Home  »   HomePage »  Scripts »  WMIC Snippets

WMIC Snippets


WMI is a powerful way to get a lot of information about a system. It can also be used to change many system properties. The downside of WMI used to be that you could only access it via scripting or fullblown programming.

However, all XP Pro and above systems have WMIC, and it is a very handy commandline tool for accessing most of the WMI space. This gives you a poor man's Powershell until the day when we start seeing Powershell installed by default on all systems. New in September 2009: I'm building a sister page, PowerShell WMI Snippets, which essentially translates everything on this page into its PowerShell equivalent. Since PowerShell is more capable than WMIC, the new page will show new capabilities not listed here.

Note that all of the examples below are text you can cut/copy/paste; they are not screenshots.

Much of the info below is columnar and will look a lot better if you stretch this window as wide as you can!

Some reference links

System, BIOS, Motherboard

This first example shows a few variations of the most common WMI query. We ask a WMI object (computersystem, or bios, or baseboard in the examples below) to return the values for a few of its properties. It returns the results in its default tabular format.

C:\Tools>wmic computersystem get domain, EnableDaylightSavingsTime, Manufacturer, Model, PartOfDomain, TotalPhysicalMemory, username
Domain       EnableDaylightSavingsTime  Manufacturer  Model     PartOfDomain  TotalPhysicalMemory  UserName
cojones.org  TRUE                       INTEL_        D865GLC_  TRUE          2146148352           PURGATORY\quux

C:\Tools>wmic bios get Caption, Manufacturer, SMBIOSBIOSVersion, Version
Caption                                     Manufacturer  SMBIOSBIOSVersion                 Version
BIOS Date: 10/14/03 10:38:21 Ver: 08.00.09  Intel Corp.   BF86510A.86A.0049.P11.0310141038  INTEL  - 20031014

C:\Tools>wmic baseboard get Manufacturer, Model, Product, SerialNumber, Version
Manufacturer       Model  Product  SerialNumber  Version
Intel Corporation         D865GLC  ABLC32421808  AAC28909-404

Processor Info 

C:\Tools>wmic cpu get deviceID, Addresswidth, MaxClockSpeed, Name, Manufacturer, ProcessorID
AddressWidth  DeviceID  Manufacturer  MaxClockSpeed  Name                               ProcessorId
32            CPU0      GenuineIntel  2992           Intel(R) Pentium(R) 4 CPU 3.00GHz  BFEBFBFF00000F29
32            CPU1      GenuineIntel  2992           Intel(R) Pentium(R) 4 CPU 3.00GHz  BFEBFBFF00000F29

Hard Drives 

C:\Tools>wmic logicaldisk where drivetype=3 get name, freespace, systemname, filesystem, size, volumeserialnumber
FileSystem  FreeSpace     Name  Size          SystemName  VolumeSerialNumber
NTFS        53473411072   C:    120023252992  GOOD        B0400204
NTFS        114517245952  E:    500105216000  GOOD        94AE4BE9

The drivetypes are

Member nameDescription


UnknownThe type of drive is unknown.


NoRootDirectoryThe drive does not have a root directory.


RemovableThe drive is a removable storage device, such as a floppy disk drive or a USB flash drive.


FixedThe drive is a fixed disk.


NetworkThe drive is a network drive.


CDRomThe drive is an optical disc device, such as a CD or DVD-ROM.


RamThe drive is a RAM disk.

Here is a bonus: S.M.A.R.T. information!

C:\Tools>WMIC /NAMESPACE:\\root\wmi PATH  MSStorageDriver_FailurePredictStatus get * /format:list

You can also experiment with 

  • MSStorageDriver_FailurePredictData
  • MSStorageDriver_FailurePredictEvent
  • MSStorageDriver_FailurePredictFunction
The best docs I have found for these are here. They're sparse, and probably a bit out of date.


I can't really explain why the output below gives me more available virtual memory than total virtual memory. 

C:\Tools>wmic memlogical get AvailableVirtualMemory, TotalPhysicalMemory, TotalVirtualMemory
AvailableVirtualMemory  TotalPhysicalMemory  TotalVirtualMemory
2049300                 2095848              1939180


NIC properties

In the first example below, I query for all NICs. Yikes, too much info!

In the second example I use a where IPEnabled='TRUE' clause to narrow things down, but it's still too much. Here we have several IPEnabled devices which we don't really care about; the system runs VMware, has a TV card, and had a disabled 100bT NIC.

In the third example, I only care about the NIC that is enabled and connected! Could have used DHCPEnabled as the second test, but we might want to get this info from systems with static IPs. I would have compared the IPAddress value to good IPs (or eliminated 192.168 and 169.* addresses), but sadly I have not figured out a way to do WHERE queries on IPAddress; apparently the {} brackets indicate it is an array value, and I have found no way to do WQL queries that compare array values. Please use the comments link if you know how to do this! So, by adding the extra query condition (shown in red), I get only the currently 'live' connection. Although I can imagine cases where DNSDomain would be null and the NIC would still be the live connection. YMMV!

The final query gets a fair amount of NIC information in list format.

C:\Tools>wmic nicconfig get caption, macaddress, ipaddress, DefaultIPGateway
Caption                                                  DefaultIPGateway  IPAddress           MACAddress
[00000001] 1394 Net Adapter
[00000002] RAS Async Adapter
[00000003] WAN Miniport (L2TP)
[00000004] WAN Miniport (PPTP)                                                                 50:50:54:50:30:30
[00000005] WAN Miniport (PPPOE)                                                                33:50:6F:45:30:30
[00000006] Direct Parallel
[00000007] WAN Miniport (IP)
[00000008] Packet Scheduler Miniport                                                           38:C7:20:52:41:53
[00000009] Microsoft TV/Video Connection                                   {""}  00:07:E9:5D:BC:F4
[00000010] Intel(R) PRO/1000 CT Network Connection                         {""}  00:07:E9:5D:BC:F4
[00000011] Packet Scheduler Miniport                                                           00:07:E9:5D:BC:F4
[00000012] VMware Virtual Ethernet Adapter for VMnet1                      {""}   00:50:56:C0:00:01
[00000013] VMware Virtual Ethernet Adapter for VMnet8                      {""}   00:50:56:C0:00:08
[00000014] NETGEAR 108 Mbps Wireless PCI Adapter WG311T  {""}     {""}       00:0F:B5:4F:78:73
[00000015] Packet Scheduler Miniport                                                           00:0F:B5:4F:78:73

C:\Tools>wmic nicconfig where "IPEnabled = 'TRUE'" get caption, macaddress, ipaddress, DefaultIPGateway
Caption                                                  DefaultIPGateway  IPAddress           MACAddress
[00000009] Microsoft TV/Video Connection                                   {""}  00:07:E9:5D:BC:F4
[00000010] Intel(R) PRO/1000 CT Network Connection                         {""}  00:07:E9:5D:BC:F4
[00000012] VMware Virtual Ethernet Adapter for VMnet1                      {""}   00:50:56:C0:00:01
[00000013] VMware Virtual Ethernet Adapter for VMnet8                      {""}   00:50:56:C0:00:08
[00000014] NETGEAR 108 Mbps Wireless PCI Adapter WG311T  {""}     {""}       00:0F:B5:4F:78:73

C:\Tools>wmic nicconfig where "IPEnabled = 'TRUE' and DNSDomain IS NOT NULL" get caption, macaddress, ipaddress, DefaultIPGateway
Caption                                                  DefaultIPGateway  IPAddress      MACAddress
[00000014] NETGEAR 108 Mbps Wireless PCI Adapter WG311T  {""}     {""}  00:0F:B5:4F:78:73

C:\Tools>wmic nicconfig where "IPEnabled = 'TRUE' and DNSDomain IS NOT NULL" get DefaultIPGateway, DHCPServer, DNSDomain, DNSHostName, DNSServerSearchOrder, IPAddress, IPSubnet, MACAddress, WINSEnableLMHostsLookup, WINSPrimaryServer, WINSSecondaryServer /format:list



C:\Tools>wmic path Win32_VideoController get  caption, CurrentHorizontalResolution, CurrentVerticalResolution, Description, DriverVersion, AdapterRAM /format:list

Caption=MOBILITY RADEON 9600/9700 (Microsoft Corporation - WDDM)
Description=MOBILITY RADEON 9600/9700 (Microsoft Corporation - WDDM)



C:\Tools>wmic printer get Caption, Default, Direct, Description, Local, Shared, Sharename, Status
Caption                        Default  Description  Direct  Local  Shared  ShareName                 Status
TPC PostScript HQ2K            FALSE                 FALSE   TRUE   FALSE                             Unknown
Microsoft XPS Document Writer  FALSE                 FALSE   TRUE   FALSE                             Unknown
Lexmark i3                     TRUE                  FALSE   TRUE   TRUE    Lexmark I3 Office         Unknown
hp photosmart 240 series       FALSE                 FALSE   TRUE   TRUE    PHOTO-printer             Unknown
hp officejet g series fax      FALSE                 FALSE   TRUE   FALSE                             Unknown
hp officejet g series          FALSE                 FALSE   TRUE   TRUE    hpoffice                  Unknown
Adobe PDF                      FALSE                 FALSE   TRUE   FALSE                             Unknown
Acrobat PDFWriter              FALSE                 FALSE   TRUE   FALSE                             Unknown
Acrobat Distiller              FALSE                 FALSE   TRUE   FALSE                             Unknown


Other Hardware

Here's a query that makes an output somewhat like Linux's lspci

C:\>wmic path Win32_PnPEntity where "PNPDeviceID like '%VEN%'" get PNPDeviceID, Status, Manufacturer, Service
Manufacturer            PNPDeviceID                                                                    Service   Status
Intel                   PCI\VEN_8086&DEV_2570&SUBSYS_00000000&REV_02\3&267A616A&0&00                             OK
Intel                   PCI\VEN_8086&DEV_2571&SUBSYS_00000000&REV_02\3&267A616A&0&08                   pci       OK
ATI Technologies Inc.   PCI\VEN_1002&DEV_4150&SUBSYS_47221002&REV_00\4&38B71F77&0&0008                 ati2mtag  OK
ATI Technologies Inc.   PCI\VEN_1002&DEV_4170&SUBSYS_47231002&REV_00\4&38B71F77&0&0108                 ati2mtag  OK
Intel                   PCI\VEN_8086&DEV_2573&SUBSYS_00000000&REV_02\3&267A616A&0&18                   pci       OK
Intel                   PCI\VEN_8086&DEV_1019&SUBSYS_303B8086&REV_00\4&26062112&0&0818                 E1000     OK
Intel                   PCI\VEN_8086&DEV_24D2&SUBSYS_4C438086&REV_02\3&267A616A&0&E8                   usbuhci   OK
(Standard disk drives)  USBSTOR\DISK&VEN_HP&PROD_PHOTOSMART_240_S&REV_1.00\7&7541E0F&1&CN3CH341FTM9&0  disk      OK
Intel                   PCI\VEN_8086&DEV_24D4&SUBSYS_4C438086&REV_02\3&267A616A&0&E9                   usbuhci   OK
Intel                   PCI\VEN_8086&DEV_24D7&SUBSYS_4C438086&REV_02\3&267A616A&0&EA                   usbuhci   OK
Intel                   PCI\VEN_8086&DEV_24DE&SUBSYS_4C438086&REV_02\3&267A616A&0&EB                   usbuhci   OK
(Standard disk drives)  USBSTOR\DISK&VEN_OEI-USB&PROD_COMPACTFLASH&REV_1.01\C67CEDBA1F&0               disk      OK
(Standard disk drives)  USBSTOR\DISK&VEN_OEI-USB&PROD_SM/MS/SD&REV_1.01\C67CEDBA1F&1                   disk      OK
Intel                   PCI\VEN_8086&DEV_24DD&SUBSYS_4C438086&REV_02\3&267A616A&0&EF                   usbehci   OK
Intel                   PCI\VEN_8086&DEV_244E&SUBSYS_00000000&REV_C2\3&267A616A&0&F0                   pci       OK
NEC                     PCI\VEN_1033&DEV_00F2&SUBSYS_00F21033&REV_01\4&2E98101C&0&00F0                 ohci1394  OK
NETGEAR, Inc.           PCI\VEN_168C&DEV_0013&SUBSYS_5A001385&REV_01\4&2E98101C&0&08F0                 AR5211    OK
Intel                   PCI\VEN_8086&DEV_24D0&SUBSYS_00000000&REV_02\3&267A616A&0&F8                   isapnp    OK
Intel                   PCI\VEN_8086&DEV_24DB&SUBSYS_4C438086&REV_02\3&267A616A&0&F9                   pciide    OK
Intel                   PCI\VEN_8086&DEV_24D1&SUBSYS_4C438086&REV_02\3&267A616A&0&FA                   pciide    OK
Intel                   PCI\VEN_8086&DEV_24D3&SUBSYS_4C438086&REV_02\3&267A616A&0&FB                   smbusp    OK
Analog Devices, Inc.    PCI\VEN_8086&DEV_24D5&SUBSYS_E0028086&REV_02\3&267A616A&0&FD                   smwdm     OK

It's best to get Caption and PNPDeviceID in your query, but that makes the output too wide for this web page. So below I show getting the Caption rather than PNPDeviceID

C:\>wmic path Win32_PnPEntity where "PNPDeviceID like '%VEN%'" get Caption, Status, Manufacturer, Service
Caption                                                                   Manufacturer            Service   Status
Intel(R) 82865G/PE/P/GV/82848P Processor to I/O Controller - 2570         Intel                             OK
Intel(R) 82865G/PE/P/GV/82848P Processor to AGP Controller - 2571         Intel                   pci       OK
ALL-IN-WONDER 9600 SERIES                                                 ATI Technologies Inc.   ati2mtag  OK
ALL-IN-WONDER 9600 SERIES - Secondary                                     ATI Technologies Inc.   ati2mtag  OK
Intel(R) 82865G/PE/P/GV/82848P Processor to PCI to CSA bridge - 2573      Intel                   pci       OK
Intel(R) PRO/1000 CT Network Connection                                   Intel                   E1000     OK
Intel(R) 82801EB USB Universal Host Controller - 24D2                     Intel                   usbuhci   OK
HP photosmart 240 s USB Device                                            (Standard disk drives)  disk      OK
Intel(R) 82801EB USB Universal Host Controller - 24D4                     Intel                   usbuhci   OK
Intel(R) 82801EB USB Universal Host Controller - 24D7                     Intel                   usbuhci   OK
Intel(R) 82801EB USB Universal Host Controller - 24DE                     Intel                   usbuhci   OK
OEI-USB CompactFlash USB Device                                           (Standard disk drives)  disk      OK
OEI-USB SM/MS/SD USB Device                                               (Standard disk drives)  disk      OK
Intel(R) 82801EB USB2 Enhanced Host Controller - 24DD                     Intel                   usbehci   OK
Intel(R) 82801 PCI Bridge - 244E                                          Intel                   pci       OK
NEC OHCI Compliant IEEE 1394 Host Controller                              NEC                     ohci1394  OK
NETGEAR 108 Mbps Wireless PCI Adapter WG311T                              NETGEAR, Inc.           AR5211    OK
Intel(R) 82801EB LPC Interface Controller - 24D0                          Intel                   isapnp    OK
Intel(R) 82801EB Ultra ATA Storage Controllers                            Intel                   pciide    OK
Intel(R) 82801EB Ultra ATA Storage Controllers                            Intel                   pciide    OK
Intel(R) ICH5/ICH5-M SMBus Controller - 24D3 (Intel(R) SMBus 2.0 Driver)  Intel                   smbusp    OK
SoundMAX Integrated Digital Audio                                         Analog Devices, Inc.    smwdm     OK

Here's a fun one. List the name and PCI ID of everything in Device manager that is in an error state. You know, those little yellow exclamation points!

C:\Tools>wmic path win32_pnpentity where "ConfigManagerErrorCode <> 0" get Name, PNPDeviceID
Name                                          PNPDeviceID
ATI T200 Unified AVStream Driver              DISPLAY\NTATIVRV01\5&883B044&1&80000008&01&00
USB Mass Storage Device                       USB\VID_55AA&PID_B012\C67CEDBA1F
1394 Net Adapter                              V1394\NIC1394\18F74C01
NETGEAR 108 Mbps Wireless PCI Adapter WG311T  PCI\VEN_168C&DEV_0013&SUBSYS_5A001385&REV_01\4&2E98101C&0&08F0
Bluetooth PAN Network Adapter                 ROOT\NET\0000
SCSI/RAID Host Controller                     ROOT\SCSIADAPTER\0000

Operating System, Service Pack, Hotfixes, Domain

Notice how I used the /format:list directive to return a list rather than a superwide table.

A QFE is a hotfix. In the first QFE query below, rather than a get verb, I used list brief.

In the second QFE query, note the use of the percent sign (%) as wildcard in a WHERE clause, highlighted in red. This is important to remember; WQL queries do not use the asterisk as a wildcard!

C:\Tools>wmic os get bootdevice, caption, csname, currenttimezone, installdate, servicepackmajorversion, servicepackminorversion, systemdrive, version, windowsdirectory /format:list

Caption=Microsoft Windows XP Professional

C:\Tools>wmic qfe list brief
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
Microsoft Data Access Components KB870669
Microsoft SQL Server 2000 Service Pack 3 Updates to MDAC 2.7 SP1
Security update for Microsoft Data Access Components
[...listing truncated, you get the point...]

C:\Tools>wmic qfe where "HotFixID like '%928366%'" get Description, FixComments, InstalledOn, ServicePackInEffect
Description                                     FixComments  InstalledOn  ServicePackInEffect
Microsoft .NET Framework 1.1 Hotfix (KB928366)  Update       7/11/2007    1.1

C:\Tools>wmic ntdomain get Caption, DnsForestName, DomainControllerAddress, Status
Caption    DnsForestName  DomainControllerAddress  Status
GOOD                                               Unknown [...note this is the localcomputer...]
PURGATORY  cojones.org   
\                OK


C:\Tools>wmic service get caption, name, state
Caption                                                 Name                               State
Atheros Configuration Service                           ACS                                Running
AdRem NetCrunch Task Scheduler                          AdRemTaskScheduler                 Stopped
Alerter                                                 Alerter                            Stopped
Application Layer Gateway Service                       ALG                                Running
Apple Mobile Device                                     Apple Mobile Device                Running
Application Management                                  AppMgmt                            Stopped
[...listing truncated, you get the point...]

C:\Tools>wmic service where "name='Alerter'" get caption, startmode, startname, state, status
Caption  StartMode  StartName                  State    Status
Alerter  Disabled   NT AUTHORITY\LocalService  Stopped  OK

Installed Software

This not the same as the 'currently installed programs' list you would get by opening Control Panel --> Add/Remove Software. I am not sure how or why the two lists are different, but on my test machine they are definitely not the same. NOTE: the 'wmic product' query doesn't work on Windows 2003 until you add the Windows Installer Provider, as illustrated here.

You can uninstall sofware, too.

C:\Tools>wmic product get Caption, InstallDate, Vendor
Caption                                                       InstallDate  Vendor
ABBYY FineReader for ScanSnap (TM) 2.0                        20070127     ABBYY Software
VMware Server Console                                         20061106     VMware, Inc.
MSXML 4.0 SP2 (KB925672)                                      20061012     Microsoft Corporation
Intel(R) PROSafe for Wired Connections                        20041226     Intel
NETGEAR Wireless Adapter WG311T                               20050415     NETGEAR
Windows Server 2003 Administration Tools Pack                 20031007     Microsoft Corporation
VMware Workstation                                            20061228     VMware, Inc.
Intel(R) PROSafe for Wired Connections                        20041226     Intel
HP Software Update                                            20050331     HEWLET~1|Hewlett-Packard
Windows Resource Kit Tools                                    20030917     Microsoft Corporation
[...listing truncated, you get the point...]

H:\>wmic path win32_product where "name = 'HP Software Update'" call Uninstall <--- UNINSTALLING software.
Executing (\\COMPUTER\root\cimv2:Win32_Product.IdentifyingNumber="{DEC61338-62B5-454A-AAB2-
71D612277798}",Name="HP Software Update",Version="1.5.0")->Uninstall()
Method execution successful.
Out Parameters:
        ReturnValue = 0;   <--- zero means success. The package was uninstalled.


Here we use several call methods to actually do stuff (rather than just listing stuff). And we get a lot of fairly ugly and needless output. But the commands are useful just the same.

C:\Tools>wmic process call create 'notepad.exe'
Executing (Win32_Process)->Create()
Method execution successful.
Out Parameters:
instance of __PARAMETERS
        ProcessId = 14524;
        ReturnValue = 0;

[...notepad starts in the GUI...]
C:\Tools>wmic process where "name='notepad.exe'" call setpriority 64
Executing (\GOOD\ROOT\CIMV2:Win32_Process.Handle="7356")->setpriority()
Method execution successful.
Out Parameters:
instance of __PARAMETERS
        ReturnValue = 0;

C:\Tools>wmic process where "name='notepad.exe'" get Caption, ExecutablePath, Priority, ProcessID, WorkingSetSize
Caption      ExecutablePath                   Priority  ProcessId  WorkingSetSize
notepad.exe  C:\WINDOWS\system32\notepad.exe  4         7356       3825664

C:\Tools>wmic process where "name='notepad.exe'" call terminate
Executing (\GOOD\ROOT\CIMV2:Win32_Process.Handle="7356")->terminate()
Method execution successful.
Out Parameters:
instance of __PARAMETERS
        ReturnValue = 0;


C:\Tools>wmic process where "name='notepad.exe'" get Caption, ExecutablePath, Priority, ProcessID, WorkingSetSize
No Instance(s) Available.

[...notepad is terminated in the GUI...]

Event Logs

Note that these take a long time to complete - so long that the command is nearly useless. I could have included the eventlog message below (it's 'Message'), but that would have made the output way too wide for this web page. The query shown below gets all warning and error log entries from System which occurred after December 4, 2007. 

H:\>WMIC NTEVENT WHERE "EventType<3 AND LogFile = 'System' AND TimeGenerated>'20071204'" GET EventCode, EventIdentifier, RecordNumber, SourceName, TimeGenerated, Type
EventCode  EventIdentifier  RecordNumber  SourceName                        TimeGenerated              Type
50         -2108030926      171408        Microsoft-Windows-Time-Service    20071204002221.000000-000  Warning
131        -2108030845      171768        Microsoft-Windows-Time-Service    20071204172639.000000-000  Warning
5719       5719             171770        NETLOGON                          20071204172741.000000-000  Error
243        -2147483405      171984        Win32k                            20071205160544.401179-000  Warning
10009      -1073731815      172190        Microsoft-Windows-DistributedCOM  20071207101245.000000-000  Error
1003       1003             172251        Microsoft-Windows-Dhcp-Client     20071208055130.000000-000  Warning
50         -2108030926      172264        Microsoft-Windows-Time-Service    20071208133340.000000-000  Warning

Users and Groups 

C:\Tools>wmic useraccount where "LocalAccount='TRUE'" get Caption, Disabled, Domain, Lockout, PasswordExpires, SID, Status
Caption                Disabled  Domain  Lockout  PasswordExpires  SID                                           Status
GOOD\ACTUser           FALSE     GOOD    FALSE    FALSE            S-1-5-21-1214440339-861567501-682003330-1015  OK
GOOD\Administrator     FALSE     GOOD    FALSE    FALSE            S-1-5-21-1214440339-861567501-682003330-500   OK
GOOD\quux              FALSE     GOOD    FALSE    FALSE            S-1-5-21-1214440339-861567501-682003330-1001  OK

GOOD\ASPNET            FALSE     GOOD    FALSE    FALSE            S-1-5-21-1214440339-861567501-682003330-1003  OK
GOOD\Guest             TRUE      GOOD    FALSE    FALSE            S-1-5-21-1214440339-861567501-682003330-501   Degraded
GOOD\HelpAssistant     TRUE      GOOD    FALSE    FALSE            S-1-5-21-1214440339-861567501-682003330-1000  Degraded
GOOD\SUPPORT_388945a0  TRUE      GOOD    FALSE    FALSE            S-1-5-21-1214440339-861567501-682003330-1002  Degraded
GOOD\VUSR_GOOD         FALSE     GOOD    FALSE    FALSE            S-1-5-21-1214440339-861567501-682003330-1014  OK
GOOD\__vmware_user__   FALSE     GOOD    FALSE    TRUE             S-1-5-21-1214440339-861567501-682003330-1025  OK

C:\Tools>wmic group where "LocalAccount='TRUE'" get Caption, SID, Status
Caption                               SID                                           Status
GOOD\Administrators                   S-1-5-32-544                                  OK
GOOD\Backup Operators                 S-1-5-32-551                                  OK
GOOD\Guests                           S-1-5-32-546                                  OK
GOOD\Network Configuration Operators  S-1-5-32-556                                  OK
GOOD\Power Users                      S-1-5-32-547                                  OK
GOOD\Remote Desktop Users             S-1-5-32-555                                  OK
GOOD\Replicator                       S-1-5-32-552                                  OK
GOOD\Users                            S-1-5-32-545                                  OK
GOOD\Debugger Users                   S-1-5-21-1214440339-861567501-682003330-1004  OK
GOOD\HelpServicesGroup                S-1-5-21-1214440339-861567501-682003330-1001  OK
GOOD\VS Developers                    S-1-5-21-1214440339-861567501-682003330-1010  OK
GOOD\__vmware__                       S-1-5-21-1214440339-861567501-682003330-1024  OK

You could use WMIC to get members of a group, like so:

wmic group where "Name='Administrators'" assoc /resultclass:Win32_useraccount

...but the result is so ugly, it's not worth the bother. There are better ways to do that sort of query. Hint: NET LOCALGROUP Administrators

Query remote hosts

/node specifies the remote host name. The rest seems self-explanatory. 

C:\Tools>wmic /node:fs1 /user:mydomain\quuxadmin /password:mypass logicaldisk where drivetype=3 get name, freespace, filesystem, size
FileSystem  FreeSpace     Name  Size
NTFS        1750355968    C:    8578932736
NTFS        321957826560  D:    536863567872
NTFS        106292609024  E:    107372081152 


Windows Installer Provider

On Windows 2003, the wmic product query will not work until you install the WMI Windows Installer Provider via Control Panel, Add/Remove Programs. You will not need to reboot the server; you can do wmic product queries as soon as the installation is complete. A picture is worth a thousand words of installation instructions, so:

Installing the WMI Windows Installer Provider

Guest 2169 - days ago 
Awsome guide - Thanks!!!!
Chili 2109 - days ago 
Excelent page! has cleared a lot of doubts regarding WMI.

Thank You!.
quux 2103 - days ago 
I really appreciate the compliments. This started out as a sort of cheatsheet for my own use. Glad to see others are finding it useful!

Bob 2102 - days ago 
Great This. I wanted to try to get a particular product,say antivirus version. how do i go about it. am running on windows server 2003 and it says invalid class. Here's the command:
c:\>wmic product where name="AntiVirusProduct" get version
bob 2102 - days ago 
infact it just doesnt work. here is out put from a simple wmic product command:wmic product get Vendor
Node - MyComputer
Code = 0x80041010
Description = Invalid class
Facility = WMI
quux 2102 - days ago 
Hey, Bob. You found a 'gotcha': the wmic product query does not work on Windows 2003 until you install the 'WMI Windows Installer Provider' via Add/Remove programs. I have updated the page to explain this.

Keep the questions coming!
Guest 2078 - days ago 
You save my day!!! Best regards from Brazil
Guest 2066 - days ago 
Thank you Thank you Thank you

Excellent webpage, a lot of useful information.


jr 2023 - days ago 
Olá quux,

great introduction into WMI and the best thing that happened to me this week :-) If you don't know: I found the link to your page on Wikipedia's article about WMI.

With the best greetings from Portugal!

Muito obrigado,
CSiebert 2016 - days ago 
The best WMI introduction with practical use that I've seen so far.

Hope to see more examples in the future! ;-)

Best regards,

bryan 1982 - days ago 
This is a very useful introduction, Thanks!

I have been trying to use WMIC with the tool Install Anywhere to determine what is already installed so that I can skip installing components which are already available. Mostly useful for upgrading, and makes my life easier (faster) when testing the installer.

The issue I have having is that when I execute WMIC from my Install Anywhere executable it hangs if run as a batch. If I run as a single command, the command will not execute until the installer has completed. I am starting to guess that WMIC is in use by Install Anywhere so it cannot complete until the install is over. This is just a guess, but if you have any information I'd appreciate it. WMIC just seems perfect for an install/uninstall because you can use the Windows Add/Remove to clean up or detect an existing application.
quux 1962 - days ago 
Hi bryan - I've never used Install Anywhere, so I have no idea how it would affect/instantiate WMI/WMIC. Sorry about that.
quux 1962 - days ago 
CSiebert, I add to the page whenever I discover new stuff. Today I'm adding a couple more little bits.
Guest 1949 - days ago 
Ola, e como faço para retirar um programa com o wmic que requer uma password
shop 1943 - days ago 
Most valuable info i have seen on the net regarding WMI!!
Guest (Guest) 1896 - days ago 
Does anyone know how to delimit the ampersand? \ does not work. I need to get a mac address based on the pnpdeviceid but the string is breaking on the &.

wmic nic where "PNPDeviceID=PCI\VEN_xxxx&Dev_xxx&..." get macaddress

gets error: dev_xxxx is not recognized as an interna or external command.

(this repeat for each part of the string after the &

preet Sangha (Guest) 1859 - days ago 
Excellent article. I've posted a link back here from my blog

- Preet
Rob (Guest) 1795 - days ago 
Nice intro!!

Any ideas on returning a processes componenents, paths and versions? Like listdlls would produce?

Chris J (Guest) (Guest) 1491 - days ago 
Here's another couple -- for those managing Virtual Server, get stats on running servers. Good example of how to query things there aren't an alias for and which live in a different namespace:

WMIC /NODE:remote_computer_name /NAMESPACE:\\root\vm\virtualserver PATH VirtualMachine GET

WMIC /NODE:remote_computer_name /NAMESPACE:\\root\vm\virtualserver PATH VirtualMachine GET Name,Uptime,PhysicalMemoryAllocated

This gives the equivalent to the VBS script, so should give folk an idea what to do to translate WMIC commandlines to scripts and vice-versa.

strComputer = "remote_computer_name"
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\vm\virtualserver")
Set colVMs = objWMIService.ExecQuery("SELECT * FROM VirtualMachine",,48)
For Each vm in colVMs
Wscript.Echo vm.name & ":: Physical Memory Allocated: " & vm.PhysicalMemoryAllocated & " bytes)"
James - Guest (Guest) 1464 - days ago 
Excellent beginners guide into WMI, thankyou!
Guest 1277 - days ago 
Great work. REALLY appreciate you sharing this.
Ran (Guest) 974 - days ago 
Great page! Thanks a lot for sharing!!!
Guest 713 - days ago 
What a way to explain in full details !!! hats off to you !!! many thanks god bless you
Vipul (Guest) 713 - days ago 
I want to delete last installed service pack hotfix from DOS prompt. As , i am not able to log in to windows vista to do so. please help
Guest 694 - days ago 
Great information! Thanks for putting this together!
Kelly (Guest) 643 - days ago 
Thanks for posting this page - a great resource for WMI. Bookmarked for future use. :)
Guest 555 - days ago 
Is it possible to execute a bat file across multiple machines using this WMIC?
I don't get it. Where do you get the wmic windows installer provider to install ? My pc is windows Xp home edition. I don't see it listed..All is see is the Wmic SNMP installer provider.
Ajitesh(Guest) (Guest) 128 - days ago 
Good one...Thanks for sharing !!
Post a comment

Your Name or E-mail ID (mandatory)

 RSS of this page