This is the built-in help made by Microsoft for the command 'Get-WmiObject', in PowerShell version 2 - as retrieved from
Windows version 'Microsoft® Windows Vista™ Ultimate ' PowerShell help files on 2016-06-23.
For PowerShell version 3 and up, where you have Update-Help, this command was run just before creating the web pages from the help files.
Gets instances of Windows Management Instrumentation (WMI) classes or information about the available classes.
Get-WmiObject [-Authority <string>] [-Amended] [-AsJob] [-Authentication {Default | None | Connect | Call | Packet | PacketIntegrity | PacketPriv
acy | Unchanged}] [-ComputerName <string[]>] [-Credential <PSCredential>] [-EnableAllPrivileges] [-Impersonation {Default | Anonymous | Identify
| Impersonate | Delegate}] [-Locale <string>] [-Namespace <string>] [-ThrottleLimit <int>] [<CommonParameters>]
Get-WmiObject [[-Class] <string>] [-Authority <string>] [-List] [-Recurse] [-Amended] [-AsJob] [-Authentication {Default | None | Connect | Call
| Packet | PacketIntegrity | PacketPrivacy | Unchanged}] [-ComputerName <string[]>] [-Credential <PSCredential>] [-EnableAllPrivileges] [-Imperso
nation {Default | Anonymous | Identify | Impersonate | Delegate}] [-Locale <string>] [-Namespace <string>] [-ThrottleLimit <int>] [<CommonParamet
ers>]
Get-WmiObject [-Authority <string>] [-Amended] [-AsJob] [-Authentication {Default | None | Connect | Call | Packet | PacketIntegrity | PacketPriv
acy | Unchanged}] [-ComputerName <string[]>] [-Credential <PSCredential>] [-EnableAllPrivileges] [-Impersonation {Default | Anonymous | Identify
| Impersonate | Delegate}] [-Locale <string>] [-Namespace <string>] [-ThrottleLimit <int>] [<CommonParameters>]
Get-WmiObject [-Class] <string> [[-Property] <string[]>] [-Authority <string>] [-DirectRead] [-Filter <string>] [-Amended] [-AsJob] [-Authenticat
ion {Default | None | Connect | Call | Packet | PacketIntegrity | PacketPrivacy | Unchanged}] [-ComputerName <string[]>] [-Credential <PSCredenti
al>] [-EnableAllPrivileges] [-Impersonation {Default | Anonymous | Identify | Impersonate | Delegate}] [-Locale <string>] [-Namespace <string>] [
-ThrottleLimit <int>] [<CommonParameters>]
Get-WmiObject -Query <string> [-Authority <string>] [-DirectRead] [-Amended] [-AsJob] [-Authentication {Default | None | Connect | Call | Packet
| PacketIntegrity | PacketPrivacy | Unchanged}] [-ComputerName <string[]>] [-Credential <PSCredential>] [-EnableAllPrivileges] [-Impersonation {D
efault | Anonymous | Identify | Impersonate | Delegate}] [-Locale <string>] [-Namespace <string>] [-ThrottleLimit <int>] [<CommonParameters>]
The Get-WmiObject cmdlet gets instances of WMI classes or information about the available WMI classes. The ComputerName parameter can always be u
sed to specify a remote computer. If the List parameter is specified, the cmdlet gets information about the WMI classes that are available in a
specified namespace. If the Query parameter is specified, the cmdlet runs a WMI query language (WQL) statement.
The Get-WmiObject cmdlet does not use the Windows PowerShell remoting infrastructure to perform remote operations. You can use the ComputerName p
arameter of the Get-WmiObject cmdlet even if your computer does not meet the requirements for Windows PowerShell remoting and even if your comput
er is not configured for remoting in Windows PowerShell.
<
Online version: http://go.microsoft.com/fwlink/?LinkID=113337
Invoke-WmiMethod
Remove-WmiObject
Set-WmiInstance
Get-WSManInstance
Invoke-WSManAction
New-WSManInstance
Remove-WSManInstance
<
-------------------------- EXAMPLE 1 --------------------------
C:\PS>get-wmiobject win32_process
__GENUS : 2
__CLASS : Win32_Process
__SUPERCLASS : CIM_Process
__DYNASTY : CIM_ManagedSystemElement
__RELPATH : Win32_Process.Handle="0"
__PROPERTY_COUNT : 45
__DERIVATION : {CIM_Process, CIM_LogicalElement, CIM_ManagedSystemElement}
__SERVER : SYSTEM01
__NAMESPACE : root\cimv2
__PATH : \\SYSTEM01\root\cimv2:Win32_Process.Handle="0"
Caption : System Idle Process
CommandLine :
CreationClassName : Win32_Process
CreationDate :
CSCreationClassName : Win32_ComputerSystem
CSName : SYSTEM01
Description : System Idle Process
ExecutablePath :
ExecutionState :
Handle : 0
HandleCount : 0
InstallDate :
KernelModeTime : 6138394740432
MaximumWorkingSetSize :
MinimumWorkingSetSize :
Name : System Idle Process
OSCreationClassName : Win32_OperatingSystem
OSName : Microsoftr Windows VistaT Ultimate |C:\Windows|\Device\Harddisk0\Partition3
OtherOperationCount : 0
OtherTransferCount : 0
PageFaults : 0
PageFileUsage : 0
ParentProcessId : 0
PeakPageFileUsage : 0
PeakVirtualSize : 0
PeakWorkingSetSize : 0
Priority : 0
PrivatePageCount : 0
ProcessId : 0
QuotaNonPagedPoolUsage : 0
QuotaPagedPoolUsage : 0
QuotaPeakNonPagedPoolUsage : 0
QuotaPeakPagedPoolUsage : 0
ReadOperationCount : 0
ReadTransferCount : 0
SessionId : 0
Status :
TerminationDate :
ThreadCount : 2
UserModeTime : 0
VirtualSize : 0
WindowsVersion : 6.0.6001
WorkingSetSize : 24576
WriteOperationCount : 0
WriteTransferCount : 0
ProcessName : System Idle Process
Handles : 0
VM : 0
WS : 24576
Path :
...
Description
-----------
This command displays information about all the processes that are running on a computer.
-------------------------- EXAMPLE 2 --------------------------
C:\PS>get-wmiobject win32_service -computername 127.0.0.1
__GENUS : 2
__CLASS : Win32_Process
__SUPERCLASS : CIM_Process
__DYNASTY : CIM_ManagedSystemElement
__RELPATH : Win32_Process.Handle="0"
__PROPERTY_COUNT : 45
__DERIVATION : {CIM_Process, CIM_LogicalElement, CIM_ManagedSystemElement}
__SERVER : SYSTEM02
__NAMESPACE : root\cimv2
__PATH : \\SYSTEM02\root\cimv2:Win32_Process.Handle="0"
Caption : System Idle Process
CommandLine :
CreationClassName : Win32_Process
CreationDate :
CSCreationClassName : Win32_ComputerSystem
CSName : SYSTEM02
Description : System Idle Process
ExecutablePath :
ExecutionState :
Handle : 0
HandleCount : 0
InstallDate :
KernelModeTime : 6138394740432
MaximumWorkingSetSize :
MinimumWorkingSetSize :
Name : System Idle Process
OSCreationClassName : Win32_OperatingSystem
OSName : Microsoftr Windows VistaT Ultimate |C:\Windows|\Device\Harddisk0\Partition3
OtherOperationCount : 0
OtherTransferCount : 0
PageFaults : 0
PageFileUsage : 0
ParentProcessId : 0
PeakPageFileUsage : 0
PeakVirtualSize : 0
PeakWorkingSetSize : 0
Priority : 0
PrivatePageCount : 0
ProcessId : 0
QuotaNonPagedPoolUsage : 0
QuotaPagedPoolUsage : 0
QuotaPeakNonPagedPoolUsage : 0
QuotaPeakPagedPoolUsage : 0
ReadOperationCount : 0
ReadTransferCount : 0
SessionId : 0
Status :
TerminationDate :
ThreadCount : 2
UserModeTime : 0
VirtualSize : 0
WindowsVersion : 6.0.6001
WorkingSetSize : 24576
WriteOperationCount : 0
WriteTransferCount : 0
ProcessName : System Idle Process
Handles : 0
VM : 0
WS : 24576
Path :
...
Description
-----------
This command displays information about the services on the remote computer. It displays the information by specifying the Internet Protocol (IP)
address 127.0.0.1. You can change this IP address to any other valid IP address on your network so that you can display information about the se
rvices on that remote computer. By default, the account you are running under must be a member of the local administrators group on the remote co
mputer that you specify .
-------------------------- EXAMPLE 3 --------------------------
C:\PS>get-wmiobject -namespace "root/default" -list
NameSpace: ROOT\default
Name Methods Properties
---- ------- ----------
__NotifyStatus {} {StatusCode}
__ExtendedStatus {} {Description, Operation, ParameterInfo, ProviderName...}
__SecurityRelatedClass {} {}
__Trustee {} {Domain, Name, SID, SidLength...}
__NTLMUser9X {} {Authority, Flags, Mask, Name...}
__ACE {} {AccessMask, AceFlags, AceType, GuidInheritedObjectType...}
__SecurityDescriptor {} {ControlFlags, DACL, Group, Owner...}
__PARAMETERS {} {}
__SystemClass {} {}
__ProviderRegistration {} {provider}
__EventProviderRegistration {} {EventQueryList, provider}
__ObjectProviderRegistration {} {InteractionType, provider, QuerySupportLevels, SupportsBat...
__ClassProviderRegistration {} {CacheRefreshInterval, InteractionType, PerUserSchema, prov...
__InstanceProviderRegistration {} {InteractionType, provider, QuerySupportLevels, SupportsBat...
__MethodProviderRegistration {} {provider}
__PropertyProviderRegistration {} {provider, SupportsGet, SupportsPut}
__EventConsumerProviderRegistration {} {ConsumerClassNames, provider}
__thisNAMESPACE {} {SECURITY_DESCRIPTOR}
__NAMESPACE {} {Name}
__IndicationRelated {} {}
__FilterToConsumerBinding {} {Consumer, CreatorSID, DeliverSynchronously, DeliveryQoS...}
__EventConsumer {} {CreatorSID, MachineName, MaximumQueueSize}
LogFileEventConsumer {} {CreatorSID, Filename, IsUnicode, MachineName...}
ActiveScriptEventConsumer {} {CreatorSID, KillTimeout, MachineName, MaximumQueueSize...}
NTEventLogEventConsumer {} {Category, CreatorSID, EventID, EventType...}
SMTPEventConsumer {} {BccLine, CcLine, CreatorSID, FromLine...}
CommandLineEventConsumer {} {CommandLineTemplate, CreateNewConsole, CreateNewProcessGro...
__AggregateEvent {} {NumberOfEvents, Representative}
__TimerNextFiring {} {NextEvent64BitTime, TimerId}
__EventFilter {} {CreatorSID, EventAccess, EventNamespace, Name...}
__Event {} {SECURITY_DESCRIPTOR, TIME_CREATED}
__NamespaceOperationEvent {} {SECURITY_DESCRIPTOR, TargetNamespace, TIME_CREATED}
__NamespaceModificationEvent {} {PreviousNamespace, SECURITY_DESCRIPTOR, TargetNamespace, T...
__NamespaceDeletionEvent {} {SECURITY_DESCRIPTOR, TargetNamespace, TIME_CREATED}
__NamespaceCreationEvent {} {SECURITY_DESCRIPTOR, TargetNamespace, TIME_CREATED}
__ClassOperationEvent {} {SECURITY_DESCRIPTOR, TargetClass, TIME_CREATED}
__ClassDeletionEvent {} {SECURITY_DESCRIPTOR, TargetClass, TIME_CREATED}
__ClassModificationEvent {} {PreviousClass, SECURITY_DESCRIPTOR, TargetClass, TIME_CREA...
__ClassCreationEvent {} {SECURITY_DESCRIPTOR, TargetClass, TIME_CREATED}
__InstanceOperationEvent {} {SECURITY_DESCRIPTOR, TargetInstance, TIME_CREATED}
__InstanceCreationEvent {} {SECURITY_DESCRIPTOR, TargetInstance, TIME_CREATED}
...
Description
-----------
This command displays the WMI classes in the root or default namespace of the local computer.
-------------------------- EXAMPLE 4 --------------------------
C:\PS>get-wmiobject -query "select * from win32_service where name='WinRM'" -computername server01, server02
ExitCode : 0
Name : WinRM
ProcessId : 1708
StartMode : Auto
State : Running
Status : OK
ExitCode : 0
Name : WinRM
ProcessId : 948
StartMode : Auto
State : Running
Status : OK
Description
-----------
This command displays information about the WinRM service on the computers that are specified in the ComputerName parameter.
-------------------------- EXAMPLE 5 --------------------------
C:\PS>(get-wmiobject win32_service -filter "name='WinRM'" -computername server01).StopService()
__GENUS : 2
__CLASS : __PARAMETERS
__SUPERCLASS :
__DYNASTY : __PARAMETERS
__RELPATH :
__PROPERTY_COUNT : 1
__DERIVATION : {}
__SERVER :
__NAMESPACE :
__PATH :
ReturnValue : 0
Another query using get-wmiobject -query "select * from win32_service where name='WinRM'" -computername server01, shows the service as stopped.
ExitCode : 0
Name : WinRM
ProcessId : 0
StartMode : Auto
State : Stopped
Status : OK
Description
-----------
This command stops the WinRM service on the Server01 remote computer. The command uses the standard Get-WmiObject command and adds a call to the
StopService method of the Win32_Service WMI class.
-------------------------- EXAMPLE 6 --------------------------
C:\PS>get-wmiobject win32_bios | format-list *
Status : OK
Name : Phoenix ROM BIOS PLUS Version 1.10 2.3.1
Caption : Phoenix ROM BIOS PLUS Version 1.10 2.3.1
SMBIOSPresent : True
__GENUS : 2
__CLASS : Win32_BIOS
__SUPERCLASS : CIM_BIOSElement
__DYNASTY : CIM_ManagedSystemElement
__RELPATH : Win32_BIOS.Name="Phoenix ROM BIOS PLUS Version 1.10 2.3.1 ",SoftwareElementID="Phoenix ROM BIOS
PLUS Version 1.10 2.3.1 ",SoftwareElementState=3,TargetOperatingSystem=0,Version="DELL - 14"
__PROPERTY_COUNT : 27
__DERIVATION : {CIM_BIOSElement, CIM_SoftwareElement, CIM_LogicalElement, CIM_ManagedSystemElement}
__SERVER : SERVER01
__NAMESPACE : root\cimv2
__PATH : \\SERVER01\root\cimv2:Win32_BIOS.Name="Phoenix ROM BIOS PLUS Version 1.10 2.3.1 ",Software
ElementID="Phoenix ROM BIOS PLUS Version 1.10 2.3.1 ",SoftwareElementState=3,TargetOperatingSys
tem=0,Version="DELL - 14"
BiosCharacteristics : {7, 9, 10, 11...}
BIOSVersion : {DELL - 14, Phoenix ROM BIOS PLUS Version 1.10 2.3.1 , Phoenix ROM BIOS PLUS Version 1.10 2.3
.1 , Phoenix ROM BIOS PLUS Version 1.10 2.3.1 }
BuildNumber :
CodeSet :
CurrentLanguage : en|US|iso8859-1
Description : Phoenix ROM BIOS PLUS Version 1.10 2.3.1
IdentificationCode :
InstallableLanguages : 1
InstallDate :
LanguageEdition :
ListOfLanguages : {en|US|iso8859-1}
Manufacturer : Dell Inc.
OtherTargetOS :
PrimaryBIOS : True
ReleaseDate : 20070521000000.000000+000
SerialNumber : 8PWRVD1
SMBIOSBIOSVersion : 2.3.1
SMBIOSMajorVersion : 2
SMBIOSMinorVersion : 3
SoftwareElementID : Phoenix ROM BIOS PLUS Version 1.10 2.3.1
SoftwareElementState : 3
TargetOperatingSystem : 0
Version : DELL - 14
Scope : System.Management.ManagementScope
Path : \\SERVER01\root\cimv2:Win32_BIOS.Name="Phoenix ROM BIOS PLUS Version 1.10 2.3.1 ",Software
ElementID="Phoenix ROM BIOS PLUS Version 1.10 2.3.1 ",SoftwareElementState=3,TargetOperatingSys
tem=0,Version="DELL - 14"
Options : System.Management.ObjectGetOptions
ClassPath : \\SERVER01\root\cimv2:Win32_BIOS
Properties : {BiosCharacteristics, BIOSVersion, BuildNumber, Caption...}
SystemProperties : {__GENUS, __CLASS, __SUPERCLASS, __DYNASTY...}
Qualifiers : {dynamic, Locale, provider, UUID}
Site :
Container :
Description
-----------
This command displays BIOS information. It displays all the properties of the WMI class, not just the properties that are specified in the Types.
ps1xml configuration file.
-------------------------- EXAMPLE 7 --------------------------
C:\PS>get-wmiobject win32_service -credential FABRIKAM\administrator -computer fabrikam
ExitCode : 0
Name : AeLookupSvc
ProcessId : 0
StartMode : Manual
State : Stopped
Status : OK
ExitCode : 1077
Name : ALG
ProcessId : 0
StartMode : Manual
State : Stopped
Status : OK
ExitCode : 1077
Name : AppIDSvc
ProcessId : 0
StartMode : Manual
State : Stopped
Status : OK
ExitCode : 0
Name : Appinfo
ProcessId : 888
StartMode : Manual
State : Running
Status : OK
ExitCode : 1077
Name : AppMgmt
ProcessId : 0
StartMode : Manual
State : Stopped
Status : OK
...
Description
-----------
This command displays service information on a computer named Fabrikam. It specifies a user account name by using the Credential parameter, which
causes a dialog box to be displayed in which you enter the corresponding password.