Querying WMI with PowerShell

What WMI and CIM are

WMI — Windows Management Instrumentation — is the database Windows keeps about itself: hardware, operating system, services, processes, disks, network adapters, installed updates. A WMI class is one table in that database: Win32_OperatingSystem is the OS row, Win32_LogicalDisk is one row per drive, Win32_Service is one row per service.

Two cmdlets read it. Get-WmiObject is the original: it speaks DCOM, works only in Windows PowerShell 5.1, and was removed from PowerShell 7. Get-CimInstance is the replacement: it speaks WS-MAN, the same protocol as remoting, works in 5.1 and 7, and queries remote machines through WinRM without DCOM firewall holes.

The rule is simple: write Get-CimInstance for anything new. Get-WmiObject appears only in old scripts and old blog posts — when you meet one, translate it: Get-WmiObject -Class Win32_LogicalDisk becomes Get-CimInstance -ClassName Win32_LogicalDisk.

Query a class

Name the class, then narrow the rows. -Filter runs on the target machine, so only matching rows travel back — always prefer it to piping everything through Where-Object:

DriveType 3 means a local fixed disk; 2 is removable, 4 is network, 5 is optical. The -Query form is WQL, WMI's SQL-like language, for conditions -Filter cannot express. For remote machines, add -ComputerName and a CIM session: New-CimSession -ComputerName SRV01, then Get-CimInstance -CimSession $s -ClassName Win32_OperatingSystem. Remote CIM needs WinRM enabled on the target — Enable-PSRemoting on the server, and the client must trust the host or be domain-joined.

Common classes worth memorizing: Win32_ComputerSystem (model, manufacturer, total memory), Win32_BIOS (serial number), Win32_Process, Win32_Service, Win32_QuickFixEngineering (installed hotfixes), Win32_NetworkAdapterConfiguration (IP settings, filter IPEnabled=TRUE).

Try it: list local disks

List every local disk with its free and total space in GB:

Each row is one local disk: DeviceID is the drive letter, FreeGB and SizeGB are calculated properties dividing the raw byte counts by 1GB and rounding to one decimal. A machine with only a C: drive returns one row; servers return one per volume.

Common mistakes

• Using Get-WmiObject in PowerShell 7. It does not exist there. The command is not found, full stop. Use Get-CimInstance and -ClassName instead of -Class.
• Filtering client-side. Piping every Win32_Process row through Where-Object pulls the whole table across the network first. -Filter narrows it on the target.
• Wrong DriveType. DriveType=3 is a local disk. Forgetting the filter returns CD drives, USB sticks and mapped network drives in the same list.
• Remote queries without WinRM. Get-CimInstance -ComputerName fails when the target has no WinRM listener. Run Enable-PSRemoting on the target first, and check Test-WSMan.
• Reading bytes as GB. FreeSpace and Size are bytes. Dividing by 1GB — not 1000 — gives the gibibytes Windows itself reports.

Your turn

On your own machine, list the installed hotfixes with Win32_QuickFixEngineering, showing HotFixID and InstalledOn, newest first. Then query Win32_BIOS for the serial number — the same value asset tags are built from.

Prove it: write it alone

Blank editor. No starter, no hints. Write a query that returns every stopped service on the local machine using WQL -Query, showing only Name and State — then rewrite it with -ClassName and -Filter instead.