List 3rd party WMI providers before rebuilding repository

Question

I'm looking for some Powershell cmdlet/script which list WMI 3rd party providers before I will rebuild whole repository.

There is GWMI cmdlet which lists all WMI objects but I'm missing something like "Company:", then I would use filter to list non-microsoft WMIs.

Get-WmiObject -List | fl *
...
PSComputerName   : MyComputer
Name             : __SystemClass
__GENUS          : 1
__CLASS          : __SystemClass
__SUPERCLASS     :
__DYNASTY        : __SystemClass
__RELPATH        : __SystemClass
__PROPERTY_COUNT : 0
__DERIVATION     : {}
__SERVER         : MyComputer
__NAMESPACE      : ROOT\CIMV2
__PATH           : \\MyComputer\ROOT\CIMV2:__SystemClass
Path             : \\MyComputer\ROOT\CIMV2:__SystemClass
Derivation       : {}
Methods          : {}
Scope            : System.Management.ManagementScope
Options          : System.Management.ObjectGetOptions
ClassPath        : \\MyComputer\ROOT\CIMV2:__SystemClass
Properties       : {}
SystemProperties : {__GENUS, __CLASS, __SUPERCLASS, __DYNASTY...}
Qualifiers       : {abstract}
Site             :
Container        :
....

Is there any way how to detect 3rd party WMI providers? Thank you for any help.

Colyn1337 · Accepted Answer · 2016-08-02T06:21:50.117

Given how WMI was built and implemented you're a bit SOL on a magical solution. I can help you some of the way, but you're still going to have to eyeball the results. Essentially you need to start with a list of providers which you can get with the following code:

$Providers = Get-WmiObject "__win32provider"

If the array count is short eyeball the provider names. Microsoft didn't use a standard naming convention so you can forget filtering with something useful like "MSProvider".

3rd parties were advised and asked, yet not required, to create their providers for their own namespaces. Anything not in "CIMV2" should stand out and be looked at more closely. For reference you can review how 3rd parties register a WMI provider and what information is required when doing so here.

The objects returned by the code above have a CLSID property which corresponds to their entry in the Windows registry. You could loop through them and query the registry and see if a 3rd party added any values to the key you could use to identify them with.

Happy hunting.

List 3rd party WMI providers before rebuilding repository

1 Answers1