Get-WmiObject

Get-WmiObject [-Class*] <String> [[-Property] <String[]>] [-Amended] [-AsJob] [-Authentication {Default | None |Connect | Call | Packet | PacketIntegrity | PacketPrivacy | Unchanged}] [-Authority <String>] [-ComputerName<String[]>] [-Credential <PSCredential>] [-DirectRead] [-EnableAllPrivileges] [-Filter <String>] [-Impersonation{Default | Anonymous | Identify | Impersonate | Delegate}] [-Locale <String>] [-Namespace <String>][-ThrottleLimit <Int32>] [<CommonParameters>]

Get-WmiObject [[-Class*] <String>] [-Amended] [-AsJob] [-Authentication {Default | None | Connect | Call | Packet |PacketIntegrity | PacketPrivacy | Unchanged}] [-Authority <String>] [-ComputerName <String[]>] [-Credential<PSCredential>] [-EnableAllPrivileges] [-Impersonation {Default | Anonymous | Identify | Impersonate | Delegate}][-List] [-Locale <String>] [-Namespace <String>] [-Recurse] [-ThrottleLimit <Int32>] [<CommonParameters>]

Get-WmiObject [-Amended] [-AsJob] [-Authentication {Default | None | Connect | Call | Packet | PacketIntegrity |PacketPrivacy | Unchanged}] [-Authority <String>] [-ComputerName <String[]>] [-Credential <PSCredential>][-DirectRead] [-EnableAllPrivileges] [-Impersonation {Default | Anonymous | Identify | Impersonate | Delegate}][-Locale <String>] [-Namespace <String>] -Query* <String> [-ThrottleLimit <Int32>] [<CommonParameters>]

Starting in Windows PowerShell 3.0, this cmdlet has been superseded by Get-CimInstancehttp://technet.microsoft.com/library/jj590758(v=wps.630).aspx.

The Get-WmiObject cmdlet gets instances of Windows Management Instrumentation (WMI) classes or information about the available WMI classes. To specify a remote computer, use the ComputerName parameter. If the List parameter is specified, the cmdlet gets information about the WMI classes that are available in a specified namespace. If the Query parameter is specified, the cmdlet runs a WMI query language (WQL) statement.

This cmdlet does not use Windows PowerShell remoting to perform remote operations. You can use the ComputerName parameter of the Get-WmiObject cmdlet even if your computer does not meet the requirements for Windows PowerShellremoting or is not configured for remoting in Windows PowerShell.

Beginning in Windows PowerShell 3.0, the __Server property of the object that Get-WmiObject returns has a PSComputerName alias. This makes it easier to include the source computer name in output and reports.

Parameters

-Amended [<SwitchParameter>]

Default value is False
Accepts pipeline input False

Indicates whether the objects that are returned from WMI should contain amended information. Typically, amended information is localizable information, such as object and property descriptions, that is attached to the WMI object.

-AsJob [<SwitchParameter>]

Default value is False
Accepts pipeline input False

Indicates that this cmdlet runs the command as a background job. Use this parameter to run commands that take a long time to finish.

When you use the AsJob parameter, the command returns an object that represents the background job and then displays the command prompt. You can continue to work in the session while the job finishes. If Get-WmiObject is used on a remote computer, the job is created on the local computer, and the results from remote computers are automatically returned to the local computer. To manage the job, use the cmdlets that contain the Job cmdlets. To get the job results, use the Receive-Job cmdlet.

To use this parameter with remote computers, the local and remote computers must be configured for remoting. Additionally, you must start Windows PowerShell by using the Run as administrator option in Windows Vista and later versions of Windows.

-Authentication <AuthenticationLevel>

Default value is None
Accepts pipeline input False

Specifies the authentication level to be used with the WMI connection. The acceptable values for this parameter are:

-1: Unchanged

0: Default

1: None (No authentication in performed.)

2: Connect (Authentication is performed only when the client establishes a relationship with the application.)

3: Call (Authentication is performed only at the beginning of each call when the application receives the request.)

4: Packet (Authentication is performed on all the data that is received from the client.)

5: PacketIntegrity (All the data that is transferred between the client and the application is authenticated and verified.)

6: PacketPrivacy (The properties of the other authentication levels are used, and all the data is encrypted.)

-Authority <String>

Default value is None
Accepts pipeline input False

Specifies the authority to use to authenticate the WMI connection. You can specify standard NTLM or Kerberos authentication. To use NTLM, set the authority setting to ntlmdomain:<DomainName>, where <DomainName> identifies a valid NTLM domain name. To use Kerberos, specify kerberos:<DomainName>\<ServerName>". You cannot include the authority setting when you connect to the local computer.

-Class <String>

This value is required
Default value is None
Accepts pipeline input False

Specifies the name of a WMI class. When this parameter is used, the cmdlet retrieves instances of the WMI class.

-ComputerName <String[]>

Default value is None
Accepts pipeline input False

Specifies the target computer for the management operation. Enter a fully qualified domain name (FQDN), a NetBIOS name, or an IP address. When the remote computer is in a different domain than the local computer, the fully qualified domain name is required.

The default is the local computer. To specify the local computer, such as in a list of computer names, use "localhost", the local computer name, or a dot (.).

This parameter does not rely on Windows PowerShell remoting, which uses WS-Management. You can use the ComputerName parameter of Get-WmiObject even if your computer is not configured to run WS-Management remote commands.

-Credential <PSCredential>

Default value is None
Accepts pipeline input False

Specifies a user account that has permission to perform this action. The default is the current user. Type a user name, such as User01, Domain01\User01, or [email protected]. Or, enter a PSCredential object, such as an object that is returned by the Get-Credential cmdlet. When you type a user name, you are prompted for a password.

-DirectRead [<SwitchParameter>]

Default value is False
Accepts pipeline input False

Specifies whether direct access to the WMI provider is requested for the specified class without any regard to its base class or to its derived classes.

-EnableAllPrivileges [<SwitchParameter>]

Default value is False
Accepts pipeline input False

Indicates that this cmdlet enables all the privileges of the current user before the command makes the WMI call.

-Filter <String>

Default value is None
Accepts pipeline input False

Specifies a Where clause to use as a filter. Uses the syntax of the WMI Query Language (WQL).

Important: Do not include the Where keyword in the value of the parameter. For example, the following commands return only the logical disks that have a DeviceID of 'c:' and services that have the name 'WinRM' without using the Where keyword.

`Get-WmiObject Win32_LogicalDisk -filter "DeviceID = 'c:' "`

`Get-WmiObject win32_service -filter "name='WinRM'"`

-Impersonation <ImpersonationLevel>

Default value is None
Accepts pipeline input False

Specifies the impersonation level to use.

The acceptable values for this parameter are:

0: Default. Reads the local registry for the default impersonation level , which is usually set to "3: Impersonate".

1: Anonymous. Hides the credentials of the caller.

2: Identify. Allows objects to query the credentials of the caller.

3: Impersonate. Allows objects to use the credentials of the caller.

4: Delegate. Allows objects to permit other objects to use the credentials of the caller.

-List [<SwitchParameter>]

Default value is False
Accepts pipeline input False

Gets the names of the WMI classes in the WMI repository namespace that is specified by the Namespace parameter.

If you specify the List parameter, but not the Namespace parameter, Get-WmiObject uses the Root\Cimv2 namespace by default. This cmdlet does not use the Default Namespace registry entry in the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Scripting registry key to determine the default namespace.

-Locale <String>

Default value is None
Accepts pipeline input False

Specifies the preferred locale for WMI objects. Enter a value in MS_<LCID> format.

-Namespace <String>

Default value is None
Accepts pipeline input False

Specifies the WMI repository namespace where the specified WMI class is located when used with the Class parameter. When used with the List parameter, it specifies the namespace from which to gather WMI class information.

-Property <String[]>

Default value is None
Accepts pipeline input False

Specifies the WMI class properties that this cmdlet gets information from. Enter the property names.

-Query <String>

This value is required
Default value is None
Accepts pipeline input False

Specifies WMI Query Language (WQL) statement that this cmdlet runs. This parameter does not support event queries.

-Recurse [<SwitchParameter>]

Default value is False
Accepts pipeline input False

Indicates that this cmdlet searches the current namespace and all other namespaces for the class name that is specified by the Class parameter.

-ThrottleLimit <Int32>

Default value is None
Accepts pipeline input False

Specifies the maximum number of WMI operations that can be executed simultaneously. This parameter is valid only when the AsJob parameter is used in the command.

<CommonParameters>

This cmdlet supports the common parameters: Verbose, Debug,ErrorAction, ErrorVariable, WarningAction, WarningVariable,OutBuffer, PipelineVariable, and OutVariable.

Inputs

None

You cannot pipe input to this cmdlet.

Outputs

PSObject or System.Management.Automation.RemotingJob

When you use the AsJob parameter, the cmdlet returns a job object. Otherwise, the object that Get-WmiObject returns depends on the value of the Class parameter.

Examples

Get processes on the local computer:
```
PS C:\> Get-WmiObject -Class Win32_Process
```
This command get the processes on the local computer.
Gets services on a remote computer:
```
PS C:\> Get-WmiObject -Class Win32_Service -ComputerName 127.0.0.1
```
This command gets the services on a remote computer. It uses the ComputerName parameter to specify the Internet Protocol (IP) address, 127.0.0.1. By default, the current account must be a member of the Administrators group on the remote computer.
Get WMI classes in the root or default namespace of the local computer:
```
PS C:\> Get-WmiObject -Namespace "root/default" -List
```
This command gets the WMI classes in the root or default namespace of the local computer.

Get a named service on multiple computers:

PS C:\> Get-WmiObject -Query "select * from win32_service where name='WinRM'" -ComputerName Server01, Server02 | Format-List -Property PSComputerName, Name, ExitCode, Name, ProcessID, StartMode, State, Status
PSComputerName : SERVER01
Name           : WinRM
ExitCode       : 0
Name           : WinRM
ProcessID      : 844
StartMode      : Auto
State          : Running
Status         : OK

   PSComputerName : SERVER02
   Name           : WinRM
   ExitCode       : 0
   Name           : WinRM
   ProcessID      : 932
   StartMode      : Auto
   State          : Running
   Status         : OK

This command gets the WinRM service on the computers that are specified by the value of the ComputerName parameter.

A pipeline operator (|) sends the output to the Format-List cmdlet, which adds the PSComputerName property to the default output. This makes it easy to see the computer on which the service resides. PSComputerName is an alias of the __Server property of the objects that Get-WmiObject returns. This alias is introduced in Windows PowerShell 3.0.

Stop a service on a remote computer:
```
PS C:\> (Get-WmiObject -Class Win32_Service -Filter "name='WinRM'" -ComputerName Server01).StopService()
```
This command stops the WinRM service on the Server01 remote computer. The command uses a Get-WmiObject command to get the WinRM service on Server01. Then, it invokes the StopService method of the Win32_Service WMI class on the object that the Get-WmiObject command returns.

This command is an alternative to using the Stop-Service cmdlet.

Get the BIOS on the local computer:

PS C:\> Get-WmiObject -Class Win32_Bios | Format-List -Property
Status                : OK
Name                  : Phoenix ROM BIOS PLUS Version 1.10 A05
Caption               : Phoenix ROM BIOS PLUS Version 1.10 A05
SMBIOSPresent         : True
__GENUS               : 2
__CLASS               : Win32_BIOS
__SUPERCLASS          : CIM_BIOSElement
__DYNASTY             : CIM_ManagedSystemElement
__RELPATH             : Win32_BIOS.Name="Phoenix ROM BIOS PLUS Version 1.10 �?�
__PROPERTY_COUNT      : 27
__DERIVATION          : {CIM_BIOSElement, CIM_SoftwareElement, CIM_LogicalElement,�?�
__SERVER              : Server01
__NAMESPACE           : root\cimv2
__PATH                : \\SERVER01\root\cimv2:Win32_BIOS.Name="Phoenix ROM BIOS
BiosCharacteristics   : {7, 9, 10, 11...}
BIOSVersion           : {DELL   - 15, Phoenix ROM BIOS PLUS Version 1.10 A05}
BuildNumber           :
CodeSet               :
CurrentLanguage       : en|US|iso8859-1
Description           : Phoenix ROM BIOS PLUS Version 1.10 A05
IdentificationCode    :
InstallableLanguages  : 1
InstallDate           :
LanguageEdition       :
ListOfLanguages       : {en|US|iso8859-1}
Manufacturer          : Dell Inc.
OtherTargetOS         :
PrimaryBIOS           : True
ReleaseDate           : 20101103000000.000000+000
SerialNumber          : 8VDM9P1
SMBIOSBIOSVersion     : A05
SMBIOSMajorVersion    : 2
SMBIOSMinorVersion    : 6SoftwareElementID     : Phoenix ROM BIOS PLUS Version 1.10 A05
SoftwareElementState  : 3
TargetOperatingSystem : 0
Version               : DELL   - 15
Scope                 : System.Management.ManagementScope
Path                  : \\SERVER01\root\cimv2:Win32_BIOS.Name="Phoenix ROM BIOS
Options               : System.Management.ObjectGetOptions
ClassPath             : \\JUNE-PC\root\cimv2:Win32_BIOS
Properties            : {BiosCharacteristics, BIOSVersion, BuildNumber, Caption...}
SystemProperties      : {__GENUS, __CLASS, __SUPERCLASS, __DYNASTY...}
Qualifiers            : {dynamic, Locale, provider, UUID}
Site                  :
Container             :

This command gets the BIOS on the local computer. The command uses a value of all (*) for the Property parameter of the Format-List cmdlet to display all properties of the returned object in a list. By default, only a subset (defined in the Types.ps1xml configuration file) are displayed.

Get the services on a remote computer:
```
PS C:\> Get-WmiObject Win32_Service -Credential FABRIKAM\administrator -Computer Fabrikam
```
This command uses the Credential parameter of the Get-WmiObject cmdlet to get the services on a remote computer. The value of the Credential parameter is a user account name. The user is prompted for a password.

Additional Notes

 * To access WMI information on a remote computer, the cmdlet must run under an account that is a member of the 
 local administrators group on the remote computer. Or, the default access control on the WMI namespace of the 
 remote repository can be changed to give access rights to other accounts.

 Only some of the properties of each WMI class are displayed by default. The set of properties that is 
 displayed for each WMI class is specified in the Types.ps1xml configuration file. To get all properties of a 
 WMI object, use the Get-Member or Format-List cmdlets.

This work is licensed under a Creative Commons Attribution 4.0 International. It is attributed to Microsoft Corporation and can be found here.

PowerShell Commands