WMI Discovery using PowerShell

Article
1/17/2024

Introduction

This article explains how you can find WMI namespace, classes and properties and methods required for your task, without using any standalone tools.

Classes
It is easy to retrieve list of classes in PowerShell, just use Get-WmiObject cmdlet with -List parameter. Following command will show you all classes in default namespace (root/cimv2)

001	Get-WmiObject -List *

To find all classes where name contains "network", use following construction:

001	Get-WmiObject -List network

It is also possible to specify namespace to retrieve classes from, using -Namespace parameter:

001	Get-WmiObject -List * -Namespace root/microsoft/homenet

Namespaces

All WMI classes are organized in namespaces. While most of standard classes located in root/CIMv2 namespace, there is also many others, some of them added when you install new product.You can view namespaces using Get-WmiObject like other classes instances. Class name that you need to specify is __Namespace (two underscores are part of the name). For example to view namespaces contained in root namespace, you can use following command:

001	Get-WmiObject -Namespace root -Class __Namespace

To view all namespaces in the system you can recursively enumerate namespaces. Here is the function for this:

001
002
003
004
005
006
007
008
009

Function Get-WmiNamespace ($Path = 'root')
{
    foreach ($Namespace in (Get-WmiObject -Namespace $Path -Class __Namespace))
    {
        $FullPath = $Path + "/" + $Namespace.Name
        Write-Output $FullPath
        Get-WmiNamespace -Path $FullPath
     }
}

You need to start PowerShell console with elevated privileges to list all namespaces, because some of them require administrator rights to access.

Class Properties and Methods

If you can get an instance of WMI class, you can easily view its properties and methods using usual PowerShell ways. For example Get-Member to view all properties, methods and their definitions:

001	Get-WmiObject -Class win32_share \| Get-Member

or Format-List -Property * to list all properties of object and their values:

001	Get-WmiObject -Class win32_share \| Select-Object -First 1 \| Format-List -Property *

You may want to expand output of Get-Member to view more detailed information for methods, like their argument names and types:

001	Get-WmiObject -Class win32_share \| Get-Member -Name SetShareInfo \| Format-List

Static Members of Classes

Many of WMI Classes have "static" methods that are independent of instances and can be called without one. This methods commonly used to create new instances of class for example.
To view this members you can also use two approaches.
In first one, you need to get object representation of class, for example using [wmiclass] adapter, and then use Get-Member:

001
002

$class = [wmiclass]"win32_share"
$class | Get-Member

Because this is not an instance, but class itself, Get-Member will display not an instance members, but class ones.

Getting properties and methods without instantiating.

If you need to get properties and methods of class before receiving its instances you should use different approach. For example CIM_DataFile class requires a lot of resources to get all instances without filtering, and to filter it, you need to know its properties. This is possible using Get-WmiObject with -List parameter again. In this mode Get-WmiObject returns not just names of classes, but also definitions of their properties and methods that can be viewed. $ClassInfo = Get-WmiObject -List CIM_DataFile

001
002

$ClassInfo.Methods
$ClassInfo.Properties

Properties that have a "key" qualifier, can be used to WMI filtering (with -Filter parameter). Methods that have a "Static" qualifier are static members of a class.

Share via