Basic ways to get WMI information using only Powershell

What is WMI?

Windows Management Instrument is a systems-management technology developed by Microsoft to allow us to access information and services on Microsoft computers.

Why use WMI?

WMI allows you to gain information about things like.

• The operating system

• Processes

• Services

• Drivers

• Applications

• User accounts

• Security Settings

When you access WMI using Powershell your results become objects. These objects can show you different properties about what you are looking for but they also can have methods that allow you to take action on those results.

Generally, the way I use WMI is that if I want information or want to do something in PowerShell I will search PowerShell help to see if there is a cmdlet that will do it. If not I will then look for a command (executable) that will do it. After that, I will see if there is anything in WMI that can help me.

Also, because of how large WMI is often easier to find the commands you want from google search directly. This article will hopefully help you get a process for how to search for PowerShell if you can't find it on the internet or you just need help getting started on doing your own searching.

Example Problem

We need information about the operating system. There are multiple pieces of information we can choose from but for our purposes, we are looking for the build number of the operating system.

Find using a WMI cmdlet

1. Find the namespace

   Get-WmiObject -Namespace Root -Class __Namespace | select -property Name

   Note: CIMV2 has most of the information associated with the operating system and some of the hardware. I would suggest if you don't know one to choose start with CIMV2.

   

2. Find the class from the namespace

   Get-WmiObject -Namespace root\CIMv2 -list | where name -like '*oper*'

   

3. See the class and its results

   Get-WmiObject -Namespace root\cimv2 -class win32_operatingsystem

   

4. Optional: Select only a specific property

   Get-WmiObject -Namespace root\cimv2 -class win32_operatingsystem | select -Property buildnumber

   

Note: WMI cmdlets are technically deprecated. The newer cmdlets Microsoft has chosen to support are CIM cmdlets. CIM stands for the common interface model and has the advantage that work on windows computers and non-windows machines. Below I show the example process for finding a build number but using CIM.

Find using a CIM cmdlet

1. Get a list of the Namespace

   Get-CimInstance -Namespace Root -ClassName __Namespace

   

2. Search for a class

   Get-CimClass -Namespace root/CIMV2 | where -Property CimClassName -Like *oper*

   

3. Get an instance of the class you found

   Get-CimInstance -Namespace root/CIMV2 -ClassName Win32_OperatingSystem

   

   Here we can see our build number as well as other information about the operating system

4. Optional: Select only a specific property

   Get-CimInstance -Namespace root/CIMV2 -ClassName Win32_OperatingSystem | Select -Property BuildNumber

   

Summary and thoughts

WMI is a technology that allows you to access information about your windows system locally and remotely. I use WMI when I can't find a cmdlet or command in windows to display or do what I want in PowerShell. WMI cmdlets are deprecated and the fully supported cmdlets are CIM cmdlets. Google and often be easier but this should give you an idea of how to go about searching for yourself