The Msft_WmiProvider_OperationEvent event class is the root definition of all WMI provider events.A provider operation is defined as some execution on behalf of a client via WMI that resultsin one or more calls to a provider executable, The properties of this class define the identity of the provider associated with the operation being executed and is uniquely associated with instances of the class Msft_Providers. Each instance of __Win32Provider can have an associated operation and be identified using the properties below. Internally WMI can contain any number of objects that refer to a particular instance of __Win32Provider since it differentiates each object based on whether the provider supports per user or per locale instantiation and also depending on where the provider is being hosted. Currently TransactionIdentifier is always an empty string.
Msft_WmiProvider_OperationEvent - child subclasses in ROOT\cimv2
'If the provider registration specifies per locale initialization, then the Locale property defines the client locale associated with specific instantiation of a provider.'
'If the provider registration specifies per user initialization, then the User property defines the client principal identity associated with specific instantiation of a provider.'
'The Msft_WmiProvider_OperationEvent event class is the root definition of all WMI provider events.A provider operation is defined as some execution on behalf of a client via WMI that resultsin one or more calls to a provider executable, The properties of this class define the identity of the provider associated with the operation being executed and is uniquely associated with instances of the class Msft_Providers. Each instance of __Win32Provider can have an associated operation and be identified using the properties below. Internally WMI can contain any number of objects that refer to a particular instance of __Win32Provider since it differentiates each object based on whether the provider supports per user or per locale instantiation and also depending on where the provider is being hosted. Currently TransactionIdentifier is always an empty string. '