Connect to WMI

WMI stands for Windows Management Instrumentation (WMI).

It is important to realize there are default values utilized for the WMI connection.

The default values are stored in the following registry location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Scripting.  There are two keys: DEFAULT IMPERSONATION LEVEL and DEFAULT NAMESPACE. DEFAULT IMPERSONATION LEVEL is set to a value of 3, which means that WMI impersonates the logged-on user and therefore uses the logged-on user name, credentials, and rights. The default namespace is Root\cimv2.

Use the Get-ItemProperty cmdlet to verify the default WMI configuration on a local computer:

get-itemproperty HKLM:\SOFTWARE\Microsoft\WBEM\Scripting
Retrieving properties


1.  Only show the properties name, model, manufacturer:

 Get-WmiObject WIN32_computersystem | Format-list name, model,manufacturer

2. Show all the properties:

 Get-WmiObject WIN32_computersystem | Format-list *

3. Show properties begin with the letters a through z:

Get-WmiObject WIN32_computersystem | Format-List [a-z]*

4. List properties that begin with the letter d.

Get-WmiObject WIN32_computersystem | Format-List D*

5. To list all the properties and their values that begin with either the letter d or the letter t

Get-WmiObject WIN32_computersystem | Format-List d*,t*

Work with Disk drives

To retrieve the default properties for each drive on the system:

gwmi win32_logicaldisk

  • Local disk drives: -filter drivetype=3
    gwmi win32_logicaldisk -filter drivetype=3

The WIN32_LogicalDisk WMI class property DriveType can have a value of 0 to 6 (inclusive). The most useful of these values are as follows: 3 (local disk), 4 (network drive), 5 (compact disk), and 6 (RAM disk).

$LogicalDisks = Get-WMIObject -ComputerName xxxx Win32_LogicalDisk
$LocalHDisks = $LogicalDisks | Where-Object { $_.DriveType -eq 3 }
$LocalHDisks | ft -auto @{Label=”Drive”;`
@{Label=”Volume Label”;`
Expression={[int]($_.FreeSpace/$_.Size * 100)};`

Query every property from every instance of a class

To return all information from all instances, perform the following steps:

1. Make a connection to WMI by using the Get-WmiObject cmdlet.

2. Use the -query argument to supply the WQL query to the Get-WmiObject cmdlet.

3. In the query, use the Select statement to choose everything: Select * .

4. In the query, use the From statement to indicate the class from which you wish to retrieve data. For example, From Win32_Share.

E.g. List shared drives:

$strComputer = "."

$wmiNS = "root\cimv2"

$wmiQuery = "Select * from win32_share"

$objWMIServices = Get-WmiObject -computer $strComputer -namespace $wmiNS `

   -query $wmiQuery

 $objWMIServices | Format-List *

Similarly you can also select specific data:

Perform the following steps:

1. Make a connection to WMI by using the Get-WmiObject cmdlet.

2. Use the -query argument to supply the WMI query to the Get-WmiObject cmdlet.

3. In the query, use the Select statement to choose the speci c property you are interested in— for example, Select name.

4. In the query, use the From statement to indicate the class from which you want to retrieve data—for example, From Win32_Share.

$strComputer = "."
$wmiNS = "root\cimv2"
$wmiQuery = "Select name from win32_Share"
$objWMIServices = Get-WmiObject -computer $strComputer -namespace $wmiNS `
   -query $wmiQuery
$objWMIServices | Sort-Object -property name | Format-List -property name
working with running processes

1. Get-process cmdlet to obtain a list of processes.

2. To return information about the Explorer process, use the -name argument: Get-process -name explorer

3. Get information about processes: Get-wmiobject win32_process | more

4. To retrieve information about the Explorer.exe process, use the -filter argument and specify that the name property is equal to Explorer.exe.

Get-wmiObject win32_process -Filter "name='explorer.exe'"

5. To display a table that is similar to the one produced by Get-Process:

Get-WmiObject win32_process -Filter "name='explorer.exe'" |

     Format-Table handlecount,quotaNonPagedPoolUsage, PeakVirtualSize,

     WorkingSetSize, VirtualSize, UserModeTime,KernelModeTime,

     ProcessID, Name

The – filter argument is surrounded by double quotation marks. The value being supplied for the property is surrounded by single quotes—for example, -Filter “name=’explorer.exe'”. This can cause a lot of frustration if not followed exactly.


Redirect output

There are two ways to redirect output to a file.

You can use redirection arrow >   or cmdlet out-file

Use > to redirect output to a file

After the redirection, if you want to open the file, such as Use Notepad to open the  file, but include the Get-WmiObject (gwmi) command, separated by a semicolon. This is illustrated next. (I’ve continued the command to the next line using the grave accent character (`) for readability.)

   gwmi win32_ComputerSystem >>c:\mytest\OSinfo.txt; `

       notepad c:\mytest\OSinfo.txt

Use out-file

we can create a variable $strFile to store the path of the text file.


Then use the out-file to produce an output file containing the results of the previous command. To ensure the output file is easily read, use ASCII encoding by using the -encoding argument.

Out-file -filepath $strFile -encoding ASCII

If you don’t want to overwrite any existing file, use the -append argument only add to the end of the text file, -noClobber argument tells out-file not to overwrite any existing files.

Eliminating the WMI query argument

1. Declare a variable called $strComputer and assign the WMI shortcut dot (.) to it, which means connect to the WMI service on the local computer. $strComputer="."

2. Declare another variable and call it $wmiClass="win32_Share"

3. Declare a variable and call it $wmiFilter, this variable will hold the string that contains the WMI filter to be used with the Get-wmiObject command.


4. Then use the Get-WmiObject cmdlet to query all the info:

Get-WmiObject -computer $strComputer -class $wmiclass -filter $wmifilter

Utilizing an operator

greater-than and less-than operators

You can use these two operators in letters: >D means letters D through Z. Also keep in mind that D$ is greater than D.

If you really want shares that begin with the letter E, then you can specify “greater than or equal to E.” This command would look like >=’E’.

Where VS filter

Where clause can be used to limit the specific data returned by a query.

Get-WmiObject -ComputerName "." -Namespace "root\cimv2" -query "Select * from win32_share where name='ipc$'"

You can also use -filter parameter to replace the where clause:

Get-WmiObject -ComputerName "." -Namespace "root\cimv2" -class "win32_share" -filter "name='ipc$'"


Property and “select .., … from”

Get-WmiObject -Query “Select name, handle from win32_process”

or you can use:

Get-WmiObject -Class WIN32_Process -Property name, handle

Use WMI to find installed software

The win32_product WMI class contains the software object in Windows, then use the for statement to print out a progress indicator.  To calculate the script executing time, we use New-TimeSpan to calculate the time difference between two time points.

 The code to get the number of software is:

$wmiQuery="Select * from win32_product"
write-host "counting installed products. This"`

"may take a little while." -ForegroundColor blue `n

$objWMIServices=Get-WmiObject -ComputerName "." -Query $wmiQuery

for ($i=1; $i -le $objWMIServices.count;$i++)

{write-host "/\" -noNewLine -foregroundColor Red} # -noNewLine make sure write-host write everything in one line without starting a new line.


$dteDiff=New-TimeSpan $dteStart $dteEnd

write-host `n "there are " $objWMIServices.count `

"products installed. It took" $dteDiff.Seconds "seconds "`

"for this script to complete".
Work on system environment

Two ways to get the environment variables:

1. We can use Get-WmiObject cmdlet to view the common properties of the WIN32_Environment WMI class. Most of time, we only need to know the name, variableValue and userName, so we can use Format-table to list the variables nicely.  -AutoSize argument can make the space between two columns tidy.


PS C:\Windows\system32> gwmi win32_environment | ft name,variableValue -AutoSize

name                   variableValue                                                                                    

----                   -------------                                                                                    

FP_NO_HOST_CHECK       NO                                                                                               

USERNAME               SYSTEM                                                                                           

Path                   %SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;%SYSTEMROOT%\System32\WindowsPow...

ComSpec                %SystemRoot%\system32\cmd.exe                                                                    

TMP                    %SystemRoot%\TEMP                                                                                

OS                     Windows_NT                                                                                       

windir                 %SystemRoot%                                                                                     

PROCESSOR_ARCHITECTURE AMD64                                                                                            

TEMP                   %SystemRoot%\TEMP                                                                                

PATHEXT                .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC                                            

PSModulePath           %SystemRoot%\system32\WindowsPowerShell\v1.0\Modules\                                            

NUMBER_OF_PROCESSORS   1                                                                                                

PROCESSOR_LEVEL        6                                                                                                

PROCESSOR_IDENTIFIER   Intel64 Family 6 Model 78 Stepping 3, GenuineIntel                                               

PROCESSOR_REVISION     4e03                                                                                             

TMP                    %USERPROFILE%\AppData\Local\Temp                                                                 

TEMP                   %USERPROFILE%\AppData\Local\Temp

2. We can use the Env PS drive by using set-location cmdlet to set the location to the Env PS drive, then get-childItem to show the variables.

 PS C:\Windows\system32> Set-Location env:

PS Env:\> Get-ChildItem

Name                           Value                                                                                    

----                           -----                                                                                    

ALLUSERSPROFILE                C:\ProgramData                                                                           

APPDATA                        C:\Users\Administrator.WIN-T4NRETS7221\AppData\Roaming                                   

CommonProgramFiles             C:\Program Files\Common Files                                                            

CommonProgramFiles(x86)        C:\Program Files (x86)\Common Files                                                      

CommonProgramW6432             C:\Program Files\Common Files                                                            

COMPUTERNAME                   TEST                                                                                     

ComSpec                        C:\Windows\system32\cmd.exe                                                              

FP_NO_HOST_CHECK               NO                                                                                       

HOMEDRIVE                      C:                                                                                       

HOMEPATH                       \Users\Administrator.WIN-T4NRETS7221                                                     

LOCALAPPDATA                   C:\Users\Administrator.WIN-T4NRETS7221\AppData\Local                                     

LOGONSERVER                    \\TEST                                                                                   

NUMBER_OF_PROCESSORS           1                                                                                        

OS                             Windows_NT

You can change back to C drive by command sl (set-location): sl c:\

Enable Windows Remote Management

Launch the Group Policy Management Console (GPMC) and navigate to the following path: Computer Policies | Administrative Templates | Windows Components | Windows Remote Management (RM) | WinRM Service. Then, double-click Allow Remote Server Management Through WinRM Policy (Figure A).

Figure A


Select the radio button next to Enabled and place the “*” for each line in the text box next to IPv4 and IPv6. Now click OK to save the settings (Figure B).

Figure B


Note: WinRM will be set to allow connections from any IPv4/IPv6 addresses when using the “*”. However, if you wish to secure access to a specific IP address or IP range, enter that in the textbox instead to lockdown the WinRM environment.

2: Configure Windows Firewall Settings

While still in GPMC, navigate to the following path: Computer Policies |Windows Settings | Security Settings | Windows Firewall with Advanced Security (Figure C).

Figure C


Expand the selection and right-click Incoming Connections, New Rule. The New Inbound Rule Wizard will appear. Select the radio button next to Predefined and from the drop-down menu, select Windows Remote Management. Click Next to continue (Figure D).

Figure D


Two predefined rules will be displayed on this screen (Figure E). Click Next to proceed.

Figure E


Select the Allow The Connection option and click Finish to complete the configuration (Figure F).

Figure F


The two inbound rules should be successfully configured and displayed in GPMC (Figure G).

Figure G


3: Configure Windows Remote Service

The last step in the configuration phase also occurs in GPMC. Navigate to the following path: Computer Policies |Windows Settings | Security Settings | System Services (Figure H).

Figure H


Double-click the Windows Remote Management (WS-Management) service to configure the properties. In the new window that opens, select Automatic under Select Service Startup Mode and check the Define This Policy Setting option (Figure I).

Figure I


Navigate to the following path: Computer Policies | Preferences | Control Panel Settings | Services. Right-click it and select New | Service (Figure J). Under the General Tab, select No Change from the drop-down menu next to Startup. Enter WinRM in the text box next to the Service Name and select Start Service from the drop-down menu next to Service action (Figure K).

Figure J


Figure K


Under the Recovery Tab, select Restart The Service from the drop-down menu next to the First, Second, and Subsequent Failures sections, then click OK to save the settings changes.