Windows Remote Management Glossary


A WS-Management protocol element returned in an enumeration that obtains both the instances and the instance EPRs. wsman:Items is a container that holds an instance and its EPR. This type of enumeration is initiated when the WSManFlagReturnObjectAndEPR flag is set in the request.


baseboard management controller (BMC)

A microcontroller attached locally to a server. BMCs have sensors that monitor the physical state of the server and a separate network connection that can communicate over the network, even if the server is offline. You have access to BMC data through the Intelligent Platform Management Interface (IPMI) WMI provider.

Basic authentication

The user name and password sent in the authentication exchange. Basic authentication can be configured to use either HTTP or HTTPS transport in a domain or workgroup. This method is the least secure method of authentication.


See baseboard management controller (BMC).



See Common Information Model (CIM).


The client application using the WS-Management protocol to access the management service on either the local or a remote computer.

Common Information Model (CIM)

The Distributed Management Task Force (DMTF) model that describes how to represent real-world computer and network objects. CIM uses an object-oriented paradigm, where managed objects are modeled using the concepts of classes and instances.


Digest authentication

An exchange wherein the server receives a request from a client and sends data about the client to an authenticating server, typically a domain controller. If the client is authenticated, then the server receives a Digest session key used to authenticate subsequent requests from the client.

Distributed Management Task Force (DMTF)

The industry organization developing management standards and integration technology for enterprise and Internet environments.


See Distributed Management Task Force (DMTF).



A resource that can be addressed by an endpoint reference (EPR).

endpoint reference (EPR)

A combination of WS-Addressing and WS-Management addressing elements that together describe an address for a resource in the message SOAP header. This is a web service term.


A set, or collection, of resource instances or the action of requesting such a set. In WS-Management protocol, WS-Enumeration is used to obtain the collection. In the WinRM service scripting implementation of enumeration, Session.Enumerate and the Enumerator object are used. The corresponding C++ method and interface are IWSManSession::Enumerate and IWSManEnumerator.


See endpoint reference (EPR).

Event Collection Service

The operating system component that receives events from the BMC and other operating system components or applications.

event forwarding

A notification of events that occur on remote computers can be sent to subscribing applications. Event forwarding is not a feature of WinRM, but of the Windows Event Log. Event forwarding becomes available for the first time in Windows Vista. The Management applications, such as Microsoft Operations Manager (MOM) use event forwarding.



A query mechanism for specifying a limited set of instances in the request for a resource. You can specify a filter parameter on calls to Session.Enumerate or IWSManSession::Enumerate.

filter dialect

An XML string that identifies the XML dialect used to specify a filter in a call to Session.Enumerate or IWSManSession::Enumerate. The WinRM service supports WQL as a filter dialect when receiving requests.


An XML string that identifies part of an instance of a resource rather than the entire resource. Fragment support is found in the ResourceLocator object.

fragment dialect

An XML string that identifies the XML dialect used to specify a fragment. Fragment support is found in the ResourceLocator object. The WinRM service supports XPath for fragment dialect when receiving requests.



The client application obtains BMC data through the WinRM listener in the operating system.

Intelligent Platform Management Interface (IPMI)

An IT industry standard for the architecture of baseboard management controller (BMC). The Windows hardware management features supply an IPMI driver and a WMI IPMI provider that allow management scripts, command-line tools, and applications to obtain BMC data. The IPMI provider has WMI classes.


See Intelligent Platform Management Interface (IMPI).

IPMI driver

The kernel driver that enables access to baseboard management controller (BMC) devices from the operating system components.

IPMI provider

A standard WMI provider that defines classes modeling the IPMI and its data. The IPMI provider is a COM DLL that obtains data from the BMC.



See Keyboard Controller Style (KCS).

Kerberos authentication

A method of mutual authentication between the client and server that uses encrypted keys. For computers running on a Windows-based operating system, the client account must be a domain account in the same domain as the server. When a client uses default credentials, Kerberos is the authentication method if the connection string is not one of the following: localhost,, or [::1].

Keyboard Controller Style (KCS)

The protocol used by the IPMI driver to communicate with the baseboard management controller (BMC).



A management service that implements WS-Management protocol to send and receive messages. WinRM is a listener service. A listener is defined by a transport (HTTP or HTTPS) and an IPv4 or IPv6 address. You can create more than one WinRM listener instance on a single computer by giving them a different TCP/IP address or port number.



A package of information transmitted between computers or separate networks constructed with the SOAP protocol. The package has a header, that describes the message target and transport, and a body that contains the content to be used when the message arrives. A message is a combination of elements from specifications such as WS-Addressing, WS-Transfer, and WS-Management.



A WMI namespace, which is a logical grouping of WMI classes and instances to control scope and access. The most frequent source of management data for systems running Windows is the root\cimv2 namespace, which contains classes such as Win32_Process. Namespaces appear in the resource URI for WMI classes, for example\_Service.

Negotiate authentication

A negotiated, single sign on type of authentication that is the Windows implementation of Simple and Protected GSSAPI Negotiation Mechanism (SPNEGO). SPNEGO negotiation determines whether authentication is handled by Kerberos or NTLM. Kerberos is the preferred mechanism. Negotiate authentication on Windows-based systems is also called Windows Integrated Authentication.

numeric sensor

A numeric type of sensor in a baseboard management controller (BMC), for example temperature or voltage.



The additional data required by the resource provider to process a request. For example, some WMI providers require additional data supplied as IWbemContext or SWbemNamedValueSet objects. Option support is found in the ResourceLocator object.


The client application obtains data directly from the baseboard management controller (BMC) of another computer, rather than through the WinRM listener in the operating system.



A WS-Enumeration pull message is sent to continue an enumeration started by an initial call to WS-Enumeration:Enumerate. The pull operation in the WinRM service is performed by Enumerator.ReadItem or IWSManEnumerator::ReadItem.



An endpoint that represents a distinct type of management operation or value. A service exposes one or more resources and some resources can have more than one instance. A management resource is similar to a WMI class or a database table, and an instance is similar to an instance of the class or a row in the table. For example, the Win32_LogicalDisk class represents a resource. Win32_LogicalDisk="C:\" is a specific instance of the resource.

resource URI

The uniform resource identifier (URI) used to identify a specific type of resource, such as disks or processes, on a system.



See System Event Log (SEL).

SEL adapter

The adapter that sends baseboard management controller (BMC) data to the Event Collector.


A name and value pair that represents a particular instance of a resource. This is essentially a filter or "key" that identifies the desired instance of the resource. Selector support is found in the ResourceLocator object.


A measurement device in a baseboard management controller (BMC).


An application that provides management services to clients through the WS-Management protocol and other web services. A service is usually the same as the listener on a network. The service has a physical transport address.


A connection between a Windows Remote Management client and the local or remote WinRM listener, or service. This connection is similar to the connection between a WMI client script and WMI on a remote server. The session operations, such as enumerating a resource (Enumerate), getting an instance of a resource (Get), or running a resource method (Invoke) are methods of the Session object. A Session object is created by WSMan.CreateSession.

Simple and Protected GSS-API Negotiation Mechanism (SPNEGO)

An authentication mechanism used by the client or server receiving requests for data through the WinRM in an Active Directory context. SPNEGO is based on an Request For Comments (RFC) protocol produced by the Internet Engineering Task Force (IETF). SPNEGO is also known as Windows Integrated Authentication, the term used in the Windows Remote Management help topics.

Simple Object Access Protocol (SOAP)

An XML-based protocol used by web services.


See Simple Object Access Protocol (SOAP).


See Simple and Protected GSS-API Negotiation Mechanism (SPNEGO).

System Event Log (SEL)

The database of events in the baseboard management controller (BMC) hardware. The SEL adapter conveys these events to the operating system.


uniform resource identifier (URI)

A string that identifies a resource in the enterprise, such as a computer, a process, a disk drive, or a temperature sensor in a baseboard management controller (BMC). The URI is the web service addressing mechanism defined in Internet Engineering Task Force (IETF) Uniform Resource Identifier (URI): Generic Syntax [RFC3986].


See uniform resource identifier (URI).


web service

A software application used for interaction between computers across the Internet or a network. Web services are described by the Web Service Description Language (WSDL). The specific description of the web service tells other services how to interact with the web service by using SOAP messages. The messages are conveyed between computers by a transport, typically HTTP or HTTPS. WS-Addressing, WS-Eventing, and WS-Management are examples of protocols used by web service applications to communicate with each other.

Web Service Description Language (WSDL)

An XML-based language used to define how to interact with a web service. Typically, the WSDL describes what SOAP messages the web service requires to return data or carry out operations. The WSDL allows an implementation from one operating system to communicate with the web service implemented on another operating system, as long as the requirements of the WSDL are met.

Windows Integrated Authentication

See Negotiate authentication.

Windows Management Instrumentation (WMI)

The Microsoft implementation of the Web-Based Enterprise Management (WBEM) standard published by the Distributed Management Task Force (DMTF). WMI allows you to manage local and remote computers and models computer and network objects using an extension of the Common Information Model (CIM) standard.

Windows Remote Management (WinRM)

The Microsoft implementation of a management web service based on the public standard WS-Management protocol.

Windows Remote Shell (WinRS)

A shell tool that relies on Windows Remote Management to execute remote commands, especially for headless servers. The command-line tool is Winrs.


See Windows Management Instrumentation (WMI).

WMI plug-in

The WinRM plug-in that makes WMI data available to WinRM clients.

WS-Addressing (wsa)

A public standard protocol, which is SOAP-based, that creates an addressing system used in the headers of messages sent across the Internet. The standard defines how resources can be located across networks and firewalls. WS-Addressing is one of the web service protocols which compose the WS-Management protocol.

WS-Enumeration (wsen)

A public standard protocol, which is SOAP-based, for enumerating a sequence of XML elements that may represent data collections, logs, or other linear information structures. WS-Enumeration is one of the web service protocols which compose the WS-Management protocol.

WS-Eventing (wse)

A public standard protocol, which is SOAP-based, that allows one web service (the subscriber) to subscribe to and accept event notification messages from another web service (the event source). WS-Eventing is one of the web service protocols which compose the WS-Management protocol.


A public standard protocol, which is SOAP-based, for sharing management data among all operating systems, computers, and devices. All messages sent by the WinRM client or server components use this protocol.

WS-Transfer (wxf)

A public standard protocol, which is SOAP-based, for accessing XML representations of web service-based resources through a simple set of verbs such as Get, Put, Invoke, or Delete. WS-Transfer defines operations for sending and receiving the representation of a particular resource and operations for creating or deleting a resource and its corresponding representation.



A path notation for addressing parts of an XML document, similar to a URL. An XPath expression is a sequence of phrases to get from the current location in the XML document to another node or set of nodes. The phrases are separated by forward-slash ("/") characters. The WinRM service supports XPath for fragment dialect.