// Copyright (c) 1997-2003 Microsoft Corporation, All Rights Reserved

#pragma autorecover
#pragma classflags(64)
#pragma namespace("\\\\.\\Root\\CIMV2")

[Abstract,Locale(1033) : ToInstance,UUID("{8502C517-5FBB-11D2-AAC1-006008C78BC7}") : ToInstance] 
class CIM_ManagedSystemElement
{
  [MaxLen(64) : ToSubclass,Read : ToSubclass] string Caption;
  [Read : ToSubclass] string Description;
  [MappingStrings{"MIF.DMTF|ComponentID|001.5"} : ToSubclass,Read : ToSubclass] datetime InstallDate;
  [Read : ToSubclass] string Name;
  [Read : ToSubclass,MaxLen(10) : ToSubclass,ValueMap{"OK", "Error", "Degraded", "Unknown", "Pred Fail", "Starting", "Stopping", "Service", "Stressed", "NonRecover", "No Contact", "Lost Comm"} : ToSubclass] string Status;
};

[Abstract,Locale(1033) : ToInstance,UUID("{8502C518-5FBB-11D2-AAC1-006008C78BC7}") : ToInstance] 
class CIM_LogicalElement : CIM_ManagedSystemElement
{
};

[SupportsDelete,DeleteBy("DeleteInstance"),Abstract,Provider("CIMWin32") : ToInstance,Locale(1033) : ToInstance,UUID("{8502C559-5FBB-11D2-AAC1-006008C78BC7}") : ToInstance] 
class CIM_LogicalFile : CIM_LogicalElement
{
  [read : ToSubclass] uint64 InUseCount;
  [read : ToSubclass,Schema("Win32") : ToInstance] boolean Archive;
  [Propagated("CIM_FileSystem.CSCreationClassName") : ToSubclass,CIM_Key : ToSubclass,read : ToSubclass] string CSCreationClassName;
  [Propagated("CIM_FileSystem.CSName") : ToSubclass,CIM_Key : ToSubclass,Read : ToSubclass] string CSName;
  [Schema("Win32") : ToInstance,read : ToSubclass] boolean Compressed;
  [CIM_Key : ToSubclass,read : ToSubclass] string CreationClassName;
  [read : ToSubclass] datetime CreationDate;
  [Schema("Win32") : ToInstance,read : ToSubclass] boolean Encrypted;
  [Propagated("CIM_FileSystem.CreationClassName") : ToSubclass,CIM_Key : ToSubclass,read : ToSubclass] string FSCreationClassName;
  [Propagated("CIM_FileSystem.Name") : ToSubclass,CIM_Key : ToSubclass,read : ToSubclass] string FSName;
  [read : ToSubclass] datetime LastAccessed;
  [read : ToSubclass] datetime LastModified;
  [read : ToSubclass] boolean Readable;
  [read : ToSubclass] uint64 FileSize;
  [Read : ToSubclass] boolean Writeable;
  [read : ToSubclass,Schema("Win32") : ToInstance] boolean Hidden;
  [read : ToSubclass,Schema("Win32") : ToInstance] boolean System;
  [read : ToSubclass,Schema("Win32") : ToInstance] string FileType;
  [read : ToSubclass,Schema("Win32") : ToInstance] string EightDotThreeFileName;
  [read : ToSubclass] string CompressionMethod;
  [read : ToSubclass] string EncryptionMethod;
  [Override("Name"),Key : ToInstance ToSubclass DisableOverride,read : ToSubclass] string Name;
  [Fixed : ToSubclass,read : ToSubclass,Schema("Win32") : ToInstance] string Drive;
  [Fixed : ToSubclass,read : ToSubclass,Schema("Win32") : ToInstance] string Path;
  [Fixed : ToSubclass,read : ToSubclass,Schema("Win32") : ToInstance] string FileName;
  [Fixed : ToSubclass,read : ToSubclass,Schema("Win32") : ToInstance] string Extension;
  [read : ToSubclass,Schema("Win32") : ToInstance,BitMap{"0", "1", "2", "3", "4", "5", "6", "7", "8", "16", "17", "18", "19", "20"} : ToSubclass] uint32 AccessMask;
  [Implemented,ValueMap{"0", "2", "8", "9", "10", "11", "12", "13", "14", "15", "16", "17", "21"} : ToSubclass,Schema("Win32") : ToInstance] uint32 TakeOwnerShip();
  [Implemented,ValueMap{"0", "2", "8", "9", "10", "11", "12", "13", "14", "15", "16", "17", "21"} : ToSubclass,Schema("Win32") : ToInstance] uint32 ChangeSecurityPermissions([In] Win32_SecurityDescriptor SecurityDescriptor,[In,BitMap{"0", "1", "2", "3"} : ToSubclass] uint32 Option);
  [Implemented,ValueMap{"0", "2", "8", "9", "10", "11", "12", "13", "14", "15", "16", "17", "21"} : ToSubclass,Schema("Win32") : ToInstance] uint32 Copy([In] string FileName);
  [Implemented,ValueMap{"0", "2", "8", "9", "10", "11", "12", "13", "14", "15", "16", "17", "21"} : ToSubclass,Schema("Win32") : ToInstance] uint32 Rename([In] string FileName);
  [Destructor,Implemented,ValueMap{"0", "2", "8", "9", "10", "11", "12", "13", "14", "15", "16", "17", "21"} : ToSubclass,Schema("Win32") : ToInstance] uint32 Delete();
  [Implemented,Schema("Win32") : ToInstance,ValueMap{"0", "2", "8", "9", "10", "11", "12", "13", "14", "15", "16", "17", "21"} : ToSubclass] uint32 Compress();
  [Implemented,ValueMap{"0", "2", "8", "9", "10", "11", "12", "13", "14", "15", "16", "17", "21"} : ToSubclass,Schema("Win32") : ToInstance] uint32 Uncompress();
  [Implemented,ValueMap{"0", "2", "8", "9", "10", "11", "12", "13", "14", "15", "16", "17", "21"} : ToSubclass,Schema("Win32") : ToInstance] uint32 TakeOwnerShipEx([Out] string StopFileName,[In,optional] string StartFileName,[In,optional] boolean Recursive);
  [Implemented,ValueMap{"0", "2", "8", "9", "10", "11", "12", "13", "14", "15", "16", "17", "21"} : ToSubclass,Schema("Win32") : ToInstance] uint32 ChangeSecurityPermissionsEx([in] Win32_SecurityDescriptor SecurityDescriptor,[In,BitMap{"0", "1", "2", "3"} : ToSubclass] uint32 Option,[Out] string StopFileName,[In,optional] string StartFileName,[In,optional] boolean Recursive);
  [Implemented,ValueMap{"0", "2", "8", "9", "10", "11", "12", "13", "14", "15", "16", "17", "21"} : ToSubclass,Schema("Win32") : ToInstance] uint32 CopyEx([In] string FileName,[Out] string StopFileName,[In,optional] string StartFileName,[In,optional] boolean Recursive);
  [Implemented,ValueMap{"0", "2", "8", "9", "10", "11", "12", "13", "14", "15", "16", "17", "21"} : ToSubclass,Schema("Win32") : ToInstance] uint32 DeleteEx([Out] string StopFileName,[In,optional] string StartFileName);
  [Implemented,ValueMap{"0", "2", "8", "9", "10", "11", "12", "13", "14", "15", "16", "17", "21"} : ToSubclass,Schema("Win32") : ToInstance] uint32 CompressEx([Out] string StopFileName,[In,optional] string StartFileName,[In,optional] boolean Recursive);
  [Implemented,ValueMap{"0", "2", "8", "9", "10", "11", "12", "13", "14", "15", "16", "17", "21"} : ToSubclass,Schema("Win32") : ToInstance] uint32 UncompressEx([Out] string StopFileName,[In,optional] string StartFileName,[In,optional] boolean Recursive);
  [Privileges{"SeSecurityPrivilege"} : ToSubclass,Implemented,Schema("Win32") : ToInstance] boolean GetEffectivePermission([In,BitMap{"0", "1", "2", "3", "4", "5", "6", "7", "8", "16", "17", "18", "19", "20"} : ToSubclass] uint32 Permissions);
};

[Dynamic,Provider("CIMWin32") : ToInstance,Locale(1033) : ToInstance,UUID("{8502C55A-5FBB-11D2-AAC1-006008C78BC7}") : ToInstance] 
class CIM_DataFile : CIM_LogicalFile
{
  [read : ToSubclass,Schema("Win32") : ToInstance] string Version;
  [read : ToSubclass,Schema("Win32") : ToInstance] string Manufacturer;
};

[singleton : ToInstance ToSubclass,Locale(1033) : ToInstance,UUID("{8502C57A-5FBB-11D2-AAC1-006008C78BC7}") : ToInstance] 
class NTEventlogProviderConfig
{
  datetime LastBootUpTime;
};

Instance of __Win32Provider as $DataProv
{
  Name = "MS_NT_EVENTLOG_PROVIDER";
  ClsId = "{FD4F53E0-65DC-11d1-AB64-00C04FD9159E}";
  ImpersonationLevel = 1;
  PerUserInitialization = "TRUE";
  HostingModel = "NetworkServiceHost";
};

Instance of __MethodProviderRegistration
{
  Provider = $DataProv;
};

Instance of __InstanceProviderRegistration
{
  Provider = $DataProv;
  SupportsPut = TRUE;
  SupportsGet = TRUE;
  SupportsDelete = FALSE;
  SupportsEnumeration = TRUE;
  QuerySupportLevels = {"WQL:UnarySelect"};
};

[dynamic,provider("MS_NT_EVENTLOG_PROVIDER") : ToInstance,SupportsUpdate,Locale(1033) : ToInstance,UUID("{8502C57B-5FBB-11D2-AAC1-006008C78BC7}") : ToInstance] 
class Win32_NTEventlogFile : CIM_DataFile
{
  [Fixed : ToSubclass,read : ToSubclass] string LogfileName;
  [read : ToSubclass,write : ToSubclass] uint32 MaxFileSize;
  [read : ToSubclass] uint32 NumberOfRecords;
  [read : ToSubclass,volatile : ToSubclass,ValueMap{"0", "1..365", "4294967295"} : ToSubclass] string OverWritePolicy;
  [read : ToSubclass,write : ToSubclass,Range("0-365 | 4294967295") : ToSubclass] uint32 OverwriteOutDated;
  [read : ToSubclass] string Sources[];
  [ValueMap{"0", "8", "21", ".."} : ToSubclass,implemented,Privileges{"SeSecurityPrivilege", "SeBackupPrivilege"} : ToSubclass] uint32 ClearEventlog([in] string ArchiveFileName);
  [ValueMap{"0", "8", "21", "183", ".."} : ToSubclass,implemented,Privileges{"SeSecurityPrivilege", "SeBackupPrivilege"} : ToSubclass] uint32 BackupEventlog([in] string ArchiveFileName);
};

[Privileges{"SeSecurityPrivilege"} : ToSubclass,Dynamic,Provider("MS_NT_EVENTLOG_PROVIDER") : ToInstance,EnumPrivileges{"SeSecurityPrivilege"} : ToSubclass,Locale(1033) : ToInstance,UUID("{8502C57C-5FBB-11D2-AAC1-006008C78BC7}") : ToInstance] 
class Win32_NTLogEvent
{
  [Key : ToInstance ToSubclass DisableOverride] uint32 RecordNumber;
  [Key : ToInstance ToSubclass DisableOverride] string Logfile;
  [Fixed : ToSubclass] uint32 EventIdentifier;
  uint16 EventCode;
  [Fixed : ToSubclass] string SourceName;
  [Fixed : ToSubclass,ValueMap{"0", "1", "2", "4", "8", "16"} : ToSubclass] string Type;
  uint16 Category;
  string CategoryString;
  [Fixed : ToSubclass] datetime TimeGenerated;
  [Fixed : ToSubclass] datetime TimeWritten;
  [Fixed : ToSubclass] string ComputerName;
  string User;
  string Message;
  string InsertionStrings[];
  Uint8 Data[];
  [Fixed : ToSubclass,ValueMap{"0", "1", "2", "3", "4", "5"} : ToSubclass] uint8 EventType;
};

[dynamic,provider("MS_NT_EVENTLOG_PROVIDER") : ToInstance,EnumPrivileges{"SeSecurityPrivilege"} : ToSubclass,Privileges{"SeSecurityPrivilege"} : ToSubclass,Locale(1033) : ToInstance,UUID("{8502C57D-5FBB-11D2-AAC1-006008C78BC7}") : ToInstance,Association : ToInstance ToSubclass DisableOverride] 
class Win32_NTLogEventLog
{
  [Key : ToInstance ToSubclass DisableOverride,read : ToSubclass] Win32_NTEventlogFile Ref Log;
  [Key : ToInstance ToSubclass DisableOverride,read : ToSubclass] Win32_NTLogEvent Ref Record;
};

[dynamic,provider("MS_NT_EVENTLOG_PROVIDER") : ToInstance,EnumPrivileges{"SeSecurityPrivilege"} : ToSubclass,Privileges{"SeSecurityPrivilege"} : ToSubclass,Locale(1033) : ToInstance,UUID("{8502C57E-5FBB-11D2-AAC1-006008C78BC7}") : ToInstance,Association : ToInstance ToSubclass DisableOverride] 
class Win32_NTLogEventUser
{
  [Key : ToInstance ToSubclass DisableOverride,read : ToSubclass] Win32_UserAccount Ref User;
  [Key : ToInstance ToSubclass DisableOverride,read : ToSubclass] Win32_NTLogEvent Ref Record;
};

[dynamic,provider("MS_NT_EVENTLOG_PROVIDER") : ToInstance,EnumPrivileges{"SeSecurityPrivilege"} : ToSubclass,Privileges{"SeSecurityPrivilege"} : ToSubclass,Locale(1033) : ToInstance,UUID("{8502C57F-5FBB-11D2-AAC1-006008C78BC7}") : ToInstance,Association : ToInstance ToSubclass DisableOverride] 
class Win32_NTLogEventComputer
{
  [Key : ToInstance ToSubclass DisableOverride,read : ToSubclass] Win32_ComputerSystem Ref Computer;
  [Key : ToInstance ToSubclass DisableOverride,read : ToSubclass] Win32_NTLogEvent Ref Record;
};

Instance of __Win32Provider as $EventProv
{
  Name = "MS_NT_EVENTLOG_EVENT_PROVIDER";
  ClsId = "{F55C5B4C-517D-11d1-AB57-00C04FD9159E}";
  HostingModel = "LocalSystemHost";
};

Instance of __EventProviderRegistration
{
  Provider = $EventProv;
  EventQueryList = {"select * from __InstanceCreationEvent where TargetInstance isa \"Win32_NTLogEvent\""};
};
#pragma autorecover
#pragma classflags(64)
#pragma namespace("\\\\.\\Root\\CIMV2")
instance of __namespace{ name="ms_409";};
#pragma namespace("\\\\.\\Root\\CIMV2\\ms_409")

[AMENDMENT, LOCALE("ms_409") : ToInstance] 
class CIM_ManagedSystemElement
{
};

[AMENDMENT, LOCALE("ms_409") : ToInstance] 
class CIM_LogicalElement : CIM_ManagedSystemElement
{
};

[AMENDMENT, LOCALE("ms_409") : ToInstance] 
class CIM_LogicalFile : CIM_LogicalElement
{
};

[AMENDMENT, LOCALE("ms_409") : ToInstance] 
class CIM_DataFile : CIM_LogicalFile
{
};

[AMENDMENT, LOCALE("ms_409") : ToInstance] 
class Win32_NTEventlogFile : CIM_DataFile
{
  [Description("The LogFileName property indicates name of the log file.") : Amended ToSubclass] string LogfileName;
  [Description("The MaxFileSize property indicates the maximum size (in bytes) permitted for the log file. If the file exceeds its maximum size, its contents are moved to another file and the primary file is emptied. A value of zero indicates no size limit. ") : Amended ToSubclass] uint32 MaxFileSize;
  [Description("Number of records in the log file. This value is determined by calling the Win32 function GetNumberOfEventLogRecords.") : Amended ToSubclass] uint32 NumberOfRecords;
  [Description("Current overwrite policy the Windows NT/Windows 2000 Event Log service employs for this log file. The possible values of the property are: \nWhenNeeded - This corresponds to OverWriteOutdated = 0.\nOutDated - This corresponds to OverWriteOutdated of 1 to 365.\nNever - This corresponds to OverWriteOutdated = 4294967295. \nThere is an interdependence between the OverWriteOutDated property (which is writable) value and the OverWritePolicy property (which is not writable) value.\nIf one changes the OverWriteOutDated property value to 0, the OverWritePolicy property value will be 'henNeeded' \nIf one changes the OverWriteOutDated property value to 1-365, the OverWritePolicy property value will be 'outDated' \nIf one changes the OverWriteOutDated property value to 4294967295, the OverWritePolicy property value will be 'Never'.") : Amended ToSubclass,Values{"WhenNeeded", "OutDated", "Never"} : Amended ToSubclass] string OverWritePolicy;
  [Description("Number of days after which an event can be overwritten. Values are:\n0 = Any entry can be overwritten when necessary.1..365 = Events that have been in the log file for one year (365 days) or less can be overwritten.4294967295 = Nothing can be ever be overwritten. \nThere is an interdependence between the OverWriteOutDated property (which is writable) value and the OverWritePolicy property (which is not writable) value.\nIf one changes the OverWriteOutDated property value to 0, the OverWritePolicy property value will be 'henNeeded' \nIf one changes the OverWriteOutDated property value to 1-365, the OverWritePolicy property value will be 'outDated' \nIf one changes the OverWriteOutDated property value to 4294967295, the OverWritePolicy property value will be 'Never'.") : Amended ToSubclass,Units("days") : Amended ToSubclass] uint32 OverwriteOutDated;
  [Description("The Sources property indicates the applications that are registered to log into this log file.") : Amended ToSubclass] string Sources[];
  [Description("Clears the specified event log, and optionally saves the current copy of the logfile to a backup file. The method returns an integer value that can be interpretted as follows: \n0 - Successful completion.\n8 - The user does not have adequate privileges.\n21 - Invalid parameter.\nOther - For integer values other than those listed above, refer to Win32 error code documentation.") : Amended ToSubclass,Values{"Success", "Privilege missing", "Invalid parameter", "Other"} : Amended ToSubclass] uint32 ClearEventlog([Description("String specifying the name of a file in which a current copy of the event logfile will be placed. If this file already exists, the function fails. ") : Amended ToSubclass,in] string ArchiveFileName);
  [Description("Saves the specified event log to a backup file. The method returns an integer value that can be interpretted as follows: \n0 - Successful completion.\n8 - The user does not have adequate privileges.\n21 - Invalid parameter.\n183 - Archive file name already exists. Cannot create file. \nOther - For integer values other than those listed above, refer to Win32 error code documentation.") : Amended ToSubclass,Values{"Success", "Privilege missing", "Invalid parameter", "Archive file name already exists.", "Other"} : Amended ToSubclass] uint32 BackupEventlog([Description("String specifying the name of the backup file.") : Amended ToSubclass,in] string ArchiveFileName);
};

[DisplayName("NT Log Events") : Amended,Description("This class is used to translate instances from the NT Eventlog.") : Amended ToSubclass,AMENDMENT, LOCALE("ms_409") : ToInstance] 
class Win32_NTLogEvent
{
  [DisplayName("Record Number") : Amended,Key : ToInstance ToSubclass DisableOverride,Description("Identifies the event within the NT Eventlog logfile. This is specific to the logfile and is used together with the logfile name to uniquely identify an instance of this class.") : Amended ToSubclass] uint32 RecordNumber;
  [DisplayName("Log File") : Amended,Key : ToInstance ToSubclass DisableOverride,Description("The name of NT Eventlog logfile. This is used together with the RecordNumber to uniquely identify an instance of this class.") : Amended ToSubclass] string Logfile;
  [DisplayName("Event Identifier") : Amended,Description("Identifies the event. This is specific to the source that generated the event log entry, and is used, together with SourceName, to uniquely identify an NT event type.") : Amended ToSubclass] uint32 EventIdentifier;
  [DisplayName("Event Code") : Amended,Description("This property has the value of the lower 16-bits of the EventIdentifier property. It is present to match the value displayed in the NT Event Viewer. NOTE: Two events from the same source may have the same value for this property but may have different severity and EventIdentifier values") : Amended ToSubclass] uint16 EventCode;
  [DisplayName("Source Name") : Amended,Description("The variable-length null-terminated string specifying the name of the source (application, service, driver, subsystem) that generated the entry. It is used, together with the EventIdentifier, to uniquely identify an NT event type.") : Amended ToSubclass] string SourceName;
  [DisplayName("Type") : Amended,Description("Specifies the type of event. This is an enumerated string") : Amended ToSubclass,Values{"Success", "Error", "Warning", "Information", "Audit Success", "Audit Failure"} : Amended ToSubclass] string Type;
  [DisplayName("Category") : Amended,Description("Specifies a subcategory for this event. This subcategory is source specific.") : Amended ToSubclass] uint16 Category;
  [DisplayName("Category String") : Amended,Description("Specifies the translation of the subcategory. The translation is source specific.") : Amended ToSubclass] string CategoryString;
  [DisplayName("Time Generated") : Amended,Description("Specifies the time at which the source generated the event.") : Amended ToSubclass] datetime TimeGenerated;
  [DisplayName("Time Written") : Amended,Description("Specifies the time at which the event was written to the logfile.") : Amended ToSubclass] datetime TimeWritten;
  [DisplayName("Computer Name") : Amended,Description("The variable-length null-terminated string specifying the name of the computer that generated this event.") : Amended ToSubclass] string ComputerName;
  [DisplayName("User Name") : Amended,Description("The user name of the logged on user when the event ocurred. If the user name cannot be determined this will be NULL") : Amended ToSubclass] string User;
  [DisplayName("Message") : Amended,Description("The event message as it appears in the NT Eventlog. This is a standard message with zero or more insertion strings supplied by the source of the NT event. The insertion strings are inserted into the standard message in a predefined format. If there are no insertion strings or there is a problem inserting the insertion strings, only the standard message will be present in this field.") : Amended ToSubclass] string Message;
  [DisplayName("Insertion Strings") : Amended,Description("The insertion strings that accompanied the report of the NT event.") : Amended ToSubclass] string InsertionStrings[];
  [DisplayName("Binary Data") : Amended,Description("The binary data that accompanied the report of the NT event.") : Amended ToSubclass] Uint8 Data[];
  [Description("The Type property specifies the type of event.") : Amended ToSubclass,DisplayName("Type Event") : Amended,Values{"Success", "Error", "Warning", "Information", "Security Audit Success", "Security Audit Failure"} : Amended ToSubclass] uint8 EventType;
};

[Description("The Win32_NTLogEventLog class represents an association between an NT log event and the log file that contains the event.") : Amended ToSubclass,AMENDMENT, LOCALE("ms_409") : ToInstance] 
class Win32_NTLogEventLog
{
  [Description("The Log property references the log file that contains the NT log event.") : Amended ToSubclass,Key : ToInstance ToSubclass DisableOverride] Win32_NTEventlogFile Ref Log;
  [Description("The Record property references an NT log event.") : Amended ToSubclass,Key : ToInstance ToSubclass DisableOverride] Win32_NTLogEvent Ref Record;
};

[Description("The Win32_NTLogEventUser class represents an association between an NT log event and the active user at the time the event was logged. ") : Amended ToSubclass,AMENDMENT, LOCALE("ms_409") : ToInstance] 
class Win32_NTLogEventUser
{
  [Description("The User property references the active user at the time the event was logged.") : Amended ToSubclass,Key : ToInstance ToSubclass DisableOverride] Win32_UserAccount Ref User;
  [Description("The Record property references an NT log event.") : Amended ToSubclass,Key : ToInstance ToSubclass DisableOverride] Win32_NTLogEvent Ref Record;
};

[Description("The Win32_NTLogEventComputer class represents an association between an NT log event and the computer from which the event was generated.") : Amended ToSubclass,AMENDMENT, LOCALE("ms_409") : ToInstance] 
class Win32_NTLogEventComputer
{
  [Description("The Computer property references the computer from which the event was generated.") : Amended ToSubclass,Key : ToInstance ToSubclass DisableOverride] Win32_ComputerSystem Ref Computer;
  [Description("The Record property references an NT log event.") : Amended ToSubclass,Key : ToInstance ToSubclass DisableOverride] Win32_NTLogEvent Ref Record;
};
