GetDescriptor method returns an integer value of 0 if the USB Descriptor is successfully returned, 1 if the request is not supported and any other number to indicate an error.
In a subclass, the set of possible return codes could be specified, using a ValueMap qualifier on the method. The strings to which the ValueMap contents are 'translated' may also be specified in the subclass as a Values array qualifier. .
a42c9160500003S ROOT\CIMV2\ms_409 ���� � �� �� 9 � � * � \ � U�������� � __PARAMETERS abstract RequestType uint8
� 7 IN
� 7 ] �� RequestType is bit-mapped and identifies the type of Descriptor request and the recipient. The type of request may be 'standard', 'class' or 'vendor-specific'. The recipient may be 'device', 'interface', 'endpoint' or 'other'. Refer to the USB Specification for the appropriate values for each bit. Description )
� 7 ] ��� � ID 6
� C ] ��� � � uint8 RequestValue uint16
� j IN
� j � �� RequestValue contains the Descriptor Type in the high byte and the Descriptor Index (for example, index or offset into the Descriptor array) in the low byte. Refer to the USB Specification for more information. Description )
� j � ��� � ID 6
� � ��� � � uint16 RequestIndex uint16
� G IN
� G n �� RequestIndex defines the 2 byte Language ID code used by the USBDevice when returning string Descriptor data. The parameter is typically 0 for non-string Descriptors. Refer to the USB Specification for more information. Description )
� G n ��y � ID 6
� n ��y � � uint16 RequestLength uint16
� . IN
� . U �� On input, RequestLength is the length (in octets) of the Descriptor that should be returned. If this value is less than the actual length of the Descriptor, only the requested length will be returned. If it is more than the actual length, the actual length is returned. On output, this parameter is the length, in octets, of the Buffer being returned. If the requested Descriptor does not exist, the contents of this parameter are undefined. Description )
� . U ��> � ID 6
� � U ��> � � uint16 __ �*
a42c9160500003S ROOT\CIMV2\ms_409 ���� � �� �� � * � t � ����������� � __PARAMETERS abstract RequestLength uint16
� 9 OUT
� 9 ` �� On input, RequestLength is the length (in octets) of the Descriptor that should be returned. If this value is less than the actual length of the Descriptor, only the requested length will be returned. If it is more than the actual length, the actual length is returned. On output, this parameter is the length, in octets, of the Buffer being returned. If the requested Descriptor does not exist, the contents of this parameter are undefined. Description )
� 9 ` ��J � ID 6
� � ` ��J � � uint16 Buffer uint8
� � OUT
� � �� Buffer returns the requested Descriptor information. If the Descriptor does not exist, the contents of the Buffer are undefined. Description )
� � ��� M ID 6
� [ ��� M uint8 ReturnValue uint32
� � uint32 out
� � � �� __ ��� �� .:}+
7 K ��
�b%� ��q�z� n� ��� � �\ �Ph t �
�>
1 ��!
FNS_88591E56F7DF51C96BBDD94E4112A5C7AADAE3154C1ACB64E20A2CB89B0D6F02 CR_229F3CD4638E22D422843A148AD2ADA2C95B3802ED7FA9E6E4113BE6A1D690E2 CR_2442933444240B68F1B8232208304D509D6ECF5830E4F4F8E4EDD13186DE1B28 CR_24BE268C5603D757BD8CCA53193660D8F104AD29F4F74D327C13832A44E7DF1F CR_2A82469DE4EDED369FA467BEF3E6440FE893BBC1F56ED2AB23AD8D2515E35AC8 CR_2F2626B7E6B190AABAC337367EE2C30A587328DFC7C5ED27A37779833EA30396 CR_25C2E8C327D4AE50AB0B89215561563C42973CDF72E4E8164880862FB1C155CC C_A82DF9B10154EC9C0F8A403786D7520B52229D45691E2690C3B352DE9F05F32F C_DE00475055EACC7B53BF4B3D912C0AED441AE802F9CCA17A5072BACBD47797C3 C_B73E13EE752D9B5AF02139CC8E7B9DD86AA46977B13267D0D5F674F26F8C3D67 C_D6B1F4AAAFDB618A9CCA914AD92E90625471E15F06457F12DC8D813813101B8A C_DAA0835D90559AB1BED3F4706FE66DA711EF5A48A581A0339267CD41A8EB5EF9 C_4EF9C71BC878CDED855571486DDA10408A556B0E0B2473232D97D8125D3EABD7 C_E66D2A11AD2317154A9C2C61CC140BA5F198CC545A25F24736AE23D74E16B49B C_C1EDB2C3B16B75C05D994CBAD887CFED943CA4B2E1180F3891F60984B8988B63 C_961B71EE3CEF77853FD06FD1FD078D670615B8B606936AC4407F5BADB29E35F4 C_61A3C0D6CB2A10AE4FD5F19276429EF7E249D991E911A200F124BE12E4F8F8C2 C_DA6435B5A6AFDE1EA49B0F1FA576B2FE264B6CCD6A9F163C86C6173386BDC535 C_F2BEF717752C099CDF2C7677200AF2332E7D1E48B470B17CCD440B8D710B7A38 R_9F036BA68CA921AFF06984BDB9CEE80E8A2696D8DB098A0C679A6507C62F4DAD CR_25A225BFD7C0706940B21958E1B4E7879B81C1069B2DA72D3945C2F2A653CB92 C_28D3480019EDB8568B100B133C2E45279CD6E1AD49C4AEEDB510EEF8207E9610 R_28D3480019EDB8568B100B133C2E45279CD6E1AD49C4AEEDB510EEF8207E9610 C_524ED280AB38E3BD86074B4D556A261D98A4E9D85B8A2DCDD6AA2F85E3342805 R_80AFDCC52F3C92AD7D0F8DD0B12150C7B0CC34A13BF2D3DD52C62A73F9713B79 R_2A9212E5C5A3E7B6904A9AD5755292499E2868895335A7FB104CA7C39F4970DA R_DDEDD07282B8324F60B5A48A479C1B42607AE5EA149F90058D5C2368C1337E02 R_ED2E871CAA85DB91DA82D43856C298DADCDDAA2D7C9D06C8655F1779E6509A4E R_6CE5293A4991040589451CEEA5CB3FB1F0BCB9AC8B0C16A2D34DE39822CD1F34 R_F22CF0C74A9002156D476F4DBA031C7F3F706A1A94FD4FF91611BCB6BD8FBB7C R_7F637DAE12A5C57B84338EBF2100C5D2953335CDC28294203995748012501B4E C_B7CFE88CDD4E2F20D43EF63AF2894F6D14A41F54E4CF74F7D9A3F5B4EC2A87C0 R_962C6E7C58B97BBA37F5179D96ED3E00EE4A4FC20E4C3C3A3312674F9F7C4195 R_378C3B019BA81FF898F9BF06FF0AC5FC705DA51C0F56DBDDF9AC986BBEE3099E R_C067A199C1ACCE03298DA4A596E9323C2C865C447DF4449AEE4DAF3E29B9DD32 R_C6F2B33A9F7EE971E46DC4A05944D1F3ED258A4BBB229A6782F76407411C3AAF R_A66D0E591535F85D5DA7C1BDF3A1DC73BE40E7ED75F810DC35A2C1D0250B7F4C C_2BBDC6530C208169E005CD28108E36BCD72310DD490D1F6D9817675EE3291874 CR_259A5E159C9BC70687CA1D3524FF3E5AFC0180D51D46E1351D0D2A9510F67A46 R_C21E8ECEFF103DE2D58A051FBB124028D9968F5617844FDA582F260A7956CF1E CR_25D6DE4F10F10C9622833D068798F50E89401E52F3D552BA53470C9A0F55267B C_A4B7E1219FA76BD23A588641B4F3CEC1D9A3585F7F85B74432295927C547BE69 C_629122007ACBC01F5C89876FEF5BF24FCF799FAC8975CF22D2EEA155F3C49ACF C_9398EE9389657B6A830EB223CFE8021EDA6EBF0AE7CE6FA1ECC3991C40D9983D R_2C338646F5C1CAA321EFF2BEDBEB6839F57D9EB755DB455A7F244BA25566E1F5 C_BCAAEBA95E435CA5300A680BE9BF735F04A93ECECD18F46C56865C6158D43B74 R_6FF6CB589253824DE681EA946AEBFF7061F07B8322E36020A90CC770B8046443 CR_290F6F8B3B7EAA26E7735FACB33E9185DC97B5AF85F7FE15A4C9FA4C0EBACD95 C_1A826788D5CB396EF46883163CDFF0FAFFB8ED9B8BC20D60D3B7762CBFBD2C44 R_2F43B8EB8E14762A257D84DCB10913E4CD9E8069D8AEA3384120BB143668FB2E R_F7E10C2E2B48C52ACA99548FFAFB6BFFFF056CE9E9128CD48CB817FDF7995302 CR_2800F9F89075C56302A7CF7269B5300116A62BE579546FA42D0E22E3EA14FE1F R_AAD0D760D72ECB11742773406575974B851067AEA4863E381AADAD2897C3D328 C_02B5557CADEF33CFA29F52E782D8C5DEF3C67D29A7C0C3B389FF34D1D0708EC3 C_328F09EA94A11C49CE9879973AEFE371583535ABF3A24603CDCD08371B636C41 C_CFA7490FC441CDBFE3AC487F4E7E6794E550150460C43DF35BA636FBEF5C66C5 C_09118298CC8EE9F900C2AC9CB3704C71C7C2F2B7198EBC74799BC99713851937 C_0C89E3FE1CDFD790CBD5FEE0B9AE5F8AE27F38181A372EB2194AFCBADEB37DA8 C_3935D6345388A245E9FF50F1CD42F69CC8FD444FF90B93C789385D0BD31672F7 C_4BBA71B8B969B6626A0E7F60779736282C60AEC40553354F5884C7B9E51AF36A C_C4C4AC3CDD7A9E38A340BB56FE91B2D1BB13CEAA14A840B9C15B1953B57A1EE9 C_24BE268C5603D757BD8CCA53193660D8F104AD29F4F74D327C13832A44E7DF1F _��}� < W
�5� kƤY[ %`хs
� Ǯ.�X
�D�e � ��rt z�~D � �0 �� � - X e S q l P k g _ h a d r _ f i l e s t r e a m _ m e s s a g e _ f i l e _ r e q u e s t �Y��7 �� 4 7 XeSqlPkg_hadr_filestream_message_file_request / ) � ��& 1
? K � M X � � f t � � D M � � � M ] WU�������������������������������������������������� � hadr_filestream_message_file_request EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid eol_requested , )
� ; B � �� sint8 WmiDataId file_path
- C
� � �
� ��� � � � string WmiDataId StringTermination NullTerminated Format w FragmentId 6
� : B M Z � �� uint32 WmiDataId Description FragmentId message_size $ )
� � � � �� uint32 WmiDataId RemainingLength 6
� & 3 � �� uint32 WmiDataId Description RemainingLength root_id ( )
� � � � �� sint32 WmiDataId scan_generation )
� � � � �� uint64 WmiDataId sequence_number )
� : B � �� uint64 WmiDataId SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �Y��7 �W XeSqlPkg
C � ��+ 8 y � � � � c����� � XeSqlPkg_hadr_wsfc_change_notifier_status Description HADR Windows Server Failover Clustering change notifier status. Guid {b20e673e-abef-4c6c-a1ab-02a34c48529e} locale MS\0x409 DisplayName hadr_wsfc_change_notifier_status �) X e S q l P k g _ h a d r _ w s f c _ c h a n g e _ n o t i f i e r _ s t a t u s �Y��7 �� 3 XeSqlPkg_hadr_wsfc_change_notifier_status + ) � ��" - ; G � u � � w � W�������������������������� � hadr_wsfc_change_notifier_status EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid current_status P
� _ g � ��r # { � � � uint32 WmiDataId XEMapId ValueMap � � � � � � � � 0 1 2 3 4 5 6 7 Values � � 2 H Q b l Starting WaitingForClusterAvailability WaitingForNodeAvailability WaitingForNodeOnline Running WaitingForEvent Stopping Stopped FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� F N Y f � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �Y��7 �� XeSqlPkg
C � ��D Q � � � � c����N � XeSqlPkg_hadr_wsfc_change_notifier_start_ag_specific_notifications Description HADR Windows Server Failover Clustering change notifier starts receiving Availability Group specific notifications. Guid {dc686069-1cd1-4671-aaeb-4685eb4898c0} locale MS\0x409 DisplayName hadr_wsfc_change_notifier_start_ag_specific_notifications �B X e S q l P k g _ h a d r _ w s f c _ c h a n g e _ n o t i f i e r _ s t a r t _ a g _ s p e c i f i c _ n o t i f i c a t i o n s �Y��7 �q " L XeSqlPkg_hadr_wsfc_change_notifier_start_ag_specific_notifications D ) � ��; F T `
! � � / A � � ! W��������������������������������� � hadr_wsfc_change_notifier_start_ag_specific_notifications EventType EventVersion ActivityId
N
� � � � � � �� � ��� object:guid WmiDataId Description ActivityId ActivityID Extension Guid availability_group_id C
� r z � ��� � � � string WmiDataId StringTermination NullTerminated Format w FragmentId 6
� # � �� uint32 WmiDataId Description FragmentId notification_key )
� x � � �� uint64 WmiDataId RemainingLength 6
� � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� e m x � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �Y��7 �� XeSqlPkg
C � ��1 > � � � � � � c���� � XeSqlPkg_hadr_wsfc_change_notifier_severe_error Description HADR Windows Server Failover Clustering change notifier encountered a severe error and will terminate. Guid {8f162c44-d6fd-4207-b29e-528dca92a499} locale MS\0x409 DisplayName hadr_wsfc_change_notifier_severe_error �/ X e S q l P k g _ h a d r _ w s f c _ c h a n g e _ n o t i f i e r _ s e v e r e _ e r r o r �Y��7 �� 9 XeSqlPkg_hadr_wsfc_change_notifier_severe_error 1 ) � ��( 3 A M � O [ � � Q a W�������������������������� � hadr_wsfc_change_notifier_severe_error EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid error_number )
� < D � �� uint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� ( 3 @ � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �Y��7 �� XeSqlPkg
C � ��3 @ � � � � � � c���� � XeSqlPkg_hadr_wsfc_change_notifier_event_received Description HADR Windows Server Failover Clustering change notifier received a cluster notification. Guid {d191468f-2130-4b65-81bc-421b3435e08c} locale MS\0x409 DisplayName hadr_wsfc_change_notifier_event_received � X e S q l P k g _ r e d o _ w o r k e r _ e x i t �[��7 �a # XeSqlPkg_redo_worker_exit ) � �� + 7 � � 8 D � � : J W�������������������������� � redo_worker_exit EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� % - � �� uint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� ) � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber �ResourceName] rceName] 41B524A3939652E49FA193A77939E65868511053C7856CA375F94BE.2669.2928240190.272 ndows\system32\kernelbase.dll[MofResourceName] __ ������������������������������������������������������������������������������������������������������������������������������������������������������ � � " % ( + . 1 5 9 = A { E I M � Q � U � Y ] a f k o s w � 9 8 . :
% : " : & : 3 / : 4 + : 8 0 ; ; ; ; ; ; ; ;
' ; ! ;
$ ; # ; ( ; ; ; ; ; ; ; 3 1 ; 5 ) < ; 5 ) = ; 5 * ; 6 - ; 7 , ; 8 2 ; ; ; ; ; ; ; > � -w��)��!��%�Y� <
�
�J � X � [ �O ��
� � � ie�2] y
k��� 9+� ���5
�]D � ��
�NS_E8C4F9926E52E9240C37C4E59745CEB61A67A77C9F6692EA4295A97E0AF583C5 KI_FD1C1D414B71B5082C266A650E31EF6D5019382724244B685F217C0AAE00A921 I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.10.3774565816.180 NS_EC9F2768D2769112CE1EF50D7321735D7B87D36D0F8A1B65990E1538277EB1A0 CI_41C53E6DB1ACF2453CEFD41398198E613F10DFF47709ECAB1D7F037756AC8CE7 IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1164.1209647730.368 CI_64659AB9F8F1C4B568DB6438BAE11B26EE8F93CB5F8195E21E8C383D6C44CC41 IL_724155B2CA7FBBC304551F8A171392C3CA07A2D9AD12D47C6D2D987EFBFD727B.1164.1613626581.187 CI_FD1C1D414B71B5082C266A650E31EF6D5019382724244B685F217C0AAE00A921 IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1164.1769139781.180 KI_41C53E6DB1ACF2453CEFD41398198E613F10DFF47709ECAB1D7F037756AC8CE7 I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1164.1209647730.368 KI_64659AB9F8F1C4B568DB6438BAE11B26EE8F93CB5F8195E21E8C383D6C44CC41 I_724155B2CA7FBBC304551F8A171392C3CA07A2D9AD12D47C6D2D987EFBFD727B.1164.1613626581.187 I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1164.1769139781.180 NS_FAD236DC88D4A39D9B808B598227AC32F45800A0F09FB4E10AAE80BE63A63AD1 CD_229F3CD4638E22D422843A148AD2ADA2C95B3802ED7FA9E6E4113BE6A1D690E2.1166.1306034966.1049 CD_3CDC4183D44F52048CE0039132A93204204F5A3326DCB27DE7954C1D3930FD11.1166.1101029878.318 CD_49777012274A486E8E2DA653CCC9FE3C0BAFC8CB49FF0E373F8540A5B458A655.1167.4081882368.3715 CD_8348E5895FE4B45964F288F6208DF14CD383D0A357608E0BFF28F226F0190D45.1166.2698031722.1603 CD_94250441BCE05715192D37120EDEE5CCA50FD2B2134EFE3C9E35BB834F26457D.1166.2883001541.3667 CD_BC8A5D3527D1BDCB19AA2B963526E673CF7D0B41B579C91C1089F6FC06405DFC.1164.3051673611.413 CD_ED6C3A2F6CC04DF3DD2F991B72C978A94559E5D3850ACCDF521D9DB88CF8E809.1166.4168789395.698 IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1165.213390791.368 CI_57E5F3ADD9E242C4E9F9EDF79AA97F79E7911C5A8B902EC150D6442E3B85A5AA IL_59543DA79A0A83C48BB9222B5916E17BBA9A5688C362D35DD3F13589A2596294.1060.2213083100.328 CI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD IL_9F79CC9E07BFC5EC416BFC61E17D76D6387C16B055C0398D995353255C542258.1154.3304675761.247 CI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C IL_9F79CC9E07BFC5EC416BFC61E17D76D6387C16B055C0398D995353255C542258.1086.3673822206.271 IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1165.3476372172.180 CR_229F3CD4638E22D422843A148AD2ADA2C95B3802ED7FA9E6E4113BE6A1D690E2 C_ED6C3A2F6CC04DF3DD2F991B72C978A94559E5D3850ACCDF521D9DB88CF8E809 CR_3CDC4183D44F52048CE0039132A93204204F5A3326DCB27DE7954C1D3930FD11 C_94250441BCE05715192D37120EDEE5CCA50FD2B2134EFE3C9E35BB834F26457D CR_8348E5895FE4B45964F288F6208DF14CD383D0A357608E0BFF28F226F0190D45 C_3CDC4183D44F52048CE0039132A93204204F5A3326DCB27DE7954C1D3930FD11 CR_94250441BCE05715192D37120EDEE5CCA50FD2B2134EFE3C9E35BB834F26457D C_229F3CD4638E22D422843A148AD2ADA2C95B3802ED7FA9E6E4113BE6A1D690E2 CR_BC8A5D3527D1BDCB19AA2B963526E673CF7D0B41B579C91C1089F6FC06405DFC C_8348E5895FE4B45964F288F6208DF14CD383D0A357608E0BFF28F226F0190D45 CR_E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 C_BC8A5D3527D1BDCB19AA2B963526E673CF7D0B41B579C91C1089F6FC06405DFC I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1165.213390791.368 KI_7010B213179D98B16AF38723EE1D750E86F808F341EE215AD8783D29EA117262 IR_59543DA79A0A83C48BB9222B5916E17BBA9A5688C362D35DD3F13589A2596294 R_241ED574CEA1CE45C178048218C62F092191B3FEDB2EDBBB00DA39363C5BD5B2.1164.4042741439.526 R_DA290273C5C5246EBD4AD92A0C51323EC9F3405D662C9D949CD09183391AA1F8.1151.2082543601.530 I_59543DA79A0A83C48BB9222B5916E17BBA9A5688C362D35DD3F13589A2596294.1060.2213083100.328 KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD I_9F79CC9E07BFC5EC416BFC61E17D76D6387C16B055C0398D995353255C542258.1154.3304675761.247 KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C I_9F79CC9E07BFC5EC416BFC61E17D76D6387C16B055C0398D995353255C542258.1086.3673822206.271 I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1165.3476372172.180 C_49777012274A486E8E2DA653CCC9FE3C0BAFC8CB49FF0E373F8540A5B458A655 CD_878D5D30666EBFE440F941E45E7884E8AFCA7A1478E4D09AB57DC26571C8B7A6.1167.1104238718.272 C_878D5D30666EBFE440F941E45E7884E8AFCA7A1478E4D09AB57DC26571C8B7A6 CD_3D10A0A77CAA5B54D6D0F826577C9C9001B09013C6D023D93A420AB24027FBBB.1167.377069244.348 CR_878D5D30666EBFE440F941E45E7884E8AFCA7A1478E4D09AB57DC26571C8B7A6 C_3D10A0A77CAA5B54D6D0F826577C9C9001B09013C6D023D93A420AB24027FBBB CD_2F2626B7E6B190AABAC337367EE2C30A587328DFC7C5ED27A37779833EA30396.1168.1.9739 C_2F2626B7E6B190AABAC337367EE2C30A587328DFC7C5ED27A37779833EA30396 C_41D84F93E168026991704896B6AB8BD6B7DB82CBC17BBAA1442A047D10A853E1 NS_CCA03770E562E2A170EDED20A589C069A2045A9BCD7412B77D068846D9054EC4 IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1077.347784919.180 C_C80F6E9FDDA5B4FCB7E91E04A37B343ACE2C1B4C4C7D997B61E1037420FC6413 CD_1388B74AC4B1A1248035D019490B1CAAA479C4415233A9E50223DD0802BA383C.1088.2086008455.3304 NS_CAB27DE1BAB7670ABD52803B0A42E2A423F561EE80F3363FD5AA3CE6C352CAC6 CD_4FD2270AA7CC321848B51530B7A77A9E39B5486B55CE0C09A2B597A1F1FCE1E6.1136.954831197.5677 CR_532671ED26AC2835681FE0B122A526862616ED33CAB2C220F171DB7BD5AD8B02 C_9E927C42162CFFA3624D55690B21114853C375D15511354B30627B7E45D7DB02 CD_0783FC4315F6719B07F6F7780EAC7B73D0B0471C3E21E23BC45CB6B44FFECA8E.5.1.9646 �靏P � u�`: : r}�gt ) r� � �ʝ��C��
) i ��t | � A G � U������������k � CIM_Location Description The Location class specifies the position and address of a physical element. AMENDMENT LOCALE Address
� � � � string Description Address is a free-form string indicating a street, building or other type of address for the physical element's location. Name )
� ~ � ��� � string Description Name is a free-form string defining a label for the location. It is a part of the key for the object. PhysicalPosition )
� C � ��K X string Description Position is a free-form string indicating the placement of a physical element. It can specify slot information on a hosting board, mounting site in a cabinet, or latitude and longitude information, for example, from a GPS. It is part of the key of the CIM_Location object. g � �ʝ��C�" ) * � ��� � � H Z ���������� � CIM_PhysicalElementLocation Description CIM_PhysicalElementLocation associates a physical element with a CIM_Location object for inventory or replacement purposes. AMENDMENT LOCALE Element f
� � ref:CIM_PhysicalElement Description The physical element whose location is specified. PhysicalLocation f
� � � � ref:CIM_Location Description The physical element's location. em � C I M _ L o g i c a l D e v i c e ktR|�C�� 9 CIM_LogicalDevice ) � ��� � � ! * } � ���_������������������������������������������������������ � CIM_AlarmDevice Description An alarm device is a type of device that emits audible or visible indications related to a problem situation. AMENDMENT LOCALE AudibleAlarm .
� � � � boolean Description Boolean indicating that the alarm is audible. Urgency 0 +
� c k x uint16 Description Urgency is an enumerated value that indicates the relative frequency at which the Alarm flashes, vibrates and/or emits audible tones. Values ( 1 8 G V d n Unknown Other Not Supported Informational Non-Critical Critical Unrecoverable VisibleAlarm 2
� � � � boolean Description Boolean indicating that the alarm is visible. T � � 0 � SetUrgency * Description SetUrgency is a method for defining the desired urgency level for the alarm. Its input parameter, RequestedUrgency, is specified using the Values list of CIM_AlarmDevice's Urgency property. SetUrgency returns 0 if the request is successfully implemented, 1 if the specified urgency level is not supported, and some other value if any other error occurred. a42c9160500003S ROOT\CIMV2\ms_409 ���� � �� �� * � ��� � __PARAMETERS abstract RequestedUrgency uint16
� < IN
� < c �� ID )
� � c ��� uint16 __ �� a42c9160500003S ROOT\CIMV2\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ �
C I M _ M e m o r y �tR|�C�� � CIM_Memory ) � ��� � � ] h � � � � 4 > � � � � ��������WU�����������������������������������������������������������������������������������������������������������������������������������������������������������y � CIM_CacheMemory Description Capabilities and management of cache memory. Cache memory is dedicated or allocated RAM that a Processor searches first for data, before going to 'regular' memory. CacheMemory is used to speed up the delivery of data to a Processor. It is usually described by its closeness to the Processor (for example, Primary or Secondary Cache).\nIf a DiskDrive includes RAM allocated for holding the disk's most recently read and/or adjacent data (in order to speed up retrieval), this also would be modeled as CacheMemory. Note that CacheMemory is NOT operating system or application level buffers but actual RAM allocated for caching data for a Processor, from a hard disk, etc. AMENDMENT LOCALE Associativity ! � +
� - � � uint16 Description An integer enumeration defining the system cache associativity. For example, 6 indicates a fully associative cache. Values � � � � . E Other Unknown Direct Mapped 2-way Set-Associative 4-way Set-Associative Fully Associative 8-way Set-Associative 16-way Set-Associative CacheType " � +
� � � � [ c uint16 Description Defines whether this is for instruction caching (value=3), data caching (value=4) or both (value=5, "Unified"). Also, "Other" (1) and "Unknown" (2) can be defined. Values { � � � � Other Unknown Instruction Data Unified FlushTimer # � +
� � � � � uint32 Description Maximum amount of time, in seconds, dirty lines or buckets may remain in the cache before they are flushed. A value of zero indicated that a cache flush is not controlled by a flushing timer. Units seconds Level $ � +
� ' � � uint16 Description Defines whether this is the primary (value=3), secondary (value=4) or tertiary (value=5) cache. Also, "Other" (1), "Unknown" (2) and "Not Applicable" (6) can be defined. Values � � $ Other Unknown Primary Secondary Tertiary Not Applicable LineSize % � +
� w � � � uint32 Description Size, in bytes, of a single cache bucket or line. Units bytes ReadPolicy & � +
� ' �
�
uint16 Description Policy that shall be employed by the cache for handling read requests. For example, "Read", "Read-Ahead" or both can be specified using the values, 3, 4 or 5, respectively. If the read policy is determined individually (ie, for each request), then the value 6 ("Determination per I/O") should be specified. "Other" (1) and "Unknown" (2) are also valid values. Values �
�
�
�
�
�
Other Unknown Read Read-Ahead Read and Read-Ahead Determination Per I/O ReplacementPolicy ' � +
� N V c � � uint16 Description An integer enumeration describing the algorithm to determine which cache lines or buckets should be re-used. Values �
( C ] z � Other Unknown Least Recently Used (LRU) First In First Out (FIFO) Last In First Out (LIFO) Least Frequently Used (LFU) Most Frequently Used (MFU) Data Dependent Multiple Algorithms WritePolicy ( � +
�
�
uint16 Description Defines whether this is write-back (value=3) or write-through (value=4) Cache, or whether this information "Varies with Address" (5) or is defined individually for each I/O (6). Also, "Other" (1) and "Unknown" (2) can be specified. Values " ) 2 > M b Other Unknown Write Back Write Through Varies with Address Determination Per I/O � __ �ocation. em � g � __ � � � �u�@ a u�*� c p?�� X
C I M _ U S B H u b 5̝��C�5 W CIM_USBHub 6 � �� � ! ' O Y � � ��������������������������������������������������������������������������������������o � Win32_USBHub CIMWin32a Locale UUID {52E56374-B17E-41DC-00EC-FC3E6E8D8783} DeviceID @ N
� � � �� � ��� � � � � string MaxLen Override DeviceID MappingStrings � Name @ 6
� = � ��E O U e string Override Name MappingStrings m � C I M _ B a t t e r y ltR|�C�5 k CIM_Battery
) � ��� � � . 8 � � ������_����������������������������������������������������������������������������������������������������_ � Win32_Battery Description The Win32_Battery class represents a battery connected to the computer system. This class applies to both batteries in Laptop Systems and other internal/external batteries. AMENDMENT LOCALE BatteryRechargeTime \ +
� + 3 @ % uint32 Description The BatteryRechargeTime property indicates the time required to fully charge the battery.
The BatteryRechargeTime property has been deprecated. There is no replacementvalue and this property is now considered obsolete. Units minutes DeviceID @ )
� o w � � �� string Description The DeviceID property contains a string identifying the battery.
Example: Internal Battery ExpectedBatteryLife ` +
� . 6 C O V uint32 Description The ExpectedBatteryLife property indicates the amount of time it takes to completely drain the battery after it has been fully charged.
The ExpectedBatteryLife property has been deprecated. There is no replacementvalue and this property is now considered obsolete. Units minutes � C I M _ C D R O M D r i v e ytR|�C�$ � CIM_CDROMDrive ) � ��� � � � � % 5 0 A � � � � + 9 � � 4
A
7 Q
�
�
T e � � � � 6 D # � � � � ������UUUUU��������������������������������������������������������������������������������������������������������������������������������������������������������������������������������k � Win32_CDROMDrive Description The Win32_CDROMDrive class represents a CD-ROM drive on a Win32_ComputerSystem.
Note: The name of the drive does not correspond to the logical drive letter assigned to device. AMENDMENT LOCALE DeviceID @ )
� & . ; � �� string Description The DeviceID property contains a string to uniquely identify this CD-ROM drive. Drive d
� � � � string Description The Drive property indicates the drive letter of the CD ROM drive.
Example: d:\ DriveIntegrity h
� a j w boolean Description The DriveIntegrity property indicates whether files can be accurately read from the CD device. This is achieved by reading a block of data twice and comparing the data against itself. FileSystemFlags j
� m u � uint16 Description The FileSystemFlags property is deprecated in favor of FileSystemFlagsEx FileSystemFlagsEx l +
� + � � uint32 BitValues g ~ � � � � � � 5 K ` u Case Sensitive Search Case Preserved Names Unicode On Disk Persistent ACLs File Compression Volume Quotas Supports Sparse Files Supports Reparse Points Supports Remote Storage Supports Long Names Volume Is Compressed Supports Object IDs Supports Encryption Supports Named Streams Description The FileSystemFlagsEx property indicates the file system flags associated with the Win32 CD-ROM drive. This parameter can be any combination of flags. FS_FILE_COMPRESSION and FS_VOL_IS_COMPRESSED are mutually exclusive.
Example: 0. Id p
� � � � string Description The Id property indicates the driver letter uniquely identifying this CD-ROM drive.
Example: d:\ Manufacturer t
� e m z string Description The Manufacturer property indicates the manufacturer of the Win32 CD-ROM drive.
Example: PLEXTOR MaximumComponentLength x
� ( 5 uint32 Description The MaximumComponentLength property indicates the maximum length of a filename component supported by the Win32 CD-ROM drive. A filename component the portion of a filename between backslashes. The value can be used to indicate that long names are supported by the specified file system. For example, for a FAT file system supporting long names, the function stores the value 255, rather than the previous 8.3 indicator. Long names can also be supported on systems that use the NTFS file system.
Example: 255. MediaLoaded |
� m
v
�
boolean Description The MediaLoaded property indicates whether a CD-ROM is in the drive.
Values: TRUE or FALSE. If TRUE, the CD is in the drive. MediaType ~ +
� E M Z � � string Description The MediaType property indicates the type of media used or accessed by this device. In this class, the value will always be "CD-ROM". Values � / Random Access Supports Writing Removable Media CD-ROM MfrAssignedRevisionLevel ! �
� } � � string Description The MfrAssignedRevisionLevel property indicates the manufacturer assigned firmware revision level of the CDROM drive.
RevisionLevel " �
� E
M
Z
string Description The RevisionLevel property indicates the firmware revision level of the Win32 CD-ROM drive. SCSIBus # �
� �
�
uint32 Description The SCSIBus property indicates the SCSI bus number for the disk drive.
Example: 0 SCSILogicalUnit $ �
� � � � uint16 Description The SCSILogicalUnit property indicates the SCSI logical unit number (LUN) of the disk drive. The LUN is used to designate which SCSI controller is being accessed in a system with more than one controller being used. The SCSI device ID is similar, but is the designation for multiple devices on one controller.
Example: 0 SCSIPort % �
� ' 4 uint16 Description The SCSIPort property indicates the SCSI port number of the disk drive.
Example: 1 SCSITargetId & �
� � � � uint16 Description The SCSITargetId property indicates the SCSI ID number of the Win32 CD-ROM drive.
Example: 0. SerialNumber ' �
� p x � string Description The Serial number property is a manufacturer-allocated number used to identify the physicalmedia.
Example: WD-WM3493798728 for a disk serial number. Size ( � +
� \ d q � � uint64 Description The Size property indicates the size of the disk drive. units bytes TransferRate ) � +
� � � � Real64 Description The TransferRate property indicates the CD-ROM drive's transfer rate. A value of -1 indicates that the rate could not be determined. This could potentially happen, for example, if the CD is not in the drive. Units kilobytes per second VolumeName * �
� : B O string Description The VolumeName property indicates the volume name of the Win32 CD-ROM drive. VolumeSerialNumber + �
� � � � string Description The VolumeSerialNumber property indicates the volume serial number of the media in the CD-ROM drive.
Example: A8C3-D032 � minutes �obsolete. � � � u- C I M _ P r o d u c t ��C�\ o CIM_Product
N � E � ��N ^ u �� � � � � D Q � � � � . ` n � � $ 2 d r � � � � " - _ k � � � � % W f � � �UUUU��������������������������������������������������������������������������������������������������������� � Win32_Product Locale UUID {CE3324AA-DB34-11d2-85FC-0000F8102E5F} MSIProv MappingStrings f Microsoft.MSI SupportsUpdate AssignmentType 6
� � � �� uint16 HelpLink H
� � � �� string HelpTelephone L
� < � �� string InstallDate " '
� � � �� � �� string DEPRECATED InstallDate2 e
&
� � � �� datetime InstallLocation
2
� � �� string InstallSource D
� X � �� string InstallState )
� � � ��� � sint16 ValueMap � � � � � � -6 -2 -1 1 2 5 Language *
� � �� string LocalPackage \
� \ � �� string PackageCache
� � � �� string PackageCode X
� � � �� string PackageName `
� � �� string ProductID @
� W � �� string RegCompany <
� � � �� string RegOwner 8
� � � �� string Transforms .
� � �� string URLInfoAbout P
� O � �� string URLUpdateInfo T
� � � �� string WordCount d
� � � �� uint32 �% r � � n �
{ � h � a j � \ � � : �! a# l# �# �# C% � Install ' 0 ��8 ��E O static Implemented ValueMap _ b n 0 2147549445 .. ae442007200009F ROOT\cimv2 ���� � �� �� � = � G * � ����������� � __PARAMETERS abstract PackageLocation string
� ; in
� ; b �� ID )
� � b ��� string Options string
� � in
� � �� ID )
� ~ ��C string AllUsers boolean
� � DEPRECATED
� � � �� in '
� � � �� �� ID 4
� � �� ��9 boolean __ �y ae442007200009F ROOT\cimv2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � Admin ' , ��4 ��A K static Implemented ValueMap [ ^ j 0 2147549445 .. ae442007200009F ROOT\cimv2 ���� � ��
�� � * � � N ������������@ � __PARAMETERS abstract PackageLocation string
� ; in
� ; b �� ID )
� � b ��� string TargetLocation string
� � in
� � �� ID )
� � ��J string Options string
� � in
� � � �� ID )
� 8 � ��� string __ �y ae442007200009F ROOT\cimv2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � Advertise ' 9 ��A ��N X static Implemented ValueMap h k w 0 2147549445 .. ae442007200009F ROOT\cimv2 ���� � �� �� � = � G * � ����������� � __PARAMETERS abstract PackageLocation string
� ; in
� ; b �� ID )
� � b ��� string Options string
� � in
� � �� ID )
� ~ ��C string AllUsers boolean
� � DEPRECATED
� � � �� in '
� � � �� �� ID 4
� � �� ��9 boolean __ �y ae442007200009F ROOT\cimv2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � Reinstall . ��; E Implemented ValueMap U X d 0 2147549445 .. x ae442007200009F ROOT\cimv2 ���� � �% �� * j � __PARAMETERS abstract ReinstallMode uint16
� 9 In
� 9 ` ��
� � � � � � � � � � 1 2 3 4 5 6 7 8 9 10 Valuemap )
� 9 ` ��� � ID 6
� b ` ��� � uint16 __ �y ae442007200009F ROOT\cimv2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � Upgrade � ��� � Implemented ValueMap � � � ч �Ν��C�_ ) � �� � � StdRegProv Locale RegProv f� : � K oca V � � � � b Q ] � � � � D S � � {" �" �" 9( �) �) �) . �0 �0 -1 95 ,8 <8 k8 �= d? t? �? �C �F �F �F ^L �M �M N +R U 2U aU �Z Z\ r\ �\ �` �c �c �c Vi �j �j k o r r Er Ov Dy [y �y �} I ` � Y� z� � CreateKey % ��2 �� implemented static � ae442007200009F ROOT\cimv2 ���� � �= �� * � � C ������ � __PARAMETERS abstract hDefKey uint32
� 3 IN
� 3 Z �� ID )
� � Z ��� uint32 sSubKeyName string
� � IN
� � �� ID )
� z ��? string __ �y ae442007200009F ROOT\cimv2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � DeleteKey p ��} �� implemented static � ae442007200009F ROOT\cimv2 ���� � �= �� * � � C ������ � __PARAMETERS abstract hDefKey uint32
� 3 IN
� 3 Z �� ID )
� � Z ��� uint32 sSubKeyName string
� � IN
� � �� ID )
� z ��? string __ �y ae442007200009F ROOT\cimv2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � EnumKey � ��� �� implemented static � ae442007200009F ROOT\cimv2 ���� � �= �� * � � C ������ � __PARAMETERS abstract hDefKey uint32
� 3 IN
� 3 Z �� ID )
� � Z ��� uint32 sSubKeyName string
� � IN
� � �� ID )
� z ��? string __ �� ae442007200009F ROOT\cimv2 ���� � �� �� � * � ��������H � __PARAMETERS abstract sNames string
� 2 out
� 2 Y �� ID )
� � Y ��� string ReturnValue uint32
� uint32 out
� �� __ � EnumValues w ��� �� implemented static � ae442007200009F ROOT\cimv2 ���� � �= �� * � � C ������ � __PARAMETERS abstract hDefKey uint32
� 3 IN
� 3 Z �� ID )
� � Z ��� uint32 sSubKeyName string
� � IN
� � �� ID )
� z ��? string __ �[ ae442007200009F ROOT\cimv2 ���� � �
�� � � * � � > ������������� � __PARAMETERS abstract sNames string
� 2 out
� 2 Y �� ID )
� � Y ��� string Types sint32
� � out
� � �� ID )
� u ��: sint32 ReturnValue uint32
� � uint32 out
� � � �� __ � DeleteValue � ��� �� implemented static ae442007200009F ROOT\cimv2 ���� � ��
�� * � � C � � ���������8 � __PARAMETERS abstract hDefKey uint32
� 3 IN
� 3 Z �� ID )
� � Z ��� uint32 sSubKeyName string
� � IN
� � �� ID )
� z ��? string sValueName string
� � in
� � � �� ID )
� 0 � ��� string __ �y ae442007200009F ROOT\cimv2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � SetDWORDValue m ��z �� implemented static x ae442007200009F ROOT\cimv2 ���� � �% �� * � � C � � J � ��������� � � __PARAMETERS abstract hDefKey uint32
� 3 IN
� 3 Z �� ID )
� � Z ��� uint32 sSubKeyName string
� � IN
� � �� ID )
� z )
� z ��? string sValueName string
� � in
� � � �� ID )
� 0 � ��� string uValue uint32
� R in
� R y �� ID )
� � y ��� uint32 __ �{ ae442007200009F ROOT\Default ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � SetQWORDValue �" ���" �� implemented static ~ ae442007200009F ROOT\Default ���� � �) �� * � � C � � J � ��������� � � __PARAMETERS abstract hDefKey uint32
� 3 IN
� 3 Z �� ID )
� � Z ��� uint32 sSubKeyName string
� � IN
� � �� ID )
� z ��? string sValueName string
� � in
� � � �� ID )
� 0 � ��� string uValue uint64
� R in
� R y �� ID )
� � y ��� uint64 __ �{ ae442007200009F ROOT\Default ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � GetDWORDValue �) ��* �� implemented static
ae442007200009F ROOT\Default ���� � ��
�� * � � C � � ���������8 � __PARAMETERS abstract hDefKey uint32
� 3 IN
� 3 Z �� ID )
� � Z ��� uint32 sSubKeyName string
� � IN
� � �� ID )
� z ��? string sValueName string
� � in
� � � �� ID )
� 0 � ��� string __ �� ae442007200009F ROOT\Default ���� � �� �� � * � ��������H � __PARAMETERS abstract uValue uint32
� 2 out
� 2 Y �� ID )
� � Y ��� uint32 ReturnValue uint32
� uint32 out
� �� __ � GetQWORDValue 81 ��E1 �� implemented static
ae442007200009F ROOT\Default ���� � ��
�� * � � C � � ���������8 � __PARAMETERS abstract hDefKey uint32
� 3 IN
� 3 Z �� ID )
� � Z ��� uint32 sSubKeyName string
� � IN
� � �� ID )
� z ��? string sValueName string
� � in
� � � �� ID )
� 0 � ��� string __ �� ae442007200009F ROOT\Default ���� � ��
�� � * � ������������H � __PARAMETERS abstract uValue uint64
� 2 out
� 2 Y �� ID )
� � Y ��� uint64 ReturnValue uint32
� uint32 out
� �� __ � SetStringValue z8 ���8 �� implemented static z ae442007200009F ROOT\Default ���� � �% �� * � � C J � � � ���������y � � __PARAMETERS abstract hDefKey uint32
� 3 IN
� 3 Z �� ID )
� � Z ��� uint32 sSubKeyName string
� � IN
� � �� ID )
� z ��? string sValueName string
� � in
� � � �� ID )
� 0 � ��� string sValue string
� R hello in
� R � �� ID )
� � � ��� string __ �{ ae442007200009F ROOT\Default ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � GetStringValue �? ���? �� implemented static
ae442007200009F ROOT\Default ���� � ��
�� * � � C � � ���������8 � __PARAMETERS abstract hDefKey uint32
� 3 IN
� 3 Z �� ID )
� � Z ��� uint32 sSubKeyName string
� � IN
� � �� ID )
� z ��? string sValueName string
� � in
� � � �� ID )
� 0 � ��� string __ �� ae442007200009F ROOT\Default ���� � �� �� � * � ��������H � __PARAMETERS abstract sValue string
� 2 out
� 2 Y �� ID )
� � Y ��� string ReturnValue uint32
� uint32 out
� �� __ � SetMultiStringValue �F ��G �� implemented static z ae442007200009F ROOT\Default ���� � �% �� * � � C J � � � ���������y � __PARAMETERS abstract hDefKey uint32
� 3 IN
� 3 Z �� ID )
� � Z ��� uint32 sSubKeyName string
� � IN
� � �� ID )
� z ��? string sValueName string
� � in
� � � �� ID )
� 0 � ��� string sValue string
� R � � hello there in
� R � �� ID )
� � � ��� string __ �{ ae442007200009F ROOT\Default ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � GetMultiStringValue :N ��GN �� implemented static
ae442007200009F ROOT\Default ���� � ��
�� * � � C � � ���������8 � __PARAMETERS abstract hDefKey uint32
� 3 IN
� 3 Z �� ID )
� � Z ��� uint32 sSubKeyName string
� � IN
� � �� ID )
� z ��? string sValueName string
� � in
� � � �� ID )
� 0 � ��� string __ �� ae442007200009F ROOT\Default ���� � �� �� � * � ��������H � __PARAMETERS abstract sValue string
� 2 out
� 2 Y �� ID )
� � Y ��� string ReturnValue uint32
� uint32 out
� �� __ � SetExpandedStringValue �U ���U �� implemented static z ae442007200009F ROOT\Default ���� � �% �� * � � C J � � � ���������y � � __PARAMETERS abstract hDefKey uint32
� 3 IN
� 3 Z �� ID )
� � Z ��� uint32 sSubKeyName string
� � IN
� � �� ID )
� z ��? string sValueName string
� � in
� � � �� ID )
� 0 � ��� string sValue string
� R %path% in
� R � �� ID )
� � � ��� string __ �{ ae442007200009F ROOT\Default ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � GetExpandedStringValue �\ ���\ �� implemented static
ae442007200009F ROOT\Default ���� � ��
�� * � � C � � ���������8 � __PARAMETERS abstract hDefKey uint32
� 3 IN
� 3 Z �� ID )
� � Z ��� uint32 sSubKeyName string
� � IN
� � �� ID )
� z ��? string sValueName string
� � in
� � � �� ID )
� 0 � ��� string __ �� ae442007200009F ROOT\Default ���� � �� �� � * � ��������H � __PARAMETERS abstract sValue string
� 2 out
� 2 Y �� ID )
� � Y ��� string ReturnValue uint32
� uint32 out
� �� __ � SetBinaryValue d ��d �� implemented static y ae442007200009F ROOT\Default ���� � �$ �� * � � C � � J � ���������x � � __PARAMETERS abstract hDefKey uint32
� 3 IN
� 3 Z �� ID )
� � Z ��� uint32 sSubKeyName string
� � IN
� � �� ID )
� z ��? string sValueName string
� � in
� � � �� ID )
� 0 � ��� string uValue uint8
� R in
� R ~ �� ID )
� � ~ ��� uint8 __ �{ ae442007200009F ROOT\Default ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � GetBinaryValue =k ��Jk �� implemented static
ae442007200009F ROOT\Default ���� � ��
�� * � � C � � ���������8 � __PARAMETERS abstract hDefKey uint32
� 3 IN
� 3 Z �� ID )
� � Z ��� uint32 sSubKeyName string
� � IN
� � �� ID )
� z ��? string sValueName string
� � in
� � � �� ID )
� 0 � ��� string __ �� ae442007200009F ROOT\Default ���� � �� �� � * � ��������F � __PARAMETERS abstract uValue uint8
� 2 out
� 2 X �� ID )
� � X ��� uint8 ReturnValue uint32
� uint32 out
� �� __ � CheckAccess tr ���r �� implemented static ae442007200009F ROOT\Default ���� � ��
�� * � � C � � ����� 7 � __PARAMETERS abstract hDefKey uint32
� 3 IN
� 3 Z �� ID )
� � Z ��� uint32 sSubKeyName string
� � IN
� � �� ID )
� z ��? string uRequired uint32
� � in
� � � �� ID )
� / � ��� uint32 __ �� ae442007200009F ROOT\Default ���� � �� �� * � � " ������L � __PARAMETERS abstract bGranted boolean
� 4 out
� 4 \ �� ID )
� � \ ��� boolean ReturnValue uint32
� uint32 out
� �� __ � SetSecurityDescriptor ' �y ���y ���y �y implemented static Privileges �y SeSecurityPrivilege
ae442007200009F ROOT\Default ���� � ��
�� � � * � � C ���������M � __PARAMETERS abstract hDefKey uint32
� 3 IN
� 3 Z �� ID )
� � Z ��� uint32 sSubKeyName string
� � IN
� � �� ID )
� z ��? string
Descriptor object
� � IN
� � � �� ID
)
� 0 � ��� object:__SecurityDescriptor __ �{ ae442007200009F ROOT\Default ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � GetSecurityDescriptor ' � ��� ��� � implemented static Privileges � SeSecurityPrivilege � ae442007200009F ROOT\Default ���� � �= �� * � � C ������ � __PARAMETERS abstract hDefKey uint32
� 3 IN
� 3 Z �� ID )
� � Z ��� uint32 sSubKeyName string
� � IN
� � �� ID )
� z ��? string __ � ae442007200009F ROOT\Default ���� � �� �� * � � 7 ��������a � __PARAMETERS abstract
Descriptor object
� 6 OUT
� 6 ] �� ID
)
� � ] ��� object:__SecurityDescriptor ReturnValue uint32
� * uint32 out
� * 2 �� __ �278 IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.292.3304868461.368 IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.292.3624726292.180 CR_8CFD3BDCF459E28A190CCF46FF43F533DE3394389F988133FD28EA5A0AEA1616 C_244B2D44BCFE4686A8EB1967E3535273855A686C9B62600F3309068E24B5ABB8 CR_A9FE98FE5C3E9051AEEC71D48BD2011F883E1553AA2DD7968A20C510AD60108F C_DF35CAA9032B2BC8E9E68BEFAD5091A66EF205D46DBC51F13F62EC987E8BBEAC CR_D628E03D0677752FF789EA97E9BA34C4E2A9B6A38484A7C74F4BA213CAD47E8C C_6EB3291DAFAF5E4121A6DBB7E0E41C22E85218F8922D3C0FEDA4960BE686F47A CR_DF35CAA9032B2BC8E9E68BEFAD5091A66EF205D46DBC51F13F62EC987E8BBEAC C_0ED8829CD55CB10045BE12FF28DC63BFD30CC65BF9376DAA6A5D15ADE3CAC700 CR_E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 C_4890EFF41348A2D3FA104A85C8075E20E025F7CF40D004E2BC1C3C9AA54865F4 C_9AB53806E88665C047824D5369B271C53B233BBEAC7C15BE3BA9BD214E527500 C_A9FE98FE5C3E9051AEEC71D48BD2011F883E1553AA2DD7968A20C510AD60108F I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.292.3304868461.368 CD_4BD0F8A6C8D9EC0678D50228DC3CB44B9F26CFF9B291F8B882B0AD7C252B23A9.290.1095409419.269 C_4BD0F8A6C8D9EC0678D50228DC3CB44B9F26CFF9B291F8B882B0AD7C252B23A9 CD_A57480D0D82DDE51E01CC9C7625981822E2D1C37B70F78DC6E6179505A7BD928.290.3249098849.173 C_A57480D0D82DDE51E01CC9C7625981822E2D1C37B70F78DC6E6179505A7BD928 KI_7010B213179D98B16AF38723EE1D750E86F808F341EE215AD8783D29EA117262 I_3E78A37E1DE70357C353A15D6BBB8A17A1D31F8D501ED8F1C3EB8104F5B04F97.293.3147664306.336 KI_CFF41370C70E26A169C5F7CC5594050646C5B9BC0F0D1F0FC4733FA2AA35939C I_B9EE4A50A67D6134A9B62FB7EC1E9B243A0F3C36ECEF51393A3D740A782225E0.293.2243816916.310 IR_3E78A37E1DE70357C353A15D6BBB8A17A1D31F8D501ED8F1C3EB8104F5B04F97 R_4455530D790C6A107153E4E0AEE1E7EE6D9C30EDA76C55D7338F9CCA63A2DE7F.293.1997109422.538 I_9C256CE37E6F9177BC0EC95344373747E0112D20D664373933986EE480BE67C9.294.882971062.338 I_BAC3F6A6A35DD56CC51CAD0BAF325F0D287989C281F534A9DBB76FD59710B3DE.294.3852914823.294 IR_9C256CE37E6F9177BC0EC95344373747E0112D20D664373933986EE480BE67C9 R_DB6E1ADD60BCFBD74FE22E3F1E6B369F784D5130B2625B864533316DFC13198C.294.158073017.538 I_2515B1950A64510A509CF61C80D68865E7CFF544688645F2490CFFE0E6C807F2.295.2242181469.338 I_7CF7DA788CB633591FE5B31F4F2207A3A629FD098D55AD1913CE2E46186B87B6.295.4261050367.300 IR_2515B1950A64510A509CF61C80D68865E7CFF544688645F2490CFFE0E6C807F2 R_CF8FDBB8C50EA6F07E9534765AE8F402553A990211E70BCC0755623188D0291B.295.726564256.538 I_BBFCCB444CF66AA09AE6F15967A6865175BB0ED216D19970A7988B72CDF0A3A4.295.2114643707.342 I_CB9763CADFAE461DFE976536B62DC6599EB9A4BFDCF34872007002B0B9896A3A.295.2503527435.308 IR_BBFCCB444CF66AA09AE6F15967A6865175BB0ED216D19970A7988B72CDF0A3A4 R_0D7451EEA0088D16D6131132974E7291CE514FD636F5E279488B0F03E91EC12A.295.375799088.538 I_8467A5D32DFAA09A39BDC8BB8DDCC953CDC4A4C5E390EC615CB5FA0C07CF5251.295.1875526186.333 I_A7E84BB1D3739B54369DFFE44BADD220083DD356D5C5AB46BF570D9C77D7DC19.295.817572890.306 IR_8467A5D32DFAA09A39BDC8BB8DDCC953CDC4A4C5E390EC615CB5FA0C07CF5251 R_D08323D375F5031C5977F7C831287E1CB6B4B4DF2FE32E858BB25E27E0DA10CB.295.3915170307.538 KI_64659AB9F8F1C4B568DB6438BAE11B26EE8F93CB5F8195E21E8C383D6C44CC41 I_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.293.3944672055.188 I_6BED86547A30ACCAD1302C7FA283B163848C4E58E936CB646E57DB7DE244D555.1021.133538043.339 IR_6BED86547A30ACCAD1302C7FA283B163848C4E58E936CB646E57DB7DE244D555 R_A44291686EEE07EF9D8E0D67D761FE07329503F95F8137BDF2C38F8956E7EE60.1021.2264341995.522 I_20A2FCD02AFF243CF774088A45E089FBE5A849A9F82F70950D8BFE6D4323904A.1021.2401429720.326 KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD I_59BFAFEBF60E8B2104B07BA7FADAF4FCFEB18999FE92B11F1C00E938CB4B93A6.1021.1898447601.246 IR_20A2FCD02AFF243CF774088A45E089FBE5A849A9F82F70950D8BFE6D4323904A R_1D9C167DBCE9A78A43B43F1489BD8AC706879DE5CF7089023DE2D9860F84D836.1021.2519508106.524 KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C I_59BFAFEBF60E8B2104B07BA7FADAF4FCFEB18999FE92B11F1C00E938CB4B93A6.1021.24318390.270 R_3FE01F381F5BCCC88268B37C2B314A2D521AE6DB7BA30597F005D1DA4B99A772.1022.946249351.528 I_1275BE448083C5AAB33DAF19956853ED9EA842E05F94D0AD39A63BA94DDA43EA.1022.3797763611.330 KI_A5134EAE65D9DD02F6CE0E924C84D387C2BC76C9409B3E6C9F586619D35EA1DA I_2B425BF8CE8732BEB182F0BC728E928FFB0498DF8A9FBACA0C514518961A5460.1022.3488569371.256 �&�� � ��� r�� � �\1�{ O ��[�� � #V�� ɧr?� / �')�� S ��� + |�;1J i \V��� � �ޮ&� � �7�}
C I M _ M a n a g e d E l e m e n t bҝ��C�� ) CIM_ManagedElement ��! * 1 L � � � � 7 � � , D � � U���������������������������������������� � CIM_RegisteredProfile Abstract Version 2.8.0 AdvertiseTypeDescriptions " +
� � � � � � string ArrayType Indexed ModelCorrespondence � CIM_RegisteredProfile.AdvertiseTypes AdvertiseTypes C
� E M ��W a z � � � uint16 Required ValueMap q t w 1 2 3 ArrayType Indexed ModelCorrespondence � CIM_RegisteredProfile.AdvertiseTypeDescriptions InstanceID
� � �� string OtherRegisteredOrganization +
� p x � � string MaxLen ModelCorrespondence � CIM_RegisteredProfile.RegisteredOrganization RegisteredName )
� ��$ string Required MaxLen RegisteredOrganization 6
� � � ��� � 7 L uint16 Required ValueMap � � � � # ' + / 3 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 ModelCorrespondence T CIM_RegisteredProfile.OtherRegisteredOrganization RegisteredVersion
� � � �� string Required � C I M _ C o l l e c t i o n cҝ��C�� CIM_Collection �� % 7 s � � ����������������������������b � CIM_Group Abstract Version 2.6.0 BusinessCategory
� c k � string MaxLen CommonName
� � � �� string Required CreationClassName )
� � ��
string MaxLen Name )
� R � ��Z string MaxLen � C I M _ L o g i c a l E l e m e n t dҝ��C�� \ CIM_LogicalElement
�� ' : � � � � � - 3 � � � � D M t � � � � � * ��WUU���������������������������������������������������������������������������������������i � CIM_Account Abstract Version 2.8.0 CreationClassName * )
� q � ��y string MaxLen Descriptions 6
� � � string MaxLen Host :
� � string LocalityName >
� % string Name @ 6
� w � �� � � string Override Name MaxLen ObjectClass
2
� � string OrganizationName B
� �� string Required OU F
� < string SeeAlso J
� l string SystemCreationClassName " 6
� � � ��� � string Propagated CIM_System.CreationClassName MaxLen SystemName
& 6
� [ � ��c o � string Propagated CIM_System.Name MaxLen UserCertificate N
� � � �� string OctetString UserID .
� string MaxLen UserPassword R
� T \ �� string OctetString � C I M _ M a n a g e d E l e m e n t eҝ��C� CIM_ManagedElement �� " ) 5 / C � � 1 C k } T������������������������������~ � CIM_Privilege Abstract Version 2.8.0 Activities 8
� { � � � � � uint16 ValueMap � � � � � � � � � 1 2 3 4 5 6 7 ..15999 16000.. ArrayType Indexed ModelCorrespondence
CIM_Privilege.ActivityQualifiers ActivityQualifiers +
� | � � � � string ArrayType Indexed ModelCorrespondence � � CIM_Privilege.Activities CIM_Privilege.QualifierFormats InstanceID
� ) � �� string PrivilegeGranted
� b boolean QualifierFormats 8
� � � � + 6 ? T uint16 ValueMap
" 2 3 4 5 6 7 8 9 ..15999 16000.. ArrayType Indexed ModelCorrespondence \ CIM_Privilege.ActivityQualifiers �
C I M _ P r i v i l e g e fҝ��C�� CIM_Privilege ��# , ��������������������������������3 � CIM_AuthorizedPrivilege Abstract Version 2.8.0 � C I M _ C o l l e c t i o n gҝ��C�� CIM_Collection ��" + 2 > ����������������p � CIM_ConcreteCollection Abstract Version 2.8.0 InstanceID
� h � �� string � C I M _ A d m i n D o m a i n hҝ��C�� I CIM_AdminDomain 6 � �� �
$ ��������������������������������������� ���� ������������������������L � AdminDomain IPMIPrv Locale UUID {f0610966-50c3-47ab-8db5-a2f3bccf3cb1} � C I M _ C o m p u t e r S y s t e m iҝ��C� a CIM_ComputerSystem 6 � �� � ! ' ����������������������������������������� ���� ����������������������������������������������O � ComputerSystem IPMIPrv Locale UUID {a3ec8fe8-83cd-40af-9513-11936d531cea} � C I M _ S y s t e m S p e c i f i c C o l l e c t i o n jҝ��C�� & CIM_SystemSpecificCollection 6 � �� � # + 1 �����������������Y � SystemSpecificCollection IPMIPrv Locale UUID {49987cb1-a986-48bf-b668-65ece707c238} �
C I M _ S e n s o r kҝ��C�= � CIM_Sensor 6 � �� � ������������������������������������������� ���� ��������������������������������������������������������������������������������������������������G � Sensor IPMIPrv Locale UUID {61da4c13-cdca-44d5-ba39-dc4c73e5e049} � C I M _ N u m e r i c S e n s o r lҝ��C�� � CIM_NumericSensor 6 � �� � & ������������������������������������������������� ���� ����������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������N � NumericSensor IPMIPrv Locale UUID {7be7579b-4370-4a75-857c-9e789d1aff8a} �
C I M _ R e c o r d L o g mҝ��C�� I CIM_RecordLog 6 � �� � " ��������������������������������������� ���� ������������������������J � RecordLog IPMIPrv Locale UUID {ec524523-0bda-434b-941e-8f296cbf97a6} �
& * � � ClearLog �� Implemented | ae442007200009F ROOT\Hardware ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ �
C I M _ L o g R e c o r d nҝ��C�� / CIM_LogRecord 6 � �� � " �����������������������������������������������J � LogRecord IPMIPrv Locale UUID {5efd8f2b-e1c7-46c1-a5cc-3aa70779c862} � ��? string sValueName string
� � in
� � � �� ID )
� 0 � ��� string uValue uint32
� R in
� R y �� ID )
� � y ��� uint32 __ �y ae442007200009F ROOT\cimv2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � SetQWORDValue �" ���" �� implemented static | ae442007200009F ROOT\cimv2 ���� � �) �� * � � C � � J � ��������� � � __PARAMETERS abstract hDefKey uint32
� 3 IN
� 3 Z �� ID )
� � Z ��� uint32 sSubKeyName string
� � IN
� � �� ID )
� z ��? string sValueName string
� � in
� � � �� ID )
� 0 � ��� string uValue uint64
� R in
� R y �� ID )
� � y ��� uint64 __ �y ae442007200009F ROOT\cimv2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � GetDWORDValue �) ���) �� implemented static ae442007200009F ROOT\cimv2 ���� � ��
�� * � � C � � ���������8 � __PARAMETERS abstract hDefKey uint32
� 3 IN
� 3 Z �� ID )
� � Z ��� uint32 sSubKeyName string
� � IN
� � �� ID )
� z ��? string sValueName string
� � in
� � � �� ID )
� 0 � ��� string __ �� ae442007200009F ROOT\cimv2 ���� � �� �� � * � ��������H � __PARAMETERS abstract uValue uint32
� 2 out
� 2 Y �� ID )
� � Y ��� uint32 ReturnValue uint32
� uint32 out
� �� __ � GetQWORDValue 1 ��%1 �� implemented static ae442007200009F ROOT\cimv2 ���� � ��
�� * � � C � � ���������8 � __PARAMETERS abstract hDefKey uint32
� 3 IN
� 3 Z �� ID )
� � Z ��� uint32 sSubKeyName string
� � IN
� � �� ID )
� z ��? string sValueName string
� � in
� � � �� ID )
� 0 � ��� string __ �� ae442007200009F ROOT\cimv2 ���� � ��
�� � * � ������������H � __PARAMETERS abstract uValue uint64
� 2 out
� 2 Y �� ID )
� � Y ��� uint64 ReturnValue uint32
� uint32 out
� �� __ � SetStringValue V8 ��c8 �� implemented static x ae442007200009F ROOT\cimv2 ���� � �% �� * � � C J � � � ���������y � � __PARAMETERS abstract hDefKey uint32
� 3 IN
� 3 Z �� ID )
� � Z ��� uint32 sSubKeyName string
� � IN
� � �� ID )
� z ��? string sValueName string
� � in
� � � �� ID )
� 0 � ��� string sValue string
� R hello in
� R � �� ID )
� � � ��� string __ �y ae442007200009F ROOT\cimv2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � GetStringValue �? ���? �� implemented static ae442007200009F ROOT\cimv2 ���� � ��
�� * � � C � � ���������8 � __PARAMETERS abstract hDefKey uint32
� 3 IN
� 3 Z �� ID )
� � Z ��� uint32 sSubKeyName string
� � IN
� � �� ID )
� z ��? string sValueName string
� � in
� � � �� ID )
� 0 � ��� string __ �� ae442007200009F ROOT\cimv2 ���� � �� �� � * � ��������H � __PARAMETERS abstract sValue string
� 2 out
� 2 Y �� ID )
� � Y ��� string ReturnValue uint32
� uint32 out
� �� __ � SetMultiStringValue �F ���F �� implemented static x ae442007200009F ROOT\cimv2 ���� � �% �� * � � C J � � � ���������y � __PARAMETERS abstract hDefKey uint32
� 3 IN
� 3 Z �� ID )
� � Z ��� uint32 sSubKeyName string
� � IN
� � �� ID )
� z ��? string sValueName string
� � in
� � � �� ID )
� 0 � ��� string sValue string
� R � � hello there in
� R � �� ID )
� � � ��� string __ �y ae442007200009F ROOT\cimv2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � GetMultiStringValue
N ��N �� implemented static ae442007200009F ROOT\cimv2 ���� � ��
�� * � � C � � ���������8 � __PARAMETERS abstract hDefKey uint32
� 3 IN
� 3 Z �� ID )
� � Z ��� uint32 sSubKeyName string
� � IN
� � �� ID )
� z ��? string sValueName string
� � in
� � � �� ID )
� 0 � ��� string __ �� ae442007200009F ROOT\cimv2 ���� � �� �� � * � ��������H � __PARAMETERS abstract sValue string
� 2 out
� 2 Y �� ID )
� � Y ��� string ReturnValue uint32
� uint32 out
� �� __ � SetExpandedStringValue LU ��YU �� implemented static x ae442007200009F ROOT\cimv2 ���� � �% �� * � � C J � � � ���������y � � __PARAMETERS abstract hDefKey uint32
� 3 IN
� 3 Z �� ID )
� � Z ��� uint32 sSubKeyName string
� � IN
� � �� ID )
� z ��? string sValueName string
� � in
� � � �� ID )
� 0 � ��� string sValue string
� R %path% in
� R � �� ID )
� � � ��� string __ �y ae442007200009F ROOT\cimv2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � GetExpandedStringValue �\ ���\ �� implemented static ae442007200009F ROOT\cimv2 ���� � ��
�� * � � C � � ���������8 � __PARAMETERS abstract hDefKey uint32
� 3 IN
� 3 Z �� ID )
� � Z ��� uint32 sSubKeyName string
� � IN
� � �� ID )
� z ��? string sValueName string
� � in
� � � �� ID )
� 0 � ��� string __ �� ae442007200009F ROOT\cimv2 ���� � �� �� � * � ��������H � __PARAMETERS abstract sValue string
� 2 out
� 2 Y �� ID )
� � Y ��� string ReturnValue uint32
� uint32 out
� �� __ � SetBinaryValue �c ���c �� implemented static w ae442007200009F ROOT\cimv2 ���� � �$ �� * � � C � � J � ���������x � � __PARAMETERS abstract hDefKey uint32
� 3 IN
� 3 Z �� ID )
� � Z ��� uint32 sSubKeyName string
� � IN
� � �� ID )
� z ��? string sValueName string
� � in
� � � �� ID )
� 0 � ��� string uValue uint8
� R in
� R ~ �� ID )
� � ~ ��� uint8 __ �y ae442007200009F ROOT\cimv2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � GetBinaryValue �j ��
k �� implemented static ae442007200009F ROOT\cimv2 ���� � ��
�� * � � C � � ���������8 � __PARAMETERS abstract hDefKey uint32
� 3 IN
� 3 Z �� ID )
� � Z ��� uint32 sSubKeyName string
� � IN
� � �� ID )
� z ��? string sValueName string
� � in
� � � �� ID )
� 0 � ��� string __ �� ae442007200009F ROOT\cimv2 ���� � �� �� � * � ��������F � __PARAMETERS abstract uValue uint8
� 2 out
� 2 X �� ID )
� � X ��� uint8 ReturnValue uint32
� uint32 out
� �� __ � CheckAccess 0r ��=r �� implemented static ae442007200009F ROOT\cimv2 ���� � ��
�� * � � C � � ����� 7 � __PARAMETERS abstract hDefKey uint32
� 3 IN
� 3 Z �� ID )
� � Z ��� uint32 sSubKeyName string
� � IN
� � �� ID )
� z ��? string uRequired uint32
� � in
� � � �� ID )
� / � ��� uint32 __ �� ae442007200009F ROOT\cimv2 ���� � �� �� * � � " ������L � __PARAMETERS abstract bGranted boolean
� 4 out
� 4 \ �� ID )
� � \ ��� boolean ReturnValue uint32
� uint32 out
� �� __ � SetSecurityDescriptor ' �y ���y ���y �y implemented static Privileges �y SeSecurityPrivilege ae442007200009F ROOT\cimv2 ���� � ��
�� � � * � � C ���������M � __PARAMETERS abstract hDefKey uint32
� 3 IN
� 3 Z �� ID )
� � Z ��� uint32 sSubKeyName string
� � IN
� � �� ID )
� z ��? string
Descriptor object
� � IN
� � � �� ID
)
� 0 � ��� object:__SecurityDescriptor __ �y ae442007200009F ROOT\cimv2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � GetSecurityDescriptor ' � ��� ��� � implemented static Privileges � SeSecurityPrivilege � ae442007200009F ROOT\cimv2 ���� � �= �� * � � C ������ � __PARAMETERS abstract hDefKey uint32
� 3 IN
� 3 Z �� ID )
� � Z ��� uint32 sSubKeyName string
� � IN
� � �� ID )
� z ��? string __ � ae442007200009F ROOT\cimv2 ���� � �� �� * � � 7 ��������a � __PARAMETERS abstract
Descriptor object
� 6 OUT
� 6 ] �� ID
)
� � ] ��� object:__SecurityDescriptor ReturnValue uint32
� * uint32 out
� * 2 �� __ �DE4EA2081AE CR_71EAB4D274B62BE0548BF7FDDBAA028C0F0BB11297C86BCB4512412235E01F04 C_E5893386A7B4C018092F4F8B136F60610FB13ED7B0A8A3475C8F55E3E9FBCB90 CR_88EB302CD16E8AAFC6641BEDCC17551C2C447BB8B7A2C0179406C6688EA18D65 C_09A1CD34FC28B461D4B117DD4689EFC08E3B06527FEBB7251285DFC403031764 CR_9A3419D1BEB3DD772F317128C59554641FCDDB696104EEE43BBF4385A72BA8A9 R_2E4CB0F875356763EA64F3060366993EE0D49772670FDDF29B1CAAF86CE9720B CR_B73E13EE752D9B5AF02139CC8E7B9DD86AA46977B13267D0D5F674F26F8C3D67 C_14EA8D1B614BC6D260E31F428D1651D98B6F7F8F49C7964016B24597B70B73AE CR_CAD4BC0418B92AF385128D89B08989F8AE935585E9C019DDE2E4449A4CA88416 C_61BD99E07DD9B896C168C32D63CDE78875D8845FB21EAF979A76CC25C89D073F CR_D6B1F4AAAFDB618A9CCA914AD92E90625471E15F06457F12DC8D813813101B8A C_B496E3C91F33B99F414E0CF911598E2EF9133E94328E67220F22C24A7531B226 CR_E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 C_329C7091D99134315D75F4D3A2328F98C961B173B884F03A89824A063291C3C4 C_F2BF551D2C47E413C4BD58FCB0E48E0B3211C53383EC4051E655BB8319ADD47D CR_F10840352061CD18DB7516F60841E629D131C524C9F2F089E5D2B510560FC583 C_B1D75A909E6CF2DABA2DE9D5B0D2A805DDF2E38027D332B19EBFB8BA7F770899 KI_7010B213179D98B16AF38723EE1D750E86F808F341EE215AD8783D29EA117262 IR_9731A66D417FDC024A9D93DAD0B38C4D96CBFD2BEC45E5FB4706D56140B553A0 R_6AE72BDD0B919DBFC69F59E9377DA38DCBBAC21329EE0949152EC064204ABDC2.11.3947071557.524 NS_88591E56F7DF51C96BBDD94E4112A5C7AADAE3154C1ACB64E20A2CB89B0D6F02 CD_0ED8829CD55CB10045BE12FF28DC63BFD30CC65BF9376DAA6A5D15ADE3CAC700.158.450744316.250 CD_25D6DE4F10F10C9622833D068798F50E89401E52F3D552BA53470C9A0F55267B.109.3477113492.1118 CR_BE7B96C50A5D954A89D26DEB913105A5F4A1453B9058D1ED2B066A1ED47BC2A6 C_8415A398133EAE0716C73F02F5C279072A12B0ED56A7172F6985A7EBD9376FCE CD_ED2E871CAA85DB91DA82D43856C298DADCDDAA2D7C9D06C8655F1779E6509A4E.34.1838294881.522 CD_C867B637B25E413A5893A8DF403F24B113B36FB9DA058811D901C232D15C4E60.34.835745797.730 CD_0685F0E7DE4E9ADE69B83CB6CC4B69291D69C22AD0E71A095A2E4AEBC8EC8B85.33.1958367369.441 NS_55B7453F9A92245078FCB5133CDA2D219EDE36D5B0C242DB457F8DA87C352EDB CD_455876B64E565F4962FC035AF2C8087D1797E42AAA9586F45C5A3E20F37175C3.291.2143025691.598 NS_3FBDCB08ECD33FBEF028D2DB3EF058F8CE959779B943F43AB3DB3EC34ACA147D CI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C IL_544CFC82C21CDF4713B5295DE1D928C00A64169D63339BF46F7D6B04314B4848.281.2513106506.266 KI_FD1C1D414B71B5082C266A650E31EF6D5019382724244B685F217C0AAE00A921 I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.292.3641209208.180 NS_511626FAE4F57DBD20DF5CD44A41DAECED28CF7B3FD8B12012C7F4B58F44E665 CI_C0C025C38981E58EE50CB7BB4E4786CBA14FD933E638861EA3A6A2E0C806211E IL_0AE842411B3B68BDB60FB4610360E1ECD2D583F7968316F79131DB25BF102F63.311.596629111.217 CR_A726CC10C860A315296DCD93520657C7C068B6652EE5FFD6550B3E0DAB8CACAE C_2F43B8EB8E14762A257D84DCB10913E4CD9E8069D8AEA3384120BB143668FB2E NS_43C2C02FBB103B6C99DD6A3C49100E0157200FB50F8CAEF2EC314CAEF9D9E15C CD_2515B1950A64510A509CF61C80D68865E7CFF544688645F2490CFFE0E6C807F2.295.2770572094.1172 NS_42E4E0D295908E5E61369FD892A1F8D55E4601E6F286F3D44587BC7BAFF4CF40 CR_1283D6E2E269ECFAA20DDCA78E5D8B7B8AC13879915B95F38BE4B062F89C60F6 C_366404C6BBC789A7EE3D5ACCDE9C5AB09583CC8BC05AB7F7F7498213BA102D4C CI_CE7B495DC4F9C5B3025BD303D59CCF3C872F4A46BF11E24BFCC42869498C54B0 IL_41CD80BFBD3EF2A72B1311F93D87AFDE77273A97897B7B012F0BFA851DE8E60A.316.3628980226.297 KI_CE7B495DC4F9C5B3025BD303D59CCF3C872F4A46BF11E24BFCC42869498C54B0 I_41CD80BFBD3EF2A72B1311F93D87AFDE77273A97897B7B012F0BFA851DE8E60A.316.3628980226.297 NS_3D98EC37D63EBFB9210DB658120A818078461369A71EFFA3DDE47412F528D55E I_88DF7CABF5BD1981831821654FEAF820A29780F13EEE1AF86755DD96BDDE9FDF.1017.1635285725.329 KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C I_DF1D72ECC9268213FCB43A06A38DBF2A7452DFF83D9A2AF1D89F3CECA76D4AF1.11.3465618677.295 CR_FBD11BA7DCC0C416362AC2A1F8EEFD82230A37B2505B7C99363ED198FE2F89CA R_CE7115C334FCF4CAF18779B5DCE6EE49094B2697F81975FFC890786B7C5BEB22 e��.� � /X� D n53 ` s �we D ����
%3r;� � ���� Y �j�� 0 E�) � �8�=� X �ӫX � ���� [ ���b � C I M _ B a t t e r y �ɝ��C�� � CIM_Battery
6 � �� � ! ) / W k � � � �
� � �������U��������������������������������������������������������������������������������������������������������������������������������� � Win32_PortableBattery CIMWin32 Locale UUID {FAF76B9E-798C-11D2-AAD1-006008C78BC7} CapacityMultiplier # ~ )
� � � ��� � uint16 MappingStrings � SMBIOS|Type 22|Design Capacity Multiplier DeviceID @ A
� F � �� � ��N X b r string Override DeviceId MappingStrings z WMI Location p )
� � � ��� � string MappingStrings � SMBIOS|Type 22|Location ManufactureDate t )
� A � ��I Y string MappingStrings a SMBIOS|Type 22|Manufacture Date Manufacturer ! x )
� � � ��� � string MappingStrings � SMBIOS|Type 22|Manufacturer MaxBatteryError " | )
� L � ��T d uint16 MappingStrings l SMBIOS|Type 22|Maximum Error in Battery Data � _ _ E x t r i n s i c E v e n t �ɝ��C� __ExtrinsicEvent $ * R ] % _����������������� � Win32_PowerManagementEvent Locale UUID {86460B6B-E709-11d2-B139-00105A1F77A1} EventType 6
� � � ��� � � � uint16 MappingStrings � Win32API|Power Management Events ValueMap 4 7 10 11 18 OEMEventCode )
� \ � ��d t uint16 MappingStrings | Win32API|Power Management Events �5 7 E 5 F 3 A D D 9 E 2 4 2 C 4 E 9 F 9 E D F 7 9 A A 9 7 F 7 9 E 7 9 1 1 C 5 A 8 B 9 0 2 E C 1 5 0 D 6 4 4 2 E 3 B 8 5 A 5 A A �ɝ��C�ȝ��C�� ���J 9 n � __Win32Provider {3DD82D10-E6F1-11d2-B139-00105A1F77A1} LocalSystemHost MS_Power_Management_Event_Provider 0 8 9 9 3 0 7 4 0 8 A 3 2 0 4 0 A 6 D A 1 9 C 0 B 1 E C 2 7 4 5 A 3 D 6 0 4 B A A 9 D F F E 8 E E 4 B 7 5 C 3 D 9 1 E 1 6 1 0 9 �ɝ��C�ȝ��C�� O � � __EventProviderRegistration % select * from Win32_PowerManagementEvent \\.\Root\CIMV2:__Win32Provider.Name="MS_Power_Management_Event_Provider"
R O O T \ C I M V 2 _ _ E v e n t P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 6 8 5 7 7 3 7 2 C 6 6 A 7 B 2 0 6 5 8 4 8 7 F B D 9 5 9 A A 1 5 4 E F 5 4 B 5 F 9 3 5 D C C 5 6 6 3 E 9 2 2 8 B 4 4 3 2 2 8 0 5 \ K I _ 0 8 9 9 3 0 7 4 0 8 A 3 2 0 4 0 A 6 D A 1 9 C 0 B 1 E C 2 7 4 5 A 3 D 6 0 4 B A A 9 D F F E 8 E E 4 B 7 5 C 3 D 9 1 E 1 6 1 0 9 \ I _ 9 B C E B F B D 0 9 9 F D 1 D B A 4 9 B 8 E 7 B C F 4 9 E E 9 7 6 2 F C 2 E F F 3 0 2 F 6 5 2 F 7 F 5 6 B F 3 E D E 2 5 D 1 F A __ � C I M _ P C M C I A C o n t r o l l e r �ɝ��C�� V CIM_PCMCIAController 6 � �� � " * 0 X b ��������������������������������������������������������������������������������������� � Win32_PCMCIAController CIMWin32 Locale UUID {98C7E2C6-D592-11d2-B355-00105A0A323A} DeviceID @ A
� � � ��� � � ��� � string Override DeviceId MappingStrings � WMI � C I M _ C o n t r o l l e r �ɝ��C�% V CIM_Controller 6 � �� � ( . V ` � � �������������������������������������������������������������������������������������\ � Win32_1394Controller CIMWin32 Locale UUID {2A7DC003-BAEF-11d2-85E5-0000F8102E5F} DeviceID @ A
� � � �� � ��� � � � string Override DeviceId MappingStrings � WMI Manufacturer L )
� - � ��5 E string MappingStrings M Win32Registry � C I M _ L o g i c a l D e v i c e �ɝ��C�� T CIM_LogicalDevice 6 � �� � # + 1 Y c � � � � U g ����������������������������������������������������������������������������������� � Win32_MotherboardDevice CIMWin32 Locale UUID {8502C4BA-5FBB-11D2-AAC1-006008C78BC7} DeviceID @ A
� � � �� � ��� � � � string Override DeviceId MappingStrings � WMI PrimaryBusType B )
� 2 � ��: J string MappingStrings R Win32Registry|HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter|Identifier RevisionNumber F )
� � � ��� string MappingStrings Win32Registry|HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System SecondaryBusType J )
� � � ��� � string MappingStrings � Win32Registry|HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter|Identifier � C I M _ C o n t r o l l e d B y �ɝ��C�c CIM_ControlledBy 6 � �� � & . 4 \ h $ ��������������������������������� � Win32_1394ControllerDevice CIMWin32 Locale UUID {8835CFC9-BAEF-11d2-85E5-0000F8102E5F} Antecedent f@ A
� � � �� � ��� � � � ref:Win32_1394Controller Override Antecedent MappingStrings � WMI|Win32_1394Controller Dependent f@ A
� s � �� � ��� � � � ref:CIM_LogicalDevice Override Dependent MappingStrings � CIM|CIM_LogicalDevice ol � C I M _ C o n t r o l l e r �ɝ��C�$ V CIM_Controller 6 � �� � ' - U _ � � �������������������������������������������������������������������������������������[ � Win32_IDEController CIMWin32 Locale UUID {9ABA5122-C7A1-11d2-911D-0060081A46FD} DeviceID @ A
� � � �� � ��� � � � string Override DeviceId MappingStrings � WMI Manufacturer L )
� , � ��4 D string MappingStrings L Win32Registry � C I M _ C o n t r o l l e d B y �ɝ��C�` CIM_ControlledBy 6 � �� � % - 3 [ g ! ��������������������������������� � Win32_IDEControllerDevice CIMWin32 Locale UUID {5BC42B62-C7A1-11d2-911D-0060081A46FD} Antecedent f@ A
� � � �� � ��� � � � ref:Win32_IDEController Override Antecedent MappingStrings � CIM|Win32_IDEController Dependent f@ A
� p � �� � ��� � � � ref:CIM_LogicalDevice Override Dependent MappingStrings � CIM|CIM_LogicalDevice ro � C I M _ E l e m e n t S e t t i n g �ɝ��C� CIM_ElementSetting ) �� ( . V _ e��������� � Win32_DeviceSettings Abstract Locale UUID {8502C4FD-5FBB-11D2-AAC1-006008C78BC7} Element f@ A
� � � �� � ��� � � � ref:CIM_LogicalDevice Override Element MappingStrings � CIM|CIM_LogicalDevice Setting f@ A
� _ � �� � ��p z � � ref:CIM_Setting Override Setting MappingStrings � CIM|CIM_Setting L � C I M _ R e g i s t e r e d P r o f i l e oҝ��C�� ) CIM_RegisteredProfile ) � �� � �����������������������������������������$ � RegisteredProfile IPMIPrv Locale � �� z ̉@k
4 ��>
�,*W 0 W�1`� m ��5�� d �U�X � �1��
X e S q l P k g _ f i l e _ w r i t e _ t h r o t t l e d �U��7 �( B ' XeSqlPkg_file_write_throttled ) � �� ! / ; � � < I � � � R ^ � � B R � � � � � � � � 5 E � � WUUU�������������������������������������������������������������� � file_write_throttled EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id $ )
� ) 1 � �� uint32 WmiDataId file_handle
4
� � � � ��� �� object WmiDataId Pointer file_id ( )
� � � � �� uint16 WmiDataId filegroup_id
* )
� ? G
� �� uint16 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId io_data
: 6
� # � ��. 9 object WmiDataId Extension Variant is_reserved_io
5 )
� � �
� �� sint8 WmiDataId is_volume_limit_hit 4 )
� � � � �� sint8 WmiDataId mode P
� ] e � ��p y � � � uint32 WmiDataId XEMapId ValueMap � � 0 1 Values � � Contiguous Scatter/Gather offset )
� � �� uint64 WmiDataId path 6 C
� n v � ��� � � � string WmiDataId StringTermination NullTerminated Format w RemainingLength 6
� $ � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber size , )
� � � � �� uint64 WmiDataId � X e S q l P k g �U��7 � XeSqlPkg
C � �� ( > D l t ~ � c����� � XeSqlPkg_checkpoint_begin Description Checkpoint has begun Guid {99ca2b70-a594-4250-9ca6-b761a9486fd2} locale MS\0x409 DisplayName checkpoint_begin � X e S q l P k g _ c h e c k p o i n t _ b e g i n �U��7 �� + # XeSqlPkg_checkpoint_begin ) � �� + 7 � � 8 G � � U d � � t � � w � WU������������������������������������������ � checkpoint_begin EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� % - � �� uint32 WmiDataId database_name C
� � � � ��� � � � string WmiDataId StringTermination NullTerminated Format w FragmentId 6
� ) 1 < I � �� uint32 WmiDataId Description FragmentId logical_db_id
$ 6
� � � � ��� � object:guid WmiDataId Extension Guid logical_db_name C
� 3 ; � ��F Y i q string WmiDataId StringTermination NullTerminated Format w physical_db_id
6
� � � � ��� � object:guid WmiDataId Extension Guid RemainingLength 6
� F N Y f � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g V��7 � XeSqlPkg
C � �� & < B j r | � c����� � XeSqlPkg_checkpoint_end Description Checkpoint has ended Guid {43694edc-2f3b-4e10-b13f-14393f3bd9d6} locale MS\0x409 DisplayName checkpoint_end � X e S q l P k g _ c h e c k p o i n t _ e n d V��7 �' 3 ! XeSqlPkg_checkpoint_end ) � �� ) 5 � � � � � � y � ' � � $ � � 3 D � � WUU������������������������������������������������= � checkpoint_end EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid checkpoint_lsn
( C
� @ H
� ��S f v ~ string WmiDataId StringTermination NullTerminated Format w database_id )
� � � � �� uint32 WmiDataId database_name C
� 8 @ � ��K ^ n v string WmiDataId StringTermination NullTerminated Format w dirty_page_lsn , C
� � � � ��� string WmiDataId StringTermination NullTerminated Format w FragmentId 6
� k s ~ � � �� uint32 WmiDataId Description FragmentId logical_db_id
$ 6
� � � � ��
object:guid WmiDataId Extension Guid logical_db_name C
� u } � ��� � � � string WmiDataId StringTermination NullTerminated Format w physical_db_id
6
�
� ��" - object:guid WmiDataId Extension Guid RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
�
- � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g V��7 �< XeSqlPkg
C � ��& 3 c i � � � � c����� � XeSqlPkg_analysis_pass_bootpage_info Description Occurs during analysis pass of crash recovery. Guid {fcc4db16-dafc-492d-9bce-17750207ca92} locale MS\0x409 DisplayName analysis_pass_bootpage_info �% X e S q l P k g _ r e c o v e r y _ s i m p l e _ l o g _ t r u n c a t e V��7 �5 / XeSqlPkg_recovery_simple_log_truncate ' ) � �� ) 7 C � � D M � � f w � � WU������������������������������p � recovery_simple_log_truncate EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� 1 9 � �� uint32 WmiDataId file_id )
� � � � �� uint16 WmiDataId FragmentId 6
� � � � � �� uint32 WmiDataId Description FragmentId page_id )
� S [ � �� uint32 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� @ H S ` � �� uint32 WmiDataId Description SequenceNumber �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 6�n�^��
͝��C�} % J.3�� Z � WDMClassesOfDriver TP_V2_ThreadSet C:\Windows\system32\kernelbase.dll[MofResourceName] ] 4�,w� � �1ʖ� 6 �3U�� � ��ӊ� E U3YZ�
� ə�� M ��� TXUj A �i��] y �=K� X e S q l P k g _ d y n _ t h r o t t l e _ c h e c k p o i n t ?V��7 �� ? * XeSqlPkg_dyn_throttle_checkpoint " ) � �� $
2 > � � F a � �
j ~ � � + � � ! 1 WU������������������������������������������������������������� � dyn_throttle_checkpoint EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid average_throughput )
� 3 ; � �� real64 WmiDataId average_writes_per_second )
� � � � �� real64 WmiDataId checkpoint_duration
8 )
� � �
� �� uint32 WmiDataId checkpoint_rate_iops , )
� W _ � �� real64 WmiDataId checkpoint_rate_mb $ )
� � � � �� real64 WmiDataId database_id 4 )
� � �� uint32 WmiDataId FragmentId 6
� o w � � � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� u } � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g @V��7 � XeSqlPkg
C � �� * > D l t ~ � c����� � XeSqlPkg_trace_flag_changed Description Trace flag changed Guid {142beaac-9a34-42ae-849a-3c2051bf13e7} locale MS\0x409 DisplayName trace_flag_changed � X e S q l P k g _ t r a c e _ f l a g _ c h a n g e d AV��7 �� " % XeSqlPkg_trace_flag_changed ) � �� - 9 � � 3 ? � � � � WU��������������������������������� � trace_flag_changed EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid flag )
� ( � �� uint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId new_value )
� � � � �� uint32 WmiDataId RemainingLength 6
� Y a l y � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber type P
� r z � ��� � � � � uint32 WmiDataId XEMapId ValueMap � � 0 1 Values � � Global Session � X e S q l P k g BV��7 � XeSqlPkg
C � ��" / H N v ~ � � c����� � XeSqlPkg_change_tracking_cleanup Description Change Tracking Cleanup Guid {D878EAE3-68D7-48FB-868E-8422E6D8A18F} locale MS\0x409 DisplayName change_tracking_cleanup � X e S q l P k g _ c h a n g e _ t r a c k i n g _ c l e a n u p CV��7 �f + * XeSqlPkg_change_tracking_cleanup " ) � �� $ 2 > � � n { � � A L � � , � � � � WU������������������������������������������ � change_tracking_cleanup EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid cleanup_id P
� R Z � ��e n x � � uint32 WmiDataId XEMapId ValueMap � � � � � � � � � � � � � � � 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 Values 3 H Y o � � � � � � 2 G U CleanupStatusChange UpdateRetention UpdateInvalidCleanup UpdateHardenedCleanup RowsCleanedUp BeginTableCleanup EndTableCleanup AddChangeTrackDbToQueue ProcessNewDatabase StartChangeTrackingCleanup StopChangeTrackingCleanup ErrorInTableCleanup RowsCleanedupInLoop RetryCleanup BeginManualTableCleanup database_id )
� � � � �� uint32 WmiDataId FragmentId 6
� ( 5 � �� uint32 WmiDataId Description FragmentId object_id )
� � � � �� sint32 WmiDataId RemainingLength 6
� � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� p x � � � �� uint32 WmiDataId Description SequenceNumber status )
� � � � �� uint32 WmiDataId value $ C
� J R � ��] p � � string WmiDataId StringTermination NullTerminated Format w � X e S q l P k g DV��7 �% XeSqlPkg
C � �� , S Y � � � � c����� � XeSqlPkg_syscommittab_cleanup Description Tracks SYS.SYSCOMMITTAB Table Cleanup Guid {8040BB1C-D62A-4327-AC4D-DDC45EC3FBB7} locale MS\0x409 DisplayName syscommittab_cleanup � X e S q l P k g _ s y s c o m m i t t a b _ c l e a n u p EV��7 �� 3 ' XeSqlPkg_syscommittab_cleanup ) � �� ! / ; � � c o � � � � j z WU�������������������������������������������������� � syscommittab_cleanup EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid cleaned_upto_date 6
� < D � ��O Z uint64 WmiDataId Extension WmiTime cleanup_ts ( )
� � � � �� uint64 WmiDataId database_id )
� � � �� uint32 WmiDataId FragmentId 6
� ` h s � � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� � � � � �� uint32 WmiDataId Description RemainingLength rows_deleted )
� W _ � �� uint64 WmiDataId SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g FV��7 � XeSqlPkg
C � �� * I O w � � c����� � XeSqlPkg_syscommittab_flush Description Tracks SYS.SYSCOMMITTAB flush Guid {2D7F99A0-E8EF-4B72-866B-CB9AC082F0E0} locale MS\0x409 DisplayName syscommittab_flush � X e S q l P k g HV��7 �Q XeSqlPkg
C � ��# 0 { � � � � � c����� � XeSqlPkg_committable_persist_info Description Tracks commit table when persisting the checkpoint timestamp to boot page Guid {493F6C3C-08EA-4B05-899E-5B4370E55C49} locale MS\0x409 DisplayName committable_persist_info �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 7�n�^��
͝��C�� ( J.3�� ] � WDMClassesOfDriver TP_V2_WTNodeSwitch C:\Windows\system32\kernelbase.dll[MofResourceName] rceName] ] eName] h �ѝ��C�� � � �� � ( ' > p � � � @ r � � � 2 d � � � 2 d � � � 3 e � � �
* \ � � � = o � � � 5 g � � � 2 d z � � � K g � � �
5
J
|
�
�
�
% A s � � � H ^ � � UUUUUUUUUU����������������������������������������������������������������������������������������������������������������������������������������������������������� � SoftwareLicensingService SppProvider AzureMetadataResponse @
� h � �� uint32 ClientMachineID 8
� � � �� string DiscoveredKeyManagementServiceMachineIpAddress
�
� �� string DiscoveredKeyManagementServiceMachineName
� j � �� string DiscoveredKeyManagementServiceMachinePort
� � � �� uint32 EmitWindowsMeter D
� � �� uint32 IsKeyManagementServiceMachine
� \ � �� uint32 KeyManagementServiceCurrentCount ,
� � � �� uint32 KeyManagementServiceDnsPublishing L
� � �� boolean KeyManagementServiceFailedRequests j
� \ � �� uint32 KeyManagementServiceHostCaching P
� � � �� boolean KeyManagementServiceLicensedRequests V
� � �� uint32 KeyManagementServiceListeningPort H
� ] � �� uint32 KeyManagementServiceLookupDomain
� � � �� string KeyManagementServiceLowPriority N
� � �� boolean KeyManagementServiceMachine
� T � �� string KeyManagementServiceNonGenuineGraceRequests b
� � � �� uint32 KeyManagementServiceNotificationRequests n
� � �� uint32 KeyManagementServiceOOBGraceRequests Z
� g � �� uint32 KeyManagementServiceOOTGraceRequests ^
� � � �� uint32 KeyManagementServicePort
� � �� uint32 KeyManagementServiceProductKeyID
� _ � �� string KeyManagementServiceTotalRequests f
� � � �� uint32 KeyManagementServiceUnlicensedRequests R
� � �� uint32 OA2xBiosMarkerMinorVersion $ �
� \ � �� uint32 OA2xBiosMarkerStatus # �
� � � �� uint32 OA3xOriginalProductKey % �
� � � �� string OA3xOriginalProductKeyDescription & �
� C � �� string OA3xOriginalProductKeyPkPn ' �
� � � �� string PolicyCacheRefreshRequired
4
� � � �� uint32 RemainingWindowsReArmCount <
� -
� �� uint32 RequiredClientCount 0
� t
� �� uint32 TokenActivationAdditionalInfo " �
� �
� �� string TokenActivationCertificateThumbprint ! ~
� � �� string TokenActivationGrantNumber z
� k � �� uint32 TokenActivationILID r
� � � �� string TokenActivationILVID v
� � � �� uint32 Version '
� @ � �� � �� string VLActivationInterval $
� � � �� uint32 VLRenewalInterval
(
� � � �� uint32 Y / 5 � � � � X o � � : V _
� � � � � � W v � � 8 T ` � $ � � � � q � � �! 5# R# n# r# �$ % !% �' 4) B) ^) b) �* �* + - �. �. �. �. D0 j0 �0 �2 4 14 M4 Q4 �5 �5 6 /8 �9 �9 �9
< �= �= �= �? ZA �A �A �C �F �F �F $K �L �L �L �O Q %Q AQ SS �T �T
U U �V � InstallProductKey " �� Implemented a4b864714000019 ROOT\CIMV2 ���� � �� �� * � ����� � __PARAMETERS abstract ProductKey string
� 6 in
� 6 ] �� ID )
� � ] ��� string __ �y a4b864714000019 ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � InstallLicense � �� implemented � a4b864714000019 ROOT\CIMV2 ���� � �� �� * � ����� � __PARAMETERS abstract License string
� 3 in
� 3 Z �� ID )
� � Z ��� string __ �y a4b864714000019 ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � InstallLicensePackage ~ �� implemented a4b864714000019 ROOT\CIMV2 ���� � �� �� * � ����� � __PARAMETERS abstract LicensePackage string
� : in
� : a �� ID )
� � a ��� string __ �y a4b864714000019 ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � SetKeyManagementServiceMachine I �� implemented a4b864714000019 ROOT\CIMV2 ���� � �� �� * � ����� � __PARAMETERS abstract MachineName string
� 7 in
� 7 ^ �� ID )
� � ^ ��� string __ �y a4b864714000019 ROOT\CIMV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f�.�� ���� u ���g% � t���
{ Ն�I Y @��� P ~�u� � �ʆR� ! X e S q l P k g _ p a g e _ c o m p r e s s i o n _ t r a c i n g [V��7 �� 5 + XeSqlPkg_page_compression_tracing # ) � �� %
3 ? � � B O � � � � h p & / y � �
T d WU��������������������������������������������������� � page_compression_tracing EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid call_duration
* )
� / 7
� �� uint64 WmiDataId database_id )
� � � � �� uint32 WmiDataId file_id )
� � � � �� uint16 WmiDataId FragmentId 6
� < D O \ � �� uint32 WmiDataId Description FragmentId opcode P
� � � � ��� � � uint32 WmiDataId XEMapId ValueMap 0 1 Values ! Begin End page_id )
� f n � �� uint32 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength rowset_id " )
� A I � �� uint64 WmiDataId SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g \V��7 �M XeSqlPkg
C � ��7 D c i � � � � c����� � XeSqlPkg_remap_add_remote_file_redo_operation_started Description AddFileRedo Operation Started Guid {78d9ba14-6815-439a-8452-ce997eac1f34} locale MS\0x409 DisplayName remap_add_remote_file_redo_operation_started �5 X e S q l P k g _ r e m a p _ a d d _ r e m o t e _ f i l e _ r e d o _ o p e r a t i o n _ s t a r t e d ]V��7 �' % ? XeSqlPkg_remap_add_remote_file_redo_operation_started 7 ) � ��. 9 G S �
T i � � � � � � 3 D � � WU�����������������������������������= � remap_add_remote_file_redo_operation_started EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� A I � �� uint32 WmiDataId database_segment_id )
� � � � �� uint32 WmiDataId file_id )
� � � � �� uint32 WmiDataId FragmentId 6
� V ^ i v � �� uint32 WmiDataId Description FragmentId is_log_file )
� � � � �� sint8 WmiDataId is_physical_name ! )
� ! ( � �� sint8 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
�
- � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g ^V��7 �S XeSqlPkg
C � ��9 F g m � � � � c����� � XeSqlPkg_remap_add_remote_file_redo_operation_completed Description AddFileRedo Operation Completed Guid {3605fd2b-ba76-471e-95af-f78f4021a6a1} locale MS\0x409 DisplayName remap_add_remote_file_redo_operation_completed �7 X e S q l P k g _ r e m a p _ a d d _ r e m o t e _ f i l e _ r e d o _ o p e r a t i o n _ c o m p l e t e d _V��7 �� ) A XeSqlPkg_remap_add_remote_file_redo_operation_completed 9 ) � ��0 ;
I U � V k � � � � � � 5 ? � � W g WU��������������������������������������� � remap_add_remote_file_redo_operation_completed EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� C K � �� uint32 WmiDataId database_segment_id )
� � � � �� uint32 WmiDataId file_id )
� � � � �� uint32 WmiDataId FragmentId 6
� X ` k x � �� uint32 WmiDataId Description FragmentId is_log_file )
� � � � �� sint8 WmiDataId is_physical_name ! )
� # * � �� sint8 WmiDataId new_name
" C
� � �
� ��� � � � string WmiDataId StringTermination NullTerminated Format w RemainingLength 6
� & . 9 F � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g `V��7 �( XeSqlPkg
C � ��' 4 N T | � � � c����� � XeSqlPkg_add_new_file_operation_error Description Error during AddFileRedo Guid {3998e619-7e85-44d5-a104-e451ed69d045} locale MS\0x409 DisplayName add_new_file_operation_error �% X e S q l P k g _ x s t o r e _ l e a s e _ r e n e w a l _ r e q u e s t kV��7 �m # / XeSqlPkg_xstore_lease_renewal_request ' ) � �� ) 7 C � N Y � � g x � � ! 1 WU���������������������������������� � xstore_lease_renewal_request EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid elapsed_since_renewal )
� ; C � �� uint64 WmiDataId file_path C
� � � � ��� � � � string WmiDataId StringTermination NullTerminated Format w FragmentId 6
� ; C N [ � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength request_type P
� Y ` � ��k V t ~ ( uint8 WmiDataId XEMapId ValueMap � � � � � � � � � � � � 13 18 6 7 15 10 3 8 16 20 14 0 11 9 4 12 17 19 1 2 5 Values � � � � � � 0 D R i x � � � � � � � FCBIoTypeCopySnapshot FCBIoTypeCreateAndWrite FCBIoTypeCreateFile FCBIoTypeDeleteFile FCBIoTypeGetBlockList FCBIoTypeGetPageRange FCBIoTypeGetProperties FCBIoTypeLease FCBIoTypeListBlobs FCBIoTypeMax FCBIoTypePutBlockList FCBIoTypeRead FCBIoTypeSetMetadata FCBIoTypeSetSeqNum FCBIoTypeSetSize FCBIoTypeSnapshot FCBIoTypeTouch FCBIoTypeTrim FCBIoTypeWrite FCBIoTypeWriteMultiple FCBIoTypeZeroFile SequenceNumber 6
� u } � � � �� uint32 WmiDataId Description SequenceNumber �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 8�n�^��
͝��C�| $ J.3�� Y � WDMClassesOfDriver TP_V2_TimerSet C:\Windows\system32\kernelbase.dll[MofResourceName] me] ResourceName] XactSequence �e] ce Error Unsupported Operation Error DMTF Reserved ModelCorrespondence CIM_Error.OtherErrorType Message +
� x � � � � string Description The formatted message. This message is constructed by combining some or all of the dynamic elements specified in the MessageArguments property with the static elements uniquely identified by the MessageID in a message registry or other catalog associated with the OwningEntity. ModelCorrespondence � � CIM_Error.MessageID CIM_Error.MessageArguments MessageArguments +
� A! I! V! �! �! string Description An array containing the dynamic content of the message. ModelCorrespondence �! �! CIM_Error.MessageID CIM_Error.Message MessageID
6
� '" /" ��9" F" �" �" string Required Description An opaque string that uniquely identifies, within the scope of the OwningEntity, the format of the Message. ModelCorrespondence �" �" CIM_Error.Message CIM_Error.MessageArguments OtherErrorSourceFormat ( +
� T# \# i# _$ t$ string Description A string defining "Other" values for ErrorSourceFormat. This value MUST be set to a non NULL value when ErrorSourceFormat is set to a value of 1 ("Other"). For all other values of ErrorSourceFormat, the value of this string must be set to NULL. ModelCorrespondence |$ CIM_Error.ErrorSourceFormat OtherErrorType +
� �$ �$ �$ T% i% string Description A free-form string describing the ErrorType when 1, "Other", is specified as the ErrorType. ModelCorrespondence q% CIM_Error.ErrorType OwningEntity
� �% �% �% string Description A string that uniquely identifies the entity that owns the definition of the format of the Message described in this instance. OwningEntity MUST include a copyrighted, trademarked or otherwise unique name that is owned by the business entity or standards body defining the format. PerceivedSeverity E
� U' ]' j' �+ �+ �+ �+ o, , uint16 Description An enumerated value that describes the severity of the Indication from the notifier's point of view:
0 - the Perceived Severity of the indication is unknown or indeterminate.
1 - Other, by CIM convention, is used to indicate that the Severity's value can be found in the OtherSeverity property.
2 - Information should be used when providing an informative response.
3 - Degraded/Warning should be used when its appropriate to let the user decide if action is needed.
4 - Minor should be used to indicate action is needed, but the situation is not serious at this time.
5 - Major should be used to indicate action is needed NOW.
6 - Critical should be used to indicate action is needed NOW and the scope is broad (perhaps an imminent outage to a critical resource will result).
7 - Fatal/NonRecoverable should be used to indicate an error occurred, but it's too late to take remedial action.
2 and 0 - Information and Unknown (respectively) follow common usage. Literally, the Error is purely informational or its severity is simply unknown. ValueMap �+ �+ �+ �+ �+ �+ �+ �+ �+ 0 1 2 3 4 5 6 7 .. Values , , , , 2, 9, @, J, `, Unknown Other Information Degraded/Warning Minor Major Critical Fatal/NonRecoverable DMTF Reserved MappingStrings �, Recommendation.ITU|X733.Perceived severity ProbableCause R
� "- *- 7- |- �- �- . @. J. �2 �2 uint16 Description An enumerated value that describes the probable cause of the error. MappingStrings �- �- �- Recommendation.ITU|X733.Probable cause Recommendation.ITU|M3100.probableCause ITU-IANA-ALARM-TC ModelCorrespondence . CIM_Error.ProbableCauseDescription ValueMap � ^0 a0 d0 g0 j0 m0 p0 s0 v0 y0 |0 �0 �0 �0 �0 �0 �0 �0 �0 �0 �0 �0 �0 �0 �0 �0 �0 �0 �0 �0 �0 �0 �0 �0 �0 �0 �0 �0 �0 �0 �0 �0 �0 1 1 1 1 1 1 1 1 1 $1 (1 ,1 01 41 81 <1 @1 D1 H1 L1 P1 T1 X1 \1 `1 d1 h1 l1 p1 t1 x1 |1 �1 �1 �1 �1 �1 �1 �1 �1 �1 �1 �1 �1 �1 �1 �1 �1 �1 �1 �1 �1 �1 �1 �1 �1 �1 �1 �1 �1 �1 �1 �1 2 2 2 2 2 2 2 %2 *2 /2 42 92 >2 C2 H2 M2 R2 W2 \2 a2 f2 k2 p2 u2 z2 2 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 .. Values � �4 �4 �4 �4 �4 �4 5 45 V5 y5 �5 �5 �5 �5 �5 �5 6 6 .6 A6 P6 `6 o6 }6 �6 �6 �6 �6 �6 �6 7 7 77 L7 [7 p7 �7 �7 �7 �7 �7 �7 8 8 >8 _8 x8 �8 �8 �8 �8 9 /9 B9 R9 g9 y9 �9 �9 �9 �9 �9 : %: A: _: t: �: �: �: �: �: �: �: ; ; 6; P; a; t; �; �; �; �; �; �; < < ;< O< e< }< �< �< �< �< �< �< �< = = "= -= <= H= U= \= m= �= �= �= �= �= �= �= > 5> M> e> �> �> �> �> �> �> ? ? ,? C? S? e? }? Unknown Other Adapter/Card Error Application Subsystem Failure Bandwidth Reduced Connection Establishment Error Communications Protocol Error Communications Subsystem Failure Configuration/Customization Error Congestion Corrupt Data CPU Cycles Limit Exceeded Dataset/Modem Error Degraded Signal DTE-DCE Interface Error Enclosure Door Open Equipment Malfunction Excessive Vibration File Format Error Fire Detected Flood Detected Framing Error HVAC Problem Humidity Unacceptable I/O Device Error Input Device Error LAN Error Non-Toxic Leak Detected Local Node Transmission Error Loss of Frame Loss of Signal Material Supply Exhausted Multiplexer Problem Out of Memory Output Device Error Performance Degraded Power Problem Pressure Unacceptable Processor Problem (Internal Machine Error) Pump Failure Queue Size Exceeded Receive Failure Receiver Failure Remote Node Transmission Error Resource at or Nearing Capacity Response Time Excessive Retransmission Rate Excessive Software Error Software Program Abnormally Terminated Software Program Error (Incorrect Results) Storage Capacity Problem Temperature Unacceptable Threshold Crossed Timing Problem Toxic Leak Detected Transmit Failure Transmitter Failure Underlying Resource Unavailable Version Mismatch Previous Alert Cleared Login Attempts Failed Software Virus Detected Hardware Security Breached Denial of Service Detected Security Credential Mismatch Unauthorized Access Alarm Received Loss of Pointer Payload Mismatch Transmission Error Excessive Error Rate Trace Problem Element Unavailable Element Missing Loss of Multi Frame Broadcast Channel Failure Invalid Message Received Routing Failure Backplane Failure Identifier Duplication Protection Path Failure Sync Loss or Mismatch Terminal Problem Real Time Clock Failure Antenna Failure Battery Charging Failure Disk Failure Frequency Hopping Failure Loss of Redundancy Power Supply Failure Signal Quality Problem Battery Discharging Battery Failure Commercial Power Problem Fan Failure Engine Failure Sensor Failure Fuse Failure Generator Failure Low Battery Low Fuel Low Water Explosive Gas High Winds Ice Buildup Smoke Memory Mismatch Out of CPU Cycles Software Environment Problem Software Download Failure Element Reinitialized Timeout Logging Problems Leak Detected Protection Mechanism Failure Protecting Resource Failure Database Inconsistency Authentication Failure Breach of Confidentiality Cable Tamper Delayed Information Duplicate Information Information Mis�s ,` , �a�� d :����
� �[F� [ �P�� % X e S q l P k g _ x i o _ r e q u e s t _ o p e n e d _ s e n s i t i v e V��7 �� : / XeSqlPkg_xio_request_opened_sensitive ' ) � �� ) 7 C � � H Z � � A M � � C S � � * 8 � � ?
O
WUU��������������������������������������������������������
� xio_request_opened_sensitive EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid file_byte_count ! )
� 5 = � �� uint64 WmiDataId file_byte_offset )
� � � � �� uint64 WmiDataId file_path 2 C
� � �� & 6 > string WmiDataId StringTermination NullTerminated Format w FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� % 2 � �� uint32 WmiDataId Description RemainingLength request_handle
4
� � � � ��� �� object WmiDataId Pointer request_id
. 6
� � �� $ object:guid WmiDataId Extension Guid request_type P
� � � � ��� W � � u } uint8 WmiDataId XEMapId ValueMap # ' + . 1 5 9 < ? C G K O S V Z ^ a d h l o r 20 14 13 6 7 16 10 3 8 17 21 23 18 15 0 11 22 9 4 19 12 1 2 5 Values � � / B W l � � � � � � � � & 8 H c t � � XIOTypeCloseHandles XIOTypeCopyBlob XIOTypeCopySnapshot XIOTypeCreateFile XIOTypeDeleteFile XIOTypeGetBlockList XIOTypeGetPageRange XIOTypeGetProperties XIOTypeLease XIOTypeListBlobs XIOTypeListStatus XIOTypeMax XIOTypePutBlob XIOTypePutBlockList XIOTypeRead XIOTypeSetMetadata XIOTypeSetMetadataNonBlocking XIOTypeSetSeqNum XIOTypeSetSize XIOTypeSetStorageBlobTier XIOTypeSnapshot XIOTypeWrite XIOTypeWriteMultiple XIOTypeZeroFile retry_count ) )
� � � � �� sint32 WmiDataId retry_reason
- P
� l s
� ��~ [ � � � � uint8 WmiDataId XEMapId ValueMap � � � � � � � � � � � 10 6 7 9 8 0 5 4 2 3 1 Values 4 P k � � � � �
"
NoRetry_ConnectionError NoRetry_ExceededMaxRetries NoRetry_InfiniteLeaseLost NoRetry_NonRetriableHTTPError NoRetry_NonRetriableStorageError NotDetermined Retry_Default Retry_InvalidHttpAndAzureErrorCode Retry_LMTConditionNotMet Retry_PreconditionFailed Retry_RetriableStorageError SequenceNumber 6
� �
�
�
�
� �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �V��7 �< XeSqlPkg
C � ��" / g m � � � � c����� � XeSqlPkg_xio_winhttp_call_failed Description Failed immidiately while executing a winhttp function. Guid {8BF42865-62A6-42B6-8995-7304DB4580D8} locale MS\0x409 DisplayName xio_winhttp_call_failed � X e S q l P k g �V��7 �i XeSqlPkg
C � ��, 9 � � � � � � c����� � XeSqlPkg_xio_winhttp_call_failed_sensitive Description Failed immidiately while executing a winhttp function. Contains sensitive data. Guid {4839F385-0DA7-4746-A6CE-205C20121307} locale MS\0x409 DisplayName xio_winhttp_call_failed_sensitive � X e S q l P k g _ x i o _ w i n h t t p _ c a l l _ f a i l e d �V��7 � X * XeSqlPkg_xio_winhttp_call_failed " ) � �� $ 2 > � � C T � � � U ` � � n � � � P a � � - 9 � � � � � � & � � WUUU������������������������������������������������������������������������������������
� xio_winhttp_call_failed EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid callback_status
" )
� 0 8
� �� uint32 WmiDataId current_seq_num C )
� � � � �� uint64 WmiDataId file_byte_count 3 )
� � � � �� uint64 WmiDataId file_byte_offset
+ )
� B J
� �� uint64 WmiDataId file_path O C
� � � � ��� � � � string WmiDataId StringTermination NullTerminated Format w FragmentId 6
� B J U b � �� uint32 WmiDataId Description FragmentId mapped_errorcode )
� � � � �� sint32 WmiDataId RemainingLength 6
� ' 2 ? � �� uint32 WmiDataId Description RemainingLength request_context
4
� � � � ��� �� object WmiDataId Pointer request_handle
4
� � ��$ �� object WmiDataId Pointer request_id
K 6
� } � � ��� � object:guid WmiDataId Extension Guid request_seq_num ; )
� � � � �� uint64 WmiDataId request_type P
� m t � �� W � � L T uint8 WmiDataId XEMapId ValueMap � � � " & * - 1 5 8 ; ? C F I 20 14 13 6 7 16 10 3 8 17 21 23 18 15 0 11 22 9 4 19 12 1 2 5 Values � � � � . C Y g y � � � � � � � : K Y o XIOTypeCloseHandles XIOTypeCopyBlob XIOTypeCopySnapshot XIOTypeCreateFile XIOTypeDeleteFile XIOTypeGetBlockList XIOTypeGetPageRange XIOTypeGetProperties XIOTypeLease XIOTypeListBlobs XIOTypeListStatus XIOTypeMax XIOTypePutBlob XIOTypePutBlockList XIOTypeRead XIOTypeSetMetadata XIOTypeSetMetadataNonBlocking XIOTypeSetSeqNum XIOTypeSetSize XIOTypeSetStorageBlobTier XIOTypeSnapshot XIOTypeWrite XIOTypeWriteMultiple XIOTypeZeroFile retry_count & )
� � � � �� sint32 WmiDataId retry_reason * P
� C
J
� ��U
[ ^
h
�
�
uint8 WmiDataId XEMapId ValueMap �
�
�
�
�
�
�
�
�
�
�
10 6 7 9 8 0 5 4 2 3 1 Values �
' B a � � � � � � NoRetry_ConnectionError NoRetry_ExceededMaxRetries NoRetry_InfiniteLeaseLost NoRetry_NonRetriableHTTPError NoRetry_NonRetriableStorageError NotDetermined Retry_Default Retry_InvalidHttpAndAzureErrorCode Retry_LMTConditionNotMet Retry_PreconditionFailed Retry_RetriableStorageError SequenceNumber 6
� j r } � � �� uint32 WmiDataId Description SequenceNumber winhttp_call_type P
�
� ��
Z &
0
W
_
uint8 WmiDataId XEMapId ValueMap H
K
N
Q
T
4 0 2 1 3 Values w
�
�
�
�
CloseHandle OpenRequest ReadData SendRequest WriteData �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 9�n�^��
͝��C�� * J.3�� _ � WDMClassesOfDriver TP_V2_TimerCancelled C:\Windows\system32\kernelbase.dll[MofResourceName] Name] eName] e] �/;� � w 6 0 y �]Pg� ; 3�~�� l /�eP � ?O�s) Y
��H� � Y�W; < �|Tpw B � ="� & X e S q l P k g _ p f s _ m a r k e r _ f i l e _ e r r o r _ l o g g i n g �V��7 � " 0 XeSqlPkg_pfs_marker_file_error_logging ( ) � �� * 8 D � � � � � � 4 > � � WU��������������������������������T � pfs_marker_file_error_logging EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid Error_Message C
� N V � ��a t � � string WmiDataId StringTermination NullTerminated Format w FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId Function_Module C
� m u � ��� � � � string WmiDataId StringTermination NullTerminated Format w RemainingLength 6
� # � �� uint32 WmiDataId Description RemainingLength resource C
� � � � ��� � � � string WmiDataId StringTermination NullTerminated Format w SequenceNumber 6
� $ , 7 D � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �V��7 �Q XeSqlPkg
C � ��. ; p v � � � � c����� � XeSqlPkg_pfs_metadata_consistency_validation Description Metadata consistency validation information for PFS Guid {94d48e1c-b9b1-41e3-b112-6ae576b0e846} locale MS\0x409 DisplayName pfs_metadata_consistency_validation �, X e S q l P k g _ p f s _ m e t a d a t a _ c o n s i s t e n c y _ v a l i d a t i o n �V��7 �� / 6 XeSqlPkg_pfs_metadata_consistency_validation . ) � ��% 0
> J � p ~ , � � k � � � 2 C � � T d WU��������������������������������������������� � pfs_metadata_consistency_validation EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid FragmentId 6
� D L W d � �� uint32 WmiDataId Description FragmentId metadata_key C
� � � � ��� �
string WmiDataId StringTermination NullTerminated Format w metadata_marker_file_value $ C
� } � � ��� � � � string WmiDataId StringTermination NullTerminated Format w metadata_sql_stored_value C
� * 2 � ��= P ` h string WmiDataId StringTermination NullTerminated Format w metadata_validation_result )
� � � � �� uint32 WmiDataId metdata_mismatch_type )
� ' � �� uint32 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength resource
( C
�
� ��& 9 I Q string WmiDataId StringTermination NullTerminated Format w SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �V��7 �D XeSqlPkg
C � �� , r x � � � � c����� � XeSqlPkg_xio_retry_task_stats Description Indicates the number of I/O requests processed by the IO retry task. Guid {0244BDAB-2C85-47DF-852A-CCE670CFDC98} locale MS\0x409 DisplayName xio_retry_task_stats � X e S q l P k g _ x i o _ r e t r y _ t a s k _ s t a t s �V��7 �� / ' XeSqlPkg_xio_retry_task_stats ) � �� !
/ ; � � a y � � 6 � � � � C O � � / WU��������������������������������������������� � xio_retry_task_stats EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid FragmentId 6
� 5 = H U � �� uint32 WmiDataId Description FragmentId IOs_failed_after_retry
( )
� � �
� �� uint32 WmiDataId IOs_fast_failed $ )
� � �� uint32 WmiDataId IOs_queued_after_retry )
� m u � �� uint32 WmiDataId IOs_queued_for_wait )
� � � � �� uint32 WmiDataId IOs_retried_successfully )
� 0 8 � �� uint32 WmiDataId queue_size )
� � � � �� uint32 WmiDataId RemainingLength 6
� � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� s { � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �V��7 �1 XeSqlPkg
C � ��' 4 W ] � � � � c����� � XeSqlPkg_xio_lease_renewal_task_stats Description XStore blobs lease renewal stats. Guid {5199374B-1FAA-41A6-B319-5BBEDAA4665B} locale MS\0x409 DisplayName xio_lease_renewal_task_stats �% X e S q l P k g _ x i o _ l e a s e _ r e n e w a l _ t a s k _ s t a t s �V��7 �W . / XeSqlPkg_xio_lease_renewal_task_stats ' ) � �� ) 7 C � � i y � � . � � ' : WU��������������������������������������������� � xio_lease_renewal_task_stats EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid FragmentId 6
� = E P ] � �� uint32 WmiDataId Description FragmentId leases_checked )
� � � � �� uint64 WmiDataId leases_renewed $ )
�
� �� uint64 WmiDataId RemainingLength 6
� r z � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � �
� �� uint32 WmiDataId Description SequenceNumber total_lease_count )
� q y � �� uint64 WmiDataId � X e S q l P k g �V��7 � XeSqlPkg
C � �� ' G M u } � � c����� � XeSqlPkg_xstore_io_stats Description XStore I/O request statistics. Guid {8BC549DC-0FE8-4C25-824B-BD3124080523} locale MS\0x409 DisplayName xstore_io_stats � X e S q l P k g 6X��7 � XeSqlPkg
C � ��! . F L t | � � c����� � XeSqlPkg_query_memory_pre_grant Description Query memory pre-grant Guid {73ebeff7-1300-42d1-aa39-ce871b412785} locale MS\0x409 DisplayName query_memory_pre_grant �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 :�n�^��
͝��C�� + J.3�� ` � WDMClassesOfDriver TP_V2_TimerSetNtTimer C:\Windows\system32\kernelbase.dll[MofResourceName] rceName] rceName] n XactSequence �e] �(
ٰ 7 ���� � ]��Cj � ���E
^ �i$� � K�읂 = �0x� K �y�
F G�dP a ��泱 X e S q l P k g _ f i l e g r o u p _ n a m e _ c h a n g e qW��7 �� ' ( XeSqlPkg_filegroup_name_change ) � �� " 0 < � � = R � � � p z � � WU������������������������������������� � filegroup_name_change EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� * 2 � �� uint32 WmiDataId database_segment_id )
� � � � �� uint32 WmiDataId filegroup_id )
� � � � �� uint32 WmiDataId FragmentId 6
� D L W d � �� uint32 WmiDataId Description FragmentId new_name C
� � � � ��� � string WmiDataId StringTermination NullTerminated Format w RemainingLength 6
� a i t � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g rW��7 �[ XeSqlPkg
C � ��$ 1 � � � � � � c����� � XeSqlPkg_filegroup_property_change Description Occurs when the file group manager changed the property for a physical filegroup. Guid {b6d0fe4c-06f2-478e-9478-399ac3836f0a} locale MS\0x409 DisplayName filegroup_property_change �" X e S q l P k g _ f i l e g r o u p _ p r o p e r t y _ c h a n g e sW��7 � ' , XeSqlPkg_filegroup_property_change $ ) � �� & 4 @ � � A V � � � t � � � * : WU�������������������������������������� � filegroup_property_change EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� . 6 � �� uint32 WmiDataId database_segment_id )
� � � � �� uint32 WmiDataId filegroup_id )
� � � � �� uint32 WmiDataId FragmentId 6
� H P [ h � �� uint32 WmiDataId Description FragmentId new_property P
� � � � ��� � � 4 < uint32 WmiDataId XEMapId ValueMap " % ( + . 1 4 5 2 3 0 1 Values X j ~ � � � AutogrowAllFiles AutogrowSingleFile Offline Online ReadOnly ReadWrite RemainingLength 6
� � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� ~ � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g tW��7 �6 XeSqlPkg
C � ��% 2 ^ d � � � � c����� � XeSqlPkg_group_commit_value_changed Description Number of group commit waiters has changed Guid {268c5088-ea00-465f-9224-2a4b9fe34bd5} locale MS\0x409 DisplayName group_commit_value_changed �# X e S q l P k g _ g r o u p _ c o m m i t _ v a l u e _ c h a n g e d uW��7 �� 3 - XeSqlPkg_group_commit_value_changed % ) � �� '
5 A � � B S � � 2 | � � � _ o � � 6 I WU������������������������������������������������� � group_commit_value_changed EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid duration_ms )
� / 7 � �� uint64 WmiDataId flushes_per_sec $ )
� � � � �� uint32 WmiDataId FragmentId 6
� � �
� �� uint32 WmiDataId Description FragmentId next_sample_duration_ms ( )
� i q � �� uint32 WmiDataId next_sample_index
, )
� � �
� �� uint32 WmiDataId RemainingLength 6
� . 6 A N � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber waiters )
� # + � �� uint32 WmiDataId waiters_per_flush )
� � � � �� uint32 WmiDataId � X e S q l P k g vW��7 � XeSqlPkg
C � �� + D J r z � � c����� � XeSqlPkg_log_flush_requested Description Log flush was requested Guid {d9b42c24-fb8a-4744-80f6-9b15149173a1} locale MS\0x409 DisplayName log_flush_requested � X e S q l P k g _ l o g _ f l u s h _ r e q u e s t e d wW��7 �� - & XeSqlPkg_log_flush_requested ) � ��
. : � � ; G � � " l y � � � � C S � � WU������������������������������������������ � log_flush_requested EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� ( 0 � �� uint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId is_delayed_durable ( )
� � �� sint8 WmiDataId log_block_id )
� Y a � �� uint64 WmiDataId only_signal
) )
� � �
� �� sint8 WmiDataId reason P
� ( 0 � ��; D N g o sint32 WmiDataId XEMapId ValueMap ^ a d 0 1 2 Values � � Waiters limit reached Time limit reached Immediate request RemainingLength 6
� % 2 � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber waiters )
� � �� uint32 WmiDataId � X e S q l P k g xW��7 � XeSqlPkg
C � �� , L R z � � � c����� � XeSqlPkg_log_buffer_allocated Description Log write buffer was allocated Guid {455e9012-2a18-4131-b6bf-1391e93d7acd} locale MS\0x409 DisplayName log_buffer_allocated � X e S q l P k g �X��7 �9 XeSqlPkg
C � ��+ 8 [ a � � � � c����� � XeSqlPkg_query_rpc_process_cmd_lob_action Description Processing LobAction RPC command. Guid {9de85962-44bf-45ec-923d-c6c8a8a4bf7b} locale MS\0x409 DisplayName query_rpc_process_cmd_lob_action �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ;�n�^��
͝��C�� 0 J.3�� e � WDMClassesOfDriver TP_V2_TimerExpirationGroup C:\Windows\system32\kernelbase.dll[MofResourceName] ame] ofResourceName] sing Information Modification Information Out of Sequence Key Expired Non-Repudiation Failure Out of Hours Activity Out of Service Procedural Error Unexpected Information DMTF Reserved ProbableCauseDescription +
� �? �? �? 4@ I@ string Description A free-form string describing the probable cause of the error. ModelCorrespondence Q@ CIM_Error.ProbableCause RecommendedActions
� �@ �@ �@ string Description A free-form string describing recommended actions to take to resolve the error. � 9 9 9 9 9 9 9
7 6 1 7 5 2 7 % 7 * 7 7 ; 7 ! 7 + 7 7 ( 7 & 7 $ 7 ' 7 ) 7 7 : 7 # 7 - 7 7 , 7 7 " 7 . 7 8 6 3 8 / 8 5 4 8 0 8 < ���+:�h�q2����"z�"z� � � ^'�
�
b D ,
�
{ �8 � �
o
�
Q
�I;.���D � �j� � � �CR_E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 KI_41C53E6DB1ACF2453CEFD41398198E613F10DFF47709ECAB1D7F037756AC8CE7 KI_FD1C1D414B71B5082C266A650E31EF6D5019382724244B685F217C0AAE00A921 NS_A2A98E75472B9249D4EF445DC9D4C380289067BF73931A828AFBC7CD7964FEBB CD_18A46D7BB56A85A77A8B14FC7C4A83D15E2F885E67C71399BAA10EFBE87C920E.1918.3625676390.319 CD_2504DC1AC3CAB9C6ED112DDC44AEE64529224B292ABC0946F5963E4C35C80939.1917.2544649125.384 CD_29DECD57CEAC20C8FBE48C1CEA8F70E0F53A065C3A111386C70723311B9A2585.1907.3346426394.330 CD_2F12799EC4705459E9FD61FC6C601B5A8AAE36085966AD27E0D7247EDCA6524B.1918.2071900281.1589 CD_3574CA0F26B4AC51BE1A9D13287FDF35F510716AB14315900C3DD347BA7A0FA0.1918.1759689009.2254 CD_5CEE3E694DB50EA9714886DD418F6CA358B9A4D6FD8DAFD5BAAA13B6529F39A0.1898.3993883311.290 CD_5E9AFB2824E4C09259A80739D70D94E550D572E8A9E41593DAFDA14D65369AE4.1918.1671791583.265 CD_632DEB324ADB39E99E029B3D88D503FFEF1874CB755EBE99E55CFDC82CE6D7E4.1917.3699853950.294 CD_71C294F689D8082A855326291989D570A1243A4CED463FF3751B7DB44F45449B.1899.1.8199 CD_73D523E5D8422D25C3616043387358F30734A705AA52BC4685A9ACF44AAE4050.1898.2401664413.769 CD_7E8FAF5FFDD42234424D10D1B6504179D220FC453A0ED3C78C0356F01FFA929D.1917.3126937819.3773 CD_4382409C2BA25AB891FE25D9946357B2012609A915D0D018CA8A80D2ABEE1CA0.1910.3730398874.258 CD_1333CB41C7BFD90D640EF18568976AC9246A93F3945F32BDDD813256745C7061.1923.291683485.425 CD_490405DFECEDBAF0721E3F7C59E6937997D0E58587EF6B9AA2763981C1499E86.1923.2875243614.255 CD_08958AE641D88CDE3333B847D49BEA2D42C946BF3924FE9A6259F27FADF6495E.1923.2681225045.262 CD_41C5F66D28A54B11831E9923AC9C75B6E565CD4B23788137E12DA876D6CFE78C.1923.3466743790.430 CD_0ABAFED91AF3160513FD4A097A7FC5F22572733C3EBFF5EDB2C1119EA3585424.1923.3581810015.792 CD_20A86FF9BCE2704D3211C5DF2F6EE611B397EFC650CD0CC8097C4D642C5980FF.1923.1775207228.673 CD_15D17602950F6C84D799561B467DD6E41D14A7C8F3BB2D223F118DC47EBDE909.1923.2564750056.699 CD_4714D9B900765C427A8C3A4D74360B2C569F951B888844030608A447B457F27B.1923.2436597047.698 NS_9E247BC9FB7055BE3C26FD39D07D3C2C6F5D269AB14F2AF4075376C4F53C0205 I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1083.2647394401.180 I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2062.1890606647.368 C_C20D4B021E0AFFB61E5D90A8AD1A949CBA948B6ED6C506FD3F623477DE2DDF5D C_E706FF8586C52A7176ACA48D7702EC2A6550564F0E42B0C09AE3FD1CCEA62CD4 C_B0FE43D7F9BDBFB580A0CA5527EF25F6B36EC4B671BA143B338B380B1F45C27D CR_E706FF8586C52A7176ACA48D7702EC2A6550564F0E42B0C09AE3FD1CCEA62CD4 R_B0FE43D7F9BDBFB580A0CA5527EF25F6B36EC4B671BA143B338B380B1F45C27D C_B209BBC3E9792036932058EAFDFF59DF6B02D2E0E24C683DBB3CFAD2B25B83E4 C_E7ACEB5389BA8C32B04736209B872B130DCE3B94FF3A17F3972AEE3EFE29C3CE C_A17354395E79A088E63A18457CAA51A441A886387058324A6BE95873BE2C4E38 C_D6F23AC5CCBEB47ECCF7BF129523258879FDED9D282F558043FF80249A7ED596 C_C80F6E9FDDA5B4FCB7E91E04A37B343ACE2C1B4C4C7D997B61E1037420FC6413 C_B89F81602D340760DCBF9C7FA464908E742B64A7C6E08A776FA3C9E7E3DE6507 C_D1F35069AB830308A3D10C95EC411D258E0A9CAA2EE0311B34E2874304803008 C_E241A982292C9628611468FB40BE60D4CC1B723333EE25A7584E871FE9DA753E C_B18A79A265A485271ADF7583A11B74126B27D0421B9B453C88A99D39E80DF5B2 CR_F071A22EE25478DF80A205153198A6FC12F84A9E6BFE53B8E5DFD1E7E2ED2B8E R_62D05C4ECF40774F04063E6FDE0B1A6CE4B671271358A09E1596B6EBA1E2DD4A C_B7CB0F72C5888EFB87CAA914B3258F858F11D8FC7438CC22070822389ABE2635 C_F33D7C5F62C48A98254F1B0ADED8C5A8E56D1601D517CF44369F4A800E4AA9F6 C_901AC56EC8F00C00FBAC686F0B7E1614E207CC1998593D930358F2BBE88093FF C_EDDF316486234851D86580CFE9B06D5A43E06F671105861787434F12D58AD4EC CR_EDDF316486234851D86580CFE9B06D5A43E06F671105861787434F12D58AD4EC C_115C2C7C875DAA2D80858EAB217D4BA6077F4CCDF9EB9B75A301CD68389427E6 C_B4744AE091F96C1897CB0086813E1AABE89C9AB276818B172EDE2A19A9884429 C_F8A40DE76638BC2D6B465FB946B5587EB32CE4928E4F71A985E7A4A1C7848063 C_7D26F1E16BC9CE86FDDDA09E425A859A3BF87CD94B9004A4B2B575CD1EF41374 NS_9F581794BF0EF2320077879A5113EE4731DF3217BB9DC47B1DB4E65852391F8B I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2794.2056762700.180 CI_FD1C1D414B71B5082C266A650E31EF6D5019382724244B685F217C0AAE00A921 IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2794.2056762700.180 I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2794.262712390.348 CI_41C53E6DB1ACF2453CEFD41398198E613F10DFF47709ECAB1D7F037756AC8CE7 IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2794.262712390.348 CD_0783FC4315F6719B07F6F7780EAC7B73D0B0471C3E21E23BC45CB6B44FFECA8E.2795.1.9646 �<D� j �ƂKZ ] Ű V� ` ��Z�
� |D�e
蜟' 7�N/> ' � &e � S��C � |�4�� � �9��� � _4�Z � �ͯ:J � �=_= � C I M _ L o g i c a l D e v i c e �ɝ��C�0 P CIM_LogicalDevice 6 � �� � # K S � � � � �������������������������������������������������������������������������������b � Win32_Bus CIMWin32 Locale UUID {8502C50E-5FBB-11D2-AAC1-006008C78BC7} BusNum B )
� � � ��� � uint32 MappingStrings � WMI BusType F 6
� � � �� < F uint32 MappingStrings Win32API|cHwRes|INTERFACE_TYPE ValueMap � � � � � � � � � � � � � � � � � � -1 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 DeviceID @ A
� ) � �� � ��1 ; E U string Override DeviceId MappingStrings ] WMI � C I M _ D e p e n d e n c y �ɝ��C�) CIM_Dependency 6 � �� � # ) Q ] � U��������� � Win32_DeviceBus CIMWin32 Locale UUID {8502C50F-5FBB-11D2-AAC1-006008C78BC7} Antecedent f@ A
� � � �� � ��� � � � ref:Win32_Bus Override Antecedent MappingStrings � WMI|Win32_Bus Dependent f@ A
� R � �� � ��i s ~ � ref:CIM_LogicalDevice Override Dependent MappingStrings � CIM|CIM_LogicalDevice W � C I M _ D e p e n d e n c y �ɝ��C�, CIM_Dependency 6 � �� � # - 5 ; c o % � � * > U��������������� � Win32_CIMLogicalDeviceCIMDataFile CIMWin32 Locale UUID {8502C510-5FBB-11D2-AAC1-006008C78BC7} Antecedent f@ A
� � � �� � ��� � � � ref:CIM_LogicalDevice Override Antecedent MappingStrings CIM|CIM_LogicalDevice Dependent f@ A
� t � �� � ��� � � � ref:CIM_DataFile Override Dependent MappingStrings � CIM|CIM_DataFile Purpose )
� � ��
uint16 MappingStrings % CIM PurposeDescription
)
� u � ��} � string MappingStrings � CIM � C I M _ P h y s i c a l C o m p o n e n t �ɝ��C�� I CIM_PhysicalComponent 6 � �� � ' - U b � � � G L ���_��������������������������������������������������������������������� � Win32_OnBoardDevice CIMWin32 Locale UUID {AEECF151-D0EA-11d2-ABFC-00805F538618} Description @ 6
� � � ��� � � � string Override Description MappingStrings � SMBIOS|Type 10|Description DeviceType @ 6
� I � ��Q a � � uint16 MappingStrings i SMBIOS|Type 10|Device Type n ValueMap � � � � � � � 1 2 3 4 5 6 7 Enabled B )
� � �� boolean MappingStrings ' SMBIOS|Type 10|Device Status n Tag @
( N
� � � ��� � ��� � � � string MaxLen Override Tag MappingStrings � WMI � C I M _ V o l t a g e S e n s o r �ɝ��C�� � CIM_VoltageSensor 6 � �� � & , T ^ ������������������������������������������������������������������������������������������������������������������������������������������ � Win32_VoltageProbe CIMWin32 Locale UUID {464FFAB8-946F-11d2-AAE2-006008C78BC7} DeviceID @ A
� � � �� � ��� � � � string Override DeviceId MappingStrings � WMI � C I M _ C u r r e n t S e n s o r �ɝ��C�� � CIM_CurrentSensor 6 � �� � & , T ^ ������������������������������������������������������������������������������������������������������������������������������������������ � Win32_CurrentProbe CIMWin32 Locale UUID {464FFABA-946F-11d2-AAE2-006008C78BC7} DeviceID @ A
� � � �� � ��� � � � string Override DeviceId MappingStrings � WMI � C I M _ T e m p e r a t u r e S e n s o r �ɝ��C�� � CIM_TemperatureSensor 6 � �� � " * 0 X b ������������������������������������������������������������������������������������������������������������������������������������������ � Win32_TemperatureProbe CIMWin32 Locale UUID {464FFABB-946F-11d2-AAE2-006008C78BC7} DeviceID @ A
� � � �� � ��� � � � string Override DeviceId MappingStrings � WMI � C I M _ F a n �ɝ��C�� T CIM_Fan 6 � �� � # K U ������������������������������������������������������������������������������������� � Win32_Fan CIMWin32 Locale UUID {464FFAB5-946F-11d2-AAE2-006008C78BC7} DeviceID @ A
� � � �� � ��� � � � string Override DeviceId MappingStrings � WMI � C I M _ R e f r i g e r a t i o n �ɝ��C�� I CIM_Refrigeration 6 � �� � ' - U _ �������������������������������������������������������������������������� � Win32_Refrigeration CIMWin32 Locale UUID {464FFAB6-946F-11d2-AAE2-006008C78BC7} DeviceID @ A
� � � �� � ��� � � � string Override DeviceId MappingStrings � WMI � C I M _ H e a t P i p e �ɝ��C�� I CIM_HeatPipe 6 � �� � " ( P Z �������������������������������������������������������������������������� � Win32_HeatPipe CIMWin32 Locale UUID {464FFAB7-946F-11d2-AAE2-006008C78BC7} DeviceID @ A
� � � �� � ��� � � � string Override DeviceId MappingStrings � WMI � �ɝ��C�� ) ��# + 1 Y c �� � � U���������������� � Win32_PnPDeviceProperty abstract Locale UUID {ee0b76cd-314b-41f1-99d4-d4f3b0421430} DeviceID
� � � �� string
� � � �� string KeyName
� � � �� string Type )
� ? � ��G Q Uint32 ValueMap 3 ! $ ' * - 0 3 6 9 < ? C G K O S W [ _ c g k o s w { � � � � � � � � � � � � � � � � � � � � � 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 4098 4099 4100 4101 4102 4103 4104 4105 4106 4107 4108 4109 4110 4111 4112 4113 8210 8211 8212 4117 4118 4119 4120 8217 .. � W i n 3 2 _ P n P D e v i c e P r o p e r t y �ɝ��C�� ! Win32_PnPDeviceProperty $ �������������������U � Win32_PnPDevicePropertyUint8 Data
� N � �� Uint8 � W i n 3 2 _ P n P D e v i c e P r o p e r t y �ɝ��C�� ! Win32_PnPDeviceProperty % ��������������������W � Win32_PnPDevicePropertyUint16 Data
� O � �� Uint16 � C I M _ G r o u p pҝ��C�� CIM_Group ) � �� � ������������������������������! � PrivilegeGroup IPMIPrv Locale � O�� u �Q �% � ?/f� 8 ���5 | ͚��
� u?��� q �ĭ�� � ��ɬ� h ��N [ Ƅ6� X e S q l P k g _ m b r _ o u t c o m e _ r e s o l u t i o n X��7 � 0 ) XeSqlPkg_mbr_outcome_resolution ! ) � �� # 1 = � � < O � � � c o � � 6 G � � WU����������������������������������������������@ � mbr_outcome_resolution EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid age_value % )
� ) 1 � �� sint64 WmiDataId federated_xact_id )
� � � � �� sint64 WmiDataId federated_xact_node_id )
� � � � �� uint32 WmiDataId federated_xact_node_local_id )
� P X � �� sint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId is_committed $ )
� $ + � �� sint8 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� # 0 � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g X��7 �� XeSqlPkg
C � �� - � � * c����A � XeSqlPkg_mbr_resolution_counts Description Occurs when matrix restore recovery has completed. It may not occur if there are no in-doubt transactions with commit outcomes to be processed during matrix restore recovery. Guid {339D0774-F237-4331-847C-772366B785B2} locale MS\0x409 DisplayName mbr_resolution_counts � X e S q l P k g _ m b r _ r e s o l u t i o n _ c o u n t s X��7 �� ( XeSqlPkg_mbr_resolution_counts ) � �� " 0 < � � b s � � I b � � W����������������������������0 � mbr_resolution_counts EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid FragmentId 6
� 6 > I V � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength resolved_commit_count )
� 6 > � �� uint32 WmiDataId resolved_rollback_count )
� � � � �� uint32 WmiDataId SequenceNumber 6
� � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g X��7 �T XeSqlPkg
C � ��+ 8 v | � � � � c����� � XeSqlPkg_backup_restore_startlsn_recorded Description Occurs when a backup restore operation recorded the startLSN Guid {C47F5A38-E94D-496C-9029-A696740DE2E6} locale MS\0x409 DisplayName backup_restore_startlsn_recorded �) X e S q l P k g _ b a c k u p _ r e s t o r e _ s t a r t l s n _ r e c o r d e d X��7 �o 3 XeSqlPkg_backup_restore_startlsn_recorded + ) � ��" - ; G � � m ~ � w � W����������������������������� � backup_restore_startlsn_recorded EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid FragmentId 6
� A I T a � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� G O Z g � �� uint32 WmiDataId Description SequenceNumber serepllsn C
� � � � ��� � string WmiDataId StringTermination NullTerminated Format w startlsn C
� o w � ��� � � � string WmiDataId StringTermination NullTerminated Format w � X e S q l P k g
X��7 �I XeSqlPkg
C � ��+ 8 k q � � � � c����� � XeSqlPkg_backup_restore_before_filestream Description Occurs just before the file stream backup starts. Guid {E8B4A4BF-CAF1-4BCC-9493-9A0208B886CD} locale MS\0x409 DisplayName backup_restore_before_filestream �) X e S q l P k g _ b a c k u p _ r e s t o r e _ b e f o r e _ f i l e s t r e a m X��7 �� 3 XeSqlPkg_backup_restore_before_filestream + ) � ��" - ; G � � H T � � J Z W�������������������������� � backup_restore_before_filestream EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� 5 = � �� uint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� ! , 9 � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g X��7 �@ XeSqlPkg
C � ��, 9 a g � � � � c����� � XeSqlPkg_metadata_create_local_temp_object Description Metadata create local temporary object Guid {D671B7C7-EB71-4546-8E87-A5C524AF8DC7} locale MS\0x409 DisplayName metadata_create_local_temp_object �* X e S q l P k g _ m e t a d a t a _ c r e a t e _ l o c a l _ t e m p _ o b j e c t
X��7 �� ' 4 XeSqlPkg_metadata_create_local_temp_object , ) � ��# . < H � � F R � � $ � � < L � � WU������������������������������������� � metadata_create_local_temp_object EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid brick_id )
� 3 ; � �� uint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId object_id )
� � �� uint32 WmiDataId object_name C
� u } � ��� � � � string WmiDataId StringTermination NullTerminated Format w RemainingLength 6
� + � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber session_id )
� � �� uint32 WmiDataId �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 <�n�^��
͝��C�� + J.3�� ` � WDMClassesOfDriver TP_V2_TimerExpiration C:\Windows\system32\kernelbase.dll[MofResourceName] rceName] me] ��a�` � ���� � �p � � ��(�� > pªb�
X e S q l P k g _ q u e r y _ p l a n _ p r o f i l e aX��7 �H v % XeSqlPkg_query_plan_profile ) � �� - 9 � � 7 F � � ' 1 { � � � / ; � � c o � � � � � � * ? � �
% o } # m } WUUUU������������������������������������������������������������������������������������������������������������������ � query_plan_profile EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid cpu_time )
� $ , � �� uint64 WmiDataId database_name l C
� � � � ��� � � � string WmiDataId StringTermination NullTerminated Format w dop ` )
� � �� uint32 WmiDataId duration
( )
� h p
� �� uint64 WmiDataId estimated_cost 4 )
� � � � �� sint32 WmiDataId estimated_rows 0 )
� $ � �� sint32 WmiDataId FragmentId 6
� � � � � �� uint32 WmiDataId Description FragmentId granted_memory_kb X )
� � � � �� uint64 WmiDataId ideal_memory_kb P )
� P X � �� uint64 WmiDataId nest_level )
� � � � �� uint16 WmiDataId object_id )
� � � �� sint32 WmiDataId object_name d C
� l t � �� � � � string WmiDataId StringTermination NullTerminated Format w object_type P
� � ��+ a 4 > �
uint16 WmiDataId XEMapId ValueMap p ! $ + 2 9 @ F M T [ b i p v } � � � � � � � � � � � � � � � � � � $ + 2 9 @ F M T [ b i p w ~ � � � � � � � � � � � � � � � � � � �
$
+
2
9
@
G
N
U
\
c
j
q
w
~
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
20801 17985 19521 21825 2 1 20545 21057 21313 19265 8257 18241 20034 19267 21059 19523 21827 8259 19779 21571 17475 20547 16964 21828 16708 21316 17220 20036 21060 21572 17732 8260 19268 17221 20549 20037 21061 17477 17989 19536 21840 16716 19525 19544 22597 21573 21848 8262 21318 21574 17222 19526 20038 21831 22601 17993 21321 21577 0 65536 22604 19277 21581 4 20047 19283 16975 18000 20816 21072 19280 8272 17232 20550 21328 131072 18002 18258 19538 21586 8274 17235 20563 20307 21075 22099 19539 21843 16723 20291 17491 18259 8276 17747 21587 20819 20051 8275 18004 16724 21076 22868 20821 21333 8277 8278 18263 19543 21847 22611 8280 21080 Values p � � � � � � � � �
%
.
3
9
D
N
U
Z
d
p
�
�
�
�
�
�
�
�
�
�
�
�
�
�
, 8 A I S ^ f o u � � � � � � � � � � � � � � % / 9 @ F O ] f n x | � � � � � � � � � � � � � � " + 3 < E N T [ a i o y � � � � ADHOC AGG AKEYLOGIN AKEYUSER ALL ANY APP APPROLE ASM ASYMKEY AUDIT AVAILABILITYGROUP BINDING CEK CERT CERTLOGIN CERTUSER CHECK CMK CONTRACT CREDENTIAL CRYPTOPROVIDER DATABASE DBAUDIT DBAUDITSPEC DBCONFIG DBCREDENTIAL DBEVTNOT DBRG DBTRIG DBXESES DEFAULT DEK EDGE ENDPOINT EVTNOTIF EXRP EXTDATASRC EXTFILEFMT EXTGRPLOGIN EXTGRPUSER EXTLANG EXTLIB EXTLOGIN EXTSCRIPT EXTTAB EXTUSER FKEY FNSCLASM FNTABASM FTCAT FTSTPLIST FUNCTION GROUPUSER INDEX INLFUNC INLSCLFN INTLTAB INVALID LOCAL LOGIN MASTERKEY MSGTYPE NOTADHOC OBEVTNOT OBFKEY OBJ PFUN PREPARED PRIORITY PRKEY PROC PROCASM PROPERTYLIST PSCHEME REMOTE REPLPROC RG ROLE ROUTE RULE SCHEMA SECPOLICY SEQUENCE SERVER SERVICE SQLLOGIN SQLUSER SRVAUDITSPEC SRVCONFIG SRVEVTNOT SRVROLE SRVTRIG SRVXESES STATISTICS SVCQ SYNONYM SYSTAB TABFUNC TRIGASM TRIGGER TYPE UQKEY USER USRTAB VIEW WINGROUP WINLOGIN WINUSER XMLSCHEMA XPROC XREL RemainingLength 6
� � � �� uint32 WmiDataId Description RemainingLength requested_memory_kb @ )
� v ~ � �� uint64 WmiDataId SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber serial_ideal_memory_kb
8 )
� \ d
� �� uint64 WmiDataId showplan_xml h C
� � � � ��� � string WmiDataId StringTermination NullTerminated Format w source_database_id )
� Z b � �� uint32 WmiDataId used_memory_kb H )
� � � � �� uint64 WmiDataId � X e S q l P k g bX��7 �� XeSqlPkg
C � ��, 9 � � # c����F � XeSqlPkg_query_post_execution_plan_profile Description Occurs after a SQL statement is executed. This event contains an XML representation of the actual query plan and uses lightweight profiling infrastructure. Guid {f68f5b0f-7b26-4c45-84be-4df646a7a539} locale MS\0x409 DisplayName query_post_execution_plan_profile �! X e S q l P k g _ q u e r y _ r x _ s e n d i n g _ b u f f e r s mX��7 �^ 0 + XeSqlPkg_query_rx_sending_buffers # ) � �� %
3 ? � � = M � � d n � � , � � � WU���������������������������������������������u � query_rx_sending_buffers EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid brick_id )
� * 2 � �� uint32 WmiDataId destination_id )
� � � � �� uint32 WmiDataId FragmentId 6
� � � � � �� uint32 WmiDataId Description FragmentId is_eos )
� R Y � �� sint8 WmiDataId query_id
% )
� � �
� �� uint64 WmiDataId query_operation_node_id )
� � �� uint32 WmiDataId RemainingLength 6
� p x � � � �� uint32 WmiDataId Description RemainingLength rows ! )
� � � � �� uint32 WmiDataId SequenceNumber 6
� E M X e � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g nX��7 � XeSqlPkg
C � �� - C I q y � � c����� � XeSqlPkg_query_rx_send_buffers Description RX sends row buffers Guid {3bc014fc-947e-4eb8-be70-dab84683ce7f} locale MS\0x409 DisplayName query_rx_send_buffers �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 =�n�^��
͝��C�} % J.3�� Z � WDMClassesOfDriver ThreadPoolTrace C:\Windows\system32\kernelbase.dll[MofResourceName] eName] ceName] �e] �g�� � 61ˁ� H ��KI� �L�� j �+Ԇ{ � �,\ V .�P%� �p�� D ��� � �pQ�� X e S q l P k g _ q u e r y _ r p c _ i n s e r t _ r o w �X��7 �� , ' XeSqlPkg_query_rpc_insert_row ) � �� ! / 9 � � � � @ L � r � � | � WU������������������������������������������� � query_rpc_insert_row EventType EventVersion accessor )
� p x � �� uint64 WmiDataId accessor_bindings )
� � � � �� uint64 WmiDataId accessor_buffer_size $ )
� - 5 � �� uint32 WmiDataId ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid FragmentId 6
� F N Y f � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� L T _ l � �� uint32 WmiDataId Description SequenceNumber use_local_rowset ( )
� � � � �� sint8 WmiDataId � X e S q l P k g �X��7 � XeSqlPkg
C � �� - M S { � � � c����� � XeSqlPkg_query_rpc_delete_rows Description Deleting rows from RPC rowset. Guid {18f0e3cc-f352-4174-8e8f-c12c1cc1fb45} locale MS\0x409 DisplayName query_rpc_delete_rows � X e S q l P k g _ q u e r y _ r p c _ d e l e t e _ r o w s �X��7 �� ( XeSqlPkg_query_rpc_delete_rows ) � �� " 0 < � � b s � � > N � � W���������������������� � query_rpc_delete_rows EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid FragmentId 6
� 6 > I V � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength row_deleted )
� , 3 � �� sint8 WmiDataId SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber use_local_rowset )
� � �� sint8 WmiDataId � X e S q l P k g �X��7 �B XeSqlPkg
C � ��+ 8 d j � � � � c����� � XeSqlPkg_query_rpc_fetch_row_by_key_value Description Fetching row by key value from RPC rowset. Guid {c264916a-bfa9-4529-bc4f-9006706e3c43} locale MS\0x409 DisplayName query_rpc_fetch_row_by_key_value �) X e S q l P k g _ q u e r y _ r p c _ f e t c h _ r o w _ b y _ k e y _ v a l u e �X��7 �w B 3 XeSqlPkg_query_rpc_fetch_row_by_key_value + ) � ��" - ; G � � F U � � f r � � : Q � � � � � WUU���������������������������������������������������������������d � query_rpc_fetch_row_by_key_value EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid cache_keys < )
� 4 ; � �� sint8 WmiDataId data_accessor ( )
� � � � �� uint64 WmiDataId data_accessor_bindings 0 )
� � � � �� uint64 WmiDataId data_accessor_buffer_size
8 )
� S [
� �� uint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId key_accessor )
� ' / � �� uint64 WmiDataId key_accessor_bindings )
� � � � �� uint64 WmiDataId key_accessor_buffer_size $ )
� � � � �� uint32 WmiDataId RemainingLength 6
� T \ g t � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber use_local_rowset = )
� R Y � �� sint8 WmiDataId � X e S q l P k g �X��7 �. XeSqlPkg
C � ��% 2 V \ � � � � c����� � XeSqlPkg_query_rpc_insert_index_row Description Inserting index row in RPC rowset. Guid {17bbc16d-1515-46d8-8402-f6c5211af541} locale MS\0x409 DisplayName query_rpc_insert_index_row �# X e S q l P k g _ q u e r y _ r p c _ i n s e r t _ i n d e x _ r o w �X��7 �� , - XeSqlPkg_query_rpc_insert_index_row % ) � �� ' 5 ? � � � � F R � x � � � � WU������������������������������������������� � query_rpc_insert_index_row EventType EventVersion accessor )
� v ~ � �� uint64 WmiDataId accessor_bindings )
� � � � �� uint64 WmiDataId accessor_buffer_size $ )
� 3 ; � �� uint32 WmiDataId ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid FragmentId 6
� L T _ l � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� R Z e r � �� uint32 WmiDataId Description SequenceNumber use_local_rowset ( )
� � � � �� sint8 WmiDataId � X e S q l P k g �X��7 � XeSqlPkg
C � �� , J P x � � � c����� � XeSqlPkg_query_rpc_end_update Description Ending update in RPC rowset. Guid {c430fedd-925b-45c4-a59b-f07d8d5c5cca} locale MS\0x409 DisplayName query_rpc_end_update � X e S q l P k g _ q u e r y _ r p c _ e n d _ u p d a t e �X��7 �j ' XeSqlPkg_query_rpc_end_update ) � �� ! / ; � � a r � � k } W����������������������� � query_rpc_end_update EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid FragmentId 6
� 5 = H U � �� uint32 WmiDataId Description FragmentId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� ; C N [ � �� uint32 WmiDataId Description SequenceNumber use_local_rowset )
� � � � �� sint8 WmiDataId �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 >�n�^��
͝��C�y ! J.3�� V � WDMClassesOfDriver TPCBDequeue C:\Windows\system32\kernelbase.dll[MofResourceName] eName] ResourceName] ctSequence �e] $�39@ L � @� ) �6-=� - 5 7 E 5 F 3 A D D 9 E 2 4 2 C 4 E 9 F 9 E D F 7 9 A A 9 7 F 7 9 E 7 9 1 1 C 5 A 8 B 9 0 2 E C 1 5 0 D 6 4 4 2 E 3 B 8 5 A 5 A A �Н��C�ȝ��C�� ���M 9 Z � __Win32Provider {7F72CC7A-74A0-45b4-909C-14FB8186DD7E} NetworkServiceHost DFSProvider E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C �Н��C� ȝ��C�� � ��������S l � __InstanceProviderRegistration \\.\Root\CIMV2:__Win32Provider.Name="DFSProvider" [ WQL:UnarySelect �Н��C� ` ) � ��� � � � � ^ o * J � � ) B � � � ] h � � � �
�
< I � � � � .
?
� � M V P a � � � � � � � n } UUUUUU������������������������������������������������������������������������������������������� � Win32_PingStatus Description The Win32_PingStatus class contains the values returned by the standard ping command. More information on ping can be found in RFC 791. AMENDMENT LOCALE Address )
� � � �� String Description The Address property holds the value of the address requested. This can be either hostname ('wxyz1234') or IP address ('193.128.177.124'). BufferSize )
� � � ��� � uint32 Description The BufferSize property indicates the buffer size sent with the ping command. The default value is 32. NoFragmentation )
� � � ��� � boolean Description The NoFragmentation property sets a 'Don't Fragment' on packets sent. The default is False, not fragmented. PrimaryAddressResolutionStatus V +
� � � � \ d uint32 Description The PrimaryAddressResolutionStatus property holds status information resulting from the gethostbyname call. This property reports the status of the resolution of the address value (ie value of the address property) given in the query. It is not related to any other resolution performed.
The property can take the following values:
0 - Success.
Other - For integer values other than those listed above, refer to WinSock error code documentation. Values p y Success Other ProtocolAddress N
� � � � String Description The ProtocolAddress property contains the address that the destination used to reply. ProtocolAddressResolved R
� n v � String Description The ProtocolAddressResolved property contains the resolved address corresponding to the ProtocolAddress property RecordRoute )
� 9 � ��A N uint32 Description The RecordRoute property indicates how many hops should be recorded while the packet is enroute. The default is zero. ReplyInconsistency 4
� boolean Description The ReplyInconsistency property reports inconsistent reply data. ReplySize 6
� � � � uint32 Description The ReplySize property indicates the size of the buffer returned. ResolveAddressNames
& )
� 8 � ��A N boolean Description The ResolveAddressesNames indicates whether or not the command will resolve address names of output address values. The default is False - no resolution. ResponseTime ,
� $
,
9
uint32 Description The ResponseTime property indicates the time elapsed to handle the request. ResponseTimeToLive
0
� �
�
�
uint32 Description The ResponseTimeToLive property indicates the time to live from moment the request is received. RouteRecord :
� u } � String Description The RouteRecord property holds a record of intermediate hops. RouteRecordResolved >
�
String Description The RouteRecordResolved property holds the resolved address corresponding to the RouteRecord entry. SourceRoute " )
� � � ��� � String Description The SourceRoute property contais a comma separated list of valid Source Routes. SourceRouteType 6
� �
� ���
�
s { uint32 Description The SourceRouteType property indicates the type of source route option to be used on host list specified in the SourceRoute property. If a value outside of the ValueMap is specified 0 is assumed. The default is zero. Values � � � None Loose Source Routing Strict Source Routing StatusCode ( +
� P X uint32 Description The StatusCode property returns the ping status codes. Values � � � � ( F T ` p � � � � � � � ) < Success Buffer Too Small Destination Net Unreachable Destination Host Unreachable Destination Protocol Unreachable Destination Port Unreachable No Resources Bad Option Hardware Error Packet Too Big Request Timed Out Bad Request Bad Route TimeToLive Expired Transit TimeToLive Expired Reassembly Parameter Problem Source Quench Option Too Big Bad Destination Negotiating IPSEC General Failure Timeout )
� � � ��� � uint32 Description The Timeout property indicates the Timeout value in milliseconds. If a response is not received in this time no response will be assumed. The default is 4000 milliseconds. TimeStampRecord B
� � � � uint32 Description The TimeStampRecord property holds a record timestamps for intermediate hops. TimeStampRecordAddress F
� 5 = J string Description The TimeStampRecordAddress property holds the intermediate hop corresponding to the TimeStampRecord entry. TimeStampRecordAddressResolved J
�
string Description The TimeStampRecordAddressResolved property holds the resolved address corresponding to the TimeStampRecordAddress entry. TimestampRoute )
� � � ��� � uint32 Description The TimestampRoute property indicates how many hops should be recorded with time stamp information while the packet is enroute. A Timestamp is the number of milliseconds that have passed since midnight UT. If the time is not available in milliseconds or cannot be provided with respect to midnight UT then any time may be inserted as a timestamp provided the high order bit of the timestamp field is set to one to indicate the use of a non-standard value. The default is zero. TimeToLive )
� � �� $ uint32 Description The TimeToLive property indicates the lifespan of the ping packet in seconds. This is an upper limit and not absolute as all routers MUST decrement this value by one and hops between routers rarely take this amount of time. When this value becomes zero the packet will be dropped by the router. The default value is 80 seconds. TypeofService )
� � � ��� � uint32 Description the TypeOfService property provides an indication of the abstract parameters of the quality of service desired. These parameters are to be used to guide the selection of the actual service parameters when transmitting a datagram through a particular network. The default value is 0.
bits 0-2: Precedence.
bit 3: 0 = Normal Delay, 1 = Low Delay.
bits 4: 0 = Normal Throughput, 1 = High Throughput.
bits 5: 0 = Normal Relibility, 1 = High Relibility.
bit 6-7: Reserved.
Precedence
111 - Network Control
110 - Internetwork Control
101 - CRITIC/ECP
100 - Flash Override
011 - Flash
010 - Immediate
001 - Priority
000 - Routine
For a detailed description of the various serive types, refer to RFC 791, page 12. �ySelect �8�ݐ S [�m�� � ��q�x � �,�i � � 8��
$ #s� � �s� ��zp� 6 X e S q l P k g _ q u e r y _ e x e c u t i o n _ b a t c h _ p r o c e s s i n g _ b i t m a p _ b u i l d �X��7 �� , @ XeSqlPkg_query_execution_batch_processing_bitmap_build 8 ) � ��/ : H T � O [ � � $ < � � a q WU������������������������������������������� � query_execution_batch_processing_bitmap_build EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid bytes )
� < D � �� uint64 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId is_fast_bitmap ( )
� � �� sint8 WmiDataId query_operator_node_id )
� s { � �� sint32 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength row_count )
� N V � �� uint64 WmiDataId SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �X��7 �m XeSqlPkg
C � ��6 C � � � � � � c����� � XeSqlPkg_query_execution_range_elimination_map_build Description Occurs when range elimination map is built in batch processing. Guid {eb0468db-7d6f-465e-bed3-318b93e83f64} locale MS\0x409 DisplayName query_execution_range_elimination_map_build �4 X e S q l P k g _ q u e r y _ e x e c u t i o n _ r a n g e _ e l i m i n a t i o n _ m a p _ b u i l d �X��7 �q * > XeSqlPkg_query_execution_range_elimination_map_build 6 ) � ��- 8 F R � S _ � � 1 ? � � WU����������������������������������������� � query_execution_range_elimination_map_build EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid bucket_size )
� @ H � �� uint64 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId query_operator_node_id )
� & � �� sint32 WmiDataId ranges_count )
� v ~ � �� uint64 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� c k v � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g �X��7 �a XeSqlPkg
C � ��< I r x � � � � c����� � XeSqlPkg_query_execution_column_store_segment_scan_started Description Occurs when column segment scan starts. Guid {0f7beae2-32fe-4e34-a3bb-be27252b62bd} locale MS\0x409 DisplayName query_execution_column_store_segment_scan_started �; X e S q l P k g _ q u e r y _ e x e c u t i o n _ c o l u m n _ s t o r e _ s e g m e n t _ s c a n _ f i n i s h e d �X��7 �� L E XeSqlPkg_query_execution_column_store_segment_scan_finished = ) � ��4 ? M Y � � � A J � � � U f � � 2 D � � WUU�������������������������������������������������������������������������g � query_execution_column_store_segment_scan_finished EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid FragmentId 6
� S [ f s � �� uint32 WmiDataId Description FragmentId impure_row_buckets_number
0 )
� � �
� �� sint64 WmiDataId input_rows_number 8 )
� . 6 � �� sint64 WmiDataId node_id )
� � � � �� sint32 WmiDataId output_rows_number @ )
� � � � �� sint64 WmiDataId pure_row_buckets_number ( )
� B J � �� sint64 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength rowgroup_id )
� ' � �� sint64 WmiDataId rowset_column_id $ )
� { � � �� sint32 WmiDataId SequenceNumber 6
� � � � � �� uint32 WmiDataId Description SequenceNumber thread_id )
� T \ � �� sint32 WmiDataId � X e S q l P k g �X��7 �� XeSqlPkg
C � ��> K � � � � � � c���� � XeSqlPkg_query_execution_column_store_rowgroup_scan_finished Description Occurs when row bucket processor finishes column store row group scan. Guid {40b21e6f-b58c-4821-9131-f5e6ebe6b11c} locale MS\0x409 DisplayName query_execution_column_store_rowgroup_scan_finished �< X e S q l P k g _ q u e r y _ e x e c u t i o n _ c o l u m n _ s t o r e _ r o w g r o u p _ s c a n _ f i n i s h e d �X��7 �t ` F XeSqlPkg_query_execution_column_store_rowgroup_scan_finished > ) � ��5 @ N Z c x � � ! 6 � � � � > Q � � j { � � G W � � WUU�������������������������������������������������������������������������������������������� � query_execution_column_store_rowgroup_scan_finished EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid cpu_cycles_counter0 , )
� P X � �� uint64 WmiDataId cpu_cycles_counter1
4 )
� � �
� �� uint64 WmiDataId cpu_cycles_counter2 < )
� � �� uint64 WmiDataId cpu_cycles_counter3 D )
� m u � �� uint64 WmiDataId cpu_cycles_counter4
L )
� � �
� �� uint64 WmiDataId cpu_cycles_counter5 T )
� + 3 � �� uint64 WmiDataId cpu_cycles_number $ )
� � � � �� uint64 WmiDataId FragmentId 6
� � � � � �� uint32 WmiDataId Description FragmentId node_id )
� W _ � �� sint32 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength rowgroup_id )
� 4 < � �� sint64 WmiDataId SequenceNumber 6
� � � � � � �� uint32 WmiDataId Description SequenceNumber thread_id )
�
� �� sint32 WmiDataId �4 8 9 0 E F F 4 1 3 4 8 A 2 D 3 F A 1 0 4 A 8 5 C 8 0 7 5 E 2 0 E 0 2 5 F 7 C F 4 0 D 0 0 4 E 2 B C 1 C 3 C 9 A A 5 4 8 6 5 F 4 ?�n�^��
͝��C�x J.3�� U � WDMClassesOfDriver TPCBCancel C:\Windows\system32\kernelbase.dll[MofResourceName] me] rceName] fResourceName] nce �e] �X�� � ?���� � ����n 5 ��
�� � �錀 Q ����
T �zv% � I�1 G ��Ea � ���� B ܶl�D J {~�ގ p M S F T _ H e a l t h R e c o r d �؝��C�� MSFT_HealthRecord ! ( ��������������Z � MSFT_HealthRecordReal64 locale Value
� R � �� real64 � .˝��C�� ) Z ��e m r � � e��������? � CIM_ProductFRU Description CIM_ProductFRU is an association between product and FRU that provides information regarding what product components have been or are being replaced. The association is one to many, conveying that a product can have many FRUs, and that a particular instance of a FRU is only applied to one (instance of a) product. AMENDMENT LOCALE FRU f
� � � � ref:CIM_FRU Description The FRU. Product f
� � ref:CIM_Product Description The product to which the FRU is applied. ei � /˝��C� ) % � ��� � � H P ��������� � CIM_ProductParentChild Description The CIM_ProductParentChild association defines a parent child hierarchy among products. For example, a product may come bundled with other products. AMENDMENT LOCALE Child f
� ! ref:CIM_Product Description The child product in the association. Parent f
� | � � ref:CIM_Product Description The parent product in the association. nd � 0˝��C�� ) * c ��n v � u��������j � CIM_ProductPhysicalElements Description Indicates the physical elements that make up a product. AMENDMENT LOCALE Component f
� � � � ref:CIM_PhysicalElement Description The physical element which is a part of the product. Product f
� > O \ ref:CIM_Product Description The product. �
C I M _ A c t i o n C˝��C�% ! CIM_Action ) " � ��� ���������������������������������� � CIM_DirectoryAction Description The CIM_DirectoryAction is an abstract class that is used for directories to be managed. Creation of directories is handled by CIM_CreateDirectoryAction and removal is handled by CIM_RemoveDirectoryAction. AMENDMENT LOCALE DirectoryName
� A I V string Description The DirectoryName indicates the name of the directory to which the action applies. �
C I M _ S e n s o r QtR|�C�( 2 CIM_Sensor ) # � ��� ��������������������������������������������������� � CIM_MultiStateSensor Description A multi-state sensor is a multi-member set of binary sensors, each binary sensor reporting a boolean result. AMENDMENT LOCALE � C I M _ R e d u n d a n c y G r o u p �tR|�C�� CIM_RedundancyGroup ) % �� / ����������I � CIM_ExtraCapacityGroup Description A class derived from redundancy group indicating that the aggregated elements have more capacity or capability than is needed. An example of this type of redundancy is the installation of N+1 power supplies or fans in a system. AMENDMENT LOCALE MinNumberNeeded
� [ c p UINT32 Description MinNumberNeeded indicates the smallest number of elements that must be operational in order to have redundancy. For example, in an N+1 redundancy relationship, the MinNumberNeeded property should be set equal to N. � C I M _ R e d u n d a n c y G r o u p �tR|�C� CIM_RedundancyGroup ) ) � ��� � � ��������� � CIM_StorageRedundancyGroup Description A class derived from redundancy group containing mass storage-related redundancy information. Storage redundancy groups are used to protect user data. They are made up of one or more physical extents, or one or more aggregate physical extents. Storage redundancy groups may overlap. However, the underlying extents within the overlap should not contain any check data. AMENDMENT LOCALE TypeOfAlgorithm +
� � > F UINT16 Description The TypeOfAlgorithm specifies the algorithm used for data redundancy and reconstruction. For example, "P+Q" (value=5) or "P+S" (7) may be specified. The value, 0, is not valid in the CIM Schema since in DMI it represents that no redundancy exists. In this case, the object should not be instantiated. Values j u | � � � � � Undefined Other Unknown Copy XOR P+Q S P+S � C I M _ R e d u n d a n c y G r o u p �tR|�C�c CIM_RedundancyGroup ) � ��� /������ � CIM_SpareGroup Description A class derived from RedundancyGroup indicating that one or more of the aggregated elements can be spared. (The actual Spares are defined using the ActsAsSpare association.) An example is the use of redundant NICs in a ComputerSystem - where one NIC is primary and the other is Spare. The 'primary' NIC would be a member of the SpareGroup (associated using the RedundancyComponent class) and the 'other' NIC would be associated using the ActsAsSpare relationship. AMENDMENT LOCALE � C I M _ L o g i c a l E l e m e n t �tR|�C� CIM_LogicalElement ) " ; ��F N a � � %������� � CIM_RedundancyGroup Description A class derived from CIM_LogicalElement that is a special collection of managed system elements. This collection indicates that the aggregated components together provide redundancy. All elements aggregated in a redundancy group should be instantiations of the same object class. AMENDMENT LOCALE CreationClassName )
� � � � � �� STRING Description CreationClassName indicates the name of the class or the subclass used in the creation of an instance. When used with the other key properties of this class, this property allows all instances of this class and its subclasses to be uniquely identified. RedundancyStatus +
� � � . 6 UINT16 Description RedundancyStatus provides information on the state of the redundancy group. "Fully Redundant" (value=2) means that all of the configured redundancy is still available; "Degraded Redundancy" (3) means that some failures have been experienced but some reduced amount of redundancy is still available; "Redundancy Lost" (4) means that a sufficient number of failures have been experienced such that no redundancy is available and the next failure experienced will cause overall failure. Also, the values, "Other" (1) and "Unknown" (0), are defined. Values N W ^ o � Unknown Other Fully Redundant Degraded Redundancy Redundancy Lost cy � C I M _ S o f t w a r e E l e m e n t uR|�C� 2 CIM_SoftwareElement ) # � ��� � ��������������������������������������������������w � CIM_VideoBIOSElement Description CIM_VideoBIOSElement represents the low-level software that is loaded into non-volatile storage and used to bring up, configure and access a computer system's video controller and display. AMENDMENT LOCALE IsShadowed ,
� , 5 B BOOLEAN Description If true, indicates that the video BIOS is shadowed. �4 1 C 5 3 E 6 D B 1 A C F 2 4 5 3 C E F D 4 1 3 9 8 1 9 8 E 6 1 3 F 1 0 D F F 4 7 7 0 9 E C A B 1 D 7 F 0 3 7 7 5 6 A C 8 C E 7 �vR|�C�ȝ��C�� � � __thisNAMESPACE � �� � � ? ? `�^�� � ��� � ���2 � � �. � �Qn=� \ �u;v3 � �u��� d ��)�F x 1 X e S q l P k g _ s t r e t c h _ r e m o t e _ i n d e x _ e x e c u t i o n _ c o m p l e t e d CT��7 �~ 0 ; XeSqlPkg_stretch_remote_index_execution_completed 3 ) � ��* 5
C O � P ] � � � V b � � ' 8 � � 1 ; WU���������������������������������������������� � stretch_remote_index_execution_completed EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� = E � �� uint32 WmiDataId duration_ms )
� � � � �� sint64 WmiDataId error_number % )
� � � � �� sint32 WmiDataId error_state
) )
� C K
� �� sint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId is_success )
� � �� sint8 WmiDataId RemainingLength 6
� | � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� ! � �� uint32 WmiDataId Description SequenceNumber table_id )
� r z � �� uint32 WmiDataId � X e S q l P k g DT��7 �� XeSqlPkg
C � ��4 A � � � � � � c���� � XeSqlPkg_stretch_remote_column_execution_completed Description Reports the completion of remote execution for the generated code for a stretched column Guid {A6909897-2742-4033-B845-6F79D93FFCF2} locale MS\0x409 DisplayName stretch_remote_column_execution_completed �2 X e S q l P k g _ s t r e t c h _ r e m o t e _ c o l u m n _ e x e c u t i o n _ c o m p l e t e d ET��7 �� 0 < XeSqlPkg_stretch_remote_column_execution_completed 4 ) � ��+ 6
D P � Q ^ � �
W c � � ( 9 � � 2 < WU���������������������������������������������� � stretch_remote_column_execution_completed EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� > F � �� uint32 WmiDataId duration_ms )
� � � � �� sint64 WmiDataId error_number % )
� � � � �� sint32 WmiDataId error_state
) )
� D L
� �� sint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId is_success )
� � �� sint8 WmiDataId RemainingLength 6
� } � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
�
" � �� uint32 WmiDataId Description SequenceNumber table_id )
� s { � �� uint32 WmiDataId � X e S q l P k g FT��7 �� XeSqlPkg
C � ��4 A � � � � � � c���� � XeSqlPkg_stretch_table_row_migration_results_event Description Reports an error or completion of a successful migration of a number of batches of rows Guid {5F754937-69D5-4732-9D99-CD27A8570892} locale MS\0x409 DisplayName stretch_table_row_migration_results_event �2 X e S q l P k g _ s t r e t c h _ t a b l e _ r o w _ m i g r a t i o n _ r e s u l t s _ e v e n t GT��7 �� 8 < XeSqlPkg_stretch_table_row_migration_results_event 4 ) � ��+ 6 D P � Q ^ � �
W c � � ( 9 � � � � � WUU������������������������������������������������������ � stretch_table_row_migration_results_event EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� > F � �� uint32 WmiDataId duration_ms )
� � � � �� sint64 WmiDataId error_number % )
� � � � �� sint32 WmiDataId error_state
) )
� D L
� �� sint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId is_success )
� � �� sint8 WmiDataId RemainingLength 6
� } � � � � �� uint32 WmiDataId Description RemainingLength rows - )
� � � � �� sint64 WmiDataId SequenceNumber 6
� R Z e r � �� uint32 WmiDataId Description SequenceNumber table_id )
� � � � �� uint32 WmiDataId � X e S q l P k g HT��7 �� XeSqlPkg
C � ��6 C � � � � � � c���� � XeSqlPkg_stretch_table_row_unmigration_results_event Description Reports an error or completion of a successful unmigration of a number of batches of rows Guid {B96AD780-60D3-4A22-B7F9-54F832F9B9AE} locale MS\0x409 DisplayName stretch_table_row_unmigration_results_event �4 X e S q l P k g _ s t r e t c h _ t a b l e _ r o w _ u n m i g r a t i o n _ r e s u l t s _ e v e n t IT��7 �� 8 > XeSqlPkg_stretch_table_row_unmigration_results_event 6 ) � ��- 8 F R � S ` � � Y e � � * ; � � � � WUU������������������������������������������������������ � stretch_table_row_unmigration_results_event EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid database_id )
� @ H � �� uint32 WmiDataId duration_ms )
� � � � �� sint64 WmiDataId error_number % )
� � � � �� sint32 WmiDataId error_state
) )
� F N
� �� sint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId is_success )
� � �� sint8 WmiDataId RemainingLength 6
� � � � � �� uint32 WmiDataId Description RemainingLength rows - )
� � � � �� sint64 WmiDataId SequenceNumber 6
� T \ g t � �� uint32 WmiDataId Description SequenceNumber table_id )
� � � � �� uint32 WmiDataId � X e S q l P k g Y��7 �P XeSqlPkg
C � ��) 6 t z � � � � c����� � XeSqlPkg_hadr_transport_replica_timeout Description Event which fires when a HADR transport replica is timed out Guid {C9492E13-3B2D-49F6-B575-BAC57CF1DC93} locale MS\0x409 DisplayName hadr_transport_replica_timeout � �x�] . 7�t> 9���E C & �Z� � ���!� �yE��
: > ���
� �]t�� < H�ɯ� v �˃�3 � o���� � �gqՄ � �� Zz � � GVc � 4�h&# � h+�� _ _ E x t r i n s i c E v e n t 3̝��C�� __ExtrinsicEvent # ) Q ^ ����������������� � Win32_ComputerSystemEvent Locale UUID {999A286E-CF9C-4f0c-8F0F-827C4C0D9CC6} MachineName
� � � �� string � R S O P _ I E P r i v a c y S e t t i n g s (ѝ��C�� RSOP_IEPrivacySettings # / �����������������������������W � RSOP_IEESCPrivacySettings Locale EscEnabled
� N boolean � C I M _ C o n t r o l l e d B y i˝��C� CIM_ControlledBy ) & x ��� � � � ��������������������������������� � CIM_USBControllerHasHub Description USBControllerHasHub defines the Hub(s) that are downstream of the USBController. AMENDMENT LOCALE Antecedent f@
� � � � ref:CIM_USBController Description The USBController. Dependent f@
� 2 B O ref:CIM_USBHub Description The USBHub that is associated with the Controller. � _ _ E x t e n d e d S t a t u s m˝��C�� __ExtendedStatus ) % � ��
6 J �����������������������������< � Win32_PrivilegesStatus Description The Win32_PrivilegesStatus class reports information about privileges required to complete an operation. It may be returned when an operation failed, or when a partially populated instance has been returned. AMENDMENT LOCALE PrivilegesNotHeld
� I Q ^ string Description The PrivilegesNotHeld property indicates required access privileges missing in order to complete an operation. The types ofaccess privileges can be found under the Windows NT Privileges. Example: SE_SHUTDOWN_NAME PrivilegesRequired
� v ~ � string Description The PrivilegesRequired property indicates all privileges required to perform an operation. This includes values from the PrivilegesNotHeld property.
Example: SE_SHUTDOWN_NAME po � n˝��C�� ) ) � ��� � � Win32_MethodParameterClass Description The Win32_MethodParameter class is a base class forimplementation of method parameters derived from this class. AMENDMENT LOCALE � C I M _ E l e m e n t S e t t i n g p˝��C�� CIM_ElementSetting ) & � ��� � � � � ���������� � Win32_WMIElementSetting Description The Win32_WMIElementSetting class represents an association between a service running in the Win32 system, and the WMI settings it can use. AMENDMENT LOCALE Element f@ )
� & � �� ref:Win32_Service Description The Element reference in the Win32_WMIElementSetting association, represents the Win32 service using or surfacing WMI properties. Setting f@ )
� � � � �� ref:Win32_WMISetting Description The Setting reference in the Win32_WMIElementSetting association, represents the WMI settings available to the Win32 service. in � C I M _ S o f t w a r e F e a t u r e MtR|�C�� CIM_SoftwareFeature ) # � ��� � � C T ������������������������������ � CIM_VideoBIOSFeature Description CIM_VideoBIOSFeature represents the capabilities of the low-level software that is used to bring up, configure and use a computer system's video controller and display. AMENDMENT LOCALE CharacteristicDescriptions
� ( 0 = STRING Description An array of free-form strings providing more detailed explanations for any of the video BIOS features indicated in the Characteristics array. Note, each entry of this array is related to the entry in the Characteristics array that is located at the same index. Characteristics +
� � � � � UINT16 Description An array of integers that specify the features supported by the video BIOS. For example, one could indicate support for VESA power management (value=6) or video BIOS shadowing (8). The value, 3, is not valid in the CIM schema since in DMI it represents that no BIOS features are supported. In this case, the object should not be instantiated. Values + 2 ; F [ { � � � Other Unknown Undefined Standard Video BIOS VESA BIOS Extensions Supported VESA Power Management Supported VESA Display Data Channel Supported Video BIOS Shadowing Allowed Video BIOS Upgradeable �
C I M _ U S B D e v i c e gtR|�C�
B CIM_USBDevice ) * ��5 = K i x �����������������������������������������������������������������c � CIM_USBHub Description USB Hub Device. AMENDMENT LOCALE GangSwitched 9
� w � � boolean Description Indicates whether power to the Hub Ports is individually or gang-switched. If this value is FALSE, power is switched individually for each Port. If this value is TRUE, power is switched to all Ports on the Hub at once. NumberOfPorts ;
� � � � uint8 Description Number of downstream Ports on the Hub, including those embedded in the Hub's silicon. Individual USBPorts are associated with the Hub using the USBPortOnHub association. � C I M _ L o g i c a l E l e m e n t �tR|�C�: CIM_LogicalElement ) ' � ��� � � Win32_ProgramGroupOrItem Description The Win32_ProgramGroupOrItem class represents a logical grouping of programs on the user's Start|Programs menu. It contains program groups and program group items. AMENDMENT LOCALE � C I M _ L o g i c a l F i l e uR|�C�k CIM_LogicalFile �� ! � CIM_DataFile AMENDMENT LOCALE � R S O P _ I E F a v o r i t e O r L i n k I t e m puR|�C�f # RSOP_IEFavoriteOrLinkItem ) ��+ 3 9 � � & 6 ���������������������������� � RSOP_IELinkItem Description AMENDMENT LOCALE name @ )
� p x � � �� string DisplayName Name rsopID 6
� � � ��� � string Description Foreign key to RSOP_PolicySetting. DisplayName RSOP ID rsopPrecedence 6
� z � ��� � � � uint32 Description Foreign key to RSOP_PolicySetting. DisplayName RSOP Precedence � M s f t S i l _ D a t a �wR|�C�� MsftSil_Data ) W ��b j r � MsftSil_Computer Description Encapsulates miscellaneous properties from a computer. AMENDMENT LOCALE MS_409 � C I M _ S t a t i s t i c a l I n f o r m a t i o n j˝��C��
$ CIM_StatisticalInformation ) � ��& �������������. � Win32_Perf Description AMENDMENT Locale �
W i n 3 2 _ P e r f k˝��C��
Win32_Perf ) � " ��- �������������5 � Win32_PerfRawData Description AMENDMENT Locale �
W i n 3 2 _ P e r f l˝��C��
Win32_Perf ) � & ( ��3 �������������; � Win32_PerfFormattedData Description AMENDMENT Locale �+ M S F T _ S e r v e r M a n a g e r S e r v e r C o m p o n e n t D e s c r i p t o r T���j��� 5 MSFT_ServerManagerServerComponentDescriptor - # ) 7 > � ServerComponent_DHCP DisplayName DHCP ClassVersion 8.0.0 mp � ���� H ��P9� . ���� M!�'
[ ���=h
� p�O�
C ��VM � �
�� � W i n 3 2 _ C o m p u t e r S y s t e m E v e n t 4̝��C�� # Win32_ComputerSystemEvent % + S Y ��������������������� � Win32_ComputerShutdownEvent Locale UUID {A6B834B1-F974-4445-8F2E-FC996638B350} Type
� � � �� uint32 � C I M _ C h e c k 0��C� ) CIM_Check C # ) � Q � ��Z j � � � � ����������������������������������������X � Win32_ProgIDSpecification Locale UUID {8D500594-DB33-11d2-85FC-0000F8102E5F} MSIProv MappingStrings r Microsoft.MSI Description @
� � � �� string Parent
" '
� � �� � �� string Fixed ProgID '
� I Q �� � �� string Fixed � C I M _ S e t t i n g }˝��C�� CIM_Setting
) $ �� ! . � � � � �������������������������T � Win32_PageFileSetting Description The Win32_PageFileSetting class represents the settings of a page file. Information contained within objects instantiated from this class specify the page file parameters used when the file is created at system startup. The properties in this class can be modified and deferred until startup. These settings are different from the run time state of a page file expressed through the associated class Win32_PageFileUsage.
Note: The SE_CREATE_PAGEFILE privilege is required for Windows XP AMENDMENT LOCALE InitialSize +
� g o v � � uint32 Units megabytes Description The InitialSize property indicates the initial size of the page file.
Example: 139 MaximumSize +
� ( 0 7 B O uint32 Units megabytes Description The MaximumSize property indicates the maximum size of the page file.
Example: 178 Name )
� � � ��� � string Description The Name property indicates the path and file name of the page file.
Example: C:\PAGEFILE.SYS � W i n 3 2 _ B a s e S e r v i c e �tR|�C�! E Win32_BaseService ) ! p ��{ ���������������������������������������������������������������������� � Win32_SystemDriver Description The Win32_SystemDriver class represents the system driver for a base service. AMENDMENT LOCALE �
C I M _ D i r e c t o r y uR|�C�p CIM_Directory ) �� � Win32_Directory Description The Win32_Directory class represents a directory entry on a Win32 computer system. Directory is a type of file that logically groups data files 'contained' in it and provides path information for the grouped files.
Example: C:\TEMP. AMENDMENT LOCALE y � C I M _ D a t a F i l e uR|�C� CIM_DataFile ) �� ) � � � � � �������� � Win32_CodecFile AMENDMENT Description The Win32_CodecFile class represents the audio or video codec installed on the computer system. Codecs convert one media format type to another, typically a compressed format to an uncompressed format. The name "codec" is derived from a combination of "compress" and "decompress." For example, a codec can convert a compressed format such as MS-ADPCM to an uncompressed format such as PCM, which most audio hardware can play directly. LOCALE Description
� ' 4 string Description The Description property indicates the full name of the codec driver. This string is intended to be displayed in large (descriptive) spaces.
Example: Microsoft PCM Converter. Group +
� $ , 9 � � string Description The Group property indicates the type of codec represented by this class. Values � � Audio Video ro � C I M _ D a t a F i l e uR|�C�r CIM_DataFile ) �� ( � � � - C P � � U����������������� � Win32_PageFile AMENDMENT Description The Win32_PageFile class has been Deprecated in favor of the Win32_PageFileUsage and Win32_PageFileSetting. These classes respectively correspond to the runtime and persisted states of pagefiles. The Win32_PageFile represents the file used for handling virtual memory file swapping on a Win32 system.
Example: C:\PAGEFILE.SYS
Note: The SE_CREATE_PAGEFILE privilege is required for Windows XP LOCALE FreeSpace +
� uint32 Description The FreeSpace property indicates the space available in the paging file. The operating system can enlarge the paging file as necessary up to the limit imposed by the user. This member shows the difference between the size of current committed memory and the current size of the paging file - it does not show the largest possible size of the paging file.
This property has been deprecated in favor of a corresponding property(s) contained in the Win32_PageFileUsage and//or the Win32_PageFileSetting. Units megabytes InitialSize +
� f n { 1 8 uint32 Description The InitialSize property indicates the initial size of the page file.
This property has been deprecated in favor of the corresponding property in the Win32_PageFileSetting class. Units megabytes MaximumSize +
� � � � � � uint32 Description The MaximumSize property indicates the maximum size of the page file as set by the user. The operating system will not allow the page file to exceed this limit.
This property has been deprecated in favor of the corresponding property in the Win32_PageFileSetting class. units megabytes Name
� � � string Description The Name property indicates the name of the page file.
Example: C:\PAGEFILE.SYS
The name property has been deprecated in favor of the corresponding property contained in the Win32_PageFileUsage and the Win32_PageFileSetting. un � R S O P _ P o l i c y S e t t i n g $uR|�C�� 8 RSOP_PolicySetting ) * U ��`
h s � � f j � � � " 1 � � < B � � ? L �_U������������������������������������������������������ � RSOP_IEEE80211PolicySetting Description Policy object for Wireless Network Policy AMENDMENT LOCALE ClassName +
� � � � � � string Description ClassName DisplayName ClassName description +
� * 2 ? L Y string Description description DisplayName description id @ 6
� � � � � � � �� string Description Inherited from RSOP_PolicySetting DisplayName ID msieee80211Data , +
� A H U g t uint8 Description msieee80211-Data DisplayName msieee80211-Data msieee80211DataType
( +
� � � � � uint32 Description msieee80211-DataType DisplayName msieee80211-DataType msieee80211ID $ +
� j r � � string Description msieee80211-ID DisplayName msieee80211-ID msieee80211Name +
� � � * string Description msieee80211-Name DisplayName msieee80211-Name name @ +
� { � � � � string Description name DisplayName name precedence @ +
� � � & 3 uint32 Description Inherited from RSOP_PolicySetting DisplayName Precedence whenChanged 0 +
� � � � � � uint32 Description whenChanged DisplayName whenChanged � AMENDMENT LOCALE ms_409 � � C I M _ M a n a g e d S y s t e m E l e m e n t �vR|�C� � " CIM_ManagedSystemElement 6 R [ ` ��k s { � A J � � G Q � � ] i � � � ) 3 � � V ` � � N ^ � � _ n �
�
2 < � � P _ � � m
u
�
�
f q 3 9 � � � � ���_UUUUU������������������������������������������������������������������������������������������������������������������������������������������1 � MSFT_Printer Description Represents a print queue and its associated settings. Version 1.0 AMENDMENT LOCALE MS_409 BranchOfficeOfflineLogSizeMB # z
� � � � uint32 Description Specifies the maximum size (in MB) of the Branch Office Remote Offline Logging file for this printer. Comment B
� v ~ � string Description A textual comment describing the printer. ComputerName . )
� � � �� string Description The name of the server which this printer resides on. Datatype N
� } � � string Description The data type the printer will use to record print jobs. DefaultJobPriority b
� ! uint32 Description The default job priority for jobs printed to this printer. DeviceType & � )
� � � ��� � uint32 Description Indicates the type of this device (Standard or 3D Printer). DisableBranchOfficeLogging " x
� : C P boolean Description Specifies whether Branch Office Remote Logging is disabled for this printer. DriverName :
� � � � string Description The name of the printer driver associated with this printer. JobCount r
� _ g t uint32 Description The number of currently queued print jobs for this printer. KeepPrintedJobs ! v
� � � boolean Description Specifies whether print jobs in the queue should be kept after they are printed. Location >
� � � � string Description A textual description of the physical location of the printer. Name @ )
� & 3 � �� string Description The name of this printer. PermissionSDDL V
� � � � string Description The SDDL representation of the permissions set on this printer. PortName 6
� + string Description The name of the port associated with this printer. PrinterStatus n +
� � � � � � uint32 Description The status of the printer device. BitValues Z b i { � � � � � � � � � � �
+
5
@
S
b
m
}
�
�
Paused Error Pending Deletion Paper Jam Paper Out Manual Feed Paper Problem Offline IO Active Busy Printing Output Bin Full Not Available Waiting Processing Initializing Warming Up Toner Low No Toner Page Punt User Intervention Out Of Memory Door Open Server Unknown Power Save Server Offline Driver Update Needed PrintProcessor J
� �
�
string Description The name of the print processor for this device. Priority ^
� h p } uint32 Description The priority of this printer when scheduling print jobs. Published T
� � � boolean Description Indicates whether this printer has been published to the Active Directory. RenderingMode Z
� � � � uint32 Description Describes the rendering mode for connections made to this printer. SeparatorPageFile F
� #
+
8
string Description Path to a file containing PDL for a separator page. Shared R
� �
�
�
boolean Description Indicates whether this printer is currently shared. ShareName 2
� # + 8 string Description The name under which this printer is shared. StartTime f
� � � � uint32 Description The earliest time at which the printer will print a job, expressed as minutes elapsed since 12:00 AM GMT (Greenwich Mean Time). Type % � )
� p � ��x � uint32 Description Indicates the type of this queue (Connection or Local queue). UntilTime j
� � uint32 Description The latest time at which the printer will print a job, expressed as minutes elapsed since 12:00 AM GMT (Greenwich Mean Time). WorkflowPolicy $ ~
� � � � uint32 Description Describes the workflow application policy for connections made to this printer. چ ] l � u �: y< �< �< Yw �x �x 1y �� �� � ʄ V� � AddConnection - Description Adds a new connection to a shared print queue. a42c9160500003S ROOT\StandardCimV2\MS_409 ���� � �� �� * ����L � __PARAMETERS abstract ConnectionName string
� : In
� : a �� Specifies the name of the shared queue. Description )
� : a ��� � ID 6
� D a ��� � � string __ �� a42c9160500003S ROOT\StandardCimV2\MS_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � AddByExistingPort ) Description Adds a new printer to the specified server using an existing printer port. t6 a42c9160500003S ROOT\StandardCimV2\MS_409 ���� � �6 R �� � � * � % N 8 m u � � w r � � � � /
x
` � �
�
2 o v � � � } u I � � T b UUUUU������������������������������������������������������������������������������ � __PARAMETERS abstract Comment string
� 3 In
� 3 Z �� Specifies the printer comment. Description )
� 3 Z ��� � ID 6
� 4 Z ��� � � string Datatype string
� X In
� X �� Specifies the data type the printer will use to record print jobs Description )
� X ��� � ID 6
� | ��� � 4 string DriverName string
� � In
� � � �� Specifies the name of the print driver to be associated with the printer. Description )
� � � ��B � ID 6
� � � ��B � � string UntilTime uint32
� � In
� � �� Specifies the latest time at which the printer will print a job, expressed as minutes elapsed since 12:00 AM GMT (Greenwich Mean Time). Description )
� � ��� H ID 6
� ] ��� H uint32 KeepPrintedJobs boolean
� � In
� � � �� Specifies whether printer jobs in the queue should be kept after spooling. De�m�@ a 36�֡ �ۓ˯ P C I M _ M a n a g e d E l e m e n t Zݝ��C�� ' CIM_ManagedElement 6 & � �� � ? M U c � � � � 5 ; � � �U�������������������������������������� � MSFT_PrinterProperty UMLPackagePath CIM::Core::CoreElements MSFT_Printer locale ComputerName '
� � � �� � �� string PrinterName '
� � � �� � �� string PropertyName '
� - � �� � �� string Type 4
� } � �� � ��� � uint32 MappingStrings � � � Boolean Integer String Value
� � string � A � V r � �
x � � � : � SetByPrinterName , ��9 �� implemented static � ae442007200009F ROOT\StandardCimV2 ���� � �1 �� * � � H � Q � U����������������� � __PARAMETERS abstract ComputerName string
� 8 In
� 8 _ �� ID )
� � _ ��� string PrinterName string
� � In
� � �� ID )
� ��D string PropertyName string
� � In
� � � �� ID )
� 7 � ��� string Value string
� X In
� X �� ID )
� � ��� string __ �� ae442007200009F ROOT\StandardCimV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � SetByPrinterPropertyObject � ��� �� implemented static N ae442007200009F ROOT\StandardCimV2 ���� � �� �� * � ����P � __PARAMETERS abstract
InputObject object
� 7 In
� 7 ^ �� MSFT_PrinterProperty EmbeddedInstance
)
� 7 ^ ��� � ID
6
� 3 ^ ��� � � object:MSFT_PrinterProperty __ �� ae442007200009F ROOT\StandardCimV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � SetByPrinterObject � ��� �� implemented static � ae442007200009F ROOT\StandardCimV2 ���� � ��
�� * � T � l ������������� � __PARAMETERS abstract
PrinterObject object
� 9 In
� 9 ` �� MSFT_Printer EmbeddedInstance
)
� 9 ` ��� � ID
6
� - ` ��� � � object:MSFT_Printer PropertyName string
� b In
� b � �� ID )
� � � ��� string Value string
� In
� : �� ID )
� � : ��h string __ �� ae442007200009F ROOT\StandardCimV2 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � M S F T _ P r i n t e r P o r t [ݝ��C�� ] MSFT_PrinterPort 6 ' � �� � @ N V g � � � � , ^ m � � O \ � � ����UU���������������������������������������������������������������������������������������� � MSFT_TcpIpPrinterPort UMLPackagePath CIM::Core::CoreElements MSFT_Printer locale LprByteCounting T
� � � �� boolean LprQueueName P
� � � �� string PortNumber >
� � �� uint32 PrinterHostAddress 6
� V � �� string PrinterHostIP :
� � � �� string Protocol L )
� � � ��� � uint32 MappingStrings RAW LPR SNMPCommunity B
� G � �� string SNMPEnabled J
� � � �� boolean SNMPIndex F
� � � �� uint32 � R S O P _ P o l i c y S e t t i n g %uR|�C� + RSOP_PolicySetting ) " / ] ��h p } � � � � % @ � � ? K � � �_�����������������������������������������W � RSOP_IEEE80211GroupPolicySetting Description Policy object for IEEE 802.11 Network Policy AMENDMENT LOCALE description +
� � � � � � string Description description DisplayName description id @ 6
� : B O r � �� string Description Inherited from RSOP_PolicySetting DisplayName ID msieee80211PolicyData +
� � � �
string Description msieee80211-PolicyData DisplayName msieee80211-PolicyData msieee80211PolicyReserved +
� y � � � � uint8 Description msieee80211-PolicyReserved DisplayName msieee80211-PolicyReserved name @ +
� & , 9 string Description name DisplayName name precedence @ +
� � � � � � uint32 Description Inherited from RSOP_PolicySetting DisplayName Precedence whenChanged $ +
� # 0 = J uint32 Description whenChanged DisplayName whenChanged � z���� � �%�� P �]�-m = ��YP� \ ��g N 4�T �
���� n ͝��C�� , i v � � � � U��������������, � WMIBinaryMofResource Locale HighDateTime '
� a � �� � �� uint32 LowDateTime '
� � � �� � �� uint32 MofProcessed
� � boolean Name '
� $ � �� � �� string � C I M _ D e p e n d e n c y �˝��C� CIM_Dependency ) $ 1 � ��� � � � u��������� � Win32_LogicalProgramGroupDirectory Description The Win32_LogicalProgramGroupDirectory class represents an association between logical program groups (groupings in the start menu) and the file directories in which they are stored. AMENDMENT LOCALE Antecedent f@ )
� ? ^ k � �� ref:Win32_LogicalProgramGroup Description The Antecedent reference represents the Win32_LogicalProgramGroup associated with the file directory. Dependent f@ )
� ) 6 � �� ref:Win32_Directory Description The Dependent reference represents the Win32_Directory that contains the file directory for thelogical program group. gi � C I M _ D e p e n d e n c y �˝��C� CIM_Dependency ) ' 4 � ��� � � � � u��������� � Win32_LogicalProgramGroupItemDataFile Description The Win32_LogicalProgramGroupItemDataFile class represents an association between the program group items of the start menu and the files in which they are stored. AMENDMENT LOCALE Antecedent f@ )
� / R _ � �� ref:Win32_LogicalProgramGroupItem Description The Antecedent reference represents the Win32_LogicalProgramGroupItem that represents program groupings in the start menu. Dependent f@ )
� / < � �� ref:CIM_DataFile Description The Dependent reference represents the CIM_DataFile class associated with the program group. am �
C I M _ C o m p o n e n t �˝��C�* CIM_Component ) ) � ��� � � � � �������� � Win32_ProgramGroupContents Description The Win32_ProgramGroupContents class represents an association between a program group order and an individual program group or item contained in it. AMENDMENT LOCALE GroupComponent f@ )
� 9 F � �� ref:Win32_LogicalProgramGroup Description The GroupComponent reference represents the Win32_LogicalProgramGroup that contains the logical program group for this association. PartComponent f@ )
� / < � �� ref:Win32_ProgramGroupOrItem Description The PartComponent reference represents the Win32_ProgramGroupOrItem containing a start menu group or item for this association e � C I M _ L o g i c a l D e v i c e otR|�C� A CIM_LogicalDevice ) � ��� � � E T � � � � ���_�������������������������������������������������������������R � Win32_SoundDevice Description The Win32_SoundDevice class represents the properties of a sound device on a Win32 computer system. AMENDMENT LOCALE DeviceID @ )
� � � � � �� string Description The DeviceID property contains information that uniquely identifies the sound device. DMABufferSize . +
� � � � uint16 Description The DMABufferSize property indicates the size of the Direct Memory Access buffer.
Example: 4 Units kilobytes Manufacturer 0
� L T a string Description The Manufacturer property names the manufacturer of the sound device.
Example: Creative Labs MPU401Address 4
� � uint32 Description The MPU401Address property indicates the starting I/O address assigned to the MPU-401 port of the sound device.
Example: 300 ProductName 8
� � � � string Description The ProductName property indicates the product name of the sound device.
Example: Creative Labs SoundBlaster AWE64PNP �
C I M _ T a p e D r i v e vtR|�C�v
� CIM_TapeDrive ) � ��� � � � � � � � � Y f � � � s ~ ? O ������U������������������������������������������������������������������������������������������������������������������������������������������������@ � Win32_TapeDrive Description The Win32_TapeDrive class represents a tape drive on a Win32 computer. Tape drives are primarily distinguished by the fact that they can be accessed only sequentially. AMENDMENT LOCALE Compression p
� ) uint32 Description The Compression property specifies whether hardware data compression is enabled or disabled.
Values: 1 (true) or 0 (false). If true, hardware data compression is enabled. DeviceID @ )
� + � �� string Description The DeviceID property contains a string uniquely identifying the tape drive with other devices on the system. ECC t +
� � � � � � uint32 Description The ECC property specifies whether the device supports hardware error correction.
Values: 1 (true) or 0 (false). If true, hardware error correction is supported. Values � � False True FeaturesHigh x
� � � uint32 Description The FeaturesHigh property specifies the high-order 32 bits of the device features flag. FeaturesLow |
� � � � uint32 Description The FeaturesLow property specifies the low-order 32 bits of the device features flag. Id �
� . 6 C string Description The Id property indicates the manufacturer's identifying name of the Win32 CD ROM drive.
Example: PLEXTOR CD-ROM PX-12CS 1.01 Manufacturer �
� � string Description The Manufacturer property indicates the manufacturer of the Win32 CD-ROM drive.
Example: PLEXTOR MediaType ! �
� � � � string Description The MediaType property specifies the media type used by (or accessed by) this device. In this case, it is set to "Tape Drive". ReportSetMarks " �
� { � � uint32 Description The ReportSetMarks property specifies whether setmark reporting is enabled. Setmark reporting makes use of a specialized recorded element that does not contain user data. This recorded element is used to provide a segmentation scheme. This segmentation scheme is hierarchically superior to filemarks. Setmarks provide faster positioning on high-capacity tapes.
Values: 1 (true) or 0 (false). If true, setmark reporting is enabled. � C I M _ L o g i c a l E l e m e n t �tR|�C�2
CIM_LogicalElement ) $ { ��� � �
& , U������������� � Win32_OptionalFeature Description This class represents status of the Optional Features present on the operating system AMENDMENT LOCALE Caption
� � � � string Description Caption property is a optional feature display name InstallState +
� T \ i � � uint32 Description This identifies the state of the optional feature. It shows if the Optional feature is enabled, disabled, absent or unknown Values Enabled Disabled Absent Unknown Name )
� c k x � �� string Description This property represents the name of the optional feature � �AWE64PNP �AWE64PNP � � e � am � gi � � � �%� 6 Q�Ѣ� � �c�J � ��l#
* ����M ��[ � A��4 / C I M _ M e d i a P r e s e n t �˝��C�� CIM_MediaPresent ) - � ��� � � � � u��������� � Win32_DiskDriveToDiskPartition Description The Win32_DiskDriveToDiskPartition class represents an association between a disk drive and a partition existing on it. AMENDMENT LOCALE Antecedent f@ )
� � � �� ref:Win32_DiskDrive Description The Antecedent reference represents the Win32_DiskDrive containing the properties of the disk drive where the partition exists. Dependent f@ )
� � � � �� ref:Win32_DiskPartition Description The Dependent reference represents the Win32_DiskPartition containing the properties of a disk partition residing on the disk drive. he � C I M _ L o g i c a l D i s k B a s e d O n P a r t i t i o n �˝��C�> ) CIM_LogicalDiskBasedOnPartition ! ) + � ��� � � � � �������������������������� � Win32_LogicalDiskToPartition Description The Win32_LogicalDiskToPartition class represents an association between a logical disk drive and the disk partition it resides on. AMENDMENT LOCALE Antecedent f@ )
� , � �� ref:Win32_DiskPartition Description The Antecedent reference represents the Win32_DiskPartition containing the properties of a disk partition where the logical disk resides. Dependent f@ )
� � � �� ref:Win32_LogicalDisk Description The Dependent reference represents the Win32_LogicalDisk containing the properties of a logical disk that resides on a physical disk partition. � C I M _ S e t t i n g �˝��C�� CIM_Setting
) # 5 ��@ H X ����������������? � Win32_AutochkSetting Description This class represents the settings for the autochk operation for a disk. The setting applies to all disks on the computer system. Note that the settings are applicable only to instances of logical disk that represent physical disks on the machine and not to mapped drives. AMENDMENT LOCALE UserInputDelay +
� � � � / 6 uint32 Description The UserInputDelay property indicates the time to wait, in seconds, for the user to hit any key before it begins to autochk the disks. Units seconds � C I M _ E l e m e n t S e t t i n g �˝��C�� CIM_ElementSetting ) % 2 x ��� ���������� � Win32_OperatingSystemAutochkSetting Description This class represents the association between an operating system and the autochk settings that apply to the disks on the machine.Note that the setting is associated to operating system rather than computer system since there can be one or more operating systems installed on the machine, each with its own autochk settings. AMENDMENT LOCALE � C I M _ R e a l i z e s ̝��C�� CIM_Realizes ) ( � ��� � � � � u��������q � Win32_MemoryArrayLocation Description The Win32_MemoryArrayLocation class represents an association between a logical memory array and the physical memory array upon which it exists. AMENDMENT LOCALE Antecedent f@ )
� / < � �� ref:Win32_PhysicalMemoryArray Description The Antecedent reference represents the physical memory array that implements the logical memory array. Dependent f@ )
� � � � �� ref:Win32_MemoryArray Description The Dependent reference indicates the logical memory array implemented by the physical memory array. or � C I M _ L o g i c a l D e v i c e ptR|�C�� ? CIM_LogicalDevice ) & �� " � � p � . ���_������������������������������������������������������������ � Win32_MotherboardDevice Description The Win32_MotherboardDevice class represents a device that contains the central components of the Win32 computer system.
Example: A single piece of hardware containing a processor, bus, memory, and basic system interfaces AMENDMENT LOCALE DeviceID @ )
� Y a n � �� string Description The DeviceID property contains a string that uniquely identifies this motherboard. PrimaryBusType .
� � string Description The PrimaryBusType property indicates the primary bus type of the motherboard.
Example: PCI RevisionNumber 2
� � � � string Description The RevisionNumber property indicates the revision number of the motherboard.
Example: 00 SecondaryBusType 6
� Z b o string Description The SecondaryBusType property indicates the secondary bus type of the motherboard.
Example: ISA � C I M _ D i s k P a r t i t i o n �tR|�C��
x CIM_DiskPartition ) " � ��� � � � � � � F M � � � � @ P �����WU������������������������������������������������������������������������������������������������������������������ � Win32_DiskPartition Description The Win32_DiskPartition class represents the capabilities and management capacity of a partitioned area of a physical disk on a Win32 system.
Example: Disk #0, Partition #1. AMENDMENT LOCALE BootPartition L
� ( 5 boolean Description The BootPartition property determines whether the partition is the active partition. The operating system uses the active partition when booting from a hard disk.
Values: TRUE or FALSE. If TRUE, the partition is active. DeviceID @ )
� S [ h � �� string Description The DeviceID property contains a string that uniquely identifies the disk drive and partition from the rest of the system DiskIndex N
� " / uint32 Description The DiskIndex property indicates the index number of the disk containing this partition.
Example: 0. HiddenSectors R
� � � � uint32 Description The HiddenSectors property indicates the number of hidden sectors in the partition.
Example: 63 Index V
� y � � uint32 Description The Index property indicates the index number of the partition.
Example: 1 RewritePartition Z
� ! . boolean Description The RewritePartition property specifies whether the partition information has changed. When you change a partition (with IOCTL_DISK_SET_DRIVE_LAYOUT), the system uses this property member to determine which partitions have changed and need their information rewritten.
Values: TRUE or FALSE. If TRUE, the partition needs to be rewritten. Size \ +
� � � � 2 9 uint64 Description The Size property indicates the total size (in bytes) of the partition.
Example: 1059045376 units bytes StartingOffset d +
� � � � uint64 Description The StartingOffset property indicates the starting offset (in bytes) of the partition.
Example: 32256 units bytes Type l +
� R Z g � � string Description The Type property indicates the type of the partition. Values � � � # 7 G ` | � � � � � Unused 12-bit FAT Xenix Type 1 Xenix Type 2 16-bit FAT Extended Partition MS-DOS V4 Huge Installable File System PowerPC Reference Platform UNIX NTFS Win95 w/Extended Int 13 Extended w/Extended Int 13 Logical Disk Manager Unknown �ple: ISA �y array. or � � � � � he � � �n the Antecedent property of this class. � tt � �ݑ` + &�棋 � J�g3V ѻ��t � �S(� | C F F 4 1 3 7 0 C 7 0 E 2 6 A 1 6 9 C 5 F 7 C C 5 5 9 4 0 5 0 6 4 6 C 5 B 9 B C 0 F 0 D 1 F 0 F C 4 7 3 3 F A 2 A A 3 5 9 3 9 C S͝��C�ȝ��C�� @ % � � __EventConsumerProviderRegistration - SMTPEventConsumer \\.\root\subscription:__Win32Provider.Name="SMTPEventConsumer" C I M _ P o w e r S u p p l y qtR|�C�� l CIM_PowerSupply ) - � ��� � � � � � �
$ � � � � W p B P ����___������������������������������������������������������������������������������������������������������
� CIM_UninterruptiblePowerSupply Description Capabilities and management of an uninterruptible power supply. The properties of the UPS device indicate when incoming power is trimmed or boosted, and the aggregated information of the batteries, generators, etc. that comprise the device. These individual components (for example, multiple batteries) can also be independently modeled and associated with the UPS. AMENDMENT LOCALE EstimatedChargeRemaining X +
� z � uint16 Description An estimate of the percentage of full charge remaining for a UPS (that uses battery technology). Units percent EstimatedRunTime Z +
� � � � � � uint32 Description EstimatedRunTime is an estimate in minutes of the time to battery, generator, ... depletion under the present load conditions if the utility power is off, or lost and remains off. Units minutes Range1InputVoltageHigh @ : +
� � uint32 Description If the voltage (in millivolts) rises above the value specified by Range1InputVoltageHigh property, the UPS will compensate by trimming the voltage. A value of 0 indicates that the voltage at which trimming occurs is 'unknown'. Units millivolts Range1InputVoltageLow @ > +
� ] e r p w uint32 Description If the voltage (in millivolts) drops below the value specified by Range1InputVoltageLow property, the UPS will compensate by boosting the voltage using its power source(s). A value of 0 indicates that the voltage at which boosting occurs is 'unknown'. Units millivolts Range2InputVoltageHigh @ J +
� � � � � � uint32 Description If the voltage (in millivolts) rises above the value specified by Range2InputVoltageHigh property, the UPS will compensate by trimming the voltage. A value of 0 indicates that the voltage at which trimming occurs is 'unknown'. Units millivolts Range2InputVoltageLow @ N +
� 1 9 F D K uint32 Description If the voltage (in millivolts) drops below the value specified by Range2InputVoltageLow property, the UPS will compensate by boosting the voltage using its power source(s). A value of 0 indicates that the voltage at which boosting occurs is 'unknown'. Units millivolts RemainingCapacityStatus ^ +
� � � � uint16 Description The indication of the capacity remaining in the UPS' batteries, generator, ... A value of "Normal" (2) indicates that the remaining estimated minutes of run-time is greater than the UPS' defined 'low power' state (typically two minutes). A value of "Low" (3) indicates that the remaining estimated minutes of run-time is less than or equal to the UPS' defined 'low power' state. A value of "Depleted" (4) indicates that the UPS will be unable to sustain the present load when and if the utility power is lost (including the possibility that the utility power is currently absent). Values " + 3 8 Unknown Normal Low Depleted TimeOnBackup ` +
� � � � �
�
uint32 Description TimeOnBackup indicates the elapsed time in seconds since the UPS last switched to battery power, generator, ... Or, the time since the UPS was last restarted, whichever is less. Zero shall be returned if the UPS is 'on line'. Units seconds � C I M _ C o n t r o l l e r �tR|�C�� P CIM_Controller ) ! f ��q y � - � � � � ����W���������������������������������������������������������������������������$ � CIM_SCSIController Description Capabilities and management of the SCSI controller, logical device. AMENDMENT LOCALE ControllerTimeouts 8
� � � � uint32 Description Number of SCSIController timeouts that have occurred since the TimeOfLastReset. MaxDataWidth < +
� f n { � � uint32 Description Maximum data width (in bits) supported by the SCSIController. Units bits MaxTransferRate @ +
� & s z uint64 Description Maximum transfer rate (in bits per second) supported by the SCSIController. Units bits per second ProtectionManagement H +
� � � � p x uint16 Description An integer enumeration indicating whether or not the SCSI controller provides redundancy or protection against device failures. Values � � � � � � Other Unknown Unprotected Protected Protected through SCC (SCSI-3 Controller Command) Protected through SCC-2 (SCSI-3 Controller Command) � C I M _ C o n t r o l l e r �tR|�C�] I CIM_Controller ) # d ��o w � � � � � ����W��������������������������������������������������������������������� � CIM_SerialController Description Capabilities and management of the serial port, logical device. AMENDMENT LOCALE Capabilities 8 +
� � � � � � uint16 Description The Capabilities property defines chip level compatibility for the serial controller. Therefore, this property describes the buffering and other capabilities of the serial controller, that may be inherent in the chip hardware. The property is an enumerated integer. Values - ? Q d u Other Unknown XT/AT Compatible 16450 Compatible 16550 Compatible 16550A Compatible 8251 Compatible 8251FIFO Compatible CapabilityDescriptions <
� � � � string Description An array of free-form strings providing more detailed explanations for any of the serial controller features indicated in the Capabilities array. Note, each entry of this array is related to the entry in the Capabilities array that is located at the same index. MaxBaudRate @ +
� 0 8 E � � uint32 Description Maximum baud rate in bits per second supported by the SerialController. Units bits per second � C I M _ C o n t r o l l e r �tR|�C�H G CIM_Controller ) % f ��q y � � � ����W������������������������������������������������������������������� � CIM_ParallelController Description Capabilities and management of the parallel port logical device AMENDMENT LOCALE Capabilities 8 +
� � � � $ , uint16 Description An integer enumeration indicating the capabilities of the parallel controller Values T ] d v � � � � � Unknown Other XT/AT Compatible PS/2 Compatible ECP EPP PC-98 PC-98-Hireso PC-H98 CapabilityDescriptions <
� � � string Description An array of free-form strings providing more detailed explanations for any of the parallel controller features indicated in the Capabilities array. Note, each entry of this array is related to the entry in the Capabilities array that is located at the same index. DMASupport @
� H Q ^ boolean Description Set to true if the ParallelController supports DMA. �er second � Command) � seconds �r second � � � � � K _�@ + 4=4 k � P�$�G � E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C ϝ��C� ȝ��C�� � ��������U n � __InstanceProviderRegistration \\.\Root\CIMV2:__Win32Provider.Name="RouteProvider" ] WQL:UnarySelect C I M _ R e a l i z e s ̝��C�� CIM_Realizes ) ) � ��� � � � � u��������? � Win32_MemoryDeviceLocation Description The Win32_MemoryDeviceLocation class represents an association between a memory device and the physical memory on which it exists. AMENDMENT LOCALE Antecedent f@ )
� * � �� ref:Win32_PhysicalMemory Description The Antecedent reference represents the physical memory containing the memory device. Dependent f@ )
� � � � � �� ref:Win32_MemoryDevice Description The Dependent reference represents the memory device existing in the physical memory. �
C I M _ D i s k D r i v e stR|�C�a � CIM_DiskDrive ) + ��6 > N ( � � � � � � j x % * 5 - 4 � � �
�
Q b � � P
a
& �
� � � � � � 6 D � � � ������UUUUU������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������ � Win32_DiskDrive Description The Win32_DiskDrive class represents a physical disk drive as seen by a computer running the Win32 operating system. Any interface to a Win32 physical disk drive is a descendent (or member) of this class. The features of the disk drive seen through this object correspond to the logical and management characteristics of the drive. In some cases, this may not reflect the actual physical characteristics of the device. Any object based on another logical device would not be a member of this class.
Example: IDE Fixed Disk. AMENDMENT LOCALE BytesPerSector d +
� � � � uint32 Description The BytesPerSector property indicates the number of bytes in each sector for the physical disk drive.
Example: 512 units bytes DeviceID @ )
� _ g t � �� string Description The DeviceID property contains a string uniquely identifying the disk drive with other devices on the system. FirmwareRevision h
� ! ) 6 string Description The Firmware Revision property is a manufacturer-allocated number used to identify the physicalmedia. Index l
� � � � uint32 Description The Index property indicates the physical drive number of the given drive. This member is filled by Get Drive Map Info. A value of 0xFF indicates that the given drive does not map to a physical drive.
Example: 1 InterfaceType p
� � � string Description The InterfaceType property indicates the interface type of physical disk drive.
Example: SCSI Manufacturer t
� � � � string Description The Manufacturer property indicates the name of the disk drive manufacturer.
Example: Seagate MediaLoaded x
� Q Z g boolean Description The MediaLoaded property determines whether the media for a disk drive is loaded. For fixed disk drives, this property will always be TRUE
Values: TRUE or FALSE. If TRUE, the media is loaded. MediaType z +
� n v � � � string Description The MediaType property is the type of media used or accessed by this device.
Example: Removable media Values $ Removable media Fixed hard disk Unknown Model ~
� ` h u string Description The Model property indicates the manufacturer's model number of the disk drive.
Example: ST32171W Partitions �
�
%
uint32 Description The Partitions property indicates the number of partitions on this physical disk drive that are recognized by the operating system.
Example: 2 SCSIBus ! �
� �
�
�
uint32 Description The SCSIBus property indicates the SCSI bus number of the disk drive.
Example: 0 SCSILogicalUnit " �
� � � � uint16 Description The SCSILogicalUnit property indicates the SCSI logical unit number (LUN) of the disk drive.
Example: 0 SCSIPort # �
� B J W uint16 Description The SCSIPort property indicates the SCSI port number of the disk drive.
Example: 0 SCSITargetId $ �
� � � � uint16 Description The SCSITargetId property indicates the SCSI ID number of the disk drive.
Example: 0 SectorsPerTrack % �
� �
�
�
uint32 Description The SectorsPerTrack property indicates the number of sectors in each track for this physical disk drive.
Example: 63 SerialNumber & �
� R Z g string Description The Serial number property is a manufacturer-allocated number used to identify the physicalmedia.
Example: WD-WM3493798728 for a disk serial number. Signature ' �
� 6 > K uint32 Description The Signature property is used to identify a disk. It can be used to identify a shared resource. Size ( � +
� � � � � uint64 Description The Size property indicates the size of the disk drive. It is calculated by multiplying the total number of cylinders, tracks in each cylinder, sectors in each track, and bytes in each sector. units bytes TotalCylinders ) �
� # uint64 Description The TotalCylinders property indicates the total number of cylinders on the physical disk drive. Note: the value for this property is obtained through extended functions of BIOS interrupt 13h. The value may be inaccurate if the drive uses a translation scheme to support high capacity disk sizes. Consult the manufacturer for accurate drive specifications.
Example: 657 TotalHeads * �
� � � � uint32 Description The TotalHeads property indicates the total number of heads on the disk drive. Note: the value for this property is obtained through extended functions of BIOS interrupt 13h. The value may be inaccurate if the drive uses a translation scheme to support high capacity disk sizes. Consult the manufacturer for accurate drive specifications. TotalSectors + �
� p x � uint64 Description The TotalSectors property indicates the total number of sectors on the physical disk drive. Note: the value for this property is obtained through extended functions of BIOS interrupt 13h. The value may be inaccurate if the drive uses a translation scheme to support high capacity disk sizes. Consult the manufacturer for accurate drive specifications.
Example: 2649024 TotalTracks , �
� 1 9 F uint64 Description The TotalTracks property indicates the total number of tracks on the physical disk drive. Note: the value for this property is obtained through extended functions of BIOS interrupt 13h. The value may be inaccurate if the drive uses a translation scheme to support high capacity disk sizes. Consult the manufacturer for accurate drive specifications.
Example: 42048 TracksPerCylinder - �
� � � uint32 Description The TracksPerCylinder property indicates the number of tracks in each cylinder on the physical disk drive. Note: the value for this property is obtained through extended functions of BIOS interrupt 13h. The value may be inaccurate if the drive uses a translation scheme to support high capacity disk sizes. Consult the manufacturer for accurate drive specifications.
Example: 64 � memory. � � � �� SvR|�C�� 6 % * 7 t �� � � � MSFT_WdacBidTraceTask ClassVersion 1.0 Description Task provider for the BidTrace setting for WDAC components. AMENDMENT LOCALE MS_409 �� � _Wd � c $ Ver 4 � a " n 7 � �# Bi �# R$ �/ A4 AC R4 �4 �; h@ T y@ �@ �G �L �L M ~Q ?V NV �V ` �d �d Ee �j Eo Ro �o �t �y �y *z ʂ �� � EnableByAllApp ! . Description Enables Built-in Diagnostics Tracing (BidTrace) for troubleshooting WDAC components. � a42c9160500003S ROOT\Microsoft\Windows\Wdac\MS_409 ���� � �o �� � � * Z � � ��������
� __PARAMETERS abstract PassThru boolean
� 4 In
� 4 \ �� Passes the object created by this cmdlet through the pipeline. By default, this cmdlet does not pass any objects through the pipeline. Description )
� 4 \ �� � ID 6
� � \ �� � V boolean IncludeAllApplications boolean
� � In
� � � �� Enable BidTrace for all applications. Description )
� � � ��N ' ID 6
� � � ��N ' � boolean Platform string
� � In
� � & �� The platform architecture of the WDAC BidTrace setting. Possible values are '32-bit', '64-bit' or 'All'. The default is '32-bit' on a 32-bit process and '64-bit' on a 64-bit process. This is the platform architecture on the remote machine if this command is executed on a remote CIM session. Description )
� � & ��y T ID 6
� & ��y T � string __ �� a42c9160500003S ROOT\Microsoft\Windows\Wdac\MS_409 ���� � �R �� * J � � ��������% � __PARAMETERS abstract
cmdletOutput object
� 8 Out
� 8 _ �� The output is an array of CIM objects of type MSFT_WdacBidTrace, each of which represents a WDAC BidTrace setting. Description
)
� 8 _ �� � ID
6
� � _ �� � F object:MSFT_WdacBidTrace ReturnValue uint32
� � uint32 out
� � � �� __ � EnableByFolder E R Description Enables Built-in Diagnostics Tracing (BidTrace) for troubleshooting WDAC components. � a42c9160500003S ROOT\Microsoft\Windows\Wdac\MS_409 ���� � �I �� � � * Z � � ����������
� __PARAMETERS abstract PassThru boolean
� 4 In
� 4 \ �� Passes the object created by this cmdlet through the pipeline. By default, this cmdlet does not pass any objects through the pipeline. Description )
� 4 \ �� � ID 6
� � \ �� � V boolean Platform string
� � In
� � � �� The platform architecture of the WDAC BidTrace setting. Possible values are '32-bit', '64-bit' or 'All'. The default is '32-bit' on a 32-bit process and '64-bit' on a 64-bit process. This is the platform architecture on the remote machine if this command is executed on a remote CIM session. Description )
� � � ��= ID 6
� � � ��= � string Folder string
� � In
� � �� Enable BidTrace for all applications under this folder. Description )
� � ��y @ ID 6
� ��y @ � string __ �� a42c9160500003S ROOT\Microsoft\Windows\Wdac\MS_409 ���� � �R �� * J � � ��������% � __PARAMETERS abstract
cmdletOutput object
� 8 Out
� 8 _ �� The output is an array of CIM objects of type MSFT_WdacBidTrace, each of which represents a WDAC BidTrace setting. Description
)
� 8 _ �� � ID
6
� � _ �� � F object:MSFT_WdacBidTrace ReturnValue uint32
� � uint32 out
� � � �� __ � EnableByInputObject H U Description Enables Built-in Diagnostics Tracing (BidTrace) for troubleshooting WDAC components. ^ a42c9160500003S ROOT\Microsoft\Windows\Wdac\MS_409 ���� � �� �� � * Z ������p � __PARAMETERS abstract PassThru boolean
� 4 In
� 4 \ �� Passes the object created by this cmdlet through the pipeline. By default, this cmdlet does not pass any objects through the pipeline. Description )
� 4 \ �� � ID 6
� � \ �� � V boolean
InputObject object
� � In
� � � �� Enable the BidTrace represented by the specified BidTrace setting objects. Enter a variable that contains the objects, oq ��P _ ~m.� @ f� �� G v�*�6 C C I M _ M e d i a A c c e s s D e v i c e wtR|�C� w CIM_MediaAccessDevice ) � ��� � � � � | � ����������������������������������������������������������������������������������������������������������������������1 � CIM_TapeDrive Description The CIM_TapeDrive class represents a tape drive on the system. Tape drives are primarily distinguished by the fact that they can only be accessed sequentially. AMENDMENT LOCALE EOTWarningZoneSize d +
� % 2 � � uint32 Description EOTWarningZoneSize indicates the size, in bytes, of the area designated as 'end of tape'. Access in this area generates an 'end of tape' warning. Units bytes MaxPartitionCount h
� ' uint32 Description The MaxPartitionCount property indicates the maximum part count for the tape drive. Padding l +
� � � � # * uint32 Description Padding indicates the number of bytes inserted between blocks on a tape Media. Units bytes � C I M _ V i d e o C o n t r o l l e r �tR|�C� � CIM_VideoController ) $ z ��� � � S f � � ��������W������������������������������������������������������������������������������������������������������������������������������ � CIM_PCVideoController Description Capabilities and management of a PC video controller, a subtype of video controller. AMENDMENT LOCALE NumberOfColorPlanes ! x
� � � � uint16 Description Current number of color planes. If this value is not applicable for the current video configuration, enter 0. VideoArchitecture " z +
� � � �
uint16 Description The video architecture. For example, VGA (value=5) or PC-98 (160) may be specified. Values
J Q Z _ d i o t y � � � Other Unknown CGA EGA VGA SVGA MDA HGC MCGA 8514A XGA Linear Frame Buffer PC-98 VideoMode # |
� � � � uint16 Description Current video mode. � C I M _ C o n t r o l l e r �tR|�C� � CIM_Controller ) " X ��c k � � � � � 6 � � ` u � � � � E Y � � � � +
?
�
�
, < ����WUUU�������������������������������������������������������������������������������������������������������������������������� � CIM_VideoController Description Capabilities and management of the video controller. AMENDMENT LOCALE AcceleratorCapabilities 8 +
� � � � - 5 uint16 Description An array of integers indicating the graphics and 3D capabilities of the video controller. Values I R Y o Unknown Other Graphics Accelerator 3D Accelerator CapabilityDescriptions <
� � � � string Description An array of free-form strings providing more detailed explanations for any of the video accelerator features indicated in the Capabilities array. Note, each entry of this array is related to the entry in the Capabilities array that is located at the same index. CurrentBitsPerPixel @ +
� - 5 B r y uint32 Description The number of bits used to display each pixel. Units bits CurrentHorizontalResolution D +
� � � � uint32 Description Current number of horizontal pixels. Units pixels CurrentNumberOfColors H
� b j w uint64 Description Number of colors supported at the current resolutions. CurrentNumberOfColumns P
� � � uint32 Description If in character mode, number of columns for this video controller. Otherwise, enter 0. CurrentNumberOfRows T
� � � � uint32 Description If in character mode, number of rows for this video controller. Otherwise, enter 0. CurrentRefreshRate X +
� X ` m � � uint32 Description Current refresh rate in hertz. Units hertz CurrentScanMode \ +
� � � � a i uint16 Description Current scan mode. "Interlaced" (value=3) or "Non Interlaced" (4) can be defined using this property. Values } � � � Other Unknown Interlaced Non Interlaced CurrentVerticalResolution ^ +
� � 6 = uint32 Description Current number of vertical pixels. Units pixels MaxMemorySupported b +
� � � � � � uint32 Description Maximum amount of memory supported in bytes. Units bytes MaxRefreshRate f +
� , 4 A y � uint32 Description Maximum refresh rate of the video controller in hertz. Units hertz MinRefreshRate j +
� � � �
$
uint32 Description Minimum refresh rate of the video controller in hertz. Units hertz NumberOfVideoPages n
� k
s
�
uint32 Description Number of video pages supported given the current resolutions and available memory. VideoMemoryType r +
� ' 4 q y uint16 Description An integer enumeration indicating the type of video memory. Values
� � � � � � � � � % Other Unknown VRAM DRAM SRAM WRAM EDO RAM Burst Synchronous DRAM Pipelined Burst SRAM CDRAM 3DRAM SDRAM SGRAM VideoProcessor t
� h p } string Description A free-form string describing the video processor/Controller. � C I M _ L o g i c a l D e v i c e �tR|�C� = CIM_LogicalDevice ) � ��� � � � � i z ���_���������������������������������������������������������[ � CIM_Controller Description Controller is a superclass for grouping the miscellaneous control-related Devices that exist. Examples of Controllers are SCSIControllers, USBControllers, SerialControllers, ... The Controller class is an abstraction for Devices with a single protocol stack, which exist primarily for communication to, and control or reset of downstream (ControlledBy) Devices. AMENDMENT LOCALE MaxNumberControlled .
� � � � uint32 Description Maximum number of directly addressable entities supported by this Controller. A value of 0 should be used if the number is unknown or unlimited. ProtocolSupported 2 +
� � � � * 2 uint16 Description The protocol used by the controller to access 'controlled' devices. Values / � �
0 6 O l � � � � � � ! ( 2 7 < F M a u � � � � � � � � � � � 6 K b Other Unknown EISA ISA PCI ATA/ATAPI Flexible Diskette 1496 SCSI Parallel Interface SCSI Fibre Channel Protocol SCSI Serial Bus Protocol SCSI Serial Bus Protocol-2 (1394) SCSI Serial Storage Architecture VESA PCMCIA Universal Serial Bus Parallel Protocol ESCON Diagnostic I2C Power HIPPI MultiBus VME IPI IEEE-488 RS232 IEEE 802.3 10BASE5 IEEE 802.3 10BASE2 IEEE 802.3 1BASE5 IEEE 802.3 10BROAD36 IEEE 802.3 100BASEVG IEEE 802.5 Token-Ring ANSI X3T9.5 FDDI MCA ESDI IDE CMD ST506 DSSI QIC2 Enhanced ATA/IDE AGP TWIRP (two-way infrared) FIR (fast infrared) SIR (serial infrared) IrBus TimeOfLastReset e 4
� � � � datetime Description The TimeOfLastReset property indicates the date and time this controller was last reset. This could mean the controller was powered down, or reinitialized. �troller. �eo mode. �ts bytes �eo mode. � � � � � (��� >�� . $��V& VJ�; � Zʼ��
7 v<� $ ��C9; Q <�x1� } 8�� 4 �k͉= � ���/ y�+�3
,�= nP QE p K e r b A c c e p t S e c u r i t y C o n t e x t ҝ��C�� # KerbAcceptSecurityContext C � �� , V a p u } � � L X
� � K U U��������������������� � KerbAcceptSecurityContext_End Description Kerberos Accept Security Context Handler EventType EventTypeName End locale MS\0x409 CredSource P
� � � % 8 A I � �� string WmiDataId Description Credentials Source StringTermination Counted format w DomainName P
� � � � � � � � � �� string WmiDataId Description Domain Name StringTermination Counted format w Status C
� c k v � � � � �� uint32 WmiDataId Description Status format x Target P
� � $ 7 @ H � �� string WmiDataId Description Target StringTermination Counted format w UserName P
� � � � � � � � � �� string WmiDataId Description User Name StringTermination Counted format w � M S K e r b T r a c e ҝ��C� MSKerbTrace
C � �� 5 ; c p � � � � KerbSetPassword Description Kerberos Set Password Guid {94c79108-b23b-4418-9b7f-e6d75a3a0ab2} DisplayName KerbSetPassword locale MS\0x409 � K e r b S e t P a s s w o r d ҝ��C�� KerbSetPassword C � �� $ ; F U \ d n � KerbSetPassword_Start Description Kerberos Set Password EventType EventTypeName Start locale MS\0x409 � K e r b S e t P a s s w o r d ҝ��C�o KerbSetPassword C � �� " 9 D S X ` j w * 8 � � � � j v ( 0 U�������������������������� � KerbSetPassword_End Description Kerberos Set Password EventType EventTypeName End locale MS\0x409 AccountName P
� � � � � ' � �� string WmiDataId Description Account Name StringTermination Counted format w AccountRealm P
� � � � � � � � � � �� string WmiDataId Description Account Realm StringTermination Counted format w ClientName P
� V ^ i v � � � � � �� string WmiDataId Description Client Name StringTermination Counted format w ClientRealm P
� ( 5 C V _ g � �� string WmiDataId Description Client Realm StringTermination Counted format w KdcAddress P
� � � � � % � �� string WmiDataId Description KDC Address StringTermination Counted format w Status C
� � � � � � � � �� uint32 WmiDataId Description Status format x � M S K e r b T r a c e ҝ��C� MSKerbTrace
C � �� ! ; A i v � � � � KerbChangePassword Description Kerberos Change Password Guid {c55e606b-334a-488b-b907-384abaa97b04} DisplayName KerbChangePassword locale MS\0x409 � K e r b C h a n g e P a s s w o r d !ҝ��C�� KerbChangePassword C � �� ' A L [ b j t � KerbChangePassword_Start Description Kerberos Change Password EventType EventTypeName Start locale MS\0x409 � K e r b C h a n g e P a s s w o r d "ҝ��C�
KerbChangePassword C � �� % ? J Y ^ f p } 0 < � � U������������| � KerbChangePassword_End Description Kerberos Change Password EventType EventTypeName End locale MS\0x409 AccountName P
� � � � � % - � �� string WmiDataId Description Account Name StringTermination Counted format w DomainName P
� � � � � � � � � � �� string WmiDataId Description Account Realm StringTermination Counted format w Status C
� I Q \ i q y � �� uint32 WmiDataId Description Status format x le �
E v e n t T r a c e #ҝ��C�Q EventTrace 6 � �� 2 8 ` h r y q����� � DigestDebugTrace Description Security: WDigest Guid {fb6a424f-b5d6-4329-b9d5-a975b3a93ead} locale MS\0x409 Flags E
� � � � � � � 7 A uint32 Description Enable Flags ValueDescriptions
. : H T ^ h r } � � Error Flag Warning Flag Trace Flag ASC Flag ISC Flag LSA Flag User Flag Function Flag Mem Flag Stuff Flag Values
� � � � � ! + Error Warning Trace TraceASC TraceICS TraceLSA TraceUser TraceFunc TraceMem TraceStuff ValueMap
m y � � � � � � � � 0x00000001 0x00000002 0x00000004 0x00000008 0x00000010 0x00000020 0x00000040 0x00000080 0x00000100 0x00000200 la �5 7 E 5 F 3 A D D 9 E 2 4 2 C 4 E 9 F 9 E D F 7 9 A A 9 7 F 7 9 E 7 9 1 1 C 5 A 8 B 9 0 2 E C 1 5 0 D 6 4 4 2 E 3 B 8 5 A 5 A A $ҝ��C�ȝ��C�� ���9 B � __Win32Provider {f8a56d3e-e304-4a9f-a916-5187019d7759} BcdProv 7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D %ҝ��C�
ȝ��C�b K � __MethodProviderRegistration \\.\root\wmi:__Win32Provider.Name="BcdProv" R O O T \ w m i _ _ M e t h o d P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 3 F B D C B 0 8 E C D 3 3 F B E F 0 2 8 D 2 D B 3 E F 0 5 8 F 8 C E 9 5 9 7 7 9 B 9 4 3 F 4 3 A B 3 D B 3 E C 3 4 A C A 1 4 7 D \ K I _ 7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D \ I _ 8 4 D A E 3 9 4 D 7 2 E E C 4 4 9 4 8 5 0 4 C 5 7 5 2 A 6 F B 4 8 8 C 2 F 3 4 A F 0 D D E 6 1 4 A 4 D 6 B A 8 E 4 E F 4 1 5 7 9 f 8 a 7 E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C &ҝ��C� ȝ��C�z �� �� M � __InstanceProviderRegistration \\.\root\wmi:__Win32Provider.Name="BcdProv" R O O T \ w m i _ _ I n s t a n c e P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 3 F B D C B 0 8 E C D 3 3 F B E F 0 2 8 D 2 D B 3 E F 0 5 8 F 8 C E 9 5 9 7 7 9 B 9 4 3 F 4 3 A B 3 D B 3 E C 3 4 A C A 1 4 7 D \ K I _ E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C \ I _ 8 4 D A E 3 9 4 D 7 2 E E C 4 4 9 4 8 5 0 4 C 5 7 5 2 A 6 F B 4 8 8 C 2 F 3 4 A F 0 D D E 6 1 4 A 4 D 6 B A 8 E 4 E F 4 1 5 7 9 a 7 4 1 C 5 3 E 6 D B 1 A C F 2 4 5 3 C E F D 4 1 3 9 8 1 9 8 E 6 1 3 F 1 0 D F F 4 7 7 0 9 E C A B 1 D 7 F 0 3 7 7 5 6 A C 8 C E 7 wҝ��C�ȝ��C�� � � __thisNAMESPACE � �� � � ? __ � SetLicensingAadInfo 3 3 Description Sets or Updates the Registration Token with the administrator supplied value � a42c9160500003S ROOT\cimv2\TerminalServices\ms_409 ���� � �W �� * � � P ��������� � __PARAMETERS abstract LicensingClientId string
� = In
� = d �� ID )
� � d ��� string TenantAadToken string
� � In
� � �� ID )
� � ��L string __ �� a42c9160500003S ROOT\cimv2\TerminalServices\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � GetRDSVersion �7 �7 Description Retrieves RDS Server Version a42c9160500003S ROOT\cimv2\TerminalServices\ms_409 ���� � �� �� � * � ��������I � __PARAMETERS abstract Version uint32
� 3 out
� 3 Z �� ID )
� � Z ��� uint32 ReturnValue uint32
� uint32 out
� �� __ � ChangeMode 4; A; Description Configures License type based on the Terminal Server Mode: For Remote Admin - Remote Desktop for AdministrationApplication Server - Per Device and Per UserPersonal Terminal Server - Personal Terminal Server. # a42c9160500003S ROOT\cimv2\TerminalServices\ms_409 ���� � �� �� * � ����� � __PARAMETERS abstract LicensingType uint32
� 9 In
� 9 ` �� ID )
� � ` ��� uint32 __ �� a42c9160500003S ROOT\cimv2\TerminalServices\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � SetAllowTSConnections �? @ Description Allows or Denies new TS Connections. The second parameter is optional, if specified and set to TRUE, then enables or disables Remote Desktop firewall exception rule depending on whether AllowTSConnections is true or false respectively. � a42c9160500003S ROOT\cimv2\TerminalServices\ms_409 ���� � �k �� * � � Z ��������� � __PARAMETERS abstract AllowTSConnections uint32
� > In
� > e �� ID )
� � e ��� uint32 ModifyFirewallException uint32
� In
� ( �� ID )
� � ( ��V uint32 __ �� a42c9160500003S ROOT\cimv2\TerminalServices\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � SetSingleSession �E �E Description Enables or disables the SingleSession state. # a42c9160500003S ROOT\cimv2\TerminalServices\ms_409 ���� � �� �� * � ����� � __PARAMETERS abstract SingleSession uint32
� 9 In
� 9 ` �� ID )
� � ` ��� uint32 __ �� a42c9160500003S ROOT\cimv2\TerminalServices\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � SetDisableForcibleLogoff �I �I Description Enables or disables logging off an administrator who is logged on to the console. ; a42c9160500003S ROOT\cimv2\TerminalServices\ms_409 ���� � �� �� * � ����� � __PARAMETERS abstract DisableForcibleLogoff uint32
� A In
� A h �� ID )
� � h ��� uint32 __ �� a42c9160500003S ROOT\cimv2\TerminalServices\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � SetProfilePath �M N Description Sets the ProfilePath for the machine. a42c9160500003S ROOT\cimv2\TerminalServices\ms_409 ���� � �� �� * � ����� � __PARAMETERS abstract ProfilePath string
� 7 In
� 7 ^ �� ID )
� � ^ ��� string __ �� a42c9160500003S ROOT\cimv2\TerminalServices\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � SetHomeDirectory R R Description Sets the Home Directory for the machine. # a42c9160500003S ROOT\cimv2\TerminalServices\ms_409 ���� � �� �� * � ����� � __PARAMETERS abstract HomeDirectory string
� 9 In
� 9 ` �� ID )
� � ` ��� string __ �� a42c9160500003S ROOT\cimv2\TerminalServices\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � SetPolicyPropertyName !V .V Description PropertyName is a string property and is either DeleteTempFolders or UseTempFolders.They are flags that are either set to False or True according as whether Value is set to 0 or 1 respectively. The call returns 0 for success and an error if the policy was set to Group policy. � a42c9160500003S ROOT\cimv2\TerminalServices\ms_409 ���� � �: �� * � � C ������� � __PARAMETERS abstract PropertyName string
� 8 In
� 8 _ �� ID )
� � _ ��� string Value boolean
� � In
� � �� ID )
� z ��? boolean __ �� a42c9160500003S ROOT\cimv2\TerminalServices\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � SetFallbackPrintDriverType �[ �[ Description Sets the FallBack printer driver to one of: 0=No fallback print drivers, 1=Best guess, 2 = Best guess and if no match is found fallback to PCL, 3=Best guess and if no match is found fallback to PS, 4=Best guess and if no match is found show both PCL and PS drivers. A a42c9160500003S ROOT\cimv2\TerminalServices\ms_409 ���� � �� �� * � ����� � __PARAMETERS abstract FallbackPrintDriverType uint32
� C In
� C j �� ID )
� � j ��� uint32 __ �� a42c9160500003S ROOT\cimv2\TerminalServices\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � GetTSLanaIds �` �` Description Gets Terminal Services Network Card Ids and descriptions. � a42c9160500003S ROOT\cimv2\TerminalServices\ms_409 ���� � �*
�� � O * � � � ������������ � __PARAMETERS abstract LanaIdList uint32
� 6 out
� 6 ] �� ID )
� � ] ��� uint32 LanaIdDescriptions string
� � out
� � �� ID )
� � ��K string ReturnValue uint32
� � uint32 out
� � � �� __ � GetWinstationDriverNames �e �e Description Retrieves a list of winstation driver names. a42c9160500003S ROOT\cimv2\TerminalServices\ms_409 ���� � �� �� � ) * � ��������S � __PARAMETERS abstract WinstaDriverNames string
� = out
� = d �� ID )
� � d ��� string ReturnValue uint32
� uint32 out
� $ �� __ � CreateWinstation Qi ^i Description Creates a new listener stack based on the unique combination of Listern Name and NIC. a42c9160500003S ROOT\cimv2\TerminalServices\ms_409 ���� � ��
�� � � * � � E ������������6 � __PARAMETERS abstract Name string
� 0 in
� 0 W �� ID )
� � W ��� string WinstaDriverName string
� � in
� � �� ID )
� | ��A string LanaId uint32
� � in
� � � �� ID )
� . � ��� uint32 __ �� a42c9160500003S ROOT\cimv2\TerminalServices\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � PingLicenseServer �o �o Description Pings license server returns S_OK if valid license server S_FALSE if not a42c9160500003S ROOT\cimv2\TerminalServices\ms_409 ���� � �� �� * � ����� � __PARAMETERS abstract )Hr̐ � ���}
� �e�i . ,k(� ��Gɶ * ���� s �FHS T ���"� (
E v e n t T r a c e Gԝ��C�� EventTrace 6 � ��
? E m u � � � u��������I � UsbstorGuid Description USB Storage Driver Tracing Provider guid {72FB9358-A9B3-41E0-AE41-E8DECA41E3A8} locale MS\0x409 Flags R
� � � � ' 5 y � � � uint32 Description Enable Flags ValueDescriptions \ � � � � � * E h � � � � � This enables all configuration traces This enables PNP traces This enables power traces This enables read/write traces This enables IOCTL traces This enables I/O queue traces This enables WMI traces This enables timer traces This enables initilization traces This enables remove lock traces This flag is not used This flag is not used This enables media change notification traces This enables ISR traces This enables device enumeration traces DefineValues u � � � � � � � " 5 H X h TRACE_FLAG_GENERAL TRACE_FLAG_PNP TRACE_FLAG_POWER TRACE_FLAG_RW TRACE_FLAG_IOCTL TRACE_FLAG_QUEUE TRACE_FLAG_WMI TRACE_FLAG_TIMER TRACE_FLAG_INIT TRACE_FLAG_LOCK TRACE_FLAG_DEBUG1 TRACE_FLAG_DEBUG2 TRACE_FLAG_MCN TRACE_FLAG_ISR TRACE_FLAG_ENUM Values � � � � * : L ] n � � � � TRACE_FLAG_GENERAL TRACE_FLAG_PNP TRACE_FLAG_POWER TRACE_FLAG_RW TRACE_FLAG_IOCTL TRACE_FLAG_QUEUE TRACE_FLAG_WMI TRACE_FLAG_TIMER TRACE_FLAG_INIT TRACE_FLAG_LOCK TRACE_FLAG_DEBUG1 TRACE_FLAG_DEBUG2 TRACE_FLAG_MCN TRACE_FLAG_ISR TRACE_FLAG_ENUM ValueMap ' 3 ? K W c o { � � � � � 0x00000001 0x00000002 0x00000004 0x00000008 0x00000010 0x00000020 0x00000040 0x00000080 0x00000100 0x00000200 0x00000400 0x00000800 0x00001000 0x00002000 0x00004000 Level _
� 7 ? L T g & 4 � � � 7 B uint32 Description Levels ValueDescriptions � � � � Abnormal exit or termination Severe errors that need logging Warnings such as allocation failure Includes non-error cases Detailed traces from intermediate steps DefineValues H [ n � TRACE_LEVEL_FATAL TRACE_LEVEL_ERROR TRACE_LEVEL_WARNINGTRACE_LEVEL_INFORMATION TRACE_LEVEL_VERBOSE Values � � � � � Fatal Error Warning Information Verbose ValueMap # ( - 2 0x1 0x2 0x3 0x4 0x5 ValueType index T �
E v e n t T r a c e Hԝ��C�� EventTrace 6 � �� > D l t ~ � � � u��������H � Sbp2portGuid Description SBP2 Port Driver Tracing Provider guid {6710597F-7319-4AAE-9B85-C8D87136A56B} locale MS\0x409 Flags R
� � � � & 4 x � � � uint32 Description Enable Flags ValueDescriptions [ � � � � � ) D g � � � � � This enables all configuration traces This enables PNP traces This enables power traces This enables read/write traces This enables IOCTL traces This enables I/O queue traces This enables WMI traces This enables timer traces This enables initilization traces This enables remove lock traces This flag is not used This flag is not used This enables media change notification traces This enables ISR traces This enables device enumeration traces DefineValues t � � � � � � � � ! 4 G W g TRACE_FLAG_GENERAL TRACE_FLAG_PNP TRACE_FLAG_POWER TRACE_FLAG_RW TRACE_FLAG_IOCTL TRACE_FLAG_QUEUE TRACE_FLAG_WMI TRACE_FLAG_TIMER TRACE_FLAG_INIT TRACE_FLAG_LOCK TRACE_FLAG_DEBUG1 TRACE_FLAG_DEBUG2 TRACE_FLAG_MCN TRACE_FLAG_ISR TRACE_FLAG_ENUM Values � � � � ) 9 K \ m � � � � TRACE_FLAG_GENERAL TRACE_FLAG_PNP TRACE_FLAG_POWER TRACE_FLAG_RW TRACE_FLAG_IOCTL TRACE_FLAG_QUEUE TRACE_FLAG_WMI TRACE_FLAG_TIMER TRACE_FLAG_INIT TRACE_FLAG_LOCK TRACE_FLAG_DEBUG1 TRACE_FLAG_DEBUG2 TRACE_FLAG_MCN TRACE_FLAG_ISR TRACE_FLAG_ENUM ValueMap & 2 > J V b n z � � � � � 0x00000001 0x00000002 0x00000004 0x00000008 0x00000010 0x00000020 0x00000040 0x00000080 0x00000100 0x00000200 0x00000400 0x00000800 0x00001000 0x00002000 0x00004000 Level _
� 6 > K S f % 3 � � � 6 A uint32 Description Levels ValueDescriptions ~ � � � � Abnormal exit or termination Severe errors that need logging Warnings such as allocation failure Includes non-error cases Detailed traces from intermediate steps DefineValues G Z m � TRACE_LEVEL_FATAL TRACE_LEVEL_ERROR TRACE_LEVEL_WARNINGTRACE_LEVEL_INFORMATION TRACE_LEVEL_VERBOSE Values � � � � � Fatal Error Warning Information Verbose ValueMap " ' , 1 0x1 0x2 0x3 0x4 0x5 ValueType index TR � R O O T \ c i m v 2 \ T e r m i n a l S e r v i c e s _ _ I n s t a n c e P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 4 0 C 7 2 9 0 2 9 0 9 8 7 2 C 8 C B 8 F 5 4 A 5 4 9 C 2 E 7 A 4 2 2 0 C 5 9 2 8 2 1 8 B 0 0 B A 6 3 8 8 8 9 9 7 9 E E 3 9 E 6 2 \ K I _ E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C \ I _ 0 F E 8 4 C B 7 2 2 8 1 8 4 8 1 9 4 3 4 E 7 3 1 8 4 A 3 3 B 5 6 9 4 C E F A E D 9 3 B 2 8 2 C 5 0 B 9 3 0 1 2 7 F 1 8 7 5 0 4 C 0 . 0 { 7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D Tԝ��C�
ȝ��C�� x � __MethodProviderRegistration \\.\ROOT\cimv2\TerminalServices:__Win32Provider.Name="Win32_TSPublishedApplication_Prov" R O O T \ c i m v 2 \ T e r m i n a l S e r v i c e s _ _ M e t h o d P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 4 0 C 7 2 9 0 2 9 0 9 8 7 2 C 8 C B 8 F 5 4 A 5 4 9 C 2 E 7 A 4 2 2 0 C 5 9 2 8 2 1 8 B 0 0 B A 6 3 8 8 8 9 9 7 9 E E 3 9 E 6 2 \ K I _ 7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D \ I _ 0 F E 8 4 C B 7 2 2 8 1 8 4 8 1 9 4 3 4 E 7 3 1 8 4 A 3 3 B 5 6 9 4 C E F A E D 9 3 B 2 8 2 C 5 0 B 9 3 0 1 2 7 F 1 8 7 5 0 4 C _ _ E x t r i n s i c E v e n t Uԝ��C�; __ExtrinsicEvent ) x � > N _��������������������� � Win32_RemoteAppChangeEvent Description This event represents a change to RemoteApp settings on this terminal server. OperationType 6
� � � ��� � uint32 Description Type of operation corresponding to the event Values & . 6 Create Delete Modify TargetInstance
)
� � � ��� � object Description Object changed by the operation corresponding to the event �0 8 9 9 3 0 7 4 0 8 A 3 2 0 4 0 A 6 D A 1 9 C 0 B 1 E C 2 7 4 5 A 3 D 6 0 4 B A A 9 D F F E 8 E E 4 B 7 5 C 3 D 9 1 E 1 6 1 0 9 Vԝ��C�ȝ��C�� O � � __EventProviderRegistration % SELECT * FROM Win32_RemoteAppChangeEvent \\.\ROOT\cimv2\TerminalServices:__Win32Provider.Name="Win32_TSPublishedApplication_Prov" R O O T \ c i m v 2 \ T e r m i n a l S e r v i c e s _ _ E v e n t P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 4 0 C 7 2 9 0 2 9 0 9 8 7 2 C 8 C B 8 F 5 4 A 5 4 9 C 2 E 7 A 4 2 2 0 C 5 9 2 8 2 1 8 B 0 0 B A 6 3 8 8 8 9 9 7 9 E E 3 9 E 6 2 \ K I _ 0 8 9 9 3 0 7 4 0 8 A 3 2 0 4 0 A 6 D A 1 9 C 0 B 1 E C 2 7 4 5 A 3 D 6 0 4 B A A 9 D F F E 8 E E 4 B 7 5 C 3 D 9 1 E 1 6 1 0 9 \ I _ 0 F E 8 4 C B 7 2 2 8 1 8 4 8 1 9 4 3 4 E 7 3 1 8 4 A 3 3 B 5 6 9 4 C E F A E D 9 3 B 2 8 2 C 5 0 B 9 3 0 1 2 7 F 1 8 7 5 0 4 C a ServerName string
� 6 in
� 6 ] �� ID )
� � ] ��� string __ �� a42c9160500003S ROOT\cimv2\TerminalServices\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � GetTStoLSConnectivityStatus �s �s Description Connects to the license server and updates the connectivity status a42c9160500003S ROOT\cimv2\TerminalServices\ms_409 ���� � �� �� * � ����� � __PARAMETERS abstract ServerName string
� 6 in
� 6 ] �� ID )
� � ] ��� string __ �� a42c9160500003S ROOT\cimv2\TerminalServices\ms_409 ���� � �� �� � * x ��������A � __PARAMETERS abstract TStoLSConnectivityStatus uint32
� D out
� D k �� � � @ ^ ~ � � � � LS_CONNECTABLE_UNKNOWN LS_CONNECTABLE_VALID_WS08R2 LS_CONNECTABLE_VALID_WS08 LS_CONNECTABLE_BETA_RTM_MISMATCH LS_CONNECTABLE_LOWER_VERSION LS_CONNECTABLE_NOT_IN_TSCGROUP LS_NOT_CONNECTABLE LS_CONNECTABLE_UNKNOWN_VALIDITY LS_CONNECTABLE_BUT_ACCESS_DENIED LS_CONNECTABLE_VALID_WS08R2_VDI LS_CONNECTABLE_FEATURE_NOT_SUPPORTED LS_CONNECTABLE_VALID_LS Values )
� D k ��5 � ID 6
� � k ��5 � t uint32 ReturnValue uint32
�
uint32 out
�
�� __ � CanAccessLicenseServer W} d} Description Checks if the TS is allowed to request CALs from license server based on the the license server security group policy on the license server and membership of RDS Endpoint Servers local group on the license server. Returns S_OK if the TS has access to the license server S_FALSE if not a42c9160500003S ROOT\cimv2\TerminalServices\ms_409 ���� � �� �� * � ����� � __PARAMETERS abstract ServerName string
� 6 in
� 6 ] �� ID )
� � ] ��� string __ � a42c9160500003S ROOT\cimv2\TerminalServices\ms_409 ���� � �� �� * � � % ��������O � __PARAMETERS abstract AccessAllowed uint32
� 9 out
� 9 ` �� ID )
� � ` ��� uint32 ReturnValue uint32
� uint32 out
� �� __ � FindLicenseServers ڃ � Description Enumerates all the License Servers along with the method of discovery � a42c9160500003S ROOT\cimv2\TerminalServices\ms_409 ���� � �`
�� j * � � � ������������& � __PARAMETERS abstract
LicenseServersList object
� > out
� > e �� ID
)
� � e ��� object:Win32_TSDiscoveredLicenseServer Count uint32
� out
� 7 �� ID )
� � 7 ��f uint32 ReturnValue uint32
� � uint32 out
� � � �� __ � GetGracePeriodDays &� 3� Description Gives number of days left for Terminal Server grace period, A zero value indicates that grace period is over a42c9160500003S ROOT\cimv2\TerminalServices\ms_409 ���� � �� �� * � � ��������J � __PARAMETERS abstract DaysLeft uint32
� 4 out
� 4 [ �� ID )
� � [ ��� uint32 ReturnValue uint32
� uint32 out
� �� __ � GetDomain ̌ ٌ Description Gives TS Domain Name a42c9160500003S ROOT\cimv2\TerminalServices\ms_409 ���� � �� �� * � � ��������H � __PARAMETERS abstract Domain string
� 2 out
� 2 Y �� ID )
� � Y ��� string ReturnValue uint32
� uint32 out
� �� __ � �� � 7 H�� 1 �;�� | ���� � J�.X � ��� , ��\ ) (
�UKQ , 9iF�} . C I M _ P h y s i c a l M e m o r y 3ʝ��C�� � CIM_PhysicalMemory 6 � �� � ( .
V b � � o � � � � � � , � � < H �����UU��������������������������������������������������������������������������������������������������������������������������������� � Win32_PhysicalMemory CIMWin32 Locale UUID {FAF76B93-798C-11D2-AAD1-006008C78BC7} Attributes h )
� � � ��� � uint32 MappingStrings � SMBIOS|Type 17|Attributes ConfiguredClockSpeed l )
� ! � ��) 9 uint32 MappingStrings A SMBIOS|Type 17|Configured Memory Clock Speed ConfiguredVoltage " x )
� � � ��� � uint32 MappingStrings � SMBIOS|Type 17|Configured voltage DeviceLocator ` )
� B � ��J Z string MappingStrings b SMBIOS|Type 17|Device Locator InterleaveDataDepth f )
� � � ��� � uint16 MappingStrings � SMBIOS|Type 20|Interleaved Data Depth MaxVoltage ! t )
� W � ��_ o uint32 MappingStrings w SMBIOS|Type 17|Maximum voltage MinVoltage p )
� � � ��� � uint32 MappingStrings � SMBIOS|Type 20|Minimum voltage SMBIOSMemoryType # | )
� c � ��k { uint32 MappingStrings � SMBIOS|Type 17|Memory_Type Tag @
( N
� � �� � �� / string MaxLen Override Tag MappingStrings 7 WMI TypeDetail d )
� � ��� � uint16 MappingStrings � SMBIOS|Type 17|Type Detail � C I M _ C a c h e M e m o r y 4ʝ��C�� � CIM_CacheMemory 6 � �� � % + S _ � � V ` � � v � � s � � �����������_U�������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������� � Win32_CacheMemory CIMWin32 Locale UUID {FAF76B97-798C-11D2-AAD1-006008C78BC7} CacheSpeed 4 � )
� � � ��� � uint32 MappingStrings � SMBIOS|Type 7|Cache Speed CurrentSRAM 2 � )
� � �� - uint16 MappingStrings 5 SMBIOS|Type 7|Current SRAM Type DeviceID @ A
� � � �� � ��� � � � string Override DeviceId MappingStrings � WMI ErrorCorrectType 3 � )
� 1 � ��9 I uint16 MappingStrings Q SMBIOS|Type 7|Error Correction Type InstalledSize 0 � )
� � � ��� � uint32 MappingStrings � SMBIOS|Type 7|Installed Size Location . � )
� ; � ��C S uint16 MappingStrings [ SMBIOS|Type 7|Location MaxCacheSize / � )
� � � ��� � uint32 MappingStrings � SMBIOS|Type 7|Maximum Cache Size SupportedSRAM 1 � )
� @ � ��H X uint16 MappingStrings ` SMBIOS|Type 7|Supported SRAM Type � C I M _ P h y s i c a l P a c k a g e 5ʝ��C�> k CIM_PhysicalPackage 6 � �� � % - 3 [ e � � q � � � & + � � ����_U����������������������������������������������������������������������������������������������������3 � Win32_PhysicalMemoryArray CIMWin32 Locale UUID {FAF76B99-798C-11D2-AAD1-006008C78BC7} Location P )
� � � ��� � uint16 MappingStrings � SMBIOS|Type 16|Location MaxCapacity V 4
� $ , �� � ��8 H uint32 DEPRECATED MappingStrings P SMBIOS|Type 16|Maximum Capacity MaxCapacityEx Z )
� � � ��� � uint64 MappingStrings � SMBIOS|Type 16|Extended Maximum Capacity MemoryDevices b )
� G � ��O _ uint16 MappingStrings g SMBIOS|Type 16|Number of Memory Devices MemoryErrorCorrection T )
� � � ��� � uint16 MappingStrings � SMBIOS|Type 16|Memory Error Correction Tag @
( N
� � � ��� � ��� � � � string MaxLen Override Tag MappingStrings � WMI Use R )
� � � �� uint16 MappingStrings SMBIOS|Type 16|Use � W i n 3 2 _ C O M A p p l i c a t i o n Aʝ��C�� Win32_COMApplication 6 � �� � ! ) / W ^ �������������������������� � Win32_DCOMApplication CIMWin32 Locale UUID {0F73ED52-8ED9-11d2-B340-00105A1F8569} AppID 4
� � � �� � ��� � string MappingStrings � Win32Registry|HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{GUID}[Default] � W i n 3 2 _ C O M C l a s s Cʝ��C�q Win32_COMClass 6 � �� � ! ) / W d �������������������������� � Win32_ClassicCOMClass CIMWin32 Locale UUID {0F73ED53-8ED9-11d2-B340-00105A1F8569} ComponentId 4
� � � �� � ��� � string MappingStrings � Win32Registry|HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{GUID}[Default] Name @ A
� d � ��l ��s } � � string Fixed Override Name MappingStrings � Win32Registry|HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{GUID}[Default] gi � Iʝ��C� A �� � �� � ( 2 : @ h r e��������� � Win32_ImplementedCategory Association CIMWin32 Locale UUID {0F73ED5B-8ED9-11d2-B340-00105A1F8569} Category f 4
� � � �� � ��� � ref:Win32_ComponentCategory MappingStrings � WMI|Win32_ComponentCategory Component f 4
� S � �� � ��n ~ ref:Win32_ClassicCOMClass MappingStrings � WMI|Win32_ClassicCOMClass ng � Jʝ��C� A �� � �� � % / 7 = e q
e��������� � Win32_ComClassEmulator Association CIMWin32 Locale UUID {0F73ED5C-8ED9-11d2-B340-00105A1F8569} NewVersion f 4
� � � �� � ��� � ref:Win32_ClassicCOMClass MappingStrings � WMI|Win32_ClassicCOMClass OldVersion f 4
� O � �� � ��j z ref:Win32_ClassicCOMClass MappingStrings � WMI|Win32_ClassicCOMClass � Kʝ��C� A �� � �� � ) 3 ; A i u e��������� � Win32_ComClassAutoEmulator Association CIMWin32 Locale UUID {0F73ED5D-8ED9-11d2-B340-00105A1F8569} NewVersion f 4
� � � �� � ��� � ref:Win32_ClassicCOMClass MappingStrings � WMI|Win32_ClassicCOMClass OldVersion f 4
� S � �� � ��n ~ ref:Win32_ClassicCOMClass MappingStrings � WMI|Win32_ClassicCOMClass in � C I M _ L o g i c a l D e v i c e }tR|�C�� 2 CIM_LogicalDevice )
V ��a ��������������������������������������������������i � CIM_Scanner Description Capabilities and management of the scanner logical device. AMENDMENT LOCALE � LOCALE � � �)U�� � ��PN$ �oȇ( ��*�7
q $25l�
� ���8 / �ZR�g � )��-5 ( 7��G] ) C I M _ P h y s i c a l M e d i a 7̝��C�J X CIM_PhysicalMedia 6 � �� � ( . V d � � ���������������������������������������������������������������������������������������| � Win32_PhysicalMedia CIMWin32a Locale UUID {BF253431-1E4D-4F57-00E7-64B2CACC801E} SerialNumber @ $ 6
� � � ��� � � � string Override SerialNumber MappingStrings � Tag @
( N
� C � ��K � ��S ] b r string MaxLen Override Tag MappingStrings z � �˝��C�� ) � ��� � � � � �������� � Win32_PnPDevice Description The Win32_PnPDevice represents an association between a device (known to Config Manager as a PnPEntity), and the function it performs. Its function is represented by a subclass of the logical device that describes its use. For example, a Win32_Keyboard or Win32_DiskDrive. Both referenced objects represent the same underlying system device - changes to resource allocation on the PnPEntity side will effect the associated Device. AMENDMENT LOCALE SameElement f )
� % � ��< I ref:CIM_LogicalDevice Description The SameElement reference represents the logical device properties that are associated with the Plug and Play device. SystemElement f )
� � �� ( ref:Win32_PnPEntity Description The SystemElement reference represents the the Plug and Play device associated with the logical device. yi � C I M _ D e p e n d e n c y �˝��C�� CIM_Dependency ) * � ��� � � � � u��������l � Win32_SystemDriverPNPEntity Description The Win32_SystemDriverPNPEntity class represents an association between a Plug and Play device on the Win32 computer system and the driver that supports the Plug and Play device. AMENDMENT LOCALE Antecedent f@ )
� 4 I V � �� ref:Win32_PNPEntity Description The Antecedent reference represents the Plug and Play device controlled by the driver. Dependent f@ )
� � � �� ref:Win32_SystemDriver Description The Dependent reference represents the driver that supports the Plug and Play device. ME � _ _ E x t r i n s i c E v e n t �˝��C�9 __ExtrinsicEvent ) & � ��� � � ��������������� � Win32_DeviceChangeEvent Description The Win32_DeviceChangeEvent class represents device change events resulting from the addition, removal or modification of devices on the computer system. This includes changes in the hardware configuration (docking and undocking), the hardware state, or newly mapped devices (mapping of a network drive). For example, a device has changed when a WM_DEVICECHANGE message is sent. AMENDMENT LOCALE EventType +
� � n v uint16 Description The EventType property indicates what type of device change notification event has occurred. Values � � � � Configuration Changed Device Arrival Device Removal Docking mp � W i n 3 2 _ D e v i c e C h a n g e E v e n t �˝��C�J ! Win32_DeviceChangeEvent ) & � �� ������������������� � Win32_VolumeChangeEvent Description The Win32_VolumeChangeEvent class represents a local drive event resulting from the addition of a drive letter or mounted drive on the computer system (e.g. CDROM). Network drives are not currently supported. AMENDMENT LOCALE DriveName
� B J W string Description The DriveName property contains the drive name (letter) from the volume that has been added or removed from the system. � W i n 3 2 _ D e v i c e C h a n g e E v e n t �˝��C�� ! Win32_DeviceChangeEvent ) & 3 h ��s ?��������������{ � Win32_SystemConfigurationChangeEvent Description The Win32_SystemConfigurationChangeEvent is an event class which indicates that the device list on the system has been refreshed. Refreshed meaning: a device has been added, removed, or the configuration changed. This event is fired when the windows message 'DevMgrRefreshOn<ComputerName>' is sent. The exact change to the device list is not contained in the message and therefore a device refresh is required in order to obtain the current system settings. Examples of configuration changes affected are IRQ settings, COM ports and BIOS version, to name a few. AMENDMENT LOCALE � C I M _ C o n t r o l l e d B y �˝��C�� CIM_ControlledBy ) * � ��� � � ` k �������������������������������� � Win32_POTSModemToSerialPort Description The Win32_POTSModemToSerialPort class represents an association between a modem and the serial port the modem uses. AMENDMENT LOCALE Antecedent f@ )
� � � �� ref:Win32_SerialPort Description The Antecedent reference represents the serial port used by the modem. Dependent f@ )
� � � � � �� ref:Win32_POTSModem Description The Dependent reference represents the POTS modem using the serial port. � C I M _ S e t t i n g ̝��C��
CIM_Setting
) � ��� ?������������� � Win32_COMSetting Description The Win32_COMSetting class represents the settings associated with a COM component or COM application. AMENDMENT LOCALE � C I M _ L o g i c a l D e v i c e ~tR|�C�� N CIM_LogicalDevice ) � ��� � � � � � � B N + 9 � � � � " + ���_U������������������������������������������������������������������������� � Win32_PnPEntity Description The Win32_PnPEntity class represents the properties of a Plug and Play device. Plug and Play entities are shown as entries in the Device Manager located in the Control Panel. AMENDMENT LOCALE ClassGuid .
� - string Description The ClassGuid property contains the Globally Unique Identifier (GUID) that uniquely identifies this Plug and Play device. CompatibleID 2
� � � � string Description List of Compatible IDs for the device. If Setup cannot locate an INF file that matches one of a device's hardware IDs, it uses compatible IDs to locate an INF file. DeviceID @ )
� � � � � �� string Description The DeviceID property contains a string identifying the Plug and Play device. HardwareID 6
� z � � string Description List of Hardware IDs associated with the device. A hardware ID is a vendor-defined identification string that Setup uses to match a device to an INF file. Manufacturer :
� e m z string Description The Manufacturer property contains the name of the manufacturer of the Plug and Play device.
Example: Acme PNPClass >
� $ 1 string Description The PNPClass property contains name of the type of this Plug and Play device. Present B
� � � � boolean Description The Present property denotes if this Plug and Play device is currently in the system. Service D
� W _ l string Description The Service property contains the name of the service that supports this Plug and Play device. See also: Win32_SystemDriverPNPEntity class.
Example: atapi � LOCALE � � � � mp � ME � yi � � �OFTWARE\Classes\CLSID\{GUID}\AutoTreaq�� O �BQ�? � Ce�=� U :�cW# kgB�2 ~ �@��
m ��
= ���;Z _ �$ǝ� � ѱـ� � j�K{ 5 ���� . �S�� ~ ���C\ ' C I M _ I n s t I n d i c a t i o n ��j�� 1 CIM_InstIndication + " 2 > K �������������������������������������������������� � CIM_InstCreation Version 2.6.0 UMLPackagePath CIM::Event Description CIM_InstCreation notifies when a new instance is created. rs � C I M _ I n s t I n d i c a t i o n ��j��S 5 CIM_InstIndication + ' 7 C P � � ����������������������������������������������������� � CIM_InstModification Version 2.10.0 UMLPackagePath CIM::Event Description CIM_InstModification notifies when an instance is modified. PreviousInstance
.
� � � � object Description A copy of the 'previous' instance whose change generated the Indication. PreviousInstance contains 'older' values of an instance's properties (as compared to SourceInstance), selected by the IndicationFilter's Query. r' � C I M _ I n s t I n d i c a t i o n ��j�� 1 CIM_InstIndication + " 2 > K �������������������������������������������������� � CIM_InstDeletion Version 2.6.0 UMLPackagePath CIM::Event Description CIM_InstDeletion notifies when an existing instance is deleted. 2 � C I M _ E r r o r ��j��� G CIM_Error � � w � � � ���������������������������������������������������������������������E � MSFT_WmiError Description A Windows error object that encapsulates what is in CIM_Error as well as includes error code, errorCategory, errorMessage and errorType. error_Category 8
� � � � uint16 Description Error Category. error_Code 4 )
� K S ��] j uint32 Required Description Error code. error_Type :
� � � � string Description Error Type. error_WindowsErrorMessage >
� - string Description Windows error message. ip �
M S F T _ W m i E r r o r ��j��L K MSFT_WmiError " � � ��������������������������������������������������������������������������� � MSFT_ExtendedStatus Description A Windows error object that encapsulates what is in CIM_Error as well as includes original_error. original_error
B
� � object _E � ��j��U
N X � � � � : D v | Q�� �������� � � RSOP_SOM Locale blocked
� E � �� boolean blocking
� � � �� boolean id '
� � � �� � �� string reason 4
� � �� ( � �� uint32 ValueMap 4 7 1 2 SOMOrder
� n � �� uint32 type )
� � � � � �� uint32 ValueMap � � � � 1 2 3 4 � ��j��% " �� / > � � %��������� � RSOP_IEToolbarButtonLink Locale Association policySetting f
� h � �� ref:RSOP_IEAKPolicySetting toolbarButton f
� � � �� ref:RSOP_IEToolbarButton � ��j��G ) ] j � � � � ! ^ m P`� � �������� � � RSOP_ExtensionStatus Locale beginTime e
� S � �� datetime displayName
� � � �� string endTime e
� � � �� datetime error
�
� �� uint32 extensionGuid '
� V � �� � �� string loggingStatus )
� � � � � �� uint32 ValueMap � � � 1 2 3 � ��j��� ' ( 3 e u � � � � ? G y � � � � � UU�������������������������������������+ � RSOP_IEAuthenticodeCertificate Locale certIndex
� ] � �� sint32 expirationDate e
� � datetime friendlyName
� � string intendedPurposes
� string issuerName
� 7 string rsopID
� q � �� string rsopPrecedence
� � � �� sint32 subjectName
� � string tabIndex
� # � �� sint32 � ����j��� 6
% 3 Z p � � � � � - 7 ^ t � � � � & X a � � � � UUU��������������������������������������������������� � RSOP_IESecurityZoneSettings Locale actionValues .
� R string currentTemplateLevel "
� � uint32 description
� � string displayName
� � string flags
&
� % uint32 iconPath
� V string minimumTemplateLevel
� � uint32 recommendedTemplateLevel
� � uint32 rsopID
� � �� string rsopPrecedence
� P � �� sint32 useHKLM
� � � �� boolean zoneIndex
� � � �� uint32 zoneMappings *
� � string � R S O P _ I E S e c u r i t y Z o n e S e t t i n g s ���j��� 8 % RSOP_IESecurityZoneSettings ( 4 ��������������������������������������������������������\ � RSOP_IEESCSecurityZoneSettings Locale EscEnabled
2
� S boolean � ���j�� �� * 4 s � %��������� � RSOP_IELinkItemLink Locale Association linkItem f
� ^ � �� ref:RSOP_IELinkItem policySetting f
� � � �� ref:RSOP_IEAKPolicySetting � ���j��f ��% - ; o v � � @ L � � ������� � � ����� � RSOP_PolicySettingBlocked abstract Locale creationTime e
� e � �� datetime GPOID
� � � �� string id 2
� � � ��� �� � �� string Required Not_Null name
� 8 � �� string precedence 2
� � � ��� �� � �� uint32 Required Not_Null SOMID
� � � �� string � R S O P _ P o l i c y S e t t i n g B l o c k e d ���j��� 1 # RSOP_PolicySettingBlocked # + 4 f o � � � � , 9 k r � � � � ���������7 5 ; ���� ! ���� # � RSOP_RegistryPolicySettingBlocked Locale command *
� ^ � �� string deleted
(
� � � �� boolean id @ '
� � � �� � �� string precedence @ '
� $ � �� � �� uint32 registryKey
� c � �� string value $
� � � �� uint8 valueName
� � � �� string valueType
� � �� uint32 � �ٱ� k W i n 3 2 _ T e r m i n a l S e t t i n g *vR|�C�] @ Win32_TerminalSetting ) % � ��� � � U c S \ � � 1 Q : � & � � J f E
S
�
�
J U �
, C UUU������������������������������������������������������������H � Win32_TSGeneralSetting Description The Win32_TSGeneralSetting includes capabilities such as Protocol, Transport, Comment, Windows authentication and Encryption Level. AMENDMENT LOCALE CertificateName 8
� � string Description Display name for the local machine personal certificate subject name Certificates
� � � � uint8 Description Contains a serialized certitificate store containing all of the certificates from the machine's MY store which are valid server certificates for use with Terminal Server SSL. Comment
� � � � string Description Descriptive name for the listener. MinEncryptionLevel +
� # � � uint32 Description Windows 2000 supports 3 levels of Encryption: Low, Medium/Client Compatible and High. Windows 2003 supports 4 levels of Encryption Low, Medium /Client Compatible, High andFIPS Compliant Values � � ! Low Medium / Client Compatible High FIPS Compliant PolicySourceMinEncryptionLevel ,
� } � � uint32 Description PolicySourceMinEncryptionLevel indicates whether the property MinEncryptionLevel is configured by Server (0),Group Policy (1), Default (2). PolicySourceSecurityLayer
4
� f n { uint32 Description PolicySourceSecurityLayer indicates whether the property SecurityLayer is configured by Server (0),Group Policy (1), Default (2). PolicySourceUserAuthenticationRequired
(
� R Z g uint32 Description PolicySourceUserAuthenticationRequired indicates whether the property UserAuthenticationRequired is configured by Server (0),Group Policy (1), Default (2). SecurityLayer 0
� ? G O uint32 Values c w � � RDP Security Layer Negotiate SSL NEWTBD SSLCertificateSHA1Hash
� � � � string Description In order to use the SSLCertificateSHA1Hash WMI property, you mustfirst find the hexadecimal Thumbprint value for the certificatethat you want to set the target server to use. The thumbprintof a certificate may be found using the Certificates MMC snap-in.In the Certificates snap-in open the properties page of thecertificate and go to the Details tab. SSLCertificateSHA1HashType
� � � � uint32 Description SSLCertificeSHA1HashType indicates whether the property SSLCertificeSHA1Hash is Invalid (0), Default Self-signed (1), Default GP Enforced (2) or Custom (3). TerminalName @ )
� �
�
�
� �� string Description Name of the Terminal. TerminalProtocol
� �
�
string Description Name of the Session Layer protocol. Example: Microsoft RDP 6.0. Transport
� � � � string Description Displays the type of transport used for the connection: Example TCP, NETBIOS, IPX/SPX. UserAuthenticationRequired $ +
� C K X uint32 Description Specifies the type of User Authentication used for remote connections.If enabled, the protocol requires early user authentication at connection time toincrease server protection against network attacks. Only RDP clients that supportRDP version 6.0 or higher will be able to connect. To avoid disruptions forremote users, it is recommended to deploy RDP clients supporting the appropriateprotocol version before enabling the property. Values & FALSE TRUE WindowsAuthentication +
� | � � ' / uint32 Description Specifies whether the connection defaults to the standard Windows Authentication if another Authentication package has been installed on the system. Values ; B FALSE TRUE � � � � � � � �
� � � SetEncryptionLevel % 2 Description Sets the Encryption level to one of Low, Medium or High. The function takes one parameter that specifies the Encryption Level: 1 = Low, 2 = Medium, 3 = High, 4 = FIPS Compliant. 2 a42c9160500003S ROOT\cimv2\TerminalServices\ms_409 ���� � �� �� * � ����� � __PARAMETERS abstract MinEncryptionLevel uint32
� > In
� > e �� ID )
� � e ��� uint32 __ �� a42c9160500003S ROOT\cimv2\TerminalServices\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � SetSecurityLayer � � Description Sets the Security layer to one of RDP Security Layer, Negotiate or SSL. The function takes one parameter that specifies the Security Layer: 0 = RDP Security Layer, 1 = Negotiate, 2 = SSL. Note that if current Encryption level = 1, then Security Layer = 2 setting is invalid. # a42c9160500003S ROOT\cimv2\TerminalServices\ms_409 ���� � �� �� * � ����� � __PARAMETERS abstract SecurityLayer uint32
� 9 In
� 9 ` �� ID )
� � ` ��� uint32 __ �� a42c9160500003S ROOT\cimv2\TerminalServices\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � SetUserAuthenticationRequired � � Description Enables or disables UserAuthenticationRequired. The function takes one parameter - the flag that enables or disables it. The call returns zero on success and an error on failure. J a42c9160500003S ROOT\cimv2\TerminalServices\ms_409 ���� � �� �� * � ����� � __PARAMETERS abstract UserAuthenticationRequired uint32
� F In
� F m �� ID )
� � m ��� uint32 __ �� a42c9160500003S ROOT\cimv2\TerminalServices\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � ,
C I M _ P o t s M o d e m tR|�C��+ CIM_PotsModem ) � ��� - � � f p % � � � � e t ) > � � � � e s [ g [
g
�
�
� � �
�
� � G X ! ( � � ^ e � � � � � � � ; C � � � � E L V ] � � � � o! ~! '" 9" # ,# �# �# �$ �$ �% �% �& �& O' U' 2( F( �������UUUUUUUUUU�����������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������) � Win32_POTSModem Description The Win32_POTSModem class represents the services and characteristics of a Plain Old Telephone Service (POTS) modem on a Win32 system. AMENDMENT LOCALE AttachedTo ]
� � � string Description The AttachedTo property indicates the port to which the POTS modem is attached.
Example: COM1. BlindOff a
� � � � string Description The BlindOff property contains the command string used to detect a dial tone before dialing.
Example: X4. BlindOn ! e
� Q Y f string Description The BlindOn property contains the command string used to dial whether or not there is a dial tone.
Example: X3. CompatibilityFlags " i
� , string Description The CompatibilityFlags property lists all modem connection protocols with which this modem device is compatible. CompressionOff # m
� � � � string Description The CompressionOff property contains the command string used to disable hardware data compression.
Example: S46=136. CompressionOn $ q
� � � � string Description The CompressionOn property contains the command string used to enable hardware data compression.
Example: S46=138. ConfigurationDialog % u
� j r string Description The ConfigurationDialog property contains the modem initialization string. This property is comprised of command strings from other members of this class. DCB & y
� L S ` uint8 Description The Device Control Block (DCB) property contains the control settings for a serial communications device, in this case, the modem device. Default ' }
� ' 4 uint8 Description The Default property indicates whether this POTS modem is the default modem on the Win32 computer system. DeviceID @ )
� � � � � �� string Description The DeviceID property contains a string uniquely identifying this POTS modem from other devices on the system. DeviceLoader ( �
� � � � string Description The DeviceLoader property indicates the name of the device loader for the modem. A device loader loads and manages device drivers and enumerators for a given device. DeviceType ) � +
� � � � �
string Description The DeviceType property indicates the physical type of the modem. Values
$
4
D
R
Null Modem Internal Modem External Modem PCMCIA Modem Unknown DriverDate e * �
� �
�
�
datetime Description The DriverDate property indicates the date of the modem driver. ErrorControlForced + �
� + 3 @ string Description The ErrorControlForced property contains the command string used to enable error correction control when establishing a connection. This increases the reliability of the connection.
Example: +Q5S36=4S48=7. ErrorControlOff , �
� L T a string Description The ErrorControlOff property contains the command string used to disable error control.
Example: +Q6S36=3S48=128. ErrorControlOn - �
�
%
string Description The ErrorControlOn property contains the command string used to enable error control.
Example: +Q5S36=7S48=7. FlowControlHard . �
� �
�
�
string Description The FlowControlHard property contains the command string used to enable hardware flow control. Flow control consists of signals sent between computers that verify that both computers are ready to transmit or receive data.
Example: &K1. FlowControlOff / �
� $ string Description The FlowControlOff property contains the command string used to disable flow control. Flow control consists of signals sent between computers that verify that both computers are ready to transmit or receive data.
Example: &K0. FlowControlSoft 0 �
� E M Z string Description The FlowControlSoft property contains the command string used to enable software flow control. Flow control consists of signals sent between computers that verify that both computers are ready to transmit or receive data.
Example: &K2. InactivityScale 1 �
� � � � string Description The InactivityScale property is a multiplier used with the InactivityTimeout property to calculate the timeout period of a connection. Index 2 �
� T \ i uint32 Description The Index property indicates the index number for this POTS modem.
Example: 0 IndexEx 3 �
� � � string Description The IndexEx property indicates the device instance ID for this POTS modem.
Example: "1&08" Model 4 �
� � � � string Description The Model property indicates the model of this POTS modem.
Example: Sportster 56K External. ModemInfPath 5 �
� = E R string Description The ModemInfPath property indicates the path to this modem's .inf file. This file contains initialization information for the modem and its driver.
Example: C:\WINNT\INF. ModemInfSection 6 �
� ; C P string Description The ModemInfSection property indicates the name of the section in the modem's .inf file that contains information about the modem. ModulationBell 7 �
� % string Description The ModulationBell property contains the command string used to instruct the modem to use Bell modulations for 300 and 1200 bps.
Example: B1. ModulationCCITT 8 �
� � � string Description The ModulationCCITT property contains the command string used to instruct the modem to use CCITT modulations for 300 and 1200 bps.
Example: B0. PortSubClass 9 �
� � � � string Description The PortSubClass property contains the string definingthe port used for this modem. Prefix : �
� o w � string Description The Prefix property indicates the dialing prefix used to access an outside line. Properties ; �
� " uint8 Description The Properties property is a string array that lists all the properties (and their values) for this modem. ProviderName < �
� � � � string Description The ProviderName property indicates the network path to the computer that provides the modem services. Pulse = �
� x � � string Description The Pulse property contains the command string used to instruct the modem to use pulse mode for dialing. Pulse dialing is necessary for phone lines that are unable to handle tone dialing.
Example: P. Reset > �
� � � � string Description The Reset property contains the command string used to reset the modem for the next call.
Example: AT&F. ResponsesKeyName ? �
� F N [ string Description The ResponsesKeyName property contains the response this modem might report to the operating system during the connection process. The first two characters specify the type of response. The second two characters specify information about the connection being made. The second two characters are used only for Negotiation Progress or Connect response codes. The next eight characters specify the modem-to-modem line speed negotiated in bits per second (bps). The characters represent a 32-bit integer doubleword format (byte and word reversed). The last eight characters indicate that the modem is changing to a different port or Data Terminal Equipment (DTE) speed. Usually this field is not used because modems make connections at a "locked" port speed regardless of the modem-to-modem or Data Communications Equipment (DCE) speed. SpeakerModeDial @ �
� � � � string Description The SpeakerModeDial property contains the command string used to turn the modem speaker on after dialing a number, and turning the speaker off when a connection has been established.
Example: M1. SpeakerModeOff A �
� � � ! string Description The SpeakerModeOff property contains the command string used to turn the modem speaker off.
Example: M0. SpeakerModeOn B �
� �! �! �! string Description The SpeakerModeOn property contains the command string used to turn the modem speaker on.
Example: M2. SpeakerModeSetup C �
� e" m" z" string Description The SpeakerModeSetup property contains the command string used to instruct the modem to turn the speaker on (until a connection is established).
Example: M3. SpeakerVolumeHigh D �
� X# `# m# string Description The SpeakerVolumeHigh property contains the command string used to set the modem speaker to the highest volume.
Example: L3. SpeakerVolumeLow E �
� )$ 1$ >$ string Description The SpeakerVolumeLow property contains the command string used to set the modem speaker to the lowest volume.
Example: L1. SpeakerVolumeMed F �
� �$ %
% string Description The SpeakerVolumeMed property contains the command string used to set the modem speaker to a medium volume.
Example: L2. StringFormat G � +
� �% �% �% G& O& string Description The StringFormat property describes the type of characters used for text passed through the modem. Values _& t& �& ASCII string format DBCS string format UNICODE string format Terminator H
� �& �& �& string Description The Terminator property contains the string that marks the end of a command string.
Example: <cr> Tone I
� �' �' �' string Description The Tone property contains the command string that instructs the modem to use tone mode for dialing. The phone line must support tone dialing.
Example: T. VoiceSwitchFeature J
� r( z( �( string Description The VoiceSwitchFeature property contains the command strings used to activate the voice capabilities of a voice modem.
Example: AT+V. � �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � C I M _ E l e m e n t S e t t i n g S̝��C�� CIM_ElementSetting ) ��) 1 7 _ h � � e��������" � Win32_SecuritySettingOfObject Abstract Locale UUID {8502C584-5FBB-11D2-AAC1-006008C78BC7} Element f@
� � � � ref:CIM_LogicalElement Override Element Setting f@
� � ref:Win32_SecuritySetting Override Setting me � T̝��C�{ 4 ��& ��3 ; A i p � � e�������� � Win32_SecuritySettingOwner abstract Association Locale UUID {8502C585-5FBB-11D2-AAC1-006008C78BC7} Owner f '
� � � �� � �� ref:Win32_SID SecuritySetting f '
� � � �� � �� ref:Win32_SecuritySetting 02 � U̝��C�{ 4 ��& ��3 ; A i p � � e�������� � Win32_SecuritySettingGroup abstract Association Locale UUID {8502C586-5FBB-11D2-AAC1-006008C78BC7} Group f '
� � � �� � �� ref:Win32_SID SecuritySetting f '
� � � �� � �� ref:Win32_SecuritySetting 02 � W i n 3 2 _ S e c u r i t y S e t t i n g O w n e r ^̝��C�� $ Win32_SecuritySettingOwner 6 � �� � " * 0 X _ � � e��������) � Win32_LogicalFileOwner SECRCW32 Locale UUID {8502C58E-5FBB-11D2-AAC1-006008C78BC7} Owner f@
� � � � ref:Win32_SID Override Owner SecuritySetting f@
� � ref:Win32_LogicalFileSecuritySetting Override SecuritySetting � C I M _ U S B C o n t r o l l e r H a s H u b G̝��C�+ ! CIM_USBControllerHasHub ) % w ��� � � ��������������������������������� � Win32_ControllerHasHub Description USBControllerHasHub defines the Hub(s) that are downstream of the USBController. AMENDMENT LOCALE Antecedent f@ )
� � � � � �� ref:Win32_USBController Description The USBController. Dependent f@ )
� I [ h � �� ref:Win32_USBHub Description The USBHub that is associated with the Controller. � C I M _ R e a l i z e s I̝��C�� CIM_Realizes ) + � ��� � � � � u��������, � Win32_DiskDrivePhysicalMedia Description The Win32_PhysicalElementsOfDiskDrive association defines the mapping between a disk drive and the physical components that implement it. AMENDMENT LOCALE Antecedent f@ )
� % 2 � �� ref:Win32_PhysicalMedia Description The Antecedent reference represents the physical component that implements the DiskDrive device. Dependent f@ )
� � � � � �� ref:Win32_DiskDrive Description The Dependent reference represents the disk drive. ha � C I M _ P h y s i c a l M e d i a *tR|�C�� C CIM_PhysicalMedia ) " � ��� � � � � ������������������������������������������������������������������B � Win32_PhysicalMedia Description The Win32_PhysicaMedia class represents any type of documentation or storage medium, such as tapes, CD ROMs, etc. AMENDMENT LOCALE SerialNumber @
� � � � string Description The Serial number property is a manufacturer-allocated number used to identify the physicalmedia.
Example: WD-WM3493798728 for a disk serial number. Tag @ )
� � � � � �� string Description The Tag property uniquely identifies the physical media in the system.
Example: \\PHYSICALDRIVE0 �
C I M _ U S B H u b ftR|�C�o F CIM_USBHub ) l ��w � J P ���������������������������������������������������������������������� � Win32_USBHub Description The Win32_USBHub class represents the management characterisitics of a USB Hub. AMENDMENT LOCALE DeviceID @ )
� � � � � �� string Description The DeviceID property DeviceID is an address or other identifying information which uniquely identifies the USBHub. Name <
� | � � string Description The Name property indicates the name of the USB Hub. �IVE0 �k drive. ha � � � � � Av��` l �� O� � �&�(� h ��,� | [[��x ( $ M s f t _ W m i P r o v i d e r _ O p e r a t i o n E v e n t _ P o s t �̝��C� 3 . Msft_WmiProvider_OperationEvent_Post & # , S [ ��������������������������������������������������� � Msft_WmiProvider_CancelQuery_Post QueryId (
� K uint32 Result
,
� z uint32 � C I M _ B a s e d O n �ʝ��C�� CIM_BasedOn
) ! . �� ! - � � ������������������������� � CIM_LogicalDiskBasedOnPartition Description LogicalDisks can be BasedOn a DiskPartition. For example, a personal computer's C: drive may be located on a Partition on local PhysicalMedia. In this association of LogicalDisks to Partitions, note that the cardinality of the Antecedent, DiskPartition, is Max(1). This dictates that a LogicalDisk can not span more than one Partition. However, there are cases where this is true. When it occurs, the LogicalDisk is really based on some kind of RAID configuration (for example, a mirror or stripe set). In these scenarios, the LogicalDisk is more correctly BasedOn a StorageVolume. To prevent incorrectly using the LogicalDiskBasedOnPartition association, the Max(1) qualifier was put on the Antecedent reference to the DiskPartition. AMENDMENT LOCALE Antecedent f@
� Y p } ref:CIM_DiskPartition Description The disk partition. Dependent f@
� � � � ref:CIM_LogicalDisk Description The logical disk which is built on the partition. � C I M _ D e p e n d e n c y �ʝ��C�4 CIM_Dependency ) # � ��� � � U ` u��������� � CIM_AssociatedMemory Description Logical devices may have memory installed on them or otherwise associated with them - such as cache memory. This is made explicit in this association. AMENDMENT LOCALE Antecedent f@
� # ref:CIM_Memory Description Memory installed on or associated with a device. Dependent f@
� � � � ref:CIM_LogicalDevice Description The logical device. � C I M _ L o g i c a l D e v i c e �tR|�C�B e CIM_LogicalDevice ) � ��� � � � � � � � � � � � � � � �
�
� � � � d
w
� � Q m
���_UUU���������������������������������������������������������������������������������������������� � CIM_PotsModem Description The POTSModem class represents a Device that translates binary data into wave modulations for sound based transmission. It connects to the POTS (Plain Old Telephone System) network. AMENDMENT LOCALE AnswerMode . +
� , 4 A � � uint16 Description Answer mode defines the current auto-answer/call-back setting for the modem. Values � � � � � � Unknown Other Disabled Manual Answer Auto Answer Auto Answer with Call-Back CompressionInfo 0 +
� O W d � � uint16 Description Describes the data compression characteristics of the modem. Values � � � � � Unknown Other No Compression MNP 5 V.42bis CountriesSupported 2
� 2 : G string Description CountriesSupported is an array (bag) that contains a set of strings defining the countries/regions in which the modem can operate. CountrySelected 6
� string Description CountrySelected is a string value defining the country/region for which the modem is currently programmed. When multiple countries/regions are supported, this property defines which one is currently selected for use. CurrentPasswords :
� 5 = J string Description CurrentPasswords is an array (bag) containing the currently defined passwords for the modem. This array may be left blank for security reasons. DialType > +
� & 3 � � uint16 Description DialType is an integer indicating whether tone (value=1) or pulse dialing (value=2) is used. "Unknown" (0) can also be defined. Values � � � Unknown Tone Pulse ErrorControlInfo @ +
� - 5 B � � uint16 Description Describes the error correction characteristics of the modem. Values � � � � � Unknown Other No Error Correction MNP 4 LAPM InactivityTimeout B +
� & 3 � � uint32 Description InactivityTimeout defines the time limit (in seconds) for automatic disconnection of the phone line, if no data is exchanged. A value of 0 indicates that this feature is present but not enabled. Units seconds MaxBaudRateToPhone F +
� U ] j � � uint32 Description Defines the maximum settable communication speed for accessing the phone system. Units bits per second MaxBaudRateToSerialPort J +
� &
.
;
�
�
uint32 Description Defines the maximum settable communication speed to the COM port for an external modem. Enter 0 if not applicable. Units bits per second MaxNumberOfPasswords N
� uint16 Description MaxNumberOfPasswords specifies the number of passwords definable in the modem itself. If this feature is not supported, enter 0. ModulationScheme P +
� � � / 7 uint16 Description Describes the modulation scheme of the modem. Values k t { � � � � � � � � � Unknown Other Not Supported Bell 103 Bell 212A V.22bis V.32 V.32bis V.turbo V.FC V.34 V.34bis RingsBeforeAnswer R
�
(
uint8 Description Number of rings before the modem answers an incoming call. SpeakerVolumeInfo S +
� �
�
�
` h uint16 Description Describes the volume level of the audible tones from the modem. For example, high, medium or low volume can be reported (values 3, 4 or 5, respectively). Values � � � � � � � � Unknown Other Not Supported High Medium Low Off Auto SupportsCallback U
� boolean Description Indication of whether the modem supports call-back SupportsSynchronousConnect W
� � � � boolean Description Boolean indicating that synchronous, as well as asynchronous, communication is supported. TimeOfLastReset e Y
� G Q ^ datetime Description The TimeOfLastReset property indicates the date and time this controller was last reset. This could mean the controller was powered down, or reinitialized. � C I M _ S t o r a g e E x t e n t �tR|�C�� R CIM_StorageExtent ) � ��� � � y � ���������������������������������������������������������������������������������3 � CIM_DiskPartition Description A DiskPartition is a presentation of a contiguous range of logical blocks that is identifiable by the OperatingSystem via the Partition's type and subtype fields. DiskPartitions should be directly realized by PhysicalMedia (indicated by the RealizesDiskPartition association) or built on StorageVolumes (indicated by the PartitionBasedOnVolume association. AMENDMENT LOCALE Bootable H
� � � � boolean Description Boolean indicating that the DiskPartition is labelled as bootable. This does not mean that an OperatingSystem is actually loaded on the partition. PrimaryPartition J
� � � � boolean Description Boolean indicating that the DiskPartition is labelled as the primary partition for a ComputerSystem. �ialized. � device. � � � � �
5 C I M _ L o g i c a l D e v i c e �tR|�C��4 � CIM_LogicalDevice )
U ��` h | � � * B � � 6 K � � � � � � � � ( = � � r � y � L ] + ~ � � � z � + C � � �! �! �$ �$ �% �% /& A& 6' J' }( �( �) �) �- �- 0 )0 �1 �1 2 12 ���_UUUUUUU����������������������������������������������������������������������������������������������������������������������������������������������������������������������2 � CIM_Printer Description Capabilities and management of the Printer LogicalDevice. AMENDMENT LOCALE AvailableJobSheets .
� � � � string Description Describes all of the job sheets that are available on the Printer. This can also be used to describe the banner that a Printer might provide at the beginning of each Job, or can describe other user specified options. Capabilities 2 +
� � � � � � uint16 Description An array of integers indicating Printer capabilities. Information such as "Duplex Printing" (value=3) or "Transparency Printing" (7) is specified in this property. Values � - 5 @ J a h o u � � � � � � � �
Unknown Other Color Printing Duplex Printing Copies Collation Stapling Transparency Printing Punch Cover Bind Black and White Printing One Sided Two Sided Long Edge Two Sided Short Edge Portrait Landscape Reverse Portrait Reverse Landscape Quality High Quality Normal Quality Low CapabilityDescriptions 6
� n v � string Description An array of free-form strings providing more detailed explanations for any of the Printer features indicated in the Capabilities array. Note, each entry of this array is related to the entry in the Capabilities array that is located at the same index. CharSetsSupported :
� � � � string Description Identifies the available character sets for the output of text related to managing the Printer. Strings provided in this property should conform to the semantics and syntax specified by section 4.1.2 ("Charset parameter") in RFC 2046 (MIME Part 2) and contained in the IANA character-set registry. Examples include "utf-8", "us-ascii" and "iso-8859-1". CurrentCapabilities > +
� � � � @ H uint16 Description Specifies which finishings and other capabilities of the Printer are currently being used. An entry in this property should also be listed in the Capabilities array. Values � � � � � � � � 7 B W m w � � � � � Unknown Other Color Printing Duplex Printing Copies Collation Stapling Transparency Printing Punch Cover Bind Black and White Printing One Sided Two Sided Long Edge Two Sided Short Edge Portrait Landscape Reverse Portrait Reverse Landscape Quality High Quality Normal Quality Low CurrentCharSet B
�
#
string Description Specifies the current character set being used for the output of text relating to management of the Printer. The character set described by this property should also be listed in CharsetsSupported. The string specified by this property should conform to the semantics and syntax specified by section 4.1.2 ("Charset parameter") in RFC 2046 (MIME Part 2) and contained in the IANA character-set registry. Examples include "utf-8", "us-ascii" and "iso-8859-1". CurrentLanguage F +
� 9 A N � � uint16 Description Indicates the current printer language being used. A language that is being used by the Printer should also be listed in LanguagesSupported. Values / �
�
�
�
�
�
�
�
�
�
�
�
�
# ( . 7 < A H P U [ b h n v � � � � � � � � � � � � � � � � Other Unknown PCL HPGL PJL PS PSPrinter IPDS PPDS EscapeP Epson DDIF Interpress ISO6429 Line Data MODCA REGIS SCS SPDL TEK4014 PDS IGP CodeV DSCDSE WPS LN03 CCITT QUIC CPAP DecPPL Simple Text NPAP DOC imPress Pinwriter NPDL NEC201PL Automatic Pages LIPS TIFF Diagnostic CaPSL EXCL LCDS XES MIME CurrentMimeType H
� 7 ? L string Description Specifies the mime type currently being used by the Printer if the CurrentLanguage is set to indicate a mime type is in use (value = 47). CurrentNaturalLanguage L
� # 0 string Description Identifies the current language being used by the Printer for management. The language listed in the CurrentNaturalLanguage property should also be listed in NaturalLanguagesSupported. CurrentPaperType P
� ( 0 = string Description Specifies the paper type that the Printer is currently using. The string should be expressed in the form specified by ISO/IEC 10175 Document Printing Application (DPA) which is also summarized in Appendix C of RFC 1759 (Printer MIB). DefaultCapabilities T +
� v ~ � 7 ? uint16 Description Specifies which finishings and other capabilities of the Printer will be used by default. An entry in DefaultCapabilities should also be listed in the Capabilities array. Values � � � � � � � � . 9 N d n y � � � � Unknown Other Color Printing Duplex Printing Copies Collation Stapling Transparency Printing Punch Cover Bind Black and White Printing One Sided Two Sided Long Edge Two Sided Short Edge Portrait Landscape Reverse Portrait Reverse Landscape Quality High Quality Normal Quality Low DefaultCopies X
� uint32 Description The number of copies that will be produced for a single Job unless otherwise specified. DefaultLanguage \ +
� � � � [ c uint16 Description Indicates the default printer language. A language that is used as a default by the Printer should also be listed in LanguagesSupported. Values / # * 3 8 > C G R X ^ g n t � � � � � � � � � � � � � � � � � �
! ' 1 < C I O [ b h n s Other Unknown PCL HPGL PJL PS PSPrinter IPDS PPDS EscapeP Epson DDIF Interpress ISO6429 Line Data MODCA REGIS SCS SPDL TEK4014 PDS IGP CodeV DSCDSE WPS LN03 CCITT QUIC CPAP DecPPL Simple Text NPAP DOC imPress Pinwriter NPDL NEC201PL Automatic Pages LIPS TIFF Diagnostic CaPSL EXCL LCDS XES MIME DefaultMimeType ^
� � � � string Description Specifies the default mime type used by the Printer if the DefaultLanguage is set to indicate a mime type is in use (value=47). DefaultNumberUp b
� � � � uint32 Description The number of print-stream pages that the Printer will render onto a single media sheet unless a Job specifies otherwise. DefaultPaperType f
� W _ l string Description Specifies the paper type that the Printer will use if a PrintJob does not specify a particular type. The string should be expressed in the form specified by ISO/IEC 10175 Document Printing Application (DPA) which is also summarized in Appendix C of RFC 1759 (Printer MIB). DetectedErrorState j +
� � � � � uint16 Description Printer error information. Values 8 A H R ] g r | � � � � Unknown Other No Error Low Paper No Paper Low Toner No Toner Door Open Jammed Offline Service Requested Output Bin Full ErrorInformation l
� � string Description An array providing supplemental information for the current error state, indicated in DetectedErrorState. HorizontalResolution p +
� Ѯv� _ 4�� � ��,�q ( #k��� ^ ~��3� _ ���V
� ��J . J��x c &(��� d �S�? � $�t�7 : \ �Dq m $Ϟr� n �FĤL � �� �B 4 �^g#v h &1 � i B i d 2 E t w _ A D O D B _ 1 _ T r a c e �ҝ��C� Bid2Etw_ADODB_1_Trace C � �� * H S b i q { � � � u��������� � Bid2Etw_ADODB_1_Trace_TextW Description ADODB.1 formatted output (W) EventType EventTypeName TextW locale MS\0x409 ModID 6
� � � � � � �� uint32 WmiDataId Description Module ID msgStr
C
� J R ] j x � � �� object WmiDataId Description Text StringW extension RWString tr �
E v e n t T r a c e �ҝ��C�� EventTrace 6 � �� ' - U ] g � Bid2Etw_ADOMD_1 Description ADOMD.1 Guid {7EA56435-3F2F-3F63-A829-F0B35B5CAD41} locale MS\0x409 B � B i d 2 E t w _ A D O M D _ 1 �ҝ��C�� Bid2Etw_ADOMD_1 C � �� $ - 3 [ h o w � � Bid2Etw_ADOMD_1_Trace Description ADOMD.1 Guid {7EA56436-3F2F-3F63-A829-F0B35B5CAD41} DisplayName ADOMD locale MS\0x409 � B i d 2 E t w _ A D O M D _ 1 _ T r a c e �ҝ��C� Bid2Etw_ADOMD_1_Trace C � �� * H S b i q { � � � u��������� � Bid2Etw_ADOMD_1_Trace_TextA Description ADOMD.1 formatted output (A) EventType EventTypeName TextA locale MS\0x409 ModID 6
� � � � � � �� uint32 WmiDataId Description Module ID msgStr
C
� J R ] j x � � �� object WmiDataId Description Text StringA extension RString gS � B i d 2 E t w _ A D O M D _ 1 _ T r a c e �ҝ��C� Bid2Etw_ADOMD_1_Trace C � �� * H S b i q { � � � u��������� � Bid2Etw_ADOMD_1_Trace_TextW Description ADOMD.1 formatted output (W) EventType EventTypeName TextW locale MS\0x409 ModID 6
� � � � � � �� uint32 WmiDataId Description Module ID msgStr
C
� J R ] j x � � �� object WmiDataId Description Text StringW extension RWString tr �
E v e n t T r a c e �ҝ��C�� EventTrace 6 � �� ) / W _ i � Bid2Etw_MSADOX_1 Description MSADOX.1 Guid {6C770D53-0441-AFD4-DCAB-1D89155FECFC} locale MS\0x409 B � B i d 2 E t w _ M S A D O X _ 1 �ҝ��C�� Bid2Etw_MSADOX_1 C � �� % / 5 ] j r z � � Bid2Etw_MSADOX_1_Trace Description MSADOX.1 Guid {6C770D54-0441-AFD4-DCAB-1D89155FECFC} DisplayName MSADOX locale MS\0x409 � B i d 2 E t w _ M S A D O X _ 1 _ T r a c e �ҝ��C� Bid2Etw_MSADOX_1_Trace C � �� + J U d k s } � � � u��������� � Bid2Etw_MSADOX_1_Trace_TextA Description MSADOX.1 formatted output (A) EventType EventTypeName TextA locale MS\0x409 ModID 6
� � � � � � �� uint32 WmiDataId Description Module ID msgStr
C
� L T _ l z � � �� object WmiDataId Description Text StringA extension RString m � B i d 2 E t w _ M S A D O X _ 1 _ T r a c e �ҝ��C� Bid2Etw_MSADOX_1_Trace C � �� + J U d k s } � � � u��������� � Bid2Etw_MSADOX_1_Trace_TextW Description MSADOX.1 formatted output (W) EventType EventTypeName TextW locale MS\0x409 ModID 6
� � � � � � �� uint32 WmiDataId Description Module ID msgStr
C
� L T _ l z � � �� object WmiDataId Description Text StringW extension RWString sg �
E v e n t T r a c e �ҝ��C�� EventTrace 6 � �� ! - 3 [ c m � Bid2Etw_MSDAPRST_1 Description MSDAPRST.1 Guid {64A552E0-6C60-B907-E59C-10F1DFF76B0D} locale MS\0x409 B � B i d 2 E t w _ M S D A P R S T _ 1 �ҝ��C�� Bid2Etw_MSDAPRST_1 C � �� ' 3 9 a n x � � � Bid2Etw_MSDAPRST_1_Trace Description MSDAPRST.1 Guid {64A552E1-6C60-B907-E59C-10F1DFF76B0D} DisplayName MSDAPRST locale MS\0x409 � B i d 2 E t w _ M S D A P R S T _ 1 _ T r a c e �ҝ��C�% " Bid2Etw_MSDAPRST_1_Trace C � �� - N Y h o w � � � � ���������� � Bid2Etw_MSDAPRST_1_Trace_TextA Description MSDAPRST.1 formatted output (A) EventType EventTypeName TextA locale MS\0x409 ModID 6
� � � � � � �� uint32 WmiDataId Description Module ID msgStr
C
� P X c p ~ � � �� object WmiDataId Description Text StringA extension RString le � B i d 2 E t w _ M S D A P R S T _ 1 _ T r a c e �ҝ��C�& " Bid2Etw_MSDAPRST_1_Trace C � �� - N Y h o w � � � � ���������� � Bid2Etw_MSDAPRST_1_Trace_TextW Description MSDAPRST.1 formatted output (W) EventType EventTypeName TextW locale MS\0x409 ModID 6
� � � � � � �� uint32 WmiDataId Description Module ID msgStr
C
� P X c p ~ � � �� object WmiDataId Description Text StringW extension RWString I �
E v e n t T r a c e �ҝ��C�� EventTrace 6 � �� + 1 Y a k � Bid2Etw_MSDAREM_1 Description MSDAREM.1 Guid {564F1E24-FC86-28E1-74F8-5CA0D950BEE0} locale MS\0x409 B � B i d 2 E t w _ M S D A R E M _ 1 �ҝ��C�� Bid2Etw_MSDAREM_1 C � �� & 1 7 _ l u } � � Bid2Etw_MSDAREM_1_Trace Description MSDAREM.1 Guid {564F1E25-FC86-28E1-74F8-5CA0D950BEE0} DisplayName MSDAREM locale MS\0x409 � B i d 2 E t w _ M S D A R E M _ 1 _ T r a c e �ҝ��C�" ! Bid2Etw_MSDAREM_1_Trace C � �� , L W f m u � � � u��������� � Bid2Etw_MSDAREM_1_Trace_TextA Description MSDAREM.1 formatted output (A) EventType EventTypeName TextA locale MS\0x409 ModID 6
� � � � � � �� uint32 WmiDataId Description Module ID msgStr
C
� N V a n | � � �� object WmiDataId Description Text StringA extension RString ID � B i d 2 E t w _ M S D A R E M _ 1 _ T r a c e �ҝ��C�# ! Bid2Etw_MSDAREM_1_Trace C � �� , L W f m u � � � u��������� � Bid2Etw_MSDAREM_1_Trace_TextW Description MSDAREM.1 formatted output (W) EventType EventTypeName TextW locale MS\0x409 ModID 6
� � � � � � �� uint32 WmiDataId Description Module ID msgStr
C
� N V a n | � � �� object WmiDataId Description Text StringW extension RWString � � � � uint32 Description Printer's horizontal resolution in pixels per inch. Units pixels per inch JobCountSinceLastReset ! t
� o w � uint32 Description Printer jobs processed since last reset. These jobs may be processed from one or more PrintQueues. LanguagesSupported " x +
� 6 > K � � uint16 Description An array indicating the print languages natively supported. Values 2 \ c l q w | � � � � � � � � � � � � � � � � � ! !
! ! ! ! &! .! ;! A! F! O! Z! `! j! u! |! �! �! �! �! �! �! �! �! �! �! Other Unknown PCL HPGL PJL PS PSPrinter IPDS PPDS EscapeP Epson DDIF Interpress ISO6429 Line Data MODCA REGIS SCS SPDL TEK4014 PDS IGP CodeV DSCDSE WPS LN03 CCITT QUIC CPAP DecPPL Simple Text NPAP DOC imPress Pinwriter NPDL NEC201PL Automatic Pages LIPS TIFF Diagnostic CaPSL EXCL LCDS XES MIME XPS HPGL2 PCLXL MarkingTechnology # | +
� " " &" ]" e" uint16 Description Specifies the marking technology used by the Printer. Values �" �" �" �" # 4# X# }# �# �# �# �# �# �#
$ $ !$ 4$ G$ V$ f$ u$ �$ �$ �$ �$ �$ Other Unknown Electrophotographic LED Electrophotographic Laser Electrophotographic Other Impact Moving Head Dot Matrix 9pin Impact Moving Head Dot Matrix 24pin Impact Moving Head Dot Matrix Other Impact Moving Head Fully Formed Impact Band Impact Other Inkjet Aqueous Inkjet Solid Inkjet Other Pen Thermal Transfer Thermal Sensitive Thermal Diffusion Thermal Other Electroerosion Electrostatic Photographic Microfiche Photographic Imagesetter Photographic Other Ion Deposition eBeam Typesetter MaxCopies $ ~
� % % +% uint32 Description The maximum number of copies that can be produced by the Printer from a single Job. MaxNumberUp % �
� �% �% �% uint32 Description The maximum number of print-stream pages that the Printer can render onto a single media sheet. MaxSizeSupported & � +
� z& �& �& $' +' uint32 Description Specifies the largest Job (as a byte stream) that the Printer will accept in units of Kbytes. A value of zero indicates that no limit has been set. Units kilobytes MimeTypesSupported ' �
� v' ~' �' string Description An array of free-form strings providing more detailed explanations of any mime types that are supported by the Printer. If data is provided for this property, then the value 47, "Mime", should be included in the LanguagesSupported property. NaturalLanguagesSupported ( �
� �( �( �( string Description Identifies the available languages for strings used by the Printer for the output of management information. The strings should conform to RFC 1766, for example "en" is used for English. PaperSizesSupported ) � +
� �) �) �) 3* ;* uint16 Description An integer array indicating the types of paper supported. Values J g+ p+ w+ z+ }+ �+ �+ �+ �+ �+ �+ �+ �+ �+ �+ , , ., A, E, I, M, Q, U, Y, ], a, e, l, p, t, x, |, �, �, �, �, �, �, �, �, �, �, �, �, �, �, �, �, �, �, �, �, �, �, - - - - $- /- 9- F- S- `- m- z- �- �- �- �- �- �- �- Unknown Other A B C D E Letter Legal NA-10x13-Envelope NA-9x12-Envelope NA-Number-10-Envelope NA-7x9-Envelope NA-9x11-Envelope NA-10x14-Envelope NA-Number-9-Envelope NA-6x9-Envelope NA-10x15-Envelope A0 A1 A2 A3 A4 A5 A6 A7 A8 A9A10 B0 B1 B2 B3 B4 B5 B6 B7 B8 B9 B10 C0 C1 C2C3 C4 C5 C6 C7 C8 ISO-Designated JIS B0 JIS B1 JIS B2 JIS B3 JIS B4 JIS B5 JIS B6 JIS B7 JIS B8 JIS B9 JIS B10 NA-Letter NA-Legal B4-Envelope B5-Envelope C3-Envelope C4-Envelope C5-Envelope C6-Envelope Designated-Long-Envelope Monarch-Envelope Executive Folio Invoice Ledger Quarto PaperTypesAvailable * �
� . '. 4. string Description An array of free-form strings specifying the types of paper that are currently available on the Printer. Each string should be expressed in the form specified by ISO/IEC 10175 Document Printing Application (DPA) which is also summarized in Appendix C of RFC 1759 (Printer MIB). Examples of valid strings are "iso-a4-colored" and "na-10x14-envelope". By definition a paper size that is available and listed in PaperTypesAvailable should also appear in the PaperSizesSupported property. PrinterStatus + � +
� b0 j0 w0 31 ;1 uint16 Description Status information for a Printer, beyond that specified in the LogicalDevice Availability property. Values include "Idle" (3) and an indication that the Device is currently printing (4). Values [1 b1 k1 q1 {1 �1 �1 Other Unknown Idle Printing Warmup Stopped Printing Offline TimeOfLastReset e , �
� �1 �1 �1 datetime Description Time of last reset of the Printer Device. VerticalResolution - � +
� j2 r2 2 �2 �2 uint32 Description Printer's vertical resolution in pixels per inch. Units pixels per inch � � boolean Description Boolean indicating that the power supply is a switching (vs. linear) supply. Range1InputFrequencyHigh 2 +
� a i v � � uint32 Description The frequency (in hertz) at the high end of this powersupply's input frequency range 1. A value of zero implies DC. Units hertz Range1InputFrequencyLow 6 +
� K S ` � � uint32 Description The frequency (in hertz) at the low end of this powersupply's input frequency range 1. A value of zero implies DC. Units hertz Range1InputVoltageHigh : +
� 3 ; H � � uint32 Description The high voltage of input voltage range 1 for this power supply, in millivolts. A value of 0 denotes 'unknown'. Units millivolts Range1InputVoltageLow > +
� $ 1 � � uint32 Description The low voltage of input voltage range 1 for this power supply, in millivolts. A value of 0 denotes 'unknown'. Units millivolts Range2InputFrequencyHigh B +
� � � uint32 Description The frequency (in hertz) at the high end of this powersupply's input frequency range 2. A value of zero implies DC. Units hertz Range2InputFrequencyLow F +
� � � z � uint32 Description The frequency (in hertz) at the low end of this powersupply's input frequency range 2. A value of zero implies DC. Units hertz Range2InputVoltageHigh J +
� � � � _ f uint32 Description The high voltage of input voltage range 2 for this power supply, in millivolts. A value of 0 denotes 'unknown'. Units millivolts Range2InputVoltageLow N +
� � � � G
N
uint32 Description The low voltage of input voltage range 2 for this power supply, in millivolts. A value of 0 denotes 'unknown'. Units millivolts TotalOutputPower R +
� �
�
�
uint32 Description Represents the total output power of the power supply in milliwatts. 0 denotes 'unknown'. Units milliwatts TypeOfRangeSwitching V +
� w � , 4 uint16 Description TypeOfRangeSwitching describes the kind of input voltage range switching implemented in this power supply. For example, Autoswitch can be specified (value=4). Values P W ` h t � Other Unknown Manual Autoswitch Wide Range Not Applicable � minutes � minutes � � � ��C � { 5�� k ��mf � ��m h -7�|s R �R��� n ѣ��3 L * X e S q l P k g _ h a d r _ d a t a b a s e _ f l o w _ c o n t r o l _ a c t i o n /Y��7 � / 4 XeSqlPkg_hadr_database_flow_control_action , ) � ��# . < H � v � > S � � � � - � � WU���������������������������������������������& � hadr_database_flow_control_action EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid availability_group_id
6
� M Z � ��e p object:guid WmiDataId Extension Guid control_action P
� � � � ��� n
$ uint32 WmiDataId XEMapId ValueMap 1 0 Values 0 9 Cleared Set database_replica_id
( 6
� � � � ��� � object:guid WmiDataId Extension Guid duration )
� � �� uint64 WmiDataId FragmentId 6
� d l w � � �� uint32 WmiDataId Description FragmentId local_availability_replica_id
$ 6
� � � �� object:guid WmiDataId Extension Guid RemainingLength 6
� q y � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � �� uint32 WmiDataId Description SequenceNumber � X e S q l P k g 0Y��7 �C XeSqlPkg
C � ��& 3 j p � � � � c����� � XeSqlPkg_hadr_log_block_group_commit Description Indicates log block group commit processing duration. Guid {3AA433C6-FBA0-455C-8914-54FDCC582539} locale MS\0x409 DisplayName hadr_log_block_group_commit �$ X e S q l P k g _ h a d r _ l o g _ b l o c k _ g r o u p _ c o m m i t 1Y��7 �E ? . XeSqlPkg_hadr_log_block_group_commit & ) � �� (
6 B � � � R ^ � � & 7 � � � � � WU������������������������������������������������������������J � hadr_log_block_group_commit EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid commit_policy
8 P
� Y a
� ��l � u � � uint32 WmiDataId XEMapId ValueMap � � � � � 4 1 0 3 2 Values � � � � � ArrayLast Delay DoNothing KillAll WaitForHarden database_id , )
� ? G � �� uint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId log_block_id 0 )
� � �� uint64 WmiDataId processing_time )
� n v � �� uint64 WmiDataId RemainingLength 6
� � � � � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� [ c n { � �� uint32 WmiDataId Description SequenceNumber start_timestamp $ )
� � � � �� uint64 WmiDataId throttle_start_timestamp )
� 7 ? � �� uint64 WmiDataId � X e S q l P k g 2Y��7 �@ XeSqlPkg
C � ��% 2 h n � � � � c����� � XeSqlPkg_hadr_log_block_compression Description Indicates log block compression processing duration. Guid {5EFB8CE9-E0B1-402D-9676-226A70BB01B6} locale MS\0x409 DisplayName hadr_log_block_compression �# X e S q l P k g _ h a d r _ l o g _ b l o c k _ c o m p r e s s i o n 3Y��7 �� I - XeSqlPkg_hadr_log_block_compression % ) � �� '
5 A � q � � � 8 E � � c q � � ' � � 1 { � WUU����������������������������������������������������������������������� � hadr_log_block_compression EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid availability_replica_id
A 6
� H U
� ��` k object:guid WmiDataId Extension Guid compressed_size
1 )
� � �
� �� uint32 WmiDataId compression_cache_insertion_time 9 )
� % - � �� uint64 WmiDataId database_id $ )
� | � � �� uint32 WmiDataId FragmentId 6
� � � � � � �� uint32 WmiDataId Description FragmentId is_compressed 0 )
� Q X � �� sint8 WmiDataId log_block_id ( )
� � � � �� uint64 WmiDataId processing_time )
� � �� uint64 WmiDataId RemainingLength 6
� k s ~ � � �� uint32 WmiDataId Description RemainingLength SequenceNumber 6
� � � � �� uint32 WmiDataId Description SequenceNumber start_timestamp )
� h p � �� uint64 WmiDataId uncompressed_size 5 )
� � � � �� uint32 WmiDataId � X e S q l P k g 4Y��7 �F XeSqlPkg
C � ��' 4 l r � � � � c����� � XeSqlPkg_hadr_log_block_decompression Description Indicates log block decompression processing duration. Guid {46C43284-1235-405F-A0CB-7F1E2D79DCF9} locale MS\0x409 DisplayName hadr_log_block_decompression �# X e S q l P k g _ h a d r _ d b _ m a n a g e r _ d b _ s t a r t d b GY��7 �� + - XeSqlPkg_hadr_db_manager_db_startdb % ) � �� ' 5 A � � h u � � ; E � � � � � � WU����������������������������������������� � hadr_db_manager_db_startdb EventType EventVersion ActivityId
N
� � � � � � �� � ��� � object:guid WmiDataId Description ActivityId ActivityID Extension Guid ag_database_id
$ 6
� ? L � ��W b object:guid WmiDataId Extension Guid database_id )
� � � � �� uint32 WmiDataId FragmentId 6
� " / � �� uint32 WmiDataId Description FragmentId group_id
6
� � � � ��� � object:guid WmiDataId Extension Guid log_accept P
� $ � ��/ y 8 B [ c uint32 WmiDataId XEMapId ValueMap R U X 0 2 1 Values s | � Disable Enable Suspend RemainingLength 6
� � � � � �� uint32 WmiDataId Description RemainingLength replica_id
6
� c p � ��{ � object:guid WmiDataId Extension Guid SequenceNumber 6
� � � � � �� uint32 WmiDataId Description SequenceNumber �_set � �� sint32 WmiDataId � ofResourceName] ��COp � b�X�6 ��[@; : �r�lu > L�u��
� bT�u � �˝��C��
) $ � ��� � � � � w �������������G � Win32_ProtocolBinding Description The Win32_ProtocolBinding class represents an association among a system level driver, network protocol, and network adapter. AMENDMENT LOCALE Antecedent f )
� � � �� ! ref:Win32_NetworkProtocol Description The Antecedent reference represents the network protocol that is used with the system driver and on the network adapter. Dependent f
� � � � ref:Win32_SystemDriver Description The Dependent reference represents the system driver that uses the network adapter through the network protocol of this class. Device f )
� � � ��� � ref:Win32_NetworkAdapter Description The Device reference represents the properties of the network adapter being used on the computer system. � W i n 3 2 _ D e v i c e S e t t i n g s �˝��C�� Win32_DeviceSettings ) * � ��� � � � � ���������P � Win32_NetworkAdapterSetting Description The Win32_NetworkAdapterSetting class represents an association between a network adapter and its configuration settings. AMENDMENT LOCALE Element f@
� � ref:Win32_NetworkAdapter Description The Element reference represents the properties of anetwork adapter that is using a particular network adapter setting. Setting f@
� � � � ref:Win32_NetworkAdapterConfiguration Description The Setting reference represents the configuration settings used on the network adapter. 32 � C I M _ C o n t r o l l e r �tR|�C� = CIM_Controller ) % ` ��k �������������������������������������������������������������s � CIM_InfraredController Description Capabilities and management of an CIM_InfraredController. AMENDMENT LOCALE � C I M _ U S B C o n t r o l l e r �tR|�C� A CIM_USBController ) " � ��� � � �����������������������������������������������������������������b � Win32_USBController Description The Win32_USBController class manages the capabilities of a Universal Serial Bus (USB) controller. AMENDMENT LOCALE DeviceID @ )
� � � � � �� string Description The DeviceID property contains a string uniquely identifying the USB controller from other devices on the system. � C I M _ L o g i c a l E l e m e n t �tR|�C�� 6 CIM_LogicalElement ) & � ���
� � � � I Z c s � � � � V \ z � �
�
� � 4
@
�
�
� � UUU���������������������������������������������������� � Win32_NetworkConnection Description The Win32_NetworkConnection class represents an active network connection in a Win32 environment. AMENDMENT LOCALE AccessMask +
� � � � � � uint32 BitValues 0 j � � � � , K a x � � � � FILE_READ_DATA (file) or FILE_LIST_DIRECTORY (directory) FILE_WRITE_DATA (file) or FILE_ADD_FILE (directory) FILE_APPEND_DATA (file) or FILE_ADD_SUBDIRECTORY (directory) FILE_READ_EA FILE_WRITE_EA FILE_EXECUTE (file) or FILE_TRAVERSE (directory) FILE_DELETE_CHILD (directory) FILE_READ_ATTRIBUTES FILE_WRITE_ATTRIBUTES DELETE READ_CONTROL WRITE_DAC WRITE_OWNER SYNCHRONIZE Description The AccessMask property is a bit array representing the access rights as set remotely on the network share held by the user or group on whose behalf the instance is returned. This property is only supported under Windows NT and Windows 2000. Comment
� � � � string Description The Comment property contains a comment supplied by the network provider. ConnectionState +
� � � � � string Description The ConnectionState property indicates the current state of the network connection. Values ! , 3 ; I U Connected Error Paused Disconnected Connecting Reconnecting ConnectionType +
� � � � G O string Description The ConnectionType property indicates the persistence type of the connection used for connecting to the network.
Example: Permanent. Values [ o Current Connection Persistent Connection DisplayType +
� � � � h p string Description The DisplayType property indicates how the network object should be displayed in a network browsing user interface.
Example: Generic. Values � � � � Domain Generic Server Share LocalName
� � � � string Description The LocalName property indicates the local name of the connected network device.
Example: c:\public. Name )
� � � � � �� string Description The Name property indicates the name of the current network connection. It is the combination of the value in the RemoteName property and the value in the LocalName property.
Example: \\NTRELEASE (c:\public). Persistent
� � � � boolean Description The Persistent property determines whether this connection will be reconnected automatically by the operating system on the next logon.
Values: TRUE or FALSE. A value of TRUE indicates the network connection will be automatically connected. ProviderName
� �
�
string Description The ProviderName property contains the name of the provider that owns the resource. This property can be NULL if the provider name is unknown. RemoteName "
� � � � string Description The RemoteName property contains the remote network resource name for a network resource. For a current or persistent connection, RemoteName contains the network name associated with the name of the value in the LocalName property. The name in RemoteName must follow the network provider's naming conventions.
Example: \\NTRELEASE. RemotePath
&
� l
t
�
string Description The RemotePath property contains the full path to the network resource.
Example: \\infosrv1\public ResourceType * +
� , 4 A � � string Description The ResourceType property identifies the type of resource to enumerate or connect to. Values � � � Disk Print Any UserName .
� �
string Description The UserName property contains the user name or the default user name used to establish a network connection.
Example: SYSTEM. � C I M _ L o g i c a l E l e m e n t �tR|�C�� CIM_LogicalElement ) " Q ��\ d r G M 5�������� � Win32_NetworkClient Description The Win32_NetworkClient class represents a network client on a Win32 system. Any computer system on the network with a client relationship to the system is a descendent (or member) of this class.
Example: A computer running Windows 2000 workstation or Windows 98 that is part of a Windows 2000 domain. AMENDMENT LOCALE Manufacturer
� � � � string Description The Manufacturer property indicates the name of the manufacturer of the network client running on the Win32 system.
Example: Microsoft Corporation Name )
� � � � � �� string Description The Name property identifies the network name of thenetwork client running on a Win32 system.
Example: Microsoft Windows Network in �TEM. �tem. � LOCALE � LOCALE � � 32 � � � � � �]0�� �
o��� � R �� � @%�PR
p /GT�� K �ҫ
��٥ 6 �'C�Q H -P�u� M ķ��� }q��� �c \� 1i.� �^�4 �
E v e n t T r a c e Bݝ��C��
EventTrace 6 � �� 3 9 a i s z � � u��������J
� KmdfTraceGuid Description KMDFv1 Trace Provider guid {544d4c9d-942c-46d5-bf50-df5cd9524a50} locale MS\0x409 Flags R
� � � � � $ � � f p uint32 Description Enable Flags ValueDescriptions h z � � � � � � # 5 I Z j � � � � � � � TRACINGFULL Flag TRACINGERROR Flag TRACINGDBGPRINT Flag TRACINGFRAMEWORKS Flag TRACINGAPI Flag TRACINGAPIERROR Flag TRACINGRESOURCES Flag TRACINGLOCKING Flag TRACINGCONTEXT Flag TRACINGPOOL Flag TRACINGHANDLE Flag TRACINGPNP Flag TRACINGIO Flag TRACINGIOTARGET Flag TRACINGDMA Flag TRACINGREQUEST Flag TRACINGDRIVER Flag TRACINGDEVICE Flag TRACINGUSEROBJECT Flag TRACINGOBJECT Flag TRACINGPNPPOWERSTATES Flag DefineValues | � � � � � � � �
& 2 = N Z j y � � � TRACINGFULL TRACINGERROR TRACINGDBGPRINT TRACINGFRAMEWORKS TRACINGAPI TRACINGAPIERROR TRACINGRESOURCES TRACINGLOCKING TRACINGCONTEXT TRACINGPOOL TRACINGHANDLE TRACINGPNP TRACINGIO TRACINGIOTARGET TRACINGDMA TRACINGREQUEST TRACINGDRIVER TRACINGDEVICE TRACINGUSEROBJECT TRACINGOBJECT TRACINGPNPPOWERSTATES Values ! . < M ` l } � � � � � � � � � - @ O TRACINGFULL TRACINGERROR TRACINGDBGPRINT TRACINGFRAMEWORKS TRACINGAPI TRACINGAPIERROR TRACINGRESOURCES TRACINGLOCKING TRACINGCONTEXT TRACINGPOOL TRACINGHANDLE TRACINGPNP TRACINGIO TRACINGIOTARGET TRACINGDMA TRACINGREQUEST TRACINGDRIVER TRACINGDEVICE TRACINGUSEROBJECT TRACINGOBJECT TRACINGPNPPOWERSTATES ValueMap � � � � � ( 4 @ L X d p | � � � � � 0x00000001 0x00000002 0x00000004 0x00000008 0x00000010 0x00000020 0x00000040 0x00000080 0x00000100 0x00000200 0x00000400 0x00000800 0x00001000 0x00002000 0x00004000 0x00008000 0x00010000 0x00020000 0x00040000 0x00080000 0x00100000 Level _
� 8 @ M U h ' 5 � � �
8
C
uint32 Description Levels ValueDescriptions � � � � � Abnormal exit or termination Severe errors that need logging Warnings such as allocation failure Includes non-error cases Detailed traces from intermediate steps DefineValues I \ o � TRACE_LEVEL_FATAL TRACE_LEVEL_ERROR TRACE_LEVEL_WARNINGTRACE_LEVEL_INFORMATION TRACE_LEVEL_VERBOSE Values � � � � � Fatal Error Warning Information Verbose ValueMap
$
)
.
3
0x1 0x2 0x3 0x4 0x5 ValueType index @ �6 4 6 5 9 A B 9 F 8 F 1 C 4 B 5 6 8 D B 6 4 3 8 B A E 1 1 B 2 6 E E 8 F 9 3 C B 5 F 8 1 9 5 E 2 1 E 8 C 3 8 3 D 6 C 4 4 C C 4 1 Cݝ��C�ȝ��C�0
� __NAMESPACE PS_MMAgent F D 1 C 1 D 4 1 4 B 7 1 B 5 0 8 2 C 2 6 6 A 6 5 0 E 3 1 E F 6 D 5 0 1 9 3 8 2 7 2 4 2 4 4 B 6 8 5 F 2 1 7 C 0 A A E 0 0 A 9 2 1 Dݝ��C�Cȝ��C�$ � __SystemSecurity 4 1 C 5 3 E 6 D B 1 A C F 2 4 5 3 C E F D 4 1 3 9 8 1 9 8 E 6 1 3 F 1 0 D F F 4 7 7 0 9 E C A B 1 D 7 F 0 3 7 7 5 6 A C 8 C E 7 Fݝ��C�ȝ��C�� � � __thisNAMESPACE � �� � � ? 5 7 E 5 F 3 A D D 9 E 2 4 2 C 4 E 9 F 9 E D F 7 9 A A 9 7 F 7 9 E 7 9 1 1 C 5 A 8 B 9 0 2 E C 1 5 0 D 6 4 4 2 E 3 B 8 5 A 5 A A Gݝ��C�ȝ��C�� �����M @ 9 Y � __Win32Provider {382AC1B5-9C16-4CCD-9D00-D5053977B8D6} NetworkServiceHost PS_MMAgent 7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D Hݝ��C�
ȝ��C�~ g � __MethodProviderRegistration \\.\Root\Microsoft\Windows\PS_MMAgent:__Win32Provider.Name="PS_MMAgent" ! R O O T \ M i c r o s o f t \ W i n d o w s \ P S _ M M A g e n t _ _ M e t h o d P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ 7 1 0 0 C 6 4 2 3 C 4 0 6 2 2 0 9 8 A F C C 4 A D 8 0 8 7 F 3 E C E F A C 6 2 1 A C F C 3 A 5 D 9 4 9 0 E 7 4 0 D C 7 9 9 8 9 B \ K I _ 7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D \ I _ C 7 B E D 1 C C C 8 E 3 2 7 9 B 7 0 E 4 8 4 6 D 9 1 5 4 B A 6 3 0 0 3 D 9 E 2 2 7 A E 1 4 E 0 5 9 0 4 9 2 F 8 6 5 3 5 6 B D 9 4 ) . , Iݝ��C�0 9 l � � � � C Q � � U���������������� � MMAgentComponents locale ApplicationLaunchPrefetching
� c � �� boolean ApplicationPreLaunch
� � � �� boolean MaxOperationAPIFiles
� � � �� uint32 MemoryCompression
� : � �� boolean OperationAPI
� { � �� boolean PageCombining
� � � �� boolean �5 7 E 5 F 3 A D D 9 E 2 4 2 C 4 E 9 F 9 E D F 7 9 A A 9 7 F 7 9 E 7 9 1 1 C 5 A 8 B 9 0 2 E C 1 5 0 D 6 4 4 2 E 3 B 8 5 A 5 A A Kݝ��C�ȝ��C�� �����M @ 9 [ � __Win32Provider {2F86B8BD-EFF5-4C07-8FA5-60788517EF95} NetworkServiceHost MSFT_Printer 7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D Lݝ��C�
ȝ��C�q Z � __MethodProviderRegistration \\.\root\StandardCimV2:__Win32Provider.Name="MSFT_Printer" R O O T \ S t a n d a r d C i m V 2 _ _ M e t h o d P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ B 5 E C 8 A D F 9 6 E 5 E 6 0 6 4 A D 9 E B 0 B 1 3 7 0 F D B D 6 6 4 E 0 B 0 E 7 8 0 2 B 6 A 2 A 5 7 9 6 B 5 F A F 2 2 A F E E \ K I _ 7 1 1 4 0 C C D 6 6 E D C 2 0 B 9 C 2 C D F 5 2 F 3 C 8 3 7 3 A C A 9 F 9 6 6 D 8 0 A 4 3 A D 6 9 8 A 5 B F C D F 5 1 5 4 9 D D \ I _ 7 E 6 A 0 0 A A B 8 4 6 7 A 7 1 2 9 2 5 8 A 0 8 7 A 1 6 8 D E 7 0 4 4 2 F 1 9 6 8 0 0 1 F D E 8 C 2 8 6 5 3 B 8 4 A 0 C 1 8 4 9 E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C Mݝ��C� ȝ��C�� � �������� \ � __InstanceProviderRegistration \\.\root\StandardCimV2:__Win32Provider.Name="MSFT_Printer" R O O T \ S t a n d a r d C i m V 2 _ _ I n s t a n c e P r o v i d e r R e g i s t r a t i o n p r o v i d e r � N S _ B 5 E C 8 A D F 9 6 E 5 E 6 0 6 4 A D 9 E B 0 B 1 3 7 0 F D B D 6 6 4 E 0 B 0 E 7 8 0 2 B 6 A 2 A 5 7 9 6 B 5 F A F 2 2 A F E E \ K I _ E 0 8 3 3 7 6 F F 2 F 9 C 4 C 5 2 3 A 9 8 8 C 9 2 5 3 1 F 9 1 8 8 F 5 D 2 7 6 4 1 6 6 B D D D E 0 1 3 F 2 4 C C 5 8 9 9 E 8 5 C \ I _ 7 E 6 A 0 0 A A B 8 4 6 7 A 7 1 2 9 2 5 8 A 0 8 7 A 1 6 8 D E 7 0 4 4 2 F 1 9 6 8 0 0 1 F D E 8 C 2 8 6 5 3 B 8 4 A 0 C 1 8 4 9 � C I M _ C o n t r o l l e r �tR|�C�� = CIM_Controller ) ��% �������������������������������������������������������������- � CIM_PCIController Description PCIController is a superclass for the PCIBridge and PCIDevice classes. These classes model adapters and bridges on a PCI bus. The properties in PCIController and its subclasses are defined in the various PCI Specifications published by the PCI SIG. AMENDMENT LOCALE � LOCALE � � @'2
@ w�^�Z � NC�T / C I M _ S e t t i n g �˝��C�� @ CIM_Setting
) ) * ��5 = I � �
� � w � q � � � � � � � � � & z � UU������������������������������������������������������������� � Win32_DisplayConfiguration Description The Win32_DisplayConfiguration class represents configuration information for the display device on a Win32 system. This class is being deprecated in favor of the properties in Win32_VideoController, Win32_DesktopMonitor, and CIM_VideoControllerResolution AMENDMENT LOCALE BitsPerPel
� u } � uint32 Description The BitsPerPel property indicates the number of bits used to represent the color in this configuration (the bits per pixel).
Example: 8.
This property has been deprecated in favor of a corresponding property(s) contained in the Win32_VideoController, Win32_DesktopMonitor and//or CIM_VideoControllerResolution DeviceName )
� � �� string Description The DeviceName property indicates the name of the display device.
This property has been deprecated in favor of a corresponding property(s) contained in the Win32_VideoController, Win32_DesktopMonitor and//or CIM_VideoControllerResolution DisplayFlags
� G O \ uint32 Description The DisplayFlags property indicates whether the display device is color (versus monochrome), and non-interlaced (versus interlaced). By masking its value with the DM_GRAYSCALE and DM_INTERLACED masks respectively, DisplayFlags indicates whether the display device is color (versus monochrome), and non-interlaced (versus interlaced). The DisplayFlags property contains two bits of information about the display.
This property has been deprecated in favor of a corresponding property(s) contained in the Win32_VideoController, Win32_DesktopMonitor and//or CIM_VideoControllerResolution DisplayFrequency +
� � � uint32 Units hertz Description The DisplayFrequency property indicates the display's vertical refresh rate. The refresh rate for a monitor is the number of times the screen is redrawn per second (frequency).
This property has been deprecated in favor of a corresponding property(s) contained in the Win32_VideoController, Win32_DesktopMonitor and//or CIM_VideoControllerResolution DitherType +
� � � � uint32 Description The DitherType property indicates the dither type of the display. This property can assume predefined values of 1 to 5, or driver-defined values from 6 to 256. Line art dithering is a special dithering method that produces well-defined borders between black, white, and gray scalings. It is not suitable for images that include continuous graduations in intensity and hue (such as scanned photographs).
This property has been deprecated in favor of a corresponding property(s) contained in the Win32_VideoController, Win32_DesktopMonitor and//or CIM_VideoControllerResolution Values 4 B P \ f No Dithering Coarse Brush Fine Brush Line Art Greyscale DriverVersion
� � � � string Description The DriverVersion property indicates the release version of the display driver.
This property has been deprecated in favor of a corresponding property(s) contained in the Win32_VideoController, Win32_DesktopMonitor and//or CIM_VideoControllerResolution ICMIntent $ +
�
H P uint32 Description The ICMIntent (Image Color Matching Intent) property indicates the value of one of the three possible color matching methods (intents) that should be used by default. This property is used primarily for non-ICM applications. ICM applications establish intents by using the ICM functions. This property can assume predefined values of 1 to 3, or driver-defined values from 4 to 256.
This property has been deprecated in favor of a corresponding property(s) contained in the Win32_VideoController, Win32_DesktopMonitor and//or CIM_VideoControllerResolution Values ` l v Saturation Contrast Exact Color ICMMethod
( +
� � � � � � uint32 Description The ICMMethod (Image Color Matching Method) property indicates how ICM is handled. For a non-ICM application, this property indicates if ICM is enabled or disabled. For ICM applications, the system examines this member to determine which part of the computer system handles ICM support.
This property has been deprecated in favor of a corresponding property(s) contained in the Win32_VideoController, Win32_DesktopMonitor and//or CIM_VideoControllerResolution Values � � � � Disabled Windows Device Driver Device LogPixels , +
� 5 = D L Y uint32 Units pixels Description The LogPixels property contains the number of pixels per logical inch. This property is valid only with devices that work with pixels (this excludes devices such as printers).
This property has been deprecated in favor of a corresponding property(s) contained in the Win32_VideoController, Win32_DesktopMonitor and//or CIM_VideoControllerResolution PelsHeight 0 +
� �
" uint32 Units pixels Description The PelsHeight property indicates the height of the displayable surface.
This property has been deprecated in favor of a corresponding property(s) contained in the Win32_VideoController, Win32_DesktopMonitor and//or CIM_VideoControllerResolution PelsWidth
4 +
� _ g n v � uint32 Units pixels Description The PelsWidth property indicates the width of the displayable surface.
This property has been deprecated in favor of a corresponding property(s) contained in the Win32_VideoController, Win32_DesktopMonitor and//or CIM_VideoControllerResolution SpecificationVersion 8
� � � � uint32 Description The SpecificationVersion property indicates the version number of the initialization data for the Win32 display device.
This property has been deprecated in favor of a corresponding property(s) contained in the Win32_VideoController, Win32_DesktopMonitor and//or CIM_VideoControllerResolution � C I M _ P C M C I A C o n t r o l l e r �tR|�C�� A CIM_PCMCIAController ) % � ��� � � ������������������������������������������������������������������ � Win32_PCMCIAController Description The Win32_PCMCIAController class manages the capabilities of a Personal Computer Memory Card Interface Adapter (PCMCIA of PC card) controller device. AMENDMENT LOCALE DeviceID @ )
� % � �� string Description The DeviceID property indicates the number that uniquely identifies this device with other peripherals using the Plug and Play BIOS. This property is derived from CIM_LogicalDevice. � C I M _ C o n t r o l l e r �tR|�C�� A CIM_Controller ) # � ��� � � � � �����������������������������������������������������������������T � Win32_1394Controller Description The Win32_1394Controller class represents the capabilities and management of a 1394 controller. IEEE 1394 is a specification for a high speed serial bus. AMENDMENT LOCALE DeviceID @ )
� ( � �� string Description The DeviceID property contains a string uniquely identifying the 1394 controller with other devices on the system. Manufacturer 8
� � � � string Description The Manufacturer property indicates the name of the manufacturer of the 1394 controller.
Example: Acme �lDevice. �le: Acme � � � �07B0D354CDC951 that is dependent on the Antecedent property of this class. � tt � NTEventLog WHERE LogfileName='#' Select * from Win32_NTEventlogFile l � T � A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 Y . � � � MSFT_CliVerb ClearEventlog ClearEventlog 6 � � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � ? ? G � MSFT_CliParam ArchiveFileName ( � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True STRING ClearEventlog W � A N u { � � � � ( / V ` U����������������������������� � MSFT_CliVerb Derivation
� 9 STRING Description
� m String Name
� � STRING Parameters
� � object:MSFT_CliParam Qualifiers
� object:MSFT_CliQualifier Usage
� N String VerbType
� uint32 \ 0 � � � MSFT_CliVerb BackupEventlog BackupEventlog 8 � � ? L s } � � � � U�����������������������F � MSFT_CliParam Default
� 7 STRING Description
� k String Optional
� � BOOLEAN ParaId
� � STRING Qualifiers
� � object:MSFT_CliQualifier Type
� > STRING � ? ? G � MSFT_CliParam ArchiveFileName ( � @ P ��������w � MSFT_CliQualifier Name
� 8 STRING QualifierValue
� o STRING e % � MSFT_CliQualifier In True STRING BackupEventlog gital, Intel, Xerox(DIX) Ethernet format. It will always receive both formats. The method returns an integer value of 0 on successful completion, and any other number to indicate an error. SetArpUseEtherSNAP � K � =�=$0 ' � ��W � C I M _ U S B C o n t r o l l e r H a s H u b 6̝��C�� ! CIM_USBControllerHasHub ) � �� � # + 7 � � ��������������������������������R � Win32_ControllerHasHub CIMWin32a Locale Antecedent f@ N
� � � � � �� � ��� � ref:Win32_USBController Min Max Override Antecedent Dependent f@ A
� & 8 � �� � ��= G ref:Win32_USBHub Min Override Dependent � C I M _ P C V i d e o C o n t r o l l e r �tR|�C�� � CIM_PCVideoController ) $ �� " 8 � � � � � � � � � � �
�
� � ; F y � f s ' 3 � � � � B ` � � � � � ���������UUUU������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������ � Win32_VideoController Description The Win32_VideoController class represents the capabilities and management capacity of the video controller on a Win32 computer system.
Examples: Video adapter manufacturer, chipset version, display resolution, and number of colors. AMENDMENT LOCALE AdapterCompatibility $ ~
� d l y string Description The AdapterCompatibility properties contains the general chip set used for this controller in order to compare compatibilities with the system AdapterDACType % �
� E M Z string Description The AdapterDACType property contains a string of the Digital-to-Analog converter (DAC) chip name or ID.
Character Set: Alphanumeric AdapterRAM & � +
� $ , 9 � � uint32 Description The AdapterRAM property indicates the memory size of the video adapter.
Example: 64000 Units bytes ColorTableEntries ' �
� � � � uint32 Description The ColorTableEntries property indicates the size of the system's color table, if the device has a color depth of no more than 8 bits per pixel, null otherwise. <P>Example: 256 CurrentRefreshRate @ X +
� � � � � uint32 Description The CurrentRefreshRate property specifies the frequency at which the video controller refreshes the image for the monitor. A value of 0 indicates the default rate is being used, while 0xFFFFFFFF indicates the optimal rate is being used. Units hertz DeviceID @ )
� E M Z � �� string Description The DeviceID property contains a identifier (unique to the computer system) for this video controller. DeviceSpecificPens ( �
�
uint32 Description The DeviceSpecificPens property indicates the current number of device-specific pens. 0xffff means the device does not support pens.
Example: 3 DitherType ) � +
� � � F
N
uint32 Description The DitherType property indicates the dither type of the video controller. The property can be one of the following predefined values, or a driver-defined value greater than or equal to 256: Value Meaning :-1 - No dithering. 2 - Dithering with a coarse brush. 3 - Dithering with a fine brush. 4 - Line art dithering; a special dithering method that produces well defined borders between black, white, and gray scalings. It is not suitable for images that include continuous graduations in intensity and hue such as scanned photographs. 5 - Device does grayscaling. Values f
t
�
�
�
No dithering Dithering with a coarse brush Dithering with a fine brush Line art dithering Device does gray scaling DriverDate e * �
� - datetime Description The DriverDate property indicates the last modification date and time of the currently-installed video driver. DriverVersion + �
� � � � string Description The DriverVersion property indicates the version number of the video driver. ICMIntent , � +
� � � > F uint32 Description The ICMIntent ( Image Color Matching Intent ) property indicates the specific value of one of the three possible color matching methods, (or intents) that should be used by default. This property is primarily for non-ICM applications. ICM applications establish intents by using the ICM functions. This property can be one of the following predefined values, or a driver defined value greater than or equal to 256.Value Meaning :-1 - Color matching should optimize for color saturation. This value is the most appropriate choice for business graphs when dithering is not desired. 2 - Color matching should optimize for color contrast. This value is the most appropriate choice for scanned or photographic images when dithering is desired. 3 - Color matching should optimize to match the exact color requested. This value is most appropriate for use with business logos or other images when an exact color match is required. Values V b l Saturation Contrast Exact Color ICMMethod - � +
� � � � uint32 Description The ICMMethod ( Image Color Matching Method ) property specifies how ICM is handled. For a non-ICM application, this property shows howICM is enabled. For ICM applications, the system examines this member to determine how to handle ICM support. This property can be one of the following predefined values, or a driver-defined value greater than or equal to 256.Value Meaning :-1 - Specifies that ICM is disabled. 2 - Specifies that ICM is handled by Windows. 3 - Specifies that ICM is handled by the device driver. 4 - Specifies that ICM is handled by the destination device. Values 0 : C R Disabled Windows Device Driver Destination Device InfFilename . �
� � � � string Description The InfFilename property indicates the path to the video adapter's .INF file.
Example: C:\WINNT\SYSTEM32\DRIVERS InfSection / �
� _ g t string Description The InfSection property indicates the section of the .INF file where the Win32 video information resides. InstalledDisplayDrivers 0 �
� $ , 9 string Description The InstalledDisplayDrivers property indicates the name of the installed display device driver. Monochrome 1 �
� � � � boolean Description The Monochrome property indicates whether gray scale or color is used to display images. ReservedSystemPaletteEntries 2 �
� � � � uint32 Description The ReservedSystemPaletteEntries property indicates the current number of reserved entries in a system's color table. The operating system may reserve entries to support standard colors for task bars and other desktop display items. If the system is not using a palette, then ReservedSystemPaletteEntries is null.<P>Example: 24. SpecificationVersion 3 �
� - 5 B uint32 Description The SpecificationVersion property indicates the version number of the initialization data specification (upon which the structure is based). SystemPaletteEntries 4 �
� ' uint32 Description The SystemPaletteEntries property indicates the current number of entries in a system's color table. If the system is not using a palette then SystemPaletteEntries is null.<P>Example: 256 VideoModeDescription 5 �
� & . ; string Description The VideoModeDescription property indicates the current resolution, color, and scan mode settings of the video controller.
Example: 1024 x 768 x 256 colors. � colors. � � Ya��0 � xј�� _ _ E x t e n d e d S t a t u s ͝��C�T __ExtendedStatus & N a � � ������������������������������ � Win32_PrivilegesStatus Locale UUID {BE46D060-7A7C-11d2-BC85-00104B2CF71C} PrivilegesNotHeld
� � � �� string PrivilegesRequired
� � � �� string � C I M _ S e r i a l C o n t r o l l e r �tR|�C�� � CIM_SerialController ) g ��r z � � � ! E W � � � � �
�
� � � � �
�
� � � � � � 2 ~ � � � � � � " = �
� �����UUUUU�����������������������������������������������������������������������������������������������������������������������< � Win32_SerialPort Description The Win32_SerialPort class represents a serial port on a Win32 system. AMENDMENT LOCALE Binary D
� � � � boolean Description The Binary property indicates whether the serial port is configured for binary data transfer. Since the Win32 API does not support non-binary mode transfers, this property must be TRUE. Specifying FALSE will not work. Values: TRUE or FALSE. A value of TRUE indicates the serial port is configured for binary data transfer. DeviceID @ )
� I Q ^ � �� string Description The DeviceID property contains a string uniquely identifying the serial port with other devices on the system. MaximumInputBufferSize F +
� ' 4 � uint32 Description The MaximumInputBufferSize property specifies the maximum size of the serial port driver's internal input buffer. A value of zero indicates that no maximum value is imposed by the serial provider. units bytes MaximumOutputBufferSize J +
� Z b o 7 > uint32 Description The MaximumOutputBufferSize property specifies the maximum size of the serial port driver's internal output buffer. A value of zero indicates that no maximum value is imposed by the serial provider. units bytes OSAutoDiscovered N
� � � � boolean Description The OSAutoDiscovered property distinguishes the instances of this class that were automatically discovered by the operating system. If, for example, hardware was added through the Control Panel, the operating system finds instances of this class by querying hardware from the instances of this class. A value of TRUE indicates that the instance was automatically discovered. ProviderType P +
� X ` m � � string Description The ProviderType property specifies the communications provider type. Values
� , ; N Z f r � � � FAX Device LAT Protocol Modem Device Network Bridge Parallel Port RS232 Serial Port RS422 Port RS423 Port RS449 Port Scanner Device TCP/IP TelNet X.25 Unspecified SettableBaudRate T
� � � � boolean Description The SettableBaudRate property indicates whether the baud rate can be changed for this serial port.
Values: TRUE or FALSE. A value of TRUE indicates the baud rate can be changed. SettableDataBits V
� � � � boolean Description The SettableDataBits property indicates whether data bits can be set for this serial port.
Values: TRUE or FALSE. A value of TRUE indicates the data bits can be set. SettableFlowControl X
� �
�
�
boolean Description The SettableFlowControl property indicates whether flow control can be set for this serial port.
Values: TRUE or FALSE. A value of TRUE indicates the flow control can be set. SettableParity Z
� � � boolean Description The SettableParity property indicates whether parity can be set for this serial port.
Values: TRUE or FALSE. A value of TRUE indicates the parity can be set. SettableParityCheck \
� � � � boolean Description The SettableParityCheck property indicates whether parity checking can be set for this serial port (if parity checking is supported).
Values: TRUE or FALSE. A value of TRUE indicates parity checking can be set. SettableRLSD ^
� boolean Description The SettableRLSD property indicates whether RLSD can be set for this serial port (if Received Line Signal Detect (RLSD) is supported).
Values: TRUE or FALSE. A value of TRUE indicates the RLSD can be set. SettableStopBits `
� ) 2 ? boolean Description The SettableStopBits property indicates whether stop bits can be set for this serial port.
Values: TRUE or FALSE. A value of TRUE indicates the stop bits can be set. Supports16BitMode b
� % . ; boolean Description The Supports16BitMode property indicates whether 16-bit mode is supported on this serial port.
Values: TRUE or FALSE. A value of TRUE indicates 16-bit mode is supported. SupportsDTRDSR ! d
� " + 8 boolean Description The SupportsDTRDSR property indicates whether Data Terminal Ready (DTR) and Data Set Ready (DSR) signals are supported on this serial port.
Values: TRUE or FALSE. A value of TRUE indicates DTR and DSR signals are supported. SupportsElapsedTimeouts " f
� ^ g t boolean Description The SupportsElapsedTimeouts property indicates whether elapsed timeouts are supported on this serial port. Elapsed timeouts track the total amount of time between data transmissions.
Values: TRUE or FALSE. A value of TRUE indicates elapsed timeouts are supported. SupportsIntTimeouts # h
� � � � boolean Description The SupportsIntTimeouts property indicates whether interval time-outs are supported. An interval timeout is the amount of time allowed to elapse between the arrival of each piece of data.
Values: TRUE or FALSE. A value of TRUE indicates interval timeouts are supported. SupportsParityCheck $ j
� % . ; boolean Description The SupportsParityCheck property indicates whether parity checking is supported on this serial port.
Values: TRUE or FALSE. A value of TRUE indicates parity checking is supported. SupportsRLSD % l
� * 3 @ boolean Description The SupportsRLSD property indicates whether Received Line Signal Detect (RLSD) is supported on this serial port.
Values: TRUE or FALSE. A value of TRUE indicates RLSD is supported. SupportsRTSCTS & n
� 2 ; H boolean Description The SupportsRTSCTS property indicates whether Ready To Send (RTS) and Clear To Send (CTS) signals are supported on this serial port.
Values: TRUE or FALSE. A value of TRUE indicates RTS and CTS signals are supported. SupportsSpecialCharacters ' p
� i r boolean Description The SupportsSpecialCharacters property indicates whether serial port control characters are supported. These characters signal events rather than data. These characters are not displayable and are set by the driver. They include EofChar, ErrorChar, BreakChar, EventChar, XonChar, and XoffChar.
Values: TRUE or FALSE. A value of TRUE indicates special characters are supported. SupportsXOnXOff ( r
� 6 ? L boolean Description The SupportsXOnXOff property indicates whether XON/XOFF flow control is supported on this serial port.
Values: TRUE or FALSE. A value of TRUE indicates XON/XOFF is supported. SupportsXOnXOffSet ) t
� < E R boolean Description The SupportsXOnXOffSet property indicates whether the communications provider supports configuration of the XON/XOFF flow control setting.
Values: TRUE or FALSE. A value of TRUE indicates XON/XOFF flow control setting is supported. �pported. � � the operating system �@�QP � �C� � ��N � � '�Ӥ� � F D 1 C 1 D 4 1 4 B 7 1 B 5 0 8 2 C 2 6 6 A 6 5 0 E 3 1 E F 6 D 5 0 1 9 3 8 2 7 2 4 2 4 4 B 6 8 5 F 2 1 7 C 0 A A E 0 0 A 9 2 1 �Ν��C�Cȝ��C�$ � __SystemSecurity
C I M _ M e m o r y �tR|�C�� � CIM_Memory ) " T ��_ g r � � ��������������������������������������������������������������������������������������������������������������������������������������������������� � CIM_VolatileStorage Description Capabilities and management of volatile storage. AMENDMENT LOCALE Cacheable ! �
� � � � boolean Description Indicates whether this memory can be cached or not. CacheType " � +
� - 5 B > F uint16 Description An enumeration indicating the cache type that is compatible with this memory. For example, 4 indicates write-through cache. If the Cacheable property is set to false, then this property does not have meaning and should be set to 5, "Not Applicable". Values ^ e n z � Other Unknown Write-Back Write-Through Not Applicable �
C I M _ M e m o r y �tR|�C�� � CIM_Memory ) % 9 ��D L Y �������������������������������������������������������������������������������������������������������������������������������������������������� � CIM_NonVolatileStorage Description Capabilities and management of NV Storage. Non-volatile memory natively includes flash and ROM storage. In addition, NV memory can be BasedOn VolatileStorage, if the volatile memory is backed by a Battery. This scenario would be completely described by an instance of the AssociatedBattery relationship, referencing the NonVolatileStorage as the Dependent and the Battery as the Antecedent, and an instance of the BasedOn relationship, referencing the NonVolatileStorage as the Dependent and the VolatileStorage as the Antecedent. AMENDMENT LOCALE IsWriteable ! �
� � � � boolean Description Indicating that the NV storage is writeable. � C I M _ S t o r a g e E x t e n t �tR|�C�� � CIM_StorageExtent ) Y ��d l � � � � � � � d r p { � � F
Q
) � � � � � � � � ����}UUU���������������������������������������������������������������������������������������������������������������������������������������, � CIM_Memory Description Capabilities and management of memory-related logical devices. AMENDMENT LOCALE AdditionalErrorData H
� � � � uint8 Description An array of octets holding additional error information. An example is ECC Syndrome or the return of the check bits if a CRC-based error methodology is used. In the latter case, if a single bit error is recognized and the CRC algorithm is known, it is possible to determine the exact bit that failed. This type of data (ECC Syndrome, Check Bit or Parity Bit data, or other vendor supplied information) is included in this field. If the ErrorInfo property is equal to 3, "OK", then the AdditionalErrorData property has no meaning. CorrectableError L
� ) boolean Description Boolean indicating that the most recent error was correctable. If the ErrorInfo property is equal to 3, "OK", then this property has no meaning. EndingAddress N +
� � � uint64 Description The ending address, referenced by an application or operating system and mapped by a memory controller, for this memory object. The ending address is specified in KBytes. Units kilobytes ErrorAccess V +
� $ 1 uint16 Description An integer enumeration indicating the memory access operation that caused the last error. The type of error is described by the ErrorInfo property. If the ErrorInfo property is equal to 3, "OK", then this property has no meaning. Values 8 ? H N U Other Unknown Read Write Partial Write ErrorAddress X
� � � � uint64 Description Specifies the address of the last memory error. The type of error is described by the ErrorInfo property. If the ErrorInfo property is equal to 3, "OK", then this property has no meaning. ErrorData `
� � � � uint8 Description Data captured during the last erroneous memory access. The data occupies the first n octets of the array necessary to hold the number of bits specified by the ErrorTransferSize property. If ErrorTransferSize is 0, then this property has no meaning. ErrorDataOrder d +
� � � � uint16 Description The ordering for data stored in the ErrorData property. "Least Significant Byte First" (value=1) or "Most Significant Byte First" (2) can be specified. If ErrorTransferSize is 0, then this property has no meaning. Values
)
Unknown Least Significant Byte First Most Significant Byte First ErrorInfo f +
� �
�
�
& uint16 Description An integer enumeration describing the type of error that occurred most recently. For example, single (value=6) or double bit errors (7) can be specified using this property. The values, 12-14, are undefined in the CIM Schema since in DMI, they mix the semantics of the type of error and whether it was correctable or not. The latter is indicated in the property, CorrectableError. Values b i r v � � � � � � � � �
Other Unknown OK Bad Read Parity Error Single-Bit Error Double-Bit Error Multi-Bit Error Nibble Error Checksum Error CRC Error Undefined Undefined Undefined ErrorMethodology @ 8
� K
S
`
string Description ErrorMethodology for CIM_Memory is a string property that indicates whether parity or CRC algorithms, ECC or other mechanisms are used. Details on the algorithm can also be supplied. ErrorResolution h +
� b j w � � uint64 Description Specifies the range, in bytes, to which the last error can be resolved. For example, if error addresses are resolved to bit 11 (i.e., on a typical page basis), then errors can be resolved to 4K boundaries and this property is set to 4000. If the ErrorInfo property is equal to 3, "OK", then this property has no meaning. Units bytes ErrorTime e p
� � datetime Description The time that the last memory error occurred. The type of error is described by the ErrorInfo property. If the ErrorInfo property is equal to 3, "OK", then this property has no meaning. ErrorTransferSize t +
� $ 1 � � uint32 Description The size of the data transfer in bits that caused the last error. 0 indicates no error. If the ErrorInfo property is equal to 3, "OK", then this property should be set to 0. Units bits OtherErrorDescription x
� 0 8 E string Description Free form string providing more information if the ErrorType property is set to 1, "Other". If not set to 1, this string has no meaning. StartingAddress | +
� ! . � � uint64 Description The beginning address, referenced by an application or operating system and mapped by a memory controller, for this memory object. The starting address is specified in KBytes. Units kilobytes SystemLevelAddress �
� 1 : G boolean Description Boolean indicating whether the address information in the property, ErrorAddress, is a system-level address (TRUE) or a physical address (FALSE). If the ErrorInfo property is equal to 3, "OK", then this property has no meaning. �iteable. �plicable �plicable � � � � scription )
� � � ��* � ID 6
� � � ��* � n boolean Location string
� � In
� � �� Specifies the location of the printer. Description )
� � ��X 0 ID 6
� � ��X 0 � string Name string
� In
� + �� Specifies the name of the printer to be added. Description )
� + ��� Y ID 6
� + ��� Y � string PermissionSDDL string
� ? In
� ? f �� Specifies the permissions for the printer as an SDDL string. Description )
� ? f ��� � ID 6
� ^
f ��� �
string PortName string
� �
In
� �
�
�� Specifies the name of the port used or created for the printer. Description )
� �
�
�� �
ID 6
� � �
�� �
\ string " PrintProcessor string "
� � In "
� � � �� Specifies the name of the print processor used by the printer. Description " )
� � � ��c # ID " 6
� � � ��c # � string
& Priority uint32
&
�
In
&
�
:
�� Specifies relative queue priority. Description
& )
�
:
���
h
ID
& 6
� :
���
h
�
uint32 * Published boolean *
� = In *
� = e �� Specifies whether to publish the printer in the AD. Description * )
� = e ��� � ID * 6
� T e ��� � boolean , RenderingMode uint32 ,
� ~ In ,
� ~ � �� Specifies the Rendering mode for the printer: SSR, CSR, or Branch Office Direct Printing. Description , )
� ~ � ��. � ID , 6
� � � ��. � r uint32
0 SeparatorPageFile string
0
� � In
0
� � �� Specifies the path to a file containing PDL for a separator page. Description
0 )
� � �� < ID
0 6
� �� < �
string 4 ComputerName string 4
� 3 In 4
� 3 Z �� Specifies the name of the computer that the printer will be added to. Description 4 )
� 3 Z ��� � ID 4 6
� [ Z ��� � string 8 ShareName string 8
� � In 8
� � � �� Specifies the share name for this printer. Description 8 )
� � � �� � ID 8 6
� � � �� � E string < Shared boolean <
� � In <
� � � �� Specifies whether this printer will be shared. Description < )
� � � ��5 ID < 6
� � � ��5 y boolean > StartTime uint32 >
� � In >
� � �� Specifies the earliest time at which the printer will print a job, expressed as minutes elapsed since 12:00 AM GMT (Greenwich Mean Time). Description > )
� � ��� < ID > 6
� S ��� < uint32 B DisableBranchOfficeLogging boolean B
� � In B
� � � �� Specifies whether Branch Office Remote Logging is disabled for this printer. Description B )
� � � ��- � ID B 6
� � � ��- � q boolean D BranchOfficeOfflineLogSizeMB uint32 D
� � In D
� � �� Specifies the maximum size (in MB) of the Branch Office Remote Offline Logging file for this printer. Description D )
� � ��� G ID D 6
� : ��� G � uint32 H WorkflowPolicy uint32 H
� d In H
� d � �� Specifies the workflow application policy for the printer: Uninitialized, Disabled, or Enabled. Description H )
� d � �� � ID H 6
� � � �� � ^ uint32 g>�ƀ . T8� �Y� � � ��˞h
{���� � k�n ��E� p ���C� �� * 4 s � %��������� � RSOP_IELinkItemLink Locale Association linkItem f
� ^ � �� ref:RSOP_IELinkItem policySetting f
� � � �� ref:RSOP_IEAKPolicySetting �
C I M _ C o n t a i n e r �ʝ��C�� CIM_Container ) � ��� � j � � � u����������������P � CIM_CardOnCard Description Cards may be plugged into motherboards/baseboards, are daughtercards of an adapter, or support special card-like modules. These relationships are described by the CIM_CardOnCard association. AMENDMENT LOCALE GroupComponent f@
� , : G ref:CIM_Card Description The card that hosts another card. MountOrSlotDescription
� � � � string Description A string describing and identifying how the card is mounted on or plugged into the 'other' card. slot information could be included in this field and may be sufficient for certain management purposes. If so, this avoids creating instantiations of connector/slot objects just to model the relationship of cards to hosting boards or other adapters. On the other hand, if slot and connector information is available, this field could be used to provide more detailed mounting or slot insertion data. PartComponent f@
� � � ref:CIM_Card Description The card that is plugged into or otherwise mounted on another card.
�
C I M _ C o n t a i n e r �ʝ��C��
CIM_Container ) $ � ��� � � x � ������������� � CIM_PackagedComponent Description A component is typically contained by a physical package, such as a chassis or card. The CIM_PackagedComponent association makes this relationship explicit. In the first sentence, the word, 'typically', is used. This is because a component may be removed from, or not yet inserted into, its containing package (i.e., the Removable boolean property is TRUE). Therefore, a component may not always be associated with a container. AMENDMENT LOCALE GroupComponent f@
� 9 F ref:CIM_PhysicalPackage Description The physical package that contains component(s). PartComponent f@
� � � � ref:CIM_PhysicalComponent Description The physical component which is contained in the package. � C I M _ C h i p -tR|�C�� R CIM_Chip
) ! � ��� � � o y , n z �
: A � � ���_U����������������������������������������������������������������������������� � CIM_PhysicalMemory Description CIM_PhysicalMemory is a subclass of CIM_Chip, representing low level memory devices - SIMMS, DIMMs, raw memory chips, etc. AMENDMENT LOCALE BankLabel .
� � � � string Description A string identifying the physically labeled bank where the memory is located - for example, 'Bank 0' or 'Bank A'. Capacity 2 +
� � � � � uint64 Description The total capacity of this physical memory, in bytes. Units bytes DataWidth : +
� P X e uint16 Description Data width of the physical memory, in bits. A data width of 0 and a total width of 8 would indicate that the memory is solely used to provide error correction bits. Units bits InterleavePosition <
� X ` m uint32 Description The position of this physical memory in an interleave. 0 indicates non-interleaved. 1 indicates the first position, 2 the second position and so on. For example, in a 2:1 interleave, a value of '1' would indicate that the memory is in the 'even' position. MemoryType @ +
� � � � � � uint16 Description The type of physical memory. Values N W ^ d v � � � � � � � � � � � � � � � � � � Unknown Other DRAM Synchronous DRAM Cache DRAM EDO EDRAM VRAM SRAM RAM ROM Flash EEPROM FEPROM EPROM CDRAM 3DRAM SDRAM SGRAM RDRAM DDR DDR2 DDR2 FB-DIMM PositionInRow B
� 9 A N uint32 Description Specifies the position of the physical memory in a 'row'. For example, if it takes two 8-bit memory devices to form a 16-bit row, then a value of '2'means that this memory is the second device. 0 is an invalid value for this property. Speed F +
� z � � � � uint32 Description The speed of the physical memory, in nanoseconds. Units nanoseconds TotalWidth J +
� # 0
uint16 Description Total width, in bits, of the physical memory, including check or error correction bits. If there are no error correction bits, the value in this property should match that specified for the DataWidth property. Units bits � C I M _ P h y s i c a l E l e m e n t 0tR|�C�� 0 CIM_PhysicalElement ) $ � ��� � � V a [ h ��_��������������������������������������������� � CIM_PhysicalComponent Description The CIM_PhysicalComponent class represents any low-level or basic component within a package. Any physical element that is not a link, connector, or package is a descendent (or member) of this class. For example, the UART chipset on an internal modem card would be a subclass (if additional properties or associations are defined) or an instance of CIM_PhysicalComponent. AMENDMENT LOCALE HotSwappable
&
� � � � boolean Description A physical component can be hot swapped if it is possible to replace the element with a physically different but equivalent one while the containing package has power applied to it (i.e., is 'on'). For example, a fan component may be designed to be hot swapped. All components that can be hot swapped are inherently removable and replaceable . Removable (
� � � � boolean Description A physical component is removable if it is designed to be taken in and out of the physical container in which it is normally found, without impairing the function of the overall packaging. A component can still be removable if power must be 'off' in order to perform the removal. If power can be 'on' and the component removed, then the element is removable and can be hot swapped. For example, an upgradeable processor chip is removable. Replaceable *
� � � � boolean Description A physical component is replaceable if it is possible to replace (FRU or upgrade) the element with a physically different one. For example, some computer systems allow the main processor chip to be upgraded to one of a higher clock rating. In this case, the processor is said to be replaceable . All removable components are inherently replaceable . � C I M _ S o f t w a r e E l e m e n t �tR|�C�� 2 CIM_SoftwareElement ) � ��� � � ��������������������������������������������������M � CIM_BIOSElement Description CIM_BIOSElement represents the low-level software that is loaded into non-volatile storage and used to bring up and configure a computer system. AMENDMENT LOCALE PrimaryBIOS ,
� � boolean Description If true, this is the primary BIOS of the computer system. �4 1 C 5 3 E 6 D B 1 A C F 2 4 5 3 C E F D 4 1 3 9 8 1 9 8 E 6 1 3 F 1 0 D F F 4 7 7 0 9 E C A B 1 D 7 F 0 3 7 7 5 6 A C 8 C E 7 vR|�C�ȝ��C�� � � __thisNAMESPACE � �� � � ? �7 vR|�C��7 8 6 ) ! ��, 4 < K � � � � � � + 6 � �
� � O g � � L! Z! �" �" �' �' {5 �5 6 *6 UUU�����������������������������������������������������6 � CIM_Error Version 2.22.1 Description CIM_Error is a specialized class that contains information about the severity, cause, recommended actions and other data related to the failure of a CIM Operation. Instances of this type MAY be included as part of the response to a CIM Operation. AMENDMENT LOCALE MS_409 CIMStatusCode
, +
� � � � � � uint32 Description The CIM status code that characterizes this instance.
This property defines the status codes that MAY be return by a conforming CIM Server or Listener. Note that not all status codes are valid for each operation. The specification for each operation SHOULD define the status codes that may be returned by that operation.
The following values for CIM status code are defined:
1 - CIM_ERR_FAILED. A general error occurred that is not covered by a more specific error code.
2 - CIM_ERR_ACCESS_DENIED. Access to a CIM resource was not available to the client.
3 - CIM_ERR_INVALID_NAMESPACE. The target namespace does not exist.
4 - CIM_ERR_INVALID_PARAMETER. One or more parameter values passed to the method were invalid.
5 - CIM_ERR_INVALID_CLASS. The specified Class does not exist.
6 - CIM_ERR_NOT_FOUND. The requested object could not be found.
7 - CIM_ERR_NOT_SUPPORTED. The requested operation is not supported.
8 - CIM_ERR_CLASS_HAS_CHILDREN. Operation cannot be carried out on this class since it has instances.
9 - CIM_ERR_CLASS_HAS_INSTANCES. Operation cannot be carried out on this class since it has instances.
10 - CIM_ERR_INVALID_SUPERCLASS. Operation cannot be carried out since the specified superclass does not exist.
11 - CIM_ERR_ALREADY_EXISTS. Operation cannot be carried out because an object already exists.
12 - CIM_ERR_NO_SUCH_PROPERTY. The specified Property does not exist.
13 - CIM_ERR_TYPE_MISMATCH. The value supplied is incompatible with the type.
14 - CIM_ERR_QUERY_LANGUAGE_NOT_SUPPORTED. The query language is not recognized or supported.
15 - CIM_ERR_INVALID_QUERY. The query is not valid for the specified query language.
16 - CIM_ERR_METHOD_NOT_AVAILABLE. The extrinsic Method could not be executed.
17 - CIM_ERR_METHOD_NOT_FOUND. The specified extrinsic Method does not exist.
18 - CIM_ERR_UNEXPECTED_RESPONSE. The returned response to the asynchronous operation was not expected.
19 - CIM_ERR_INVALID_RESPONSE_DESTINATION. The specified destination for the asynchronous response is not valid.
20 - CIM_ERR_NAMESPACE_NOT_EMPTY. The specified Namespace is not empty.
21 - CIM_ERR_INVALID_ENUMERATION_CONTEXT. The enumeration context supplied is not valid.
22 - CIM_ERR_INVALID_OPERATION_TIMEOUT. The specified Namespace is not empty.
23 - CIM_ERR_PULL_HAS_BEEN_ABANDONED. The specified Namespace is not empty.
24 - CIM_ERR_PULL_CANNOT_BE_ABANDONED. The attempt to abandon a pull operation has failed.
25 - CIM_ERR_FILTERED_ENUMERATION_NOT_SUPPORTED. Filtered Enumeratrions are not supported.
26 - CIM_ERR_CONTINUATION_ON_ERROR_NOT_SUPPORTED. Continue on error is not supported.
27 - CIM_ERR_SERVER_LIMITS_EXCEEDED. The WBEM Server limits have been exceeded (e.g. memory, connections, ...).
28 - CIM_ERR_SERVER_IS_SHUTTING_DOWN. The WBEM Server is shutting down.
29 - CIM_ERR_QUERY_FEATURE_NOT_SUPPORTED. The specified Query Feature is not supported. Values w
�
�
�
�
�
�
1 N j � � � � � ( E k � � � � ? l � � � CIM_ERR_FAILED CIM_ERR_ACCESS_DENIED CIM_ERR_INVALID_NAMESPACE CIM_ERR_INVALID_PARAMETER CIM_ERR_INVALID_CLASS CIM_ERR_NOT_FOUND CIM_ERR_NOT_SUPPORTED CIM_ERR_CLASS_HAS_CHILDREN CIM_ERR_CLASS_HAS_INSTANCES CIM_ERR_INVALID_SUPERCLASS CIM_ERR_ALREADY_EXISTS CIM_ERR_NO_SUCH_PROPERTY CIM_ERR_TYPE_MISMATCH CIM_ERR_QUERY_LANGUAGE_NOT_SUPPORTED CIM_ERR_INVALID_QUERY CIM_ERR_METHOD_NOT_AVAILABLE CIM_ERR_METHOD_NOT_FOUND CIM_ERR_UNEXPECTED_RESPONSE CIM_ERR_INVALID_RESPONSE_DESTINATION CIM_ERR_NAMESPACE_NOT_EMPTY CIM_ERR_INVALID_ENUMERATION_CONTEXT CIM_ERR_INVALID_OPERATION_TIMEOUT CIM_ERR_PULL_HAS_BEEN_ABANDONED CIM_ERR_PULL_CANNOT_BE_ABANDONED CIM_ERR_FILTERED_ENUMERATION_NOT_SUPPORTED CIM_ERR_CONTINUATION_ON_ERROR_NOT_SUPPORTED CIM_ERR_SERVER_LIMITS_EXCEEDED CIM_ERR_SERVER_IS_SHUTTING_DOWN CIM_ERR_QUERY_FEATURE_NOT_SUPPORTED DMTF Reserved CIMStatusCodeDescription 0
� ' / < string Description A free-form string containing a human-readable description of CIMStatusCode. This description MAY extend, but MUST be consistent with, the definition of CIMStatusCode. ErrorSource
"
� & 3 string Description The identifying information of the entity (i.e., the instance) generating the error. If this entity is modeled in the CIM Schema, this property contains the path of the instance encoded as a string parameter. If not modeled, the property contains some identifying string that names the entity that generated the error. The path or identifying string is formatted per the ErrorSourceFormat property. ErrorSourceFormat & +
� $ � � uint16 Description The format of the ErrorSource property is interpretable based on the value of this property. Values are defined as:
0 - Unknown. The format is unknown or not meaningfully interpretable by a CIM client application.
1 - Other. The format is defined by the value of the OtherErrorSourceFormat property.2 - CIMObjectPath. A CIM Object Path as defined in the CIM Infrastructure specification. Note: CIM 2.5 and earlier used the term object names. Values �
Unknown Other CIMObjectPath DMTF Reserved ErrorType +
� o w � � � uint16 Description Primary classification of the error. The following values are defined:
2 - Communications Error. Errors of this type are principally associated with the procedures and/or processes required to convey information from one point to another.
3 - Quality of Service Error. Errors of this type are principally associated with failures that result in reduced functionality or performance.
4 - Software Error. Error of this type are principally associated with a software or processing fault.
5 - Hardware Error. Errors of this type are principally associated with an equipment or hardware failure.
6 - Environmental Error. Errors of this type are principally associated with a failure condition relating the to facility, or other environmental considerations.
7 - Security Error. Errors of this type are associated with security violations, detection of viruses, and similar issues.
8 - Oversubscription Error. Errors of this type are principally associated with the failure to allocate sufficient resources to complete the operation.
9 - Unavailable Resource Error. Errors of this type are principally associated with the failure to access a required resource.
10 -Unsupported Operation Error. Errors of this type are principally associated with requests that are not supported. Values � � � � $ 9 I a } � Unknown Other Communications Error Quality of Service Error Software Error Hardware Error Environmental Error Security Error Oversubscription Error Unavailable Resource Error Unsupported Operation Error DMTF Reserved Message
� � � � string Description The formatted message. This message is constructed by combining some or all of the dynamic elements specified in the MessageArguments property with the static elements uniquely identified by the MessageID in a message registry or other catalog associated with the OwningEntity. MessageArguments
� H P ] string Description An array containing the dynamic content of the message. MessageID
� � � � string Description An opaque string that uniquely identifies, within the scope of the OwningEntity, the format of the Message. OtherErrorSourceFormat (
� � � � string Description A string defining "Other" values for ErrorSourceFormat. This value MUST be set to a non NULL value when ErrorSourceFormat is set to a value of 1 ("Other"). For all other values of ErrorSourceFormat, the value of this string must be set to NULL. OtherErrorType
� � � � string Description A free-form string describing the ErrorType when 1, "Other", is specified as the ErrorType. OwningEntity
� �! �! �! string Description A string that uniquely identifies the entity that owns the definition of the format of the Message described in this instance. OwningEntity MUST include a copyrighted, trademarked or otherwise unique name that is owned by the business entity or standards body defining the format. PerceivedSeverity +
� # # # 4' <' uint16 Description An enumerated value that describes the severity of the Indication from the notifier\'s point of view:
0 - the Perceived Severity of the indication is unknown or indeterminate.
1 - Other, by CIM convention, is used to indicate that the Severity\'s value can be found in the OtherSeverity property.
2 - Information should be used when providing an informative response.
3 - Degraded/Warning should be used when its appropriate to let the user decide if action is needed.
4 - Minor should be used to indicate action is needed, but the situation is not serious at this time.
5 - Major should be used to indicate action is needed NOW.
6 - Critical should be used to indicate action is needed NOW and the scope is broad (perhaps an imminent outage to a critical resource will result).
7 - Fatal/NonRecoverable should be used to indicate an error occurred, but it\'s too late to take remedial action.
2 and 0 - Information and Unknown (respectively) follow common usage. Literally, the Error is purely informational or its severity is simply unknown. Values d' m' t' �' �' �' �' �' �' Unknown Other Information Degraded/Warning Minor Major Critical Fatal/NonRecoverable DMTF Reserved ProbableCause +
� ( ( -( r( z( uint16 Description An enumerated value that describes the probable cause of the error. Values � �* �* �* �* �* �* + #+ E+ h+ t+ �+ �+ �+ �+ �+ �+ , , 0, ?, O, ^, l, �, �, �, �, �, �, �, - &- ;- J- _- u- �- �- �- �- �- �-
. -. N. g. �. �. �. �. / / 1/ A/ V/ h/ }/ �/ �/ �/ �/ �/ 0 00 N0 c0 s0 �0 �0 �0 �0 �0 �0 �0
1 %1 ?1 P1 c1 {1 �1 �1 �1 �1 �1 2 2 *2 >2 T2 l2 �2 �2 �2 �2 �2 �2 �2 �2 3 3 3 +3 73 D3 K3 \3 o3 �3 �3 �3 �3 �3 �3 4 $4 <4 T4 o4 }4 �4 �4 �4 �4 �4 5 5 25 B5 T5 l5 Unknown Other Adapter/Card Error Application Subsystem Failure Bandwidth Reduced Connection Establishment Error Communications Protocol Error Communications Subsystem Failure Configuration/Customization Error Congestion Corrupt Data CPU Cycles Limit Exceeded Dataset/Modem Error Degraded Signal DTE-DCE Interface Error Enclosure Door Open Equipment Malfunction Excessive Vibration File Format Error Fire Detected Flood Detected Framing Error HVAC Problem Humidity Unacceptable I/O Device Error Input Device Error LAN Error Non-Toxic Leak Detected Local Node Transmission Error Loss of Frame Loss of Signal Material Supply Exhausted Multiplexer Problem Out of Memory Output Device Error Performance Degraded Power Problem Pressure Unacceptable Processor Problem (Internal Machine Error) Pump Failure Queue Size Exceeded Receive Failure Receiver Failure Remote Node Transmission Error Resource at or Nearing Capacity Response Time Excessive Retransmission Rate Excessive Software Error Software Program Abnormally Terminated Software Program Error (Incorrect Results) Storage Capacity Problem Temperature Unacceptable Threshold Crossed Timing Problem Toxic Leak Detected Transmit Failure Transmitter Failure Underlying Resource Unavailable Version Mismatch Previous Alert Cleared Login Attempts Failed Software Virus Detected Hardware Security Breached Denial of Service Detected Security Credential Mismatch Unauthorized Access Alarm Received Loss of Pointer Payload Mismatch Transmission Error Excessive Error Rate Trace Problem Element Unavailable Element Missing Loss of Multi Frame Broadcast Channel Failure Invalid Message Received Routing Failure Backplane Failure Identifier Duplication Protection Path Failure Sync Loss or Mismatch Terminal Problem Real Time Clock Failure Antenna Failure Battery Charging Failure Disk Failure Frequency Hopping Failure Loss of Redundancy Power Supply Failure Signal Quality Problem Battery Discharging Battery Failure Commercial Power Problem Fan Failure Engine Failure Sensor Failure Fuse Failure Generator Failure Low Battery Low Fuel Low Water Explosive Gas High Winds Ice Buildup Smoke Memory Mismatch Out of CPU Cycles Software Environment Problem Software Download Failure Element Reinitialized Timeout Logging Problems Leak Detected Protection Mechanism Failure Protecting Resource Failure Database Inconsistency Authentication Failure Breach of Confidentiality Cable Tamper Delayed Information Duplicate Information Information Missing Information Modification Information Out of Sequence Key Expired Non-Repudiation Failure Out of Hours Activity Out of Service Procedural Error Unexpected Information DMTF Reserved ProbableCauseDescription
� �5 �5 �5 string Description A free-form string describing the probable cause of the error. RecommendedActions
� V6 ^6 k6 string Description A free-form string describing recommended actions to take to resolve the error. �to it (i.e., is 'on'). For example, a fan component may be designed to be hot swapped. All components that can be hot swapped are inherently removable and replaceable . Removable (
� � � � boolean Description A physical component is removable if it is designed to be taken in and out of the physical container in which it is normally found, without impairing the function of the overall packaging. A component can still be removable if power must be 'off' in order to perform the removal. If power can be 'on' and the component removed, then the element is removable and can be hot swapped. For example, an upgradeable processor chip is removable. Replaceable *
� � � � boolean Description A physical component is replaceable if it is possible to replace (FRU or upgrade) the element with a physically different one. For example, some computer systems allow the main processor chip to be upgraded to one of a higher clock rating. In this case, the processor is said to be replaceable . All removable components are inherently replaceable . � C I M _ S o f t w a r e E l e m e n t �tR|�C�� 2 CIM_SoftwareElement ) � ��� � � ��������������������������������������������������M � CIM_BIOSElement Description CIM_BIOSElement represents the low-level software that is loaded into non-volatile storage and used to bring up and configure a computer system. AMENDMENT LOCALE PrimaryBIOS ,
� � boolean Description If true, this is the primary BIOS of the computer system. �le . �ts bits �ts bits � � � � � � 8 uint16 Description Total width, in bits, of the physical memory, including check or error correction bits. If there are no error correction bits, the value in this property should match that specified for the DataWidth property. Units bits � �@_@ � [�T4 Z �)=(Z � M S F T _ N e t S e t t i n g D a t a �yR|�C�K / MSFT_NetSettingData ) * K ��V ^ f r � � � � , � � � � ) / �UU��������������������������������������������� � MSFT_NetTeredoConfiguration Description Reset the Teredo configuration. AMENDMENT LOCALE MS_409 ClientPort
� � � � uint32 Description Client's UDP port. DefaultQualified
(
� boolean Description This policy setting allows you to set Teredo to be ready to communicate, a process referred to as qualification. By default, Teredo enters a dormant state when not in use. The qualification process brings it out of a dormant state. PolicyStore
� = E R string Description PolicyStore property defines the store to retrieve the Teredo configuration policy. RefreshInterval
� � � � uint32 Description Client refresh interval (in seconds). ServerName
� X ` m string Description Describes the name or IPv4 address of the Teredo server. ServerShunt *
� � � � boolean Description If enabled, bypasses the tunnel miniport and IPv4 routing layer for high throughput on the Teredo Relay functionality of the Teredo Server. ServerVirtualIP $
� � � � string Description IPv4 address of the server virtual ip. Not applicable if running as teredo client. Type +
� h p } � uint32 Description Describes the Teredo service. One of the following values: disabled, client, enterpriseclient, natawareclient, server, default. Values * 3 : B J T _ q default relay client server disabled automatic enterpriseclient natawareclient C F � � Reset % Description Reset the Teredo configuration. � a42c9160500003S ROOT\StandardCimv2\MS_409 ���� � �1 �� Q � � 2 = � � � � B � � t * � UU����������������� � __PARAMETERS abstract Type boolean
� 0 In
� 0 X �� ID )
� � X ��� boolean ServerName boolean
� � In
� � �� ID )
� y ��> boolean RefreshInterval boolean
� � In
� � � �� ID )
� 6 � ��� boolean ClientPort boolean
� ] In
� ] � �� ID )
� � � ��� boolean ServerVirtualIP boolean
� In
� B �� ID )
� � B ��p boolean
DefaultQualified boolean
� � In
� � �� ID
)
� i ��. boolean ServerShunt boolean
� � In
� � � �� ID )
� " � ��� boolean PassThru boolean
� G In
� G o �� ID )
� � o ��� boolean __ �> a42c9160500003S ROOT\StandardCimv2\MS_409 ���� � �� �� * � � @ ��������j � __PARAMETERS abstract
OutputObject object
� 8 Out
� 8 _ �� ID
)
� � _ ��� object:MSFT_NetTeredoConfiguration ReturnValue uint32
� 3 uint32 out
� 3 ; �� __ � C I M _ E l e m e n t S e t t i n g D a t a �yR|�C� CIM_ElementSettingData ) " f ��q y � � � m z ������������������������ � MSFT_NetTeredoState Description This class represents per-interface Teredo Configuration settings. AMENDMENT LOCALE MS_409 Error
� � � � string Description Specifies the error of the teredo interface ManagedElement f@
� 2 G T ref:CIM_LANEndpoint Description Teredo tunnel interface SettingData f@
� � � � ref:MSFT_NetTeredoConfiguration Description Teredo global settings associated with this interface State
� > F S string Description Specifies the state of the teredo interface �
E v e n t T r a c e ٧���C�� EventTrace 6 � �� 8 > f n x � � u��������: � WMPNsCfgGuid Description WMP Network Sharing Taskbar guid {d804a67f-4c25-43c1-896f-89ff78b3a911} locale MS\0x409 Flags R
� � � � : H c k � � uint32 Description Enable Flags ValueDescriptions ! 1 EntryExit Flag Ux Flag DefineValues T _ EntryExit Ux Values w � EntryExit Ux ValueMap � � 0x00000001 0x00000002 Level _
� ( 0 = E X % � � � � ( 3 uint32 Description Levels ValueDescriptions p � � � � Abnormal exit or termination Severe errors that need logging Warnings such as allocation failure Includes non-error cases Detailed traces from intermediate steps DefineValues 9 L _ � TRACE_LEVEL_FATAL TRACE_LEVEL_ERROR TRACE_LEVEL_WARNINGTRACE_LEVEL_INFORMATION TRACE_LEVEL_VERBOSE Values � � � � � Fatal Error Warning Information Verbose ValueMap # 0x1 0x2 0x3 0x4 0x5 ValueType index � �}P � ��X� � ��!� � ��pV M M S F T _ S C M E v e n t L o g E v e n t �͝��C�e MSFT_SCMEventLogEvent + $ 0 ; U | � � � _��������������������� � MSFT_NetConnectionTimeout EventId 3221232481 EventType InsertionStringTemplates a q %Milliseconds% %Service% Milliseconds
� � uint32 Service
� � string � W i n 3 2 _ S M B I O S M e m o r y �tR|�C�L � Win32_SMBIOSMemory ) � ��� � � f x �������������������������������������������������������������������������������������������������������������������������������������������������Q � Win32_MemoryArray Description The Win32_MemoryArray class represents the properties of the computer system memory array and mapped addresses. AMENDMENT LOCALE DeviceID @ )
� � � � � �� string Description The DeviceID property contains a string that uniquely identifies the memory array.
Example: Memory Array 1 ErrorGranularity ! � +
� � � � ) 1 uint16 Description The ErrorGranularity identifies the level where the error can be resolved.
Example: Device level. Values E H K N 1 2 3 4 � W i n 3 2 _ S M B I O S M e m o r y �tR|�C�� � Win32_SMBIOSMemory ) ! � ��� � � � � �������������������������������������������������������������������������������������������������������������������������������������������������� � Win32_MemoryDevice Description The Win32_MemoryDevice class represents the properties of a computer system's memory device along with it's associated mapped addresses. AMENDMENT LOCALE DeviceID @ )
� � � �� string Description The DeviceID property contains a string that uniquely identifies the memory device.
Example: Memory Device 1 ErrorGranularity ! � +
� � � � N V uint16 Description The ErrorGranularity property identifies the level where the error can be resolved.
Example: Device level. Values j q z � Other Unknown Device level Memory partition level � C I M _ S t o r a g e E x t e n t �tR|�C� � CIM_StorageExtent ) ! ^ ��i q � � � � � � � ) 7 � b r �
�
8
J
d u u � N a Z q * , @ ����}UUU���������������������������������������������������������������������������������������������������������������������������������������� � Win32_SMBIOSMemory Description The Win32_SMBIOSMemory class represents the properties of a computer system's memory as seen through the System Management BIOS (SMBIOS) interface. The SMBIOS interface does not distinguish between non-volatile, volatile, and flash memories. As such, the CIM_Memory class is the parent class of all types of memory. AMENDMENT LOCALE AdditionalErrorData H
� � � � uint8 Description The AdditionalErrorData property contains additional error information. An example is ECC Syndrome, or the return of the check bits if a CRC-based ErrorMethodology is used. In the latter case, if a single bit error is recognized and the CRC algorithm is known, it is possible to determine the exact bit that failed. This type of data (ECC Syndrome, Check Bit, Parity Bit data, or other vendor-supplied information) is included in this field. This property is used only when the ErrorInfo property is not equal to 3. CorrectableError L
� boolean Description CorrectableError property indicates whether the most recent error was correctable. This property is not used if ErrorInfo is set to 3.
Values: TRUE or FALSE. If TRUE, the error is correctable. EndingAddress N
� % 2 uint64 Description The EndingAddress property specifies the ending address referenced by an application or operating system. This memory address is mapped by a memory controller for this memory object. ErrorAccess V +
� 0 8 E � � uint16 Description The ErrorAccess property indicates the memory access operation that caused the last error. This property is valid only when ErrorInfo is not set to 3. Values �
Other Unknown Read Write Partial Write ErrorAddress X
� c k x uint64 Description The ErrorAddress property specifies the address of the last memory error. This property is used only when ErrorInfo is not set to 3. ErrorData `
� 5 < I uint8 Description The ErrorData property contains data captured from the last memory access with an error. The data occupies the first n octets of the array necessary to hold the number of bits specified by the ErrorTransferSize property. If ErrorTransferSize is 0, then this property is not used. ErrorDataOrder d +
� � � � W
_
uint16 Description The ErrorDataOrder property indicates the ordering for data stored in the ErrorData property. This property is used only when ErrorTransferSize is 0. Values o
x
�
Unknown Least Significant Byte First Most Significant Byte First ErrorInfo f +
� �
�
( 0 uint16 Description The ErrorInfo property contains an integer enumeration describing the type of error that occurred most recently. The values, 12-14 are not used with this property. These values indicate whether an error is correctable but this information is found in the CorrectableError property. Values l s | � � � � � � � � �
#
Other Unknown OK Bad Read Parity Error Single-Bit Error Double-Bit Error Multi-Bit Error Nibble Error Checksum Error CRC Error Corrected single-bit error Corrected error Uncorrectable error ErrorMethodology @ 8 +
� �
�
�
�
string Description The ErrorMethodology property specifies the types of error checking used by the memory hardware. Values " ) 2 8 @ P _ Other Unknown None Parity Single-bit ECC Multi-bit ECC CRC ErrorResolution h +
� � � � g n uint64 Description The ErrorResolution property specifies the amount of data actually determined to cause the error. This property is unused when the ErrorInfo property is set to 3. Units bytes ErrorTime e p
� � � � datetime Description The ErrorTime property contains the time that the last memory error occurred. This property is valid only when ErrorInfo is not set to 3. ErrorTransferSize t +
� � � � M T uint32 Description The ErrorTransferSize property specifies the size of the data (containing the last error) being transferred. This property is set to 0 if there is no error. Units bits OtherErrorDescription x
� � � � string Description The OtherErrorDescription property provides more information when the ErrorInfo property is set to 1. StartingAddress |
� V ^ k uint64 Description The StartingAddress property specifies the beginning address referenced by an application or the operating system. This memory address is mapped by a memory controller for this memory object. SystemLevelAddress �
� l u � boolean Description The SystemLevelAddress property indicates whether the address information in the ErrorAddress property is a system-level address (TRUE) or a physical address (FALSE). This property is used only when ErrorInfo is not set to 3.
Values: TRUE or FALSE. If TRUE, ErrorAddress contains a system-level address. �on level � 2 3 4 �on level � � � � c8 C I M _ L o g i c a l D i s k �tR|�C� � CIM_LogicalDisk ) � ��� � � � � � � T ` � K V * � � k
}
� � � � 3 Q � � � � �����WUU����������������������������������������������������������������������������������������������������������������������������������� � Win32_LogicalDisk Description The Win32_LogicalDisk class represents a data source that resolves to an actual local storage device on a Win32 system.
The class returns both local as well as mapped logical disks. However, the recommended approach is to use this class for obtaining information on local disks and to use the Win32_MappedLogicalDisk class for information on mapped logical disk. AMENDMENT LOCALE Compressed X
� � � � boolean Description The Compressed property indicates whether the logical volume exists as a single compressed entity, such as a DoubleSpace volume. If file based compression is supported (such as on NTFS), this property will be FALSE. DeviceID @ )
� � �� string Description The DeviceID property contains a string uniquely identifying the logical disk from other devices on the system. DriveType Z +
� � � � � � uint32 Description The DriveType property contains a numeric value corresponding to the type of disk drive this logical disk represents. Please refer to the Platform SDK documentation for additional values.
Example: A CD-ROM drive would return 5. Values � � ! - < J Unknown No Root Directory Removable Disk Local Disk Network Drive Compact Disc RAM Disk FileSystem ^
� � � � string Description The FileSystem property indicates the file system on the logical disk.
Example: NTFS MaximumComponentLength b
� ; C P uint32 Description The MaximumComponentLength property contains the maximum length of a filename component supported by the Win32 drive. A filename component is that portion of a filename between backslashes. The value can be used to indicate that long names are supported by the specified file system. For example, for a FAT file system supporting long names, the function stores the value 255, rather than the previous 8.3 indicator. Long names can also be supported on systems that use the NTFS file system.
Example: 255 MediaType f +
� � � � � � uint32 Description The MediaType property indicates the type of media currently present in the logical drive. This value will be one of the values of the MEDIA_TYPE enumeration defined in winioctl.h.
<B>Note:</B> The value may not be exact for removable drives if currently there is no media in the drive. Values ,
?
T
i
~
�
�
�
�
�
�
4 K ` u � � � � � � Format is unknown 5�-Inch Floppy Disk 3�-Inch Floppy Disk 3�-Inch Floppy Disk 3�-Inch Floppy Disk 3�-Inch Floppy Disk 5�-Inch Floppy Disk 5�-Inch Floppy Disk 5�-Inch Floppy Disk 5�-Inch Floppy Disk 5�-Inch Floppy Disk Removable media other than floppy Fixed hard disk media 3�-Inch Floppy Disk 3�-Inch Floppy Disk 5�-Inch Floppy Disk 5�-Inch Floppy Disk 3�-Inch Floppy Disk 3�-Inch Floppy Disk 5�-Inch Floppy Disk 3�-Inch Floppy Disk 3�-Inch Floppy Disk 8-Inch Floppy Disk ProviderName j
� V ^ k string Description The ProviderName property indicates the network path name to the logical device. QuotasDisabled n
� �
boolean Description The QuotasDisabled property indicates that Quota management is not enabled on this volume. QuotasIncomplete p
� �
�
�
boolean Description The QuotasIncomplete property indicates that Quota management was used but has been disabled. Incomplete refers to the information left in the file system after quota management has been disabled. QuotasRebuilding r
� � � � boolean Description The QuotasRebuilding property indicates an active state signifying that the file system is in process of compiling information and setting the disk up for quota management. SupportsDiskQuotas t
� � � � boolean Description The SupportsDiskQuotas property indicates whether this volume supports disk Quotas SupportsFileBasedCompression v
� } � � boolean Description The SupportsFileBasedCompression property indicates whether the logical disk partition supports file based compression, such as is the case with NTFS. This property is FALSE, when the Compressed property is TRUE.
Values: TRUE or FALSE. If TRUE, the logical disk supports file based compression. VolumeDirty x
� � �
boolean Description The VolumeDirty property indicates whether the disk requires chkdsk to be run at next boot up time. The property is applicable to only those instances of logical disk that represent a physical disk in the machine. It is not applicable to mapped logical drives. VolumeName ! z
� I Q ^ string Description The VolumeName property indicates the volume name of the logical disk.
Constraints: Maximum 32 characters VolumeSerialNumber " ~
� string Description The VolumeSerialNumber property indicates the volume serial number of the logical disk.
Constraints: Maximum 11 characters
Example: A8C3-D032 2" � � 8 I � ) � Z �! � Chkdsk & 3 � � Description This method invokes the chkdsk operation on the disk. The method is applicable to only those instances of logical disk that represent a physical disk in the machine. It is not applicable to mapped logical drives. The return value of the method will indicate one of the following - Success - Chkdsk completed, Success - Locked and chkdsk scheduled on reboot, Failure - Unknown file system, Failure - Unknown error, Failure - Unsupported File System. Values 1 b � � Success - Chkdsk completed Success - Locked and chkdsk scheduled on reboot Failure - Unknown file system Failure - Unknown error Failure - Unsupported File System � a42c9160500003S ROOT\CIMV2\ms_409 ���� � �� �� * @ q z t � � � � U�������������; � __PARAMETERS abstract FixErrors boolean
� 5 This parameter indicates what should be done to errors found on the disk. If true, then errors are fixed. Description
� 5 � ] in )
� 5 � ] �� ID 6
� � � ] ��< boolean VigorousIndexCheck boolean
� � This parameter indicates whether a vigorous check of index entries should be performed. Description
� � 4 � in )
� � 4 � m �� ID 6
� � 4 � m ��� boolean SkipFolderCycle boolean
� This parameter indicates whether the folder cycle checking should be skipped or not. Description
� � D in )
� � D � �� ID 6
� V � D � �� boolean ForceDismount boolean
� � This parameter indicates whether the drive should be forced to dismount before checking. Description
� � � in )
� � � ; �� ID 6
� � � ; ��v boolean RecoverBadSe �# C I M _ N e x t H o p R o u t e �ڝ��C�3 ? CIM_NextHopRoute C 5 C J � �� � R
g v � � ' Y i � � � � ( 2 � � � � ��VU�������������������������� ������������������������������2 � MSFT_NetRoute UMLPackagePath CIM::Network::Routes ClassVersion 1.0.0 locale VpnClientPSProvider AddressFamily 6 )
� � � ��� � uint16 ValueMap � � 2 23 DestinationPrefix
� � �� string InterfaceAlias $
� Q � �� string InterfaceIndex
� � � �� uint32 NextHop (
� � � �� string PreferredLifetime e 1 '
� � �� � �� datetime Protocol 8 )
� i � ��q { uint16 ValueMap � � � � � � � � � � � � � � � �
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 Publish
, 4
� Y � �� � ��` j uint8 ValueMap z } � 0 1 2 Store 5 )
� � � � � �� uint8 ValueMap � � 0 1 ValidLifetime e - '
� ( � �� � �� datetime � 7 � � � M b � Create " ��/ �� implemented static � ae442007200009F ROOT\Microsoft\Windows\RemoteAccess\Client ���� � � ( �� _ � �
� M * � [ � | � � U v � o � % * � UUU�������������������������������������� � __PARAMETERS abstract InterfaceIndex uint32
� : In
� : a �� ID )
� � a ��� uint32 InterfaceAlias string
� � In
� � �� ID )
� � ��I string DestinationPrefix string
� � In
� � � �� ID )
� A � �� string NextHop string
� d In
� d � �� ID )
� � � ��� string Publish uint8
� In
� = �� ID )
� � = ��k uint8 RouteMetric uint16
� � In
� � � �� ID )
� \ � ��! uint16 Protocol uint16
� � In
� � � �� ID )
� � ��� uint16 e ValidLifetime datetime e
� 9 In e
� 9 b �� ID e )
� � b ��� datetime e PreferredLifetime datetime e
� � In e
� � # �� ID e )
� � # ��Q datetime PolicyStore string
� � In
� � � �� ID )
� E � ��
string
! AddressFamily uint16
!
� n In
!
� n � �� ID
! )
� � � ���
uint16 # PassThru boolean #
� " In #
� " J �� ID # )
� � J ��x boolean __ �� ae442007200009F ROOT\Microsoft\Windows\RemoteAccess\Client ���� � �� �� * � V � ��������� � __PARAMETERS abstract
CmdletOutput object
� 8 Out
� 8 _ �� MSFT_NetRoute EmbeddedInstance
)
� 8 _ ��� � ID
6
� . _ ��� � � object:MSFT_NetRoute ReturnValue uint32
� � uint32 out
� � � �� __ � Select � ��� �� implemented static F ae442007200009F ROOT\Microsoft\Windows\RemoteAccess\Client ���� � ��
�� * � � M � ������������G � __PARAMETERS abstract InterfaceIndex uint32
� : In
� : a �� ID )
� � a ��� uint32 LocalIPAddress string
� � In
� � �� ID )
� � ��I string RemoteIPAddress string
� � In
� � � �� ID )
� ? � �� string ctors boolean
� � This parameter indicates whether the bad sectors should be located and the readable information should be recovered from these sectors. Description
� � � in )
� � � � �� ID 6
� Y � � �� boolean
OkToRunAtBootUp boolean
� � This parameter indicates whether the chkdsk operation should be performed at next boot up time, in case the operation could not be performed because the disk was locked at time the method was called. Description
� � v � in
)
� � v � � �� ID
6
� 2 v � � ��� boolean __ �� a42c9160500003S ROOT\CIMV2\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � ScheduleAutoChk g t v ~ Description This method is used schedule chkdsk to be run at the next reboot if the dirty bit has been set. The method is applicable to only those instances of logical disk that represent a physical disk in the machine. It is not applicable to mapped logical drives. Values � � � � � No Error Error - Remote Drive Error - Removable Drive Error - Drive Not Root Directory Error - Unknown Drive � a42c9160500003S ROOT\CIMV2\ms_409 ���� � �+ �� * � ����� � __PARAMETERS abstract LogicalDisk string
� 7 in
� 7 ^ �� This parameter is used to specify the list of drives that should be scheduled for autochk at next reboot. The string syntax consists of the the drive letter for the logical disk. Description )
� 7 ^ ��@ � ID 6
� � ^ ��@ � � string __ �� a42c9160500003S ROOT\CIMV2\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � ExcludeFromAutochk G T , 4 Description This method is used exclude disks from the chkdsk operation to be run at the next reboot. If not excluded, chkdsk is performed on the disk if the dirty bit has been set for the disk. Note that the calls to exclude disks are not cumulative. That is, if a call is made to excluded some disks, then the new list is not added to the list of ones that were already marked for exclusion, instead the new list of disks overwrites the previous one. The method is applicable to only those instances of logical disk that represent a physical disk in the machine and is not applicable to mapped logical drives.
For example, a valid specification of drives would be "C:", "d:","G:" Note that the colon is required with the drive letter. Values L U k � � Success Error - Remote Drive Error - Removable Drive Error - Drive Not Root Directory Error - Unknown Drive � a42c9160500003S ROOT\CIMV2\ms_409 ���� � �? �� * � ����� � __PARAMETERS abstract LogicalDisk string
� 7 in
� 7 ^ �� This parameter is used to specify the list of drives that should be excluded from autochk at next reboot. The string syntax consists of the the drive letter followed by a colon for the logical disk. Description )
� 7 ^ ��T � ID 6
� � ^ ��T � � string __ �� a42c9160500003S ROOT\CIMV2\ms_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � __ � �!
C I M _ P r o c e s s o r �tR|�C��! � CIM_Processor ) �� * � �
� � = M
� � � � � � �
' A
H
�
3 A � � � � ; V � � � � � � � � � � � � � f s � � � � � � x � �����WUUUUUU��������������������������������������������������������������������������������������������������������������������������������������������������������������������������� � Win32_Processor Description The Win32_Processor class represents a device that is capable of interpreting a sequence of machine instructions on a Win32 computer system. On a multiprocessor machine, there will exist one instance of this class for each processor. AMENDMENT LOCALE Architecture P +
� c k x E M uint16 Description The Architecture property specifies the processor architecture used by this platform. It returns one of the following integer values:
0 - x86
1 - MIPS
2 - Alpha
3 - PowerPC
6 - ia64
9 - x64
Values i n t { � � x86 MIPS Alpha PowerPC ia64 x64 AssetTag R
� � � � string Description String number for the asset tag of this processor Characteristics V
� J R _ uint32 Description Defines which functions the processor supports. CpuStatus Z +
� � � � � � uint16 Description The CpuStatus property specifies the current status of the processor. Changes in status arise from processor usage, not the physical condition of the processor. Values � � � � " , 6 Unknown CPU Enabled CPU Disabled by User via BIOS Setup CPU Disabled By BIOS (POST Error) CPU is Idle Reserved Reserved Other CurrentVoltage \ +
� � � � � � uint16 Description The CurrentVoltage specifies the voltage of the processor. bits 0-6 of the field contain the processor's current voltage times 10. This value is only set when SMBIOS designates a voltage value. For specific values, see VoltageCaps.
Example: field value for a processor voltage of 1.8 volts would be 92h = 80h + (1.8 x 10) = 80h + 18 = 80h + 12h. Units tenth-volts DeviceID @ )
� K S ` � �� string Description The DeviceID property contains a string uniquely identifying the processor with other devices on the system. ExtClock ^ +
� & � � uint32 Description The ExtClock property specifies the external clock frequency. If the frequency is unknown this property is set to null. Units megahertz L2CacheSize b +
� � � � � uint32 Description The L2CacheSize property specifies the size of the processor's Level 2 cache. A Level 2 cache is an external memory area that has a faster access times than the main RAM memory. Units kilobytes L2CacheSpeed f +
�
-
�
�
uint32 Description The L2CacheSpeed property specifies the clockspeed of the processor's Level 2 cache. A Level 2 cache is an external memory area that has a faster access times than the main RAM memory. Units megahertz L3CacheSize ! j +
� ? G T uint32 Description The L3CacheSize property specifies the size of the processor's Level 3 cache. A Level 3 cache is an external memory area that has a faster access times than the main RAM memory. Units kilobytes L3CacheSpeed " n +
� ` h u /
6
uint32 Description The L3CacheSpeed property specifies the clockspeed of the processor's Level 3 cache. A Level 3 cache is an external memory area that has a faster access times than the main RAM memory. Units megahertz Level # r
� t
|
�
uint16 Description The Level property further defines the processor type. The value depends on the architecture of the processor. LoadPercentage @ 8 +
� C K X # * uint16 Description The LoadPercentage property specifies each processor's load capacity averaged over the last second. The term 'processor loading' refers to the total computing burden each processor carries at one time. Units percent Manufacturer $ t
� m u � string Description The Manufacturer property specifies the name of the processor's manufacturer.
Example: GenuineSilicon NumberOfCores % x
� $ , 9 uint32 Description The NumberOfCores property contains a Processor's total number of cores. e.g dual core machine will have NumberOfCores = 2. NumberOfEnabledCore & |
� � � uint32 Description Number of enabled cores per processor socket. NumberOfLogicalProcessors ' �
� � � � uint32 Description The NumberOfLogicalProcessors property specifies the total number of logical processors. PartNumber ( �
� ) 1 > string Description String number for the part number of this processor This value is set by the manufacturer and normally not changeable. ProcessorId ) �
� � � string Description The ProcessorId property contains processor-specific information that describes the processor's features. For x86 class CPUs, the field's format depends on the processor's support of the CPUID instruction. If the instruction is supported, the ProcessorId property contains two DWORD-formatted values. The first (offsets 08h-0Bh) is the EAX value returned by a CPUID instruction with input EAX set to 1. The second (offsets 0Ch-0Fh) is the EDX value returned by that instruction. Only the first two bytes of the ProcessorID property are significant (all others are set to 0) and contain (in WORD-format) the contents of the DX register at CPU reset. ProcessorType * � +
� � � � 3 ; uint16 Description The ProcessorType property specifies the processor's primary function. Values W ^ g z � � Other Unknown Central Processor Math Processor DSP Processor Video Processor Revision + �
� � � � uint16 Description The Revision property specifies the system's architecture-dependent revision level. The meaning of this value depends on the architecture of the processor. It contains the same values as the "Version" member, but in a numerical format. SecondLevelAddressTranslationExtensions , �
� 7 @ M boolean Description The SecondLevelAddressTranslationExtensions property determines whether the processor supports address translation extensions used for virtualization. SerialNumber - �
� ' 4 string Description String number for the serial number of this processor This value is set by the manufacturer and normally not changeable. SocketDesignation . �
� � � string Description The SocketDesignation property contains the type of chip socket used on the circuit.
Example: J202 ThreadCount / �
� � � � uint32 Description Number of threads per processor socket. Version 0 �
� ' string Description The Version property specifies an architecture-dependent processor revision number. Note: This member is not used in Windows 95.
Example: Model 2, Stepping 12. VirtualizationFirmwareEnabled 1 �
� ) boolean Description The VirtualizationFirmwareEnabled property determines whether the Firmware has enabled virtualization extensions. VMMonitorModeExtensions 2 �
� � � � boolean Description The VMMonitorModeExtensions property determines whether the processor supports Intel or AMD Virtual Machine Monitor extensions. VoltageCaps 3 � 8
� � � � � � x�� � f
�0� � ��k
� �hq@
� ��*_ {�T� \ (��Py b��9{ 9 �u'#� V ��ă
� �J� G 2
� R S O P _ P o l i c y S e t t i n g ���C�� U RSOP_PolicySetting ! , ^ k � � � � ) [ q � � � � & 1 c � � � " T g � � � � % W d �^UUU��������� � � ������������������������������������������������������������� � RSOP_IPSECPolicySetting Locale ClassName
� V � �� string description
� � � �� string id @ '
� � � �� � �� string ipsecData ,
� � �� uint8 ipsecDataType
(
� S � �� uint32 ipsecFilterReference L
� � � �� string ipsecID $
� � � �� string ipsecISAKMPReference 0
� � �� string ipsecName
� [ � �� string ipsecNegotiationPolicyAction H
� � � �� string ipsecNegotiationPolicyReference @
� � � �� string ipsecNegotiationPolicyType D
� L � �� string ipsecNFAReference
4
� � � �� string ipsecOwnersReference <
� � � �� string name @
� � �� string precedence @
� O � �� uint32 whenChanged 8
� � � �� uint32 � R S O P _ P o l i c y S e t t i n g ���C�n 8 RSOP_PolicySetting
% 0 b o � � � � $ 9 k z � � � � ' 3 e r �^U���������� � � ��������������������������������� � RSOP_IEEE80211PolicySetting Locale ClassName
� Z � �� string description
� � � �� string id @ '
� � � �� � �� string msieee80211Data ,
� � �� uint8 msieee80211DataType
(
� c � �� uint32 msieee80211ID $
� � � �� string msieee80211Name
� � � �� string name @
� � �� string precedence @
� ] � �� uint32 whenChanged 0
� � � �� uint32 � R S O P _ P o l i c y S e t t i n g ���C�� + RSOP_PolicySetting " * 7 i m � � � ? E w � � � �^���������� � � ��������������������� � RSOP_IEEE80211GroupPolicySetting Locale description
� a � �� string id @ '
� � � �� � �� string msieee80211PolicyData
� � � �� string msieee80211PolicyReserved
� 8 � �� uint8 name @
� o � �� string precedence @
� � � �� uint32 whenChanged $
� � � �� uint32 � R S O P _ P o l i c y S e t t i n g ���C�� + RSOP_PolicySetting ! ) 6 h l � � � < B t � � � �^���������� � � ��������������������� � RSOP_IEEE8023GroupPolicySetting Locale description
� ` � �� string id @ '
� � � �� � �� string msieee8023PolicyData
� � � �� string msieee8023PolicyReserved
� 5 � �� uint8 name @
� l � �� string precedence @
� � � �� uint32 whenChanged $
� � � �� uint32 � R S O P _ P o l i c y S e t t i n g ���C�� 1 RSOP_PolicySetting $ - _ h � � � � % 2 d k � � � � ���������� � � ���� ���� � RSOP_RegistryPolicySetting Locale command *
� W � �� string deleted
(
� � � �� boolean id @ '
� � � �� � �� string precedence @ '
� � �� � �� uint32 registryKey
� \ � �� string value $
� � � �� uint8 valueName
� � � �� string valueType
� � �� uint32 � ���C�D
! ) 0 m | � � ����� ����� � RSOP_AdministrativeTemplateFile Locale GPOID '
� e � �� � �� string lastWriteTime e
� � � �� datetime name '
� � � �� � �� string � R S O P _ P o l i c y S e t t i n g ���C�� + RSOP_PolicySetting " & c o � � ) j w � � �N������� � � ���� ���� ) � RSOP_ScriptPolicySetting Locale id @ '
� [ � �� � �� string precedence @ '
� � � �� � �� uint32 psScriptOrder $ )
� � � � �� uint32 ValueMap 1 2 3 scriptList
� S � �� object:RSOP_ScriptCmd scriptOrder '
� � � �� � �� uint32 scriptType )
� � � � �� uint32 ValueMap # & 1 2 3 4 � ���C�!
# U d � � ������������� � RSOP_ScriptCmd Locale arguments
� M � �� string executionTime e
� � � �� datetime script
� � � �� string ri � ���C�>
$ , 8 u � � � ������������� � RSOP_ApplicationManagementCategory Locale CategoryId '
� m � �� � �� string CreationTime e
� � � �� datetime Name
� � � �� string pl � ���C�� / 1 X s � � � � " I ` � � � � � 7 ? q � � � UUU��������������������������������������������� � RSOP_IEProgramSettings Locale calendarProgram
� P string checkIfIEIsDefaultBrowser
(
� � boolean contactListProgram $
� � string emailProgram
� string htmlEditorHKCURegData
� A string htmlEditorHKLMRegData
� string htmlEditorProgram
� � string internetCallProgram
� � string newsgroupsProgram
� / string rsopID
� i � �� string rsopPrecedence
� � � �� uint32 useIEForFTP *
� � boolean � ���C�/ ( �� 5 D � � 5��������� � RSOP_IEImportedProgramSettings Locale Association policySetting f
� n � �� ref:RSOP_IEAKPolicySetting programSettings f
� � � �� ref:RSOP_IEProgramSettings �
E v e n t T r a c e �ҝ��C�� EventTrace 6 � �� + 1 Y a k � Bid2Etw_MSDASQL_1 Description MSDASQL_1 Guid {B6501BA0-C61A-C4E6-6FA2-A4E7F8C8E7A0} locale MS\0x409 B � � uint32 BitValues � � � 5 3.3 2.9 Description The VoltageCaps property specifies the voltage capabilities of the processor. Bits 0-3 of the field represent specific voltages that the processor socket can accept. All other bits should be set to zero. The socket is configurable if multiple bits are being set. For a range of voltages see CurrentVoltage. If the property is NULL, then the voltage capabilities are unknown. Units volts ���������������������������������������������������������� � Win32_Processor Description The Win32_Processor class represents a device that is capable of interpreting a sequence of machine instructions on a Win32 computer system. On a multiprocessor machine, there will exist one instance of this class for each processor. AMENDMENT LOCALE Architecture $ | +
� c k x E M uint16 Description The Architecture property specifies the processor architecture used by this platform. It returns one of the following integer values:
0 - x86
1 - MIPS
2 - Alpha
3 - PowerPC
6 - ia64
9 - x64
Values i n t { � � x86 MIPS Alpha PowerPC ia64 x64 AssetTag 4 �
� � � � string Description String number for the asset tag of this processor Characteristics 8 �
� J R _ uint32 Description Defines which functions the processor supports. CpuStatus ' � +
� � � � � � uint16 Description The CpuStatus property specifies the current status of the processor. Changes in status arise from processor usage, not the physical condition of the processor. Values � � � � " , 6 Unknown CPU Enabled CPU Disabled by User via BIOS Setup CPU Disabled By BIOS (POST Error) CPU is Idle Reserved Reserved Other CurrentVoltage ( � +
� � � � � � uint16 Units tenth-volts Description The CurrentVoltage specifies the voltage of the processor. bits 0-6 of the field contain the processor's current voltage times 10. This value is only set when SMBIOS designates a voltage value. For specific values, see VoltageCaps.
Example: field value for a processor voltage of 1.8 volts would be 92h = 80h + (1.8 x 10) = 80h + 18 = 80h + 12h. DeviceID @ )
� K S ` � �� string Description The DeviceID property contains a string uniquely identifying the processor with other devices on the system. ExtClock ) � +
� + 8 uint32 Units megahertz Description The ExtClock property specifies the external clock frequency. If the frequency is unknown this property is set to null. L2CacheSize l +
� � � uint32 Units kilobytes Description The L2CacheSize property specifies the size of the processor's Level 2 cache. A Level 2 cache is an external memory area that has a faster access times than the main RAM memory. L2CacheSpeed ! p +
�
'
2
?
uint32 Units megahertz Description The L2CacheSpeed property specifies the clockspeed of the processor's Level 2 cache. A Level 2 cache is an external memory area that has a faster access times than the main RAM memory. L3CacheSize " t +
� ? G N Y f uint32 Units kilobytes Description The L3CacheSize property specifies the size of the processor's Level 3 cache. A Level 3 cache is an external memory area that has a faster access times than the main RAM memory. L3CacheSpeed # x +
� ` h o z � uint32 Units megahertz Description The L3CacheSpeed property specifies the clockspeed of the processor's Level 3 cache. A Level 3 cache is an external memory area that has a faster access times than the main RAM memory. Level % ~
� t
|
�
uint16 Description The Level property further defines the processor type. The value depends on the architecture of the processor. LoadPercentage @ P +
� C K X # * uint16 Description The LoadPercentage property specifies each processor's load capacity averaged over the last second. The term 'processor loading' refers to the total computing burden each processor carries at one time. Units percent Manufacturer h
� m u � string Description The Manufacturer property specifies the name of the processor's manufacturer.
Example: GenuineSilicon NumberOfCores - �
� $ , 9 uint32 Description The NumberOfCores property contains a Processor's total number of cores. e.g dual core machine will have NumberOfCores = 2. NumberOfEnabledCore 6 �
� � � uint32 Description Number of enabled cores per processor socket. NumberOfLogicalProcessors , �
� � � � uint32 Description The NumberOfLogicalProcessors property specifies the total number of logical processors. PartNumber 5 �
� ) 1 > string Description String number for the part number of this processor This value is set by the manufacturer and normally not changeable. ProcessorId * �
� � � string Description The ProcessorId property contains processor-specific information that describes the processor's features. For x86 class CPUs, the field's format depends on the processor's support of the CPUID instruction. If the instruction is supported, the ProcessorId property contains two DWORD-formatted values. The first (offsets 08h-0Bh) is the EAX value returned by a CPUID instruction with input EAX set to 1. The second (offsets 0Ch-0Fh) is the EDX value returned by that instruction. Only the first two bytes of the ProcessorID property are significant (all others are set to 0) and contain (in WORD-format) the contents of the DX register at CPU reset. ProcessorType + � +
� � � � 3 ; uint16 Description The ProcessorType property specifies the processor's primary function. Values W ^ g z � � Other Unknown Central Processor Math Processor DSP Processor Video Processor Revision & �
� � � � uint16 Description The Revision property specifies the system's architecture-dependent revision level. The meaning of this value depends on the architecture of the processor. It contains the same values as the "Version" member, but in a numerical format. SecondLevelAddressTranslationExtensions 1 �
� 7 @ M boolean Description The SecondLevelAddressTranslationExtensions property determines whether the processor supports address translation extensions used for virtualization. SerialNumber 3 �
� ' 4 string Description String number for the serial number of this processor This value is set by the manufacturer and normally not changeable. SocketDesignation . �
� � � string Description The SocketDesignation property contains the type of chip socket used on the circuit.
Example: J202 ThreadCount 7 �
� � � � uint32 Description Number of threads per processor socket. Version d
� ' string Description The Version property specifies an architecture-dependent processor revision number. Note: This member is not used in Windows 95.
Example: Model 2, Stepping 12. VirtualizationFirmwareEnabled 2 �
� ) boolean Description The VirtualizationFirmwareEnabled property determines whether the Firmware has enabled virtualization extensions. VMMonitorModeExtensions 0 �
� � � � boolean Description The VMMonitorModeExtensions property determines whether the processor supports Intel or AMD Virtual Machine Monitor extensions. VoltageCaps / � 8
� � � � � � f q uint32 Units volts Description T��p � j-*-� p {�
9e p +�t�� � ;� � p ��/M� � C I M _ M a n a g e d S y s t e m E l e m e n t �vR|�C��
� " CIM_ManagedSystemElement ) ! > ��I Q Y h � � ] i � � ] g � � 1 B � � ! 0 � � w � 5 E � � 8 F � � & , � � } �
/
�
�
� � � ���_UUUUU���������������������������������������������������������������������������������������������������������������������������������������������D � MSFT_PrinterDriver Description Represents a printer driver AMENDMENT LOCALE MS_409 ColorProfiles z
� � � � string Description Any color profiles associated with this driver. ComputerName . )
� � ��' 4 string Description The server this driver is installed on. ConfigFile >
� � � � string Description The config file for this driver. CoreDriverDependencies # �
� % string Description A list of core printer drivers this driver depends on. DataFile :
� � � � string Description The data file for this driver. Date e R
� � datetime Description The timestamp for this driver. DefaultDatatype N
� n v � string Description The default datatype for this driver. DependentFiles F
� � � � string Description The dependent files for this driver. DriverVersion Z
� \ d q uint64 Description The driver-specific version of this driver. HardwareID j
� � � � string Description The hardware ID of this driver. HelpFile B
� B J W string Description The help file for this driver. InfPath ! ~ )
� � � ��� � string Description P a t h t o t h i s d r i v e r s I N F f i l e i n t h e d r i v e r s t o r e . IsPackageAware " �
� q z � boolean Description Indicates whether this driver is package-aware. MajorVersion V
� � � uint32 Description The major version of this driver (e.g. 3 or 4). Manufacturer b
� r z � string Description The manufacturer of this driver. Monitor J
� � � � string Description The name of the language monitor for this driver. Name @ )
� c k x � �� string Description The name of this driver. OEMUrl f
� � � � string Description The URL of the manufacturer of this driver. Path 6
� : B O string Description The path to this driver in the driver store. PreviousCompatibleNames $ �
� � � � string Description A list previous driver names that are compatible with this driver. PrinterEnvironment 2 )
� f
� ��n
{
string Description The environment of this driver. PrintProcessor r
� �
�
�
string Description The print processor needed for this driver. n
� F N [ string Description The print provider needed for this driver. VendorSetup v
� � � � string Description T h e v e n d o r s s e t u p d l l a n d e n t r y p o i n t f o r t h i s d r i v e r . O
b � +
� Add # Description Installs a print driver into the print server's driver store. 9 a42c9160500003S ROOT\StandardCimV2\MS_409 ���� � �� �� � � E * � m ? U����������������� � __PARAMETERS abstract Name string
� 0 In
� 0 W �� The name for the driver. Description )
� 0 W ��� � ID 6
� + W ��� � � string InfPath string
� N In
� N u �� The path to the driver's INF file. Description )
� N u ��� � ID 6
� S u ��� � string PrinterEnvironment string
� � In
� � � �� The environment for the server. Description )
� � � ��� � ID 6
� � � ��� � ; string ComputerName string
� � In
� � � �� The name of the server that the printer driver will be added to. Description )
� � � ��B ID 6
� � � ��B � string __ �� a42c9160500003S ROOT\StandardCimV2\MS_409 ���� � �& �� * k ����� � __PARAMETERS abstract ReturnValue uint32
� ^ uint32 out
� ^ f �� __ � �vR|�C�X 6 " / V ��a i q y y � U����������� � MSFT_PrinterNfcTag Version 1.0 Description Contains printer data for an NFC tag. AMENDMENT LOCALE MS_409 Locked
� � � � boolean Description Indicates whether the tag is locked, preventing changes to the tag's contents. SharePath
� B J W string Description UNC share paths for the printer. WsdAddress
� � � � string Description WSD addresses for the printer. b �4 1 C 5 3 E 6 D B 1 A C F 2 4 5 3 C E F D 4 1 3 9 8 1 9 8 E 6 1 3 F 1 0 D F F 4 7 7 0 9 E C A B 1 D 7 F 0 3 7 7 5 6 A C 8 C E 7 �vR|�C�ȝ��C�� � � __thisNAMESPACE � �� � � ? F D 1 C 1 D 4 1 4 B 7 1 B 5 0 8 2 C 2 6 6 A 6 5 0 E 3 1 E F 6 D 5 0 1 9 3 8 2 7 2 4 2 4 4 B 6 8 5 F 2 1 7 C 0 A A E 0 0 A 9 2 1 �vR|�C�Cȝ��C�$ � __SystemSecurity 4 1 C 5 3 E 6 D B 1 A C F 2 4 5 3 C E F D 4 1 3 9 8 1 9 8 E 6 1 3 F 1 0 D F F 4 7 7 0 9 E C A B 1 D 7 F 0 3 7 7 5 6 A C 8 C E 7 �vR|�C�ȝ��C�� � � __thisNAMESPACE � �� � � 6 4 6 5 9 A B 9 F 8 F 1 C 4 B 5 6 8 D B 6 4 3 8 B A E 1 1 B 2 6 E E 8 F 9 3 C B 5 F 8 1 9 5 E 2 1 E 8 C 3 8 3 D 6 C 4 4 C C 4 1 �xR|�C�ȝ��C�,
� __NAMESPACE MS_409 Y7 C I M _ L o g i c a l E l e m e n t �tR|�C�* 2 CIM_LogicalElement ) � ��� � � � � � � � � � c u j y � � p$ �$ �& �& /( H( �( �( UUU�����������������������������������������������) � CIM_LogicalDevice Description An abstraction or emulation of a hardware entity, that may or may not be realized in physical hardware. Any characteristics of logical devices that are used to manage its operation or configuration are contained in, or associated with, the CIM_LogicalDevice object. Examples of the operational properties for a printer would be paper sizes supported, or detected errors. Examples of the configuration properties of a sensor device would be threshold settings. Various configurations could exist for a logical device. These configurations could be contained in CIM_Setting objects and associated with the logical device. AMENDMENT LOCALE Availability +
� � � � A I uint16 Description The availability and status of the device. For example, the Availability property indicates that the device is running and has full power (value=3), or is in a warning (4), test (5), degraded (10) or power save state (values 13-15 and 17). Regarding the power saving states, these are defined as follows: Value 13 ("Power Save - Unknown") indicates that the device is known to be in a power save mode, but its exact status in this mode is unknown; 14 ("Power Save - Low Power Mode") indicates that the device is in a power save state but still functioning, and may exhibit degraded performance; 15 ("Power Save - Standby") describes that the device is not functioning but could be brought to full power 'quickly'; and value 17 ("Power Save - Warning") indicates that the device is in a warning state, though also in a power save mode. Values � � � � � � � � � . D a w � � � � � Other Unknown Running/Full Power Warning In Test Not Applicable Power Off Off Line Off Duty Degraded Not Installed Install Error Power Save - Unknown Power Save - Low Power Mode Power Save - Standby Power Cycle Power Save - Warning Paused Not Ready Not Configured Quiesced ConfigManagerErrorCode +
� - s { uint32 Description Indicates the Win32 Configuration Manager error code. The following values may be returned:
0 This device is working properly.
1 This device is not configured correctly.
2 Windows cannot load the driver for this device.
3 The driver for this device might be corrupted, or your system may be running low on memory or other resources.
4 This device is not working properly. One of its drivers or your registry might be corrupted.
5 The driver for this device needs a resource that Windows cannot manage.
6 The boot configuration for this device conflicts with other devices.
7 Cannot filter.
8 The driver loader for the device is missing.
9 This device is not working properly because the controlling firmware is reporting the resources for the device incorrectly.
10 This device cannot start.
11 This device failed.
12 This device cannot find enough free resources that it can use.
13 Windows cannot verify this device's resources.
14 This device cannot work properly until you restart your computer.
15 This device is not working properly because there is probably a re-enumeration problem.
16 Windows cannot identify all the resources this device uses.
17 This device is asking for an unknown resource type.
18 Reinstall the drivers for this device.
19 Your registry might be corrupted.
20 Failure using the VxD loader.
21 System failure: Try changing the driver for this device. If that does not work, see your hardware documentation. Windows is removing this device.
22 This device is disabled.
23 System failure: Try changing the driver for this device. If that doesn't work, see your hardware documentation.
24 This device is not present, is not working properly, or does not have all its drivers installed.
25 Windows is still setting up this device.
26 Windows is still setting up this device.
27 This device does not have valid log configuration.
28 The drivers for this device are not installed.
29 This device is disabled because the firmware of the device did not give it the required resources.
30 This device is using an Interrupt Request (IRQ) resource that another device is using.
31 This device is not working properly because Windows cannot load the drivers required for this device. Values � ! K | � J � � � � � � 4 w �
B j � � ? Y � , V � � � H � This device is working properly. This device is not configured correctly. Windows cannot load the driver for this device. The driver for this device might be corrupted, or your system may be running low on memory or other resources. This device is not working properly. One of its drivers or your registry might be corrupted. The driver for this device needs a resource that Windows cannot manage. The boot configuration for this device conflicts with other devices. Cannot filter. The driver loader for the device is missing. This device is not working properly because the controlling firmware is reporting the resources for the device incorrectly. This device cannot start. This device failed. This device cannot find enough free resources that it can use. Windows cannot verify this device's resources. This device cannot work properly until you restart your computer. This device is not working properly because there is probably a re-enumeration problem. Windows cannot identify all the resources this device uses. This device is asking for an unknown resource type. Reinstall the drivers for this device. Failure using the VxD loader. Your registry might be corrupted. System failure: Try changing the driver for this device. If that does not work, see your hardware documentation. Windows is removing this device. This device is disabled. System failure: Try changing the driver for this device. If that doesn'