PowerShell WMI Snippets

Some reference links

• WMI classes
• WQL - SQL for WMI

System, BIOS, Motherboard

Processor Info

Hard Drives 

Memory

NIC properties

Video

Printers

Other Hardware

Operating System, Service Pack, Hotfixes, Domain

Services

Installed Software

Processes

Event Logs

Users and Groups

Query remote hosts

Windows Installer Provider

Exploring WMI via PowerShell

At the top of this page I have given some reference links, including a link to quite a few (but not all!) of the documented WMI namespaces. This link will come in very handy in your uses of WMI, but it can be a drag to always be skipping back and forth from PS to a web browser. Fortunatelyl, PS has much documentation builtin. Let's explore some of the ways to navigate the vast array of WMI namespaces and classes available, from within PowerShell.

First let's find out what namespaces are available:
PS C:\> Get-WmiObject -Namespace "root" -Class "__NAMESPACE" | Format-List Name

Name : subscription
Name : DEFAULT
Name : CIMV2
Name : Cli
Name : nap
Name : SECURITY
Name : SecurityCenter2
Name : RSOP
Name : WMI
Name : directory
Name : Policy
Name : Interop
Name : ServiceModel
Name : SecurityCenter
Name : MSAPPS12
Name : Microsoft
Name : aspnet

Wow, on my Win7 system, there are quite a few (and you'd find more on a server)! We've barely explored CIMV2 namespace, and it is by far the most interesting of those listed. So let's see what we've got here!

PS C:\> Get-WmiObject -List -Namespace root\CIMV2
   NameSpace: ROOT\CIMV2
Name                                Methods  Properties
----                                -------  ----------
Win32_DeviceChangeEvent             {}       {EventType, SECURITY_DESCRIPTOR, TIME_CREATED}
Win32_SystemConfigurationChangeE... {}       {EventType, SECURITY_DESCRIPTOR, TIME_CREATED}
Win32_VolumeChangeEvent             {}       {DriveName, EventType, SECURITY_DESCRIPTOR, TIME_CREATED}
MSFT_WMI_GenericNonCOMEvent         {}       {ProcessId, PropertyNames, PropertyValues, ProviderName...}
MSFT_NCProvEvent                    {}       {Namespace, ProviderName, Result, SECURITY_DESCRIPTOR...}
MSFT_NCProvCancelQuery              {}       {ID, Namespace, ProviderName, Result...}
MSFT_NCProvClientConnected          {}       {Inproc, Namespace, ProviderName, Result...}
MSFT_NCProvNewQuery                 {}       {ID, Namespace, ProviderName, Query...}
MSFT_NCProvAccessCheck              {}       {Namespace, ProviderName, Query, QueryLanguage...}
Win32_SystemTrace                   {}       {SECURITY_DESCRIPTOR, TIME_CREATED}
Win32_ProcessTrace                  {}       {ParentProcessID, ProcessID, ProcessName, SECURITY_DESCRIPTOR...}
Win32_ProcessStartTrace             {}       {ParentProcessID, ProcessID, ProcessName, SECURITY_DESCRIPTOR...}
Win32_ProcessStopTrace              {}       {ExitStatus, ParentProcessID, ProcessID, ProcessName...}
Win32_ThreadTrace                   {}       {ProcessID, SECURITY_DESCRIPTOR, ThreadID, TIME_CREATED}
...
This listing truncated both top and bottom - there's a LOT more! Actually let's take a second to find out how much more:

PS C:\> Get-WmiObject -List -Namespace root\cimv2 |measure-object -Line | format-list
Lines     : 1037

Wow again. root\CIMV2 contains over a thousand WMI classes - and each of those will have many properties we can query. But who has time to read all of a thousand lines to find the one we need? So how can we quickly find what we're looking for? I remember that one I liked had the word 'operating' in it. So I will use a where-object filter to find classes which contain that word in their names:

 PS C:\> Get-WmiObject -List | Where-Object { $_.name -match 'Operating'}

   NameSpace: ROOT\cimv2
Name                                Methods              Properties
----                                -------              ----------
CIM_OperatingSystem                 {Reboot, Shutdown}   {Caption, CreationClassName, CSCreationClassName, CSName...}
Win32_OperatingSystem               {Reboot, Shutdown... {BootDevice, BuildNumber, BuildType, Caption...}
Win32_OperatingSystemAutochkSetting {}                   {Element, Setting}
Win32_SystemOperatingSystem         {}                   {GroupComponent, PartComponent, PrimaryOS}
CIM_OperatingSystemSoftwareFeature  {}                   {GroupComponent, PartComponent}
Win32_OperatingSystemQFE            {}                   {Antecedent, Dependent}

That second one looks like it. Let's examine it a little more closely:

 PS C:\> gwmi Win32_OperatingSystem |get-Member -MemberType property

   TypeName: System.Management.ManagementObject#root\cimv2\Win32_OperatingSystem

Name                                      MemberType Definition

----                                      ---------- ----------

BootDevice                                Property   System.String BootDevice {get;set;}

BuildNumber                               Property   System.String BuildNumber {get;set;}

BuildType                                 Property   System.String BuildType {get;set;}

Caption                                   Property   System.String Caption {get;set;}

CodeSet                                   Property   System.String CodeSet {get;set;}

CountryCode                               Property   System.String CountryCode {get;set;}

CreationClassName                         Property   System.String CreationClassName {get;set;}

CSCreationClassName                       Property   System.String CSCreationClassName {get;set;}

CSDVersion                                Property   System.String CSDVersion {get;set;}

CSName                                    Property   System.String CSName {get;set;}

CurrentTimeZone                           Property   System.Int16 CurrentTimeZone {get;set;}

...

Again the list is truncated. There were 73 lines.

 ---

Gahh, zoho formatter has gone nuts again. Will continue later with:

OK, want to look at properties that reference memory:

gwmi Win32_OperatingSystem |get-Member -MemberType property | Where-Object { $_.name -match 'mem'}