Get the CIM instances of a class from a CIM server. Equivalent to the old WMI cmdlet Get-WmiObject , the CIM version uses WSMAN (WinRM) to connect to remote machines and is therefore an order of magnitude faster.
Syntax
Get-CimInstance [-ClassName] String [-Filter String]
[ -ComputerName String[] | -CimSession CimSession[] ]
[-KeyOnly] [-Namespace String] [-Shallow]
[-Property String[]] [-QueryDialect String]
[-OperationTimeoutSec UInt32] [CommonParameters]
Get-CimInstance -ResourceUri Uri [-Filter String]
[ -ComputerName String[] | -CimSession CimSession[] ]
[-KeyOnly] [-Namespace String] [-Shallow]
[-Property String[]]
[-OperationTimeoutSec UInt32] [CommonParameters]
Get-CimInstance -Query String
[ -ComputerName String[] | -CimSession CimSession[] ]
[-Namespace String] [-Shallow] [-QueryDialect String]
[-ResourceUri Uri]
[-OperationTimeoutSec UInt32] [CommonParameters]
Get-CimInstance [-InputObject] CimInstance
[ -ComputerName String[] | -CimSession CimSession[] ]
[-ResourceUri Uri]
[-OperationTimeoutSec UInt32] [CommonParameters]
Key
-CimSession CimSession[]
The CIM session to use for this cmdlet. Enter a variable that contains the CIM session or a
command that creates or gets the CIM session, such as the New-CimSession or Get-CimSession cmdlets.
For more information, see about_CimSessions.
-ClassName String
The name of the CIM class for which to retrieve the CIM instances.
NOTE: You can use tab completion to browse the list of classes, because wps_2 gets a list of classes
from the local WMI server to provide a list of class names.
-ComputerName String[]
The computer on which you want to run the CIM operation. You can specify a fully qualified domain
name (FQDN), a NetBIOS name, or an IP address.
If you specify this parameter, the cmdlet creates a temporary session to the specified computer
using the WsMan protocol.If you do not specify this parameter, the cmdlet performs the operation
on the local computer using Component Object Model (COM).
Aliases: -CN, -ServerName
Using a CIM session will improve performance when multiple operations are being performed on the
same computer
-Filter String
Specifies a where clause to use as a filter. Specify the clause in either the WQL or the CQL query
language. Do not include the where keyword in the value of the parameter.
-InputObject CimInstance
Specifies a CIM instance object to use as input.
If you are already working with a CIM instance object, you can use this parameter to pass the CIM
instance object in order to get the latest snapshot from the CIM server.
When you pass a CIM instance object as an input, Get-CimInstance returns the object from server
using a get CIM operation, instead of an enumerate or query operation.
A get CIM operation is more efficient than retrieving all instances and then filtering them.
If the CIM class does not implement the get operation, then specifying the InputObject parameter
returns an error. Alias: -CimInstance (do not confuse with -CimSession).
-KeyOnly
Indicates that only objects with key properties populated are returned.
Specifying the KeyOnly parameter reduces the amount of data transferred over the network.
Use the KeyOnly parameter to return only a small portion of the object, which can be used for
other operations, such as the Set-CimInstance or Get-CimAssociatedInstance cmdlets.
-Namespace String
Specifies the namespace of CIM class.
The default namespace is root/cimv2.
NOTE: You can use tab completion to browse the list of namespaces, because wps_2 gets a list
of namespaces from the local WMI server to provide the list of namespaces.
-OperationTimeoutSec UInt32
Specifies the amount of time that the cmdlet waits for a response from the computer.
By default, the value of this parameter is 0, which means that the cmdlet uses the default
timeout value for the server.
If the OperationTimeoutSec parameter is set to a value less than the robust connection retry
timeout of 3 minutes, network failures that last more than the value of the OperationTimeoutSec
parameter are not recoverable, because the operation on the server times out before the client
can reconnect.
-Property String[]
Specifies a set of instance properties to retrieve.
Use this parameter when you need to reduce the size of the object returned, either in memory or
over the network.
The object returned always has key properties populated, irrespective of the set of properties
listed by the Property parameter. Other properties of the class are present but they are not populated.
-Query String
A query to run on the CIM server. For WQL-based queries, you can only use a SELECT query that
returns instances.
If the value specified contains double quotes (“), single quotes (‘), or a backslash (\), you must
escape those characters by prefixing them with the backslash (\) character. If the value specified
uses the WQL LIKE operator, then you must escape the following characters by enclosing them in
square brackets ([]): percent (%), underscore (_), or opening square bracket ([).
You cannot use a metadata query to retrieve a list of classes or an event query. To retrieve a list
of classes, use the Get-CimClass cmdlet.
To retrieve an event query, use the Register-CimIndicationEvent cmdlet.
You can specify the query dialect using the -QueryDialect parameter.
-QueryDialect String
Specifies the query language used for the Query parameter.
psdx_paramvalues WQL or CQL.
The default value is WQL.
-ResourceUri Uri
Specifies the resource uniform resource identifier (URI) of the resource class or instance.
The URI is used to identify a specific type of resource, such as disks or processes, on a computer.
A URI consists of a prefix and a path to a resource. For example:
http://schemas.microsoft.com/wbem/wsman/1/wmi/root/cimv2/Win32_LogicalDisk
http://intel.com/wbem/wscim/1/amt-schema/1/AMT_GeneralSettings
By default, if you do not specify this parameter, the DMTF standard resource URI
http://schemas.dmtf.org/wbem/wscim/1/cim-schema/2/ is used and the class name is appended to it.
ResourceURI can only be used with CIM sessions created using the WSMan protocol, or when specifying
the ComputerName parameter, which creates a CIM session using WSMan. If you specify this parameter
without specifying the ComputerName parameter, or if you specify a CIM session created using DCOM
protocol, you will get an error, because the DCOM protocol does not support the ResourceURI parameter.
If both the -ResourceUri and -Filter parameters are specified, the -Filter parameter is ignored.
-Shallow
Return instances of a class without including the instances of any child classes.
By default, the cmdlet returns the instances of a class and its child classes.
The Common Information Model (CIM) is the DMTF standard [DSP0004] for describing the structure and behavior of managed resources such as storage, network, or software components.
As with all PowerShell cmdlet parameters, if there’s no ambiguity about what the parameter can be, then you can provide just part of the name. Instead of Get-CimInstance -ClassName SomeClass you can write Get-CimInstance -cl SomeClass
Standard Alias for Get-CIMInstance: gcim
The CIM classes available will vary according to your Operating System.
List all CIM classes:
PS C:\> Get-cimclassList all the classes involding discs:
PS C:\> Get-cimclass -List | Where cimClassName -like "*disk*"Some common CIM classes:
Win32_Baseboard (Motherboard) Win32_BIOS Win32_ComputerSystem Win32_LogicalDisk (hard disk) Win32_OperatingSystem (Virtual Memory) Win32_PingStatus Win32_Printer Win32_PrinterShare Win32_PhysicalMemory Win32_Process Win32_Processor (32+64 bit processor info) Win32_Product (avoid this: see Q974524) Win32_Share (File shares)List all properties of a class:
PS C:\> Get-CIMinstance -ClassName Win32_BIOS | Get-MemberAt the command line this can be simplified to:
PS C:\> Get-CIMinstance -Class Win32_BIOS | Get-Member
or if class name is the first item:
PS C:\> Get-CIMinstance Win32_BIOS | Get-MemberFind a specific class property:
PS C:\> gcim Win32_bios | Get-Member -MemberType property | Where { $_.name -match 'install'} or just: PS C:\> gcim Win32_bios | Get-Member -MemberType property | Where name -match 'install'
Display information about all processes on the machine 'Server64':
PS C:\> Get-CimInstance -ClassName Win32_Process -computername Server64
Get the computer install date:
PS> (Get-CimInstance -ClassName Win32_OperatingSystem).InstallDate
18 May 2023 12:24:16
Get the last boot time of the computer, note this is automatically formatted as a Date:
PS> Get-CimInstance -ClassName Win32_OperatingSystem | Select-Object LastBootUpTime
24 Jan 2023 11:09:31
List the GUID's of all software installed on a remote machine via Windows Installer:
PS C:\> Get-CimInstance -computername workstation64 Win32_Product | Format-Table IdentifyingNumber, Name, LocalPackage -AutoSize
Built-in account names are localized, so the names will change based on the language of the Windows OS.
Run a WMI query to return the built-in Administrator account based on its SID, a wildcard is used for the domain:
PS> Get-CimInstance -ClassName Win32_UserAccount -Filter "LocalAccount = TRUE and SID like 'S-1-5-%-500'"
List all the Win32_OperatingSystem properties available:
PS> Get-CimInstance -Class Win32_OperatingSystem | get-member
Get the system memory (RAM):
PS> $mem = Get-CimInstance -ClassName Win32_computerSystem | Select-Object TotalPhysicalMemory
PS> "Memory $([math]::Round($mem.TotalPhysicalMemory/1GB,2)) GB"
Ping a computer once with an ICMP timeout of 1000ms:
$ComputerName = 'computer64'
$Filter = 'Address="$ComputerName" and Timeout=1000'
Get-ciminstance Win32_PingStatus -Filter $Filter | Select-Object Address, ProtocolAddress, ResponseTime, TimeoutThe -filter can also specify multiple addresses:
'Address="example.com" and Timeout=2000 or Address="example2.com" and Timeout=2000'
Get the Mac Address of a remote machine (2=connected adapters):
PS C:\> Get-CimInstance -Query 'Select * From Win32_NetworkAdapter Where NetConnectionStatus=2' | Select-Object -Property Name, MacAddress
Set the DNS Search Order (equivalent to using Set-DNSClientServerAddress):
[string[]]$DNSServers = 'dns64','dns65'Get-CimInstance Win32_NetworkAdapterConfiguration -Filter "'IPEnabled=True' AND DHCPEnabled = 'False'" | Invoke-CimMethod -MethodName SetDNSServerSearchOrder @{ DNSServerSearchOrder = $DNSServers }
Determine the connected Domain Name/forest/DNS Server:
PS C:\> Get-CimInstance -ClassName Win32_NTDomain
Get a list of namespaces from a WMI server
PS C:\> $NS = Get-CimInstance –Namespace root –ClassName __Namespace
PS C:\> $NS
Get instances of a class filtered by using a query to find those that starts with 'postgresql':
PS C:\> Get-CimInstance -Query "SELECT * from Win32_Process WHERE name LIKE 'postgresql%'"
Display service names on the local machine filtered to those that starts with 'postgresql':
PS C:\> Get-CimInstance -ClassName Win32_Process -filter "name like 'postgresql%'" | select name
Get CIM instances from remote computer:
PS C:\> $comp = Get-CimInstance -ClassName Win32_ComputerSystem -ComputerName Server64, Server65
Get only the key properties, instead of all properties, this reduces the size of the object and network traffic:
PS C:\> Get-CimInstance -ClassName Win32_Process -KeyOnly
Display the command line that was used to launch svchost.exe processes:
PS C:\> gcim win32_process -filter "name='svchost.exe'" | Select-Object commandline, name
Retrieve items with the -Property parameter and perform other CIM operations, for example Set-CimInstance or Invoke-CimMethod.
PS C:\> $x = Get-CimInstance -ClassName Win32_Process -Property Name, KernelModeTime
PS C:\> $x | Invoke-CimMethod -MethodName GetOwner
List services that are set to start automatically:
PS C:\> gcim win32_service -filter "startmode='auto'" | select name,startmode
List services that are set to start automatically (same as above but written in WQL):
PS C:\> gcim -query "select * from win32_service where startmode='auto'" | select name,startmode
Display information about the Geolocation service (lfsvc):
PS C:\> gcim -query "select * from win32_service where name='lfsvc'"
View the Running/Stopped status of the Geolocation service, use Invoke-CimMethod to stop/start:
PS C:\> (gcim win32_service -filter "name='lfsvc'").State
Get the computer serial number (or Dell service tag) for a remote PC and convert it to a string:
PS C:\> (gcim win32_systemenclosure -computername wkstn64).SerialNumber
or
PS C:\> gcim win32_bios -computername wkstn64 | Select-Object SerialNumber
Display BIOS and Memory information:
PS C:\> gcim win32_bios | format-list *
PS C:\> gcim Win32_ComputerSystem
PS C:\> gcim Win32_PhysicalMemory
Display the per-computer printers installed on workstation64:
PS C:\> Get-CimInstance -ClassName Win32_Printer -ComputerName "workstation64"
List the file shares on a remote server: SERVER64 (PowerShell equivalent of the RMTShare utility).
$shares = Get-CimInstance -class Win32_Share -computername SERVER64 -filter "Type=0"
$shares | ForEach-Object {
$path=($_.path)
$Description=($_.Description)
$name=($_.name)
$Caption=($_.Caption)
"Share Name : $name
Source Folder: $path
Description : $Description
Caption : $Caption"
}
“plus ça change, plus c'est la même chose (The more things change, the more they are the same.)” ~ Jean-Baptiste Alphonse Karr 1849.
HowTo: Remote inventory of OperatingSystem and Service Pack
Get-CimAssociatedInstance - Retrieve CIM instance by an association.
Get-CimClass - Get a list of CIM classes in a specific namespace.
Set-CimInstance - Modify a CIM instance on a CIM server.
Invoke-CimMethod - Invoke a method of a CIM class or CIM instance.
New-CimInstance - Create a new instance of a class.
Remove-CimInstance - Remove a CIM instance from a computer.
Register-CimIndicationEvent
Get-Credential - Get a security credential object based on a user name and password.
RUNDLL32 - Run a DLL command (add/remove print connections).
Identify installed applications without using Win32_Product - Microsoft Scripting blog.