PowerShell CIM versus WMI

CIM and WMI reach the same data through different plumbing. Get-WmiObject is the old cmdlet: it uses DCOM, needs a range of RPC ports open, and was removed in PowerShell 7. Get-CimInstance is the current one: it uses WinRM over a single port and is what you should write.

Lesson 2 min read Windows PowerShell 5.1 and PowerShell 7

Documentation: Microsoft Learn

Written and tested by Dhrub Bharali · Updated 02 October 2026

Overview

The mapping is mechanical. Get-WmiObject becomes Get-CimInstance, Invoke-WmiMethod becomes Invoke-CimMethod, and Remove-WmiObject becomes Remove-CimInstance. Class names and properties are unchanged, so converting an old script is mostly a find and replace.

One behavioural difference matters. WMI objects carried methods you could call directly, so $svc.StopService() worked. CIM returns inert data, so you use Invoke-CimMethod -InputObject $svc -MethodName StopService instead. This is the line that breaks when converting old scripts.

-Filter takes WQL and runs on the remote machine, so it is far cheaper than Where-Object, which filters after everything has crossed the network. Note the WQL syntax: single quotes around values, = rather than -eq.

For repeated queries against one host, create a session with New-CimSession and reuse it.

What happens

-Filter is WQL, which is why it reads State = 'Running' rather than PowerShell's -eq syntax. That filter runs where the data is, so only running services come back. StartName is the account the service runs under, which is the property Get-Service cannot give you.

Worth remembering

Get-CimInstance is current; Get-WmiObject is gone in PowerShell 7.
CIM objects don't expose callable methods — use Invoke-CimMethod.
-Filter is WQL and runs remotely; Where-Object runs locally.
CIM needs WinRM. WMI needed DCOM and a wide port range.

Primary documentation

Select-Object reference · Get-CimInstance reference

Try it

Browser simulation · fictional data; no changes to your computer.

Command

Interactive simulation · fictional data

Queries running services with a WQL filter, including the service account.

Show reference output

Browser dataset output · the real environment will differ

Name      Status   StartType
--------  -------  ---------
BITS      Running  Manual   
Dnscache  Running  Automatic
EventLog  Running  Automatic
Spooler   Running  Automatic
W32Time   Running  Manual

Keep going

Next: PowerShell Event logs