CmdID / PowerShell / Cmdlets / Get
Get-WmiObject
Gets instances of Windows Management Instrumentation (WMI) classes or information about the available classes. PowerShell reference
From the PowerShell reference
18 parameters
Alias gwmi
1 Sigma rule looks for it
What it does
Gets instances of Windows Management Instrumentation (WMI) classes or information about the available classes. Starting in PowerShell 3.0, this cmdlet has been superseded by Get-CimInstance. The Get-WmiObject cmdlet gets instances of WMI classes or information about the available WMI classes. To specify a remote computer, use the ComputerName parameter. If the List parameter is specified, the cmdlet gets information about the WMI classes that are available in a specified namespace. If the Query parameter is specified, the cmdlet runs a WMI query language (WQL) statement. The Get-WmiObject cmdlet does not use Windows PowerShell remoting to perform remote operations. You can use the ComputerName parameter of the Get-WmiObject cmdlet even if your computer does not meet the requirements for Windows PowerShell remoting or is not configured for remoting in Windows PowerShell. Beginning in Windows PowerShell 3.0, the __Server property of the object that Get-WmiObject returns has a PSComputerName alias. This makes it easier to include the source computer name in output and reports.
Get-WmiObject [-Class] <String> [[-Property] <String[]>] [-Filter <String>] [-Amended] [-DirectRead] [-AsJob] [-Impersonation <ImpersonationLevel>] [-Authentication <AuthenticationLevel>] [-Locale <String>] [-EnableAllPrivileges] [-Authority <String>] [-Credential <PSCredential>] [-ThrottleLimit <Int32>] [-ComputerName <String[]>] [-Namespace <String>] [<CommonParameters>]Get-WmiObject [[-Class] <String>] [-Recurse] [-Amended] [-List] [-AsJob] [-Impersonation <ImpersonationLevel>] [-Authentication <AuthenticationLevel>] [-Locale <String>] [-EnableAllPrivileges] [-Authority <String>] [-Credential <PSCredential>] [-ThrottleLimit <Int32>] [-ComputerName <String[]>] [-Namespace <String>] [<CommonParameters>]Get-WmiObject [-Amended] [-DirectRead] -Query <String> [-AsJob] [-Impersonation <ImpersonationLevel>] [-Authentication <AuthenticationLevel>] [-Locale <String>] [-EnableAllPrivileges] [-Authority <String>] [-Credential <PSCredential>] [-ThrottleLimit <Int32>] [-ComputerName <String[]>] [-Namespace <String>] [<CommonParameters>]Get-WmiObject [-Amended] [-AsJob] [-Impersonation <ImpersonationLevel>] [-Authentication <AuthenticationLevel>] [-Locale <String>] [-EnableAllPrivileges] [-Authority <String>] [-Credential <PSCredential>] [-ThrottleLimit <Int32>] [-ComputerName <String[]>] [-Namespace <String>] [<CommonParameters>]Get-WmiObject [-Amended] [-AsJob] [-Impersonation <ImpersonationLevel>] [-Authentication <AuthenticationLevel>] [-Locale <String>] [-EnableAllPrivileges] [-Authority <String>] [-Credential <PSCredential>] [-ThrottleLimit <Int32>] [-ComputerName <String[]>] [-Namespace <String>] [<CommonParameters>]
Get processes on the local computer
Get-WmiObject -Class Win32_ProcessIdentifyGets services on a remote computer
Get-WmiObject -Class Win32_Service -ComputerName 10.1.4.62IdentifyGet WMI classes in the root or default namespace of the local computer
Get-WmiObject -Namespace "root/DEFAULT" -ListIdentifyGet a named service on multiple computers
Get-WmiObject -Query "select * from Win32_Service where name='WinRM'" -ComputerName Server01, Server02 |
Format-List -Property PSComputerName, Name, ExitCode, Name, ProcessId, StartMode, State, StatusIdentifyStop a service on a remote computer
(Get-WmiObject -Class Win32_Service -Filter "name='WinRM'" -ComputerName Server01).StopService()IdentifyGet the BIOS on the local computer
Get-WmiObject -Class Win32_BIOS | Format-List -Property *IdentifyGet the services on a remote computer
Get-WmiObject Win32_Service -Credential FABRIKAM\administrator -ComputerName FabrikamIdentifyIts page in the reference: Get-WmiObject.
Parameters
Show its 18 parameters
-AmendedGets or sets a value that indicates whether the objects that are returned from WMI should contain amended information. Typically, amended information is localizable information, such as object and property descriptions, that is attached to the WMI object.-AsJobRuns the command as a background job. Use this parameter to run commands that take a long time to finish.
When you use the AsJob parameter, the command returns an object that represents the background job and then displays the command prompt. You can continue to work in the session while the job finishes. If Get-WmiObject is used with the ComputerName parameter, the job is created on the local computer, and the results from remote computers are automatically returned to the local computer. To manage the job, use the cmdlets that contain the Job noun. To get the job results, use the Receive-Job cmdlet.
For more information about Windows PowerShell background jobs, see about_Jobs and about_Remote_Jobs.-AuthenticationSpecifies the authentication level to be used with the WMI connection. Valid values are:
- -1: Unchanged
- 0: Default
- 1: None (No authentication in performed.)
- 2: Connect (Authentication is performed only when the client establishes a relationship with
the application.)
- 3: Call (Authentication is performed only at the beginning of each call when the application
receives the request.)
- 4: Packet (Authentication is performed on all the data that is received from the client.)
- 5: PacketIntegrity (All the data that is transferred between the client and the application
is authenticated and verified.)
- 6: PacketPrivacy (The properties of the other authentication levels are used, and all the
data is encrypted.)-AuthoritySpecifies the authority to use to authenticate the WMI connection. You can specify standard NTLM or Kerberos authentication. To use NTLM, set the authority setting to ntlmdomain:<DomainName>, where <DomainName> identifies a valid NTLM domain name. To use Kerberos, specify kerberos:<DomainName>\<ServerName>. You cannot include the authority setting when you connect to the local computer.-ClassSpecifies the name of a WMI class. When this parameter is used, the cmdlet retrieves instances of the WMI class.-ComputerNameSpecifies the target computer for the management operation. Enter a fully qualified domain name (FQDN), a NetBIOS name, or an IP address. When the remote computer is in a different domain than the local computer, the fully qualified domain name is required.
The default is the local computer. To specify the local computer, such as in a list of computer names, use localhost, the local computer name, or a dot (.).
When specifying a remote computer, your current account or the one you specify with the Credential parameter must have appropriate permissions to access the information.
This parameter does not rely on Windows PowerShell remoting, which uses WS-Management. You can use
the ComputerName parameter of Get-WmiObject even if your computer is not configured to run
WS-Management remote commands.-CredentialSpecifies a user account that has permission to perform this action. The default is the current user. Type a user name, such as User01, Domain01\User01, or User@Contoso.com. Or, enter a PSCredential object, such as an object that is returned by the Get-Credential cmdlet. When you type a user name, you are prompted for a password. Credentials cannot be used when targeting the local computer.-DirectReadSpecifies whether direct access to the WMI provider is requested for the specified class without any regard to its base class or to its derived classes.-EnableAllPrivilegesEnables all the privileges of the current user before the command makes the WMI call.-FilterSpecifies a Where clause to use as a filter. Uses the syntax of the WMI Query Language (WQL).
IMPORTANT: Do not include the Where keyword in the value of the parameter. For example, the following commands return only the logical disks that have a DeviceID of C:\ and services that have the name 'WinRM' without using the Where keyword.
Get-WmiObject Win32_LogicalDisk -Filter "DeviceID = 'C:' "
Get-WmiObject Win32_Service -Filter "name='WinRM'"-ImpersonationSpecifies the impersonation level to use.
The acceptable values for this parameter are:
- 0: Default. Reads the local registry for the default impersonation level. The default is
usually set to Impersonate.
- 1: Anonymous. Hides the credentials of the caller.
- 2: Identify. Allows objects to query the credentials of the caller.
- 3: Impersonate. Allows objects to use the credentials of the caller.
- 4: Delegate. Allows objects to permit other objects to use the credentials of the caller.-ListGets the names of the WMI classes in the WMI repository namespace that is specified by the Namespace parameter.
If you specify the List parameter, but not the Namespace parameter, Get-WmiObject uses the root/CIMV2 namespace by default. This cmdlet does not use the Default Namespace registry entry in the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Scripting registry key to determine the default namespace.-LocaleSpecifies the preferred locale for WMI objects. Enter a value in MS_<LCID> format.-NamespaceWhen used with the Class parameter, the Namespace parameter specifies the WMI repository namespace where the specified WMI class is located. When used with the List parameter, it specifies the namespace from which to gather WMI class information.-PropertySpecifies the WMI class properties that this cmdlet gets information from. Enter the property names.-QueryRuns the specified WMI Query Language (WQL) statement. This parameter does not support event queries.-RecurseSearches the current namespace and all other namespaces for the class name that is specified by the Class parameter.-ThrottleLimitSpecifies the maximum number of WMI operations that can be executed simultaneously. This parameter is valid only when the AsJob parameter is used in the command.