Table of Contents
Windows Management Instrumentation (WMI) is a core technology for Windows system administration because it exposes a wide range of information in a uniform manner. Because of how much WMI makes possible, the PowerShell cmdlet for accessing WMI objects, Get-CimInstance, is one of the most useful for doing real work. We’re going to discuss how to use the CIM cmdlets to access WMI objects and then how to use WMI objects to do specific things.
Listing WMI classes
The first problem most WMI users face is trying to find out what can be done with WMI. WMI classes describe the resources that can be managed. There are hundreds of WMI classes, some of which contain dozens of properties.
Get-CimClass addresses this problem by making WMI discoverable. You can get a list of the WMI classes available on the local computer by typing:
Get-CimClass -Namespace root/CIMV2 | Where-Object CimClassName -like Win32* | Select CimClassName
CimClassName
------------
Win32_DeviceChangeEvent
Win32_SystemConfigurationChangeEvent
Win32_VolumeChangeEvent
Win32_SystemTrace
Win32_ProcessTrace
...You can retrieve the same information from a remote computer using the ComputerName parameter, specifying a computer name or IP address:
Get-CimClass -Namespace root/CIMV2 -ComputerName 192.168.1.29Displaying WMI class details
If you already know the name of a WMI class, you can use it to get information immediately. For example, one of the WMI classes commonly used for retrieving information about a computer is Win32_OperatingSystem.
PS C:\> Get-CimInstance -Class Win32_OperatingSystem
SystemDirectory Organization BuildNumber RegisteredUser SerialNumber Version
--------------- ------------ ----------- -------------- ------------ -------
C:\Windows\system32 22621 admin 00331-10000-00001-AA343 10.0.22621Although we’re showing all of the parameters, the command can be expressed in a more succinct way. The ComputerName parameter isn’t necessary when connecting to the local system. We show it to demonstrate the most general case and remind you about the parameter. The Namespace defaults to root/CIMV2, and can be omitted as well.
Finally, most cmdlets allow you to omit the name of common parameters. With Get-CimInstance, if no name is specified for the first parameter, PowerShell treats it as the Class parameter. This means the last command could have been issued by typing:
PS C:\> Get-CimInstance Win32_OperatingSystem
SystemDirectory Organization BuildNumber RegisteredUser SerialNumber Version
--------------- ------------ ----------- -------------- ------------ -------
C:\Windows\system32 22621 admin 00331-10000-00001-AA343 10.0.22621The Win32_OperatingSystem class has many more properties than those displayed here. You can use Get-Member to see all the properties. The properties of a WMI class are automatically available like other object properties:
PS C:\> Get-CimInstance -Class Win32_OperatingSystem | Get-Member -MemberType Property
TypeName: Microsoft.Management.Infrastructure.CimInstance#root/cimv2/Win32_OperatingSystem
Name MemberType Definition
---- ---------- ----------
BootDevice Property string BootDevice {get;}
BuildNumber Property string BuildNumber {get;}
BuildType Property string BuildType {get;}
Caption Property string Caption {get;}
CodeSet Property string CodeSet {get;}
CountryCode Property string CountryCode {get;}
CreationClassName Property string CreationClassName {get;}
CSCreationClassName Property string CSCreationClassName {get;}
CSDVersion Property string CSDVersion {get;}
CSName Property string CSName {get;}
CurrentTimeZone Property int16 CurrentTimeZone {get;}
DataExecutionPrevention_32BitApplications Property bool DataExecutionPrevention_32BitApplications {get;}
DataExecutionPrevention_Available Property bool DataExecutionPrevention_Available {get;}
DataExecutionPrevention_Drivers Property bool DataExecutionPrevention_Drivers {get;}
DataExecutionPrevention_SupportPolicy Property byte DataExecutionPrevention_SupportPolicy {get;}
Debug Property bool Debug {get;}
Description Property string Description {get;set;}
Distributed Property bool Distributed {get;}
EncryptionLevel Property uint32 EncryptionLevel {get;}
ForegroundApplicationBoost Property byte ForegroundApplicationBoost {get;set;}
FreePhysicalMemory Property uint64 FreePhysicalMemory {get;}
FreeSpaceInPagingFiles Property uint64 FreeSpaceInPagingFiles {get;}
FreeVirtualMemory Property uint64 FreeVirtualMemory {get;}
InstallDate Property CimInstance#DateTime InstallDate {get;}
LargeSystemCache Property uint32 LargeSystemCache {get;}
LastBootUpTime Property CimInstance#DateTime LastBootUpTime {get;}
LocalDateTime Property CimInstance#DateTime LocalDateTime {get;}
Locale Property string Locale {get;}
Manufacturer Property string Manufacturer {get;}
MaxNumberOfProcesses Property uint32 MaxNumberOfProcesses {get;}
MaxProcessMemorySize Property uint64 MaxProcessMemorySize {get;}
MUILanguages Property string[] MUILanguages {get;}
Name Property string Name {get;}
NumberOfLicensedUsers Property uint32 NumberOfLicensedUsers {get;}
NumberOfProcesses Property uint32 NumberOfProcesses {get;}
NumberOfUsers Property uint32 NumberOfUsers {get;}
OperatingSystemSKU Property uint32 OperatingSystemSKU {get;}
Organization Property string Organization {get;}
OSArchitecture Property string OSArchitecture {get;}
OSLanguage Property uint32 OSLanguage {get;}
OSProductSuite Property uint32 OSProductSuite {get;}
OSType Property uint16 OSType {get;}
OtherTypeDescription Property string OtherTypeDescription {get;}
PAEEnabled Property bool PAEEnabled {get;}
PlusProductID Property string PlusProductID {get;}
PlusVersionNumber Property string PlusVersionNumber {get;}
PortableOperatingSystem Property bool PortableOperatingSystem {get;}
Primary Property bool Primary {get;}
ProductType Property uint32 ProductType {get;}
PSComputerName Property string PSComputerName {get;}
RegisteredUser Property string RegisteredUser {get;}
SerialNumber Property string SerialNumber {get;}
ServicePackMajorVersion Property uint16 ServicePackMajorVersion {get;}
ServicePackMinorVersion Property uint16 ServicePackMinorVersion {get;}
SizeStoredInPagingFiles Property uint64 SizeStoredInPagingFiles {get;}
Status Property string Status {get;}
SuiteMask Property uint32 SuiteMask {get;}
SystemDevice Property string SystemDevice {get;}
SystemDirectory Property string SystemDirectory {get;}
SystemDrive Property string SystemDrive {get;}
TotalSwapSpaceSize Property uint64 TotalSwapSpaceSize {get;}
TotalVirtualMemorySize Property uint64 TotalVirtualMemorySize {get;}
TotalVisibleMemorySize Property uint64 TotalVisibleMemorySize {get;}
Version Property string Version {get;}
WindowsDirectory Property string WindowsDirectory {get;}Displaying non-default properties with Format cmdlets
If you want information contained in the Win32_OperatingSystem class that isn’t displayed by default, you can display it by using -Property * parameter:
PS C:\> Get-CimInstance Win32_OperatingSystem -Property *
Status : OK
Name : Microsoft Windows 11 Pro|C:\Windows|\Device\Harddisk0\Partition3
FreePhysicalMemory : 34990828
FreeSpaceInPagingFiles : 3094040
FreeVirtualMemory : 34819416
Caption : Microsoft Windows 11 Pro
Description :
InstallDate : 4/7/2023 6:44:50 AM
CreationClassName : Win32_OperatingSystem
CSCreationClassName : Win32_ComputerSystem
CSName : DESKTOP-B2TOHJT
CurrentTimeZone : 420
Distributed : False
LastBootUpTime : 8/8/2023 8:39:35 PM
LocalDateTime : 8/12/2023 9:02:22 PM
MaxNumberOfProcesses : 4294967295
MaxProcessMemorySize : 137438953344
NumberOfLicensedUsers : 0
NumberOfProcesses : 318
NumberOfUsers : 2
OSType : 18
OtherTypeDescription :
SizeStoredInPagingFiles : 3145728
TotalSwapSpaceSize :
TotalVirtualMemorySize : 53152824
TotalVisibleMemorySize : 50007096
Version : 10.0.22621
BootDevice : \Device\HarddiskVolume1
BuildNumber : 22621
BuildType : Multiprocessor Free
CodeSet : 1252
CountryCode : 1
CSDVersion :
DataExecutionPrevention_32BitApplications : True
DataExecutionPrevention_Available : True
DataExecutionPrevention_Drivers : True
DataExecutionPrevention_SupportPolicy : 2
Debug : False
EncryptionLevel : 256
ForegroundApplicationBoost : 2
LargeSystemCache :
Locale : 0409
Manufacturer : Microsoft Corporation
MUILanguages : {en-US}
OperatingSystemSKU : 48
Organization :
OSArchitecture : 64-bit
OSLanguage : 1033
OSProductSuite : 256
PAEEnabled :
PlusProductID :
PlusVersionNumber :
PortableOperatingSystem : False
Primary : True
ProductType : 1
RegisteredUser : admin
SerialNumber : 00331-10000-00001-AA343
ServicePackMajorVersion : 0
ServicePackMinorVersion : 0
SuiteMask : 272
SystemDevice : \Device\HarddiskVolume3
SystemDirectory : C:\Windows\system32
SystemDrive : C:
WindowsDirectory : C:\Windows
PSComputerName :
CimClass : root/cimv2:Win32_OperatingSystem
CimInstanceProperties : {Caption, Description, InstallDate, Name...}
CimSystemProperties : Microsoft.Management.Infrastructure.CimSystemPropertiesThe memory data might be more readable if you format it as a list by typing:
PS C:\> Get-CimInstance -Class Win32_OperatingSystem | Format-List Total*Memory*, Free*
TotalVirtualMemorySize : 53152824
TotalVisibleMemorySize : 50007096
FreePhysicalMemory : 34811944
FreeSpaceInPagingFiles : 3094040
FreeVirtualMemory : 34599264
Name : Microsoft Windows 11 Pro|C:\Windows|\Device\Harddisk0\Partition3
