---
description: Reference for WMI detection criterion, including namespace handling and serialized-table matching.
date_published: 2026-08-13
date_modified: 2026-08-13
canonical_url: https://metricshub.org/community-connectors/develop/detection/wmi.html
---

# Detection by WMI

On this Page

- [When to Use](#when-to-use)
- [Syntax](#syntax)
- [Properties](#properties)
- [Runtime Behavior](#runtime-behavior)
- [Recommended Pattern](#recommended-pattern)
- [Common Mistakes](#common-mistakes)
- [Examples](#examples)

## When to Use

Use `wmi` for any connector that relies on WMI (Windows Management Instrumentation) or WINMGMT to retrieve Windows-specific information.

The `wmi` detection criteria will work when the `wmi` or the `winrm` protocols are configured by the user for a given resource.

## Syntax

```yaml
connector:
  detection:
    criteria:
    - type: wmi
      namespace: root/cimv2
      query: SELECT Name FROM Win32_LogicalDisk
      expectedResult: .+
```

## Properties

| Property | Required | Default | Description |
| --- | --- | --- | --- |
| `type` | Yes | - | `wmi`. |
| `query` | Yes | - | WQL query. Must be non-blank. |
| `namespace` | No | `root/cimv2` | CIM namespace. Can also be `automatic` for namespace discovery. |
| `expectedResult` | No | none | Regex matched against serialized query result. |
| `errorMessage` | No | none | Connector-authored failure context (for logs/reporting). |
| `forceSerialization` | No | `false` | Guarantees operations are performed sequentially against one host. |

## Runtime Behavior

- With `namespace: automatic`, runtime probes candidate namespaces, selects one matching the criterion, then caches it per connector/host.
- Result tables are serialized with semicolons/newlines before regex matching.
- No `expectedResult`: success if serialized result is non-empty.
- With `expectedResult`: case-insensitive, multiline regex.

See below example on how a result table of a WMI query is converted to text before matching with `expectedResult`:

#### Criterion

```yaml
- type: wmi
  query: SELECT Name, DriveType, FreeSpace FROM Win32_LogicalDisk
  expectedResult: ^[C-Z]:;3;[1-9]
```

#### Result

| Name | DriveType | FreeSpace |
| --- | --- | --- |
| C: | 3 | 1406479736832 |
| D: | 3 | 703239868416 |

#### Result As Text

```text
C:;3;1406479736832;
D:;3;703239868416;
```

✅ The criterion passes because both lines of the text result match `expectedResult: ^[C-Z]:;3;[1-9]`. **One single matching line is enough for the criterion to pass.**

## Recommended Pattern

- Prefer explicit namespace when known and stable.
- Use `automatic` namespace only for heterogeneous environments where namespace varies and when the WQL query is specific enough to identify the namespace that hosts the necessary classes for the connector to work.
- Keep detection query minimal and deterministic (single class/property).
- Follow with additional criteria when one class existence is too broad.

## Common Mistakes

- Running deep inventory queries in detection.
- Using broad expected regexes that match unrelated class values.
- Relying on `automatic` when a fixed namespace is already known.

## Examples

Community example — the `wmi` criterion of `system/WindowsService/WindowsService.yaml`, included directly from the connector source:

```
- type: wmi
  namespace: root\CIMv2
  query: SELECT * FROM Win32_OperatingSystem
```