CmdID / PowerShell / Cmdlets / Remove
Remove-WmiObject
Deletes an instance of an existing Windows Management Instrumentation (WMI) class. PowerShell reference
From the PowerShell reference
15 parameters
Alias rwmi
1 Sigma rule looks for it
What it does
Deletes an instance of an existing Windows Management Instrumentation (WMI) class. The Remove-WmiObject cmdlet deletes an instance of an existing Windows Management Instrumentation (WMI)class.
Remove-WmiObject [-Class] <String> [-AsJob] [-Impersonation <ImpersonationLevel>] [-Authentication <AuthenticationLevel>] [-Locale <String>] [-EnableAllPrivileges] [-Authority <String>] [-Credential <PSCredential>] [-ThrottleLimit <Int32>] [-ComputerName <String[]>] [-Namespace <String>] [-WhatIf] [-Confirm] [<CommonParameters>]Remove-WmiObject -InputObject <ManagementObject> [-AsJob] [-ThrottleLimit <Int32>] [-WhatIf] [-Confirm] [<CommonParameters>]Remove-WmiObject -Path <String> [-AsJob] [-Impersonation <ImpersonationLevel>] [-Authentication <AuthenticationLevel>] [-Locale <String>] [-EnableAllPrivileges] [-Authority <String>] [-Credential <PSCredential>] [-ThrottleLimit <Int32>] [-ComputerName <String[]>] [-Namespace <String>] [-WhatIf] [-Confirm] [<CommonParameters>]Remove-WmiObject [-AsJob] [-Impersonation <ImpersonationLevel>] [-Authentication <AuthenticationLevel>] [-Locale <String>] [-EnableAllPrivileges] [-Authority <String>] [-Credential <PSCredential>] [-ThrottleLimit <Int32>] [-ComputerName <String[]>] [-Namespace <String>] [-WhatIf] [-Confirm] [<CommonParameters>]Remove-WmiObject [-AsJob] [-Impersonation <ImpersonationLevel>] [-Authentication <AuthenticationLevel>] [-Locale <String>] [-EnableAllPrivileges] [-Authority <String>] [-Credential <PSCredential>] [-ThrottleLimit <Int32>] [-ComputerName <String[]>] [-Namespace <String>] [-WhatIf] [-Confirm] [<CommonParameters>]Remove-WmiObject [-AsJob] [-Impersonation <ImpersonationLevel>] [-Authentication <AuthenticationLevel>] [-Locale <String>] [-EnableAllPrivileges] [-Authority <String>] [-Credential <PSCredential>] [-ThrottleLimit <Int32>] [-ComputerName <String[]>] [-Namespace <String>] [-WhatIf] [-Confirm] [<CommonParameters>]Close all instances of a Win32 process
notepad
$np = Get-WmiObject -Query "select * from Win32_Process where name='notepad.exe'"
$np | Remove-WmiObjectIdentifyDelete a folder
$a = Get-WmiObject -Query "Select * From Win32_Directory Where Name ='C:\\Test'"
$a | Remove-WmiObjectIdentifyIts page in the reference: Remove-WmiObject.
Parameters
-AsJobIndicates that this cmdlet run as a background job. Use this parameter to run commands that take a long time to finish.
New CIM cmdlets, introduced Windows PowerShell 3.0, perform the same tasks as the WMI cmdlets. The CIM cmdlets comply with WS-Management (WSMan) standards and with the Common Information Model (CIM) standard, which enables the cmdlets to use the same techniques to manage computers that run the Windows operating system and those running other operating systems. Instead of using Remove-WmiObject, consider using the Remove-CimInstance cmdlet.
When you use the AsJob parameter, the command returns an object that represents the background job and then displays the command prompt. You can continue to work in the session while the job finishes. If Remove-WmiObject is used against a remote computer, the job is created on the local computer, and the results from remote computers are automatically returned to the local computer. To manage the job, use the cmdlets that contain the Job noun (the Job cmdlets). To get the job results, use the Receive-Job cmdlet.
To use this parameter for remote computers, the local and remote computers must be configured for remoting. …-AuthenticationSpecifies the authentication level to use for the WMI connection. The acceptable values for this parameter are:
- -1: Unchanged.
- 0: Default.
- 1: None.
No authentication in performed.
- 2: Connect.
Authentication is performed only when the client establishes a relationship with the application.
- 3: Call.
Authentication is performed only at the start of each call when the application receives the request.
- 4: Packet.
Authentication is performed on all the data that is received from the client.
- 5: PacketIntegrity.
All the data that is transferred between the client and the application is authenticated and verified.
- 6: PacketPrivacy.
The properties of the other authentication levels are used, and all the data is encrypted.-AuthoritySpecifies the authority to use to authenticate the WMI connection. You can specify standard NTLM or Kerberos authentication. To use NTLM, set the authority setting to ntlmdomain:<DomainName>, where <DomainName> identifies a valid NTLM domain name. To use Kerberos, specify kerberos:<DomainName>\\<ServerName>. You cannot include the authority setting when you connect to the local computer.-ClassSpecifies the name of a WMI class that this cmdlet deletes.-ComputerNameSpecifies the name of the computer on which this cmdlet runs. The default is the local computer.
This parameter does not rely on Windows PowerShell remoting. You can use the ComputerName parameter even if your computer is not configured to run remote commands.-CredentialSpecifies a user account that has permission to perform this action. The default is the current user.-EnableAllPrivilegesIndicates that this cmdlet enables all the permissions of the current user before the command it makes the WMI call.-ImpersonationSpecifies the impersonation level to use. The acceptable values for this parameter are:
- 0: Default.
Reads the local registry for the default impersonation level, which is usually set to 3: Impersonate.
- 1: Anonymous.
Hides the credentials of the caller.
- 2: Identify.
Allows objects to query the credentials of the caller.
- 3: Impersonate.
Allows objects to use the credentials of the caller.
- 4: Delegate.
Allows objects to permit other objects to use the credentials of the caller.-InputObjectSpecifies a ManagementObject object to use as input. When this parameter is used, all other parameters are ignored.-LocaleSpecifies the preferred locale for WMI objects. The Locale parameter is specified as an array in the MS_\<LCID> format in the preferred order.-NamespaceSpecifies the WMI repository namespace where the referenced WMI class is located when it is used with the Class parameter.-PathSpecifies the WMI object path of a WMI class, or specifies the WMI object path of an instance of a WMI class to delete.-ThrottleLimitSpecifies the maximum number of concurrent connections that can be established to run this command. This parameter is used together with the AsJob parameter. The throttle limit applies only to the current command, not to the session or to the computer.-ConfirmPrompts you for confirmation before running the cmdlet.-WhatIfShows what would happen if the cmdlet runs. The cmdlet is not run.