Find WMI Providers and Namespaces in Regedit

Windows Management Instrumentation (WMI) relies on specific Windows Registry paths to register provider COM components, maintain system paths, and configure the Common Information Model Object Manager (CIMOM). While the actual WMI namespace schema and data are stored in a dedicated binary repository, the Registry Editor (regedit.exe) holds the underlying service architecture, provider CLSID mappings, and engine configurations.

Core WMI Configuration and Repository Path

The primary registry key governing the WMI infrastructure and CIMOM settings is:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM

Within this key, the CIMOM subkey contains crucial configuration parameters: * HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM * Repository Directory: Defines the physical location of the WMI namespace database (by default, %SystemRoot%\System32\wbem\Repository). * Logging and Hosting: Contains settings for provider host processes (WmiPrvSE.exe), logging levels, and memory quotas.

Registered WMI Provider COM Objects

WMI providers are implemented as Component Object Model (COM) servers (DLLs or EXEs). When a provider is installed, its Class Identifier (CLSID) is registered within the standard COM registry directories:

• 64-bit Providers: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{Provider-GUID} (or HKEY_CLASSES_ROOT\CLSID\{Provider-GUID})
• 32-bit Providers (on 64-bit Windows): HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{Provider-GUID}

Under each provider’s CLSID subkey, inspect: * InprocServer32 or LocalServer32: Shows the full file path to the provider binary (e.g., .dll or .exe). * ThreadingModel: Displays the threading architecture (typically Both or Free).

WDM Provider Registrations

Providers that bridge Windows Driver Model (WDM) device drivers into WMI are referenced under:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\WDM

This section contains references linking hardware device IDs and driver interfaces to WMI data blocks.

Inspecting Namespaces via WMI Tooling

While registry keys define how WMI starts and where providers execute, the namespaces themselves (such as root\cimv2 or root\default) are managed dynamically inside the WBEM repository database. To inspect registered namespaces and their bound __Win32Provider instances directly, use WMI tools such as PowerShell (Get-CimInstance -Namespace "root" -ClassName "__Namespace") or the Windows wbemtest.exe utility alongside Registry Editor.