WMI and PowerShell

Richard Siddaway Profile: Richard Siddaway

WMI has been around since the days of Windows NT. We have been able to use it via various tools including VBScript. The formatting of VBScript was poor so the Scriptomatic tool was produced by the Microsoft Script Center to make it easier.

PowerShell support for WMI is a huge step forward compared to what we have had before.  We have already seen the Get-WmiObject cmdlet in action. This was the main stay of PowerShell support in version 1. We also had some accelerators –

[WMI]

[WMIClass]

[WMISearcher]

These can be used to quickly create PowerShell objects of the correct type.

[WMI] can used as an alternative to Get-WmiObject

Get-WmiObject -Class Win32_Process -Filter “Name = ‘Winword.exe'”

[wmi][WMI]’root\cimv2:Win32_Process.Handle=”4144″‘

Both return the same object but Get-WmiObject is easier to use so we will concentrate on that method.

[WMIClass] can be used to create an instance of a WMI class so

([wmiclass]’Win32_process’).Create(“Notepad.exe”)

Will start up a new process with an instance of notepad.

Our final accelerator is used to search for one of more instances of a WMI class

([wmisearcher]’Select * from Win32_process where Name=”winword.exe”‘).Get() |

Format-Table Name, processid -autosize

This is the same as

get-wmiobject -class Win32_process -filter ‘Name=”winword.exe”‘ |

Format-Table Name, processid -autosize

Already we are seeing one of the potential issues with PowerShell – there are usually multiple, valid ways to achieve the goal. Usually we will pick our favourite and stick with it. It pays to be aware of the other options so that we can use them if need be.

PowerShell v2 adds even more WMI support. As well as beefing up Get-WmiObject we get more cmdlets for working with WMI.

PS> Get-help *-wmi*  | Format-Table Name, Synopsis -Wrap

Name                      Synopsis

----                      --------

Get-WmiObject             Gets instances of Windows Management Instrumentation

                          (WMI) classes or information about the available

                           classes.

Invoke-WmiMethod          Calls Windows Management Instrumentation

                          (WMI) methods.

Remove-WmiObject          Deletes an instance of an existing Windows Management

                          Instrumentation (WMI) class.

Register-WmiEvent         Subscribes to a Windows Management Instrumentation

                          (WMI) event.

Set-WmiInstance           Creates or updates an instance of an existing Windows

                          Management Instrumentation (WMI) class.

We will be seeing these commands a lot during our investigation of what we can do with PowerShell and WMI.

Comment     RSS Feed     Email a friend