Get-CimInstance: Get WMI Objects with PowerShell
In case you haven’t heard, starting on January 29, 2024, Microsoft has deprecated the Windows Management Instrumentation Command-line (WMIC), disabled by default on Windows 11 insider builds. If your application depends on WMIC, Microsoft, in their documentation, recommends that you migrate away from it. Get-CimInstance cmdlet is a modern PowerShell-based tool with tremendous value you can use to interact with WMI classes and the Common Information Model (CIM) with various parameters.
Table of contents
Get-CimInstance
With the deprecation of WMI and the newer CIM instance object and the Get-CimInstance cmdlet, admins get a more robust, efficient, and versatile tool. Unlike its predecessor, Get-WmiObject, Get-CimInstance uses the CIM server over the more dated Component Object Model (COM) interface. This leads to performance benefits and more efficient network communication when managing remote computers.
Take a look at the output of a Get-Help Get-CimInstance cmd.NAME
Get-CimInstance
SYNTAX
Get-CimInstance [-ClassName] <string> [-ComputerName <string[]>] [-KeyOnly] [-Namespace <string>]
[-OperationTimeoutSec <uint>] [-QueryDialect <string>] [-Shallow] [-Filter <string>] [-Property <string[]>]
[<CommonParameters>]
Get-CimInstance [-InputObject] <ciminstance> -CimSession <CimSession[]> [-ResourceUri <uri>] [-OperationTimeoutSec
<uint>] [<CommonParameters>]
Get-CimInstance -CimSession <CimSession[]> -Query <string> [-ResourceUri <uri>] [-Namespace <string>]
[-OperationTimeoutSec <uint>] [-QueryDialect <string>] [-Shallow] [<CommonParameters>]
Get-CimInstance [-ClassName] <string> -CimSession <CimSession[]> [-KeyOnly] [-Namespace <string>]
[-OperationTimeoutSec <uint>] [-QueryDialect <string>] [-Shallow] [-Filter <string>] [-Property <string[]>]
[<CommonParameters>]
Get-CimInstance -CimSession <CimSession[]> -ResourceUri <uri> [-KeyOnly] [-Namespace <string>]
[-OperationTimeoutSec <uint>] [-Shallow] [-Filter <string>] [-Property <string[]>] [<CommonParameters>]
Get-CimInstance -ResourceUri <uri> [-ComputerName <string[]>] [-KeyOnly] [-Namespace <string>]
[-OperationTimeoutSec <uint>] [-Shallow] [-Filter <string>] [-Property <string[]>] [<CommonParameters>]
Get-CimInstance [-InputObject] <ciminstance> [-ResourceUri <uri>] [-ComputerName <string[]>] [-OperationTimeoutSec
<uint>] [<CommonParameters>]
Get-CimInstance -Query <string> [-ResourceUri <uri>] [-ComputerName <string[]>] [-Namespace <string>]
[-OperationTimeoutSec <uint>] [-QueryDialect <string>] [-Shallow] [<CommonParameters>]CIM advantages
CIM is a standard that is defined by the Distributed Management Task Force (DMTF). It is a standardized way of describing management data. With CIM, admins can use a consistent approach across different platforms.
Get-CimInstance Examples for Local and Remote System Queries
The cmdlet allows you to query a wide range of system information, including installed software and services and hardware details.
Querying Local Computer Information
Let’s use Get-CimInstance to query the local computer. The simplest form of a Get-CimInstance command looks like this:
Get-CimInstance -ClassName CIM_OperatingSystemThis command fetches basic operating system details. But Get-CimInstance shines in its ability to filter and refine these queries using the -Property parameter to specify only the key properties you’re interested in.
Remote Computer queries
Let’s use Get-CimInstance for remote system management. We need to use the ComputerName parameter. This allows queries across the network on remote systems. For instance, to get the operating system information from a remote machine, you’d use the WMI class “CIM_OperatingSystem”:
Get-CimInstance -ClassName CIM_OperatingSystem -ComputerName "RemoteComputerName"
You can also query multiple remote computers in a single command by passing an array of computer names to the ComputerName parameter.
Advanced Get-CimInstance Query techniques
To truly leverage Get-CimInstance, understanding its advanced querying capabilities is key. The -Query parameter allows for WMI Query Language (WQL) statements, offering precise control over the data retrieved.
Filtering with WQL
For example, to retrieve processor information only for processors with a speed greater than 2 GHz, you would use:
Get-CimInstance -Query "SELECT * FROM CIM_Processor WHERE MaxClockSpeed > 2000"
CIM Sessions
CIM sessions enable persistent connections to remote systems. This has an advantage for executing multiple operations on the same remote computer. It minimizes the management to create connections for each query.
Establishing a CIM Session
Creating a CIM session is straightforward:
$session = New-CimSession -ComputerName "RemoteComputerName" Get-CimInstance -ClassName CIM_OperatingSystem -CimSession $sessionUsing Get-CimInstance to query the Event log
We can use Get-CimInstance to query the event log.
To monitor system events, you might use:
Get-CimInstance -ClassName Win32_NTLogEvent -Filter "Logfile = 'System' AND EventType = 1"With this command you can monitor and list critical system events and all the properties of each.
Troubleshooting
WMI and WinRM can still be quirky when it comes to domain permissions and workgroup configurations. The command is sensitive to using a computer name or IP address in an operation or connection, as you can see below:
In the above, you will need to make sure to use the computer name for the commands instead.
Below, a workgroup computer is attempting to query a server that is joined to a Windows domain.
Wrapping up
Get-CimInstance is a great PowerShell cmdlet for system management and has many features. It can query multiple WMI classes locally and remotely. You can use a New-CimSession cmdlet to establish a session that can be reused, and you can also use it for real-world examples like querying the event logs. These cmdlets are the future for an administrator querying objects in a script or accessing quick information from the command line.
