It’s always cool to work with a command prompt, batch file, etc. I still love to do a lot of work with command prompts and automate things with batch files. In this article, I will list you WMI Commands (Windows Management Instrumentation) that would be helpful to run a query within Windows 11/10/8/7 for various purposes.
Is WMIC available in Windows 11?
Microsoft has deprecated the WMIC feature and disabled it by default on Windows 11 Insider builds starting from January 29, 2024. Originally WMIC was deprecated in 2016 on Windows. Since then, it is available as a Feature on Demand (FoD) as a part of Windows 11 22H2. FoDs can be added to Windows 11 anytime and work on them. Feature on Demand is enabled by default on Windows 11 versions 22H2 and later. But, starting from January 29, 2024, they are disabled by default starting with the insider builds of Windows 11.
Windows Management Instrumentation Command-line or WMIC
Windows Management Instrumentation (WMI) is the infrastructure for management data and operations on Windows-based operating systems. You can write WMI scripts or applications to automate administrative tasks on remote computers, but WMI also supplies management data to other parts of the operating system and products, for example, System Center Operations Manager.
The following global switches are available:
/NAMESPACE Path for the namespace the alias operate against.
/ROLE Path for the role containing the alias definitions.
/NODE Servers the alias will operate against.
/IMPLEVEL Client impersonation level.
/AUTHLEVEL Client authentication level.
/LOCALE Language id the client should use.
/PRIVILEGES Enable or disable all privileges.
/TRACE Outputs debugging information to stderr.
/RECORD Logs all input commands and output.
/INTERACTIVE Sets or resets the interactive mode.
/FAILFAST Sets or resets the FailFast mode.
/USER User to be used during the session.
/PASSWORD Password to be used for session login.
/OUTPUT Specifies the mode for output redirection.
/APPEND Specifies the mode for output redirection.
/AGGREGATE Sets or resets aggregate mode.
/AUTHORITY Specifies the <authority type> for the connection.
/?[:<BRIEF|FULL>] Usage information.
For more information on a specific global switch, type: switch-name /?
Read: WMIC command give Access is denied error when connecting remotely
The following alias/es are available in the current role:
ALIAS - Access to the aliases available on the local system
BASEBOARD - Base board (also known as a motherboard or system board)
management.
BIOS - Basic input/output services (BIOS) management.
BOOTCONFIG - Boot configuration management.
CDROM - CD-ROM management.
COMPUTERSYSTEM - Computer system management.
CPU - CPU management.
CSPRODUCT - Computer system product information from SMBIOS.
DATAFILE - DataFile Management.
DCOMAPP - DCOM Application management.
DESKTOP - User's Desktop management.
DESKTOPMONITOR - Desktop Monitor management.
DEVICEMEMORYADDRESS - Device memory addresses management.
DISKDRIVE - Physical disk drive management.
DISKQUOTA - Disk space usage for NTFS volumes.
DMACHANNEL - Direct memory access (DMA) channel management.
ENVIRONMENT - System environment settings management.
FSDIR - Filesystem directory entry management.
GROUP - Group account management.
IDECONTROLLER - IDE Controller management.
IRQ - Interrupt request line (IRQ) management.
JOB - Provides access to the jobs scheduled using the schedule service
LOADORDER - Management of system services that define execution dependencies.
LOGICALDISK - Local storage device management.
LOGON - LOGON Sessions.
MEMCACHE - Cache memory management.
MEMORYCHIP - Memory chip information.
MEMPHYSICAL - Computer system's physical memory management.
NETCLIENT - Network Client management.
NETLOGIN - Network login information (of a particular user) management.
NETPROTOCOL - Protocols (and their network characteristics) management.
NETUSE - Active network connection management.
NIC - Network Interface Controller (NIC) management.
NICCONFIG - Network adapter management.
NTDOMAIN - NT Domain management.
NTEVENT - Entries in the NT Event Log.
NTEVENTLOG - NT eventlog file management.
ONBOARDDEVICE - Management of common adapter devices built into
the motherboard (system board).
OS - Installed Operating System/s management.
PAGEFILE - Virtual memory file swapping management.
PAGEFILESET - Page file settings management.
PARTITION - Management of partitioned areas of a physical disk.
PORT - I/O port management.
PORTCONNECTOR - Physical connection ports management.
PRINTER - Printer device management.
PRINTERCONFIG - Printer device configuration management.
PRINTJOB - Print job management.
PROCESS - Process management.
PRODUCT - Installation package task management.
QFE - Quick Fix Engineering.
QUOTASETTING - Setting information for disk quotas on a volume.
RDACCOUNT - Remote Desktop connection permission management.
RDNIC - Remote Desktop connection management on a specific
network adapter.
RDPERMISSIONS - Permissions to a specific Remote Desktop connection.
RDTOGGLE - Turning Remote Desktop listener on or off remotely.
RECOVEROS - Information that will be gathered from memory when the
operating system fails.
REGISTRY - Computer system registry management.
SCSICONTROLLER - SCSI Controller management.
SERVER - Server information management.
SERVICE - Service application management.
SHADOWCOPY - Shadow copy management.
SHADOWSTORAGE - Shadow copy storage area management.
SHARE - Shared resource management.
SOFTWAREELEMENT - Management of the elements of a software product installed
on a system.
SOFTWAREFEATURE - Management of software product subsets of SoftwareElement.
SOUNDDEV - Sound Device management.
STARTUP - Management of commands that run automatically when users
log onto the computer system.
SYSACCOUNT - System account management.
SYSDRIVER - Management of the system driver for a base service.
SYSTEMENCLOSURE - Physical system enclosure management.
SYSTEMSLOT - Management of physical connection points including ports,
slots and peripherals, and proprietary connections points.
TAPEDRIVE - Tape drive management.
TEMPERATURE - Data management of a temperature sensor (electronic thermometer).
TIMEZONE - Time zone data management.
UPS - Uninterruptible power supply (UPS) management.
USERACCOUNT - User account management.
VOLTAGE - Voltage sensor (electronic voltmeter) data management.
VOLUME - Local storage volume management.
VOLUMEQUOTASETTING - Associates the disk quota setting with a specific disk volume.
VOLUMEUSERQUOTA - Per user storage volume quota management.
WMISET - WMI service operational parameters management.
For more information on a specific alias, type: alias /?
CLASS - Escapes to full WMI schema. PATH - Escapes to full WMI object paths. CONTEXT - Displays the state of all the global switches. QUIT/EXIT - Exits the program.
Here is an example:
QFE command is something I often use to find out the list of hotfixes or security updates applied to the system.
Usage:
Open the command prompt and type in wmic qfe. This will give you the list!
Output:
Caption CSName Description HotFixID InstalledBy http://go.microsoft.com/fwlink/?LinkId=161784 CAPTAINDBG Update KB971033 NT AUTHORITY\SYSTEM http://support.microsoft.com/?kbid=2079403 CAPTAINDBG Security Update KB2079403 NT AUTHORITY\SYSTEM http://support.microsoft.com/?kbid=2207566 CAPTAINDBG Security Update KB2207566 NT AUTHORITY\SYSTEM http://support.microsoft.com/?kbid=2281679 CAPTAINDBG Security Update KB2281679 NT AUTHORITY\SYSTEM http://support.microsoft.com/?kbid=2286198 CAPTAINDBG Security Update KB2286198 NT AUTHORITY\SYSTEM http://support.microsoft.com/?kbid=2296011 CAPTAINDBG Security Update KB2296011 NT AUTHORITY\SYSTEM
Also read: How to repair or rebuild the WMI Repository on Windows 11/10
What replaced WMIC?
WMIC is replaced by Windows PowerShell for WMI. Microsoft has been investing heavily in Windows PowerShell. Microsoft says they provide a more efficient way of querying WMI. It reduces the code complexity and keeps users more secure and productive.
Related read: How to use WMIC to connect to a remote computer.
Table of Contents
. What is WMI repository
. What is WQL
. Why you need to query WMI repository
. WMI Query with Windows Management Instrumentation Tester
. Query with freeware tool WMI Explorer by Alexander Kozlov
. How to query WMI with WQL
. How to query WMI with Powershell
. How to query WMI with Command Line (CMD) and Batch File
. Drilling down the aliases of WMIC in Command Line
Affiliate: Experience limitless no-code automation, streamline your workflows, and effortlessly transfer data between apps with Make.com.
This WMI query guide was arranged in order for the System Administrators to have the most useful options on one page.
What is WMI repository
“Windows Management Instrumentation (WMI) is the Microsoft implementation of Web-Based Enterprise Management (WBEM), which is an industry initiative to develop a standard technology for accessing management information in an enterprise environment. WMI uses the Common Information Model (CIM) industry standard to represent systems, applications, networks, devices, and other managed components. CIM is developed and maintained by the Distributed Management Task Force”. The information is from Microsoft’s “About WMI” page. Basically, WMI is like a database table with many different and useful settings and information of the local computer / server hardware and software.
What is WQL
To query WMI – WMI Query Language (WQL) is used. WQL syntax is almost identical to SQL. In order to query WMI, you need to know the exact namespace. You can enumerate needed namespaces with WMI Explorer.
Why you need to query WMI repository
For making a good automation you definitely use or used even once WMI repository in order to query for different types of information. Even getting as simple as querying for your hardware model, you use WMI Repository reading queries. But how to know where the information is stored and in which tables? There are different WMI Monitors are available.
WMI Query with Windows Management Instrumentation Tester
The basic WMI tool is built into Windows: “Windows Management Instrumentation Tester”.
. To open it press [Win]+[R] to open “Run” window
. type “wbemtest” (No quotes needed) and [Enter].
. [Connect] to your local namespace like:
root\cimv2
or [Connect] to a namespace of a remote computer:
\\RemoteComputerName\root\cimv2
and you can run a [Query…] and other processes. Thus, if you know the structure of your table.
Here comes in a tool that can give you a full table structure. One of the tools that we cover in our WMI query guide is “WMI Explorer” by Alexander Kozlov. You can download it here at WMI Explorer Download page.
*** Many other cool WMI Tools can be found at Rob’s blog WMI Tools page.
When you open wmiexplorer.exe, you will be automatically connected to your Local WMI Repository to namespace: root\cimv2 (You can see it in the left-bottom corner of the window).
You can connect to another namespace:
[Action] => [Connect to host/namespace…]
Host: localhost
You can write here the name or IP of any computer on your network that you want to connect to its WMI.
Name space: rootAuth. Level: Default*** You can input the credentials if needed[OK]
While connected to the “root” namespace you can check all the classes and repositories that are available in that directory. If you want to know which subdirectories are existing, you can select “__NAMESPACE” and in left-bottom pane [Instances] you will see all the subdirectories. If you see an Instance “SECURITY” inside “__NAMESPACE”, you can connect to it by typing a name space in the Connect window, we used before:
Root\SECURITY
By selecting the tables in the main pane in the [Classes] tab, you will see their contents in the bottom-right pane and you will be presented with a query that you can run and check the results.
If you want to know which other subdirectories of “Root\SECURITY” there are, click on “__NAMESPACE” again in the main pane in the [Classes] tab and you see the subdirectories of that namespace in the bottom left pane in the [Instances] tab, to which you can also connect through the [Connect] window. Like if we see “sms” in [Instances] of “Root\SECURITY”, we will connect to:
Root\SECURITY\sms
How to query WMI with WQL
We need to understand how to query the WMI for information in our automations. In this WMI query guide we will explain the usage of WQL.
First of all, you can check if your WMI query is right inside the WMI Explorer.
*** Example:
. Open WMI Explorer
[Actions] => [Connect to host/namespace…]
Host: localhost
Name space: root\cimv2
[OK]
Click on (Select) the class "Win32_ComputerSystem"
After you made a selection, you will get the bottom line “Query” updated to:
SELECT * FROM Win32_ComputerSystem
*** This is WQL.
There is no need for capital letters in the syntax, but it is easier to recognize where the WQL commands and operators are and where the objects are.
You can go to [Query] tab on the top and [Execute] this query (remember that this query is executed in the “root\cimv2” namespace). You will receive all the properties and their values of this namespace. If you want to know specific Property (let’s say Model) you can change the “*” character to that property and [Execute]:
SELECT Model FROM Win32_ComputerSystemNow you have only Model (from class “Win32_ComputerSystem”) of your hardware returned from your query.
You can query for several Properties of that class at once:
SELECT Model, Manufacturer, WakeUpType, PartOfDomain FROM Win32_ComputerSystemThe Properties in WMI Explorer are returned in Alphabetical order, so you will see: Manufacturer, Model, PartOfDomain, WakeUpType.
If you want, you can query for more than one instance at a time. Let’s query for processes class:
SELECT * FROM Win32_ProcessYou will get all the processes that are running in the system right now. What if you want to return only “iexplore.exe” and “wmiprvse.exe”:
SELECT * FROM Win32_Process WHERE Caption = 'wmiprvse.exe' OR Caption = 'iexplore.exe'Now you will get only instances of that.
More operators available:
<>
Is "NOT EQUAL" operator
!=
Also "NOT EQUAL" operator
Or you can write: Not Caption = 'iexplore.exe'
Full syntax: SELECT * FROM Win32_Process WHERE Not Caption = 'iexplore.exe'
And you will be returned with all the processes that aren't "iexplore.exe"
Another example to return all the processes that contain “explore” in them:
SELECT * FROM Win32_Process WHERE Caption LIKE '%explore%'You will be returned all the Instances of “explorer.exe”, “wmiexplorer.exe” and “iexplore.exe”.
Now let’s say we want to return all the instances of “iexplore.exe” with Property SessionId of 2 and 8:
SELECT * FROM Win32_Process WHERE Caption = 'iexplore.exe' AND (SessionId = 2 OR SessionId = 8)If you want to return all the processes that are with Property “PageFileUsage” between 1000 and 4000:
SELECT * FROM Win32_Process WHERE PageFileUsage >1000 and PageFileUsage < 4000After we understood the basic syntax of WQL, let’s see how we can query it in our automations.
The most practical way is using Powershell cmdlet: “Get-WmiObject“. In this WMI query guide we will give some examples of using this Cmdlet.
To list all the available classes and events of particular namespace you can use “-List”:
Get-WmiObject –List –Namespace rootBy default, if “-Namespace” isn’t set in the command, “Get-WmiObject” uses namespace of “root/cimv2”.
In addition, by default the command is executed for WMI on a local computer, but you can query the WMI for a remote computer as well:
Get-WmiObject –List –Namespace root –ComputerName 10.10.10.240Also, if needed you can query local computer with “–ComputerName” parameter:
Get-WmiObject –List –Namespace root –ComputerName .or
Get-WmiObject –List –Namespace root –ComputerName localhostIf it is executed on a remote computer there may be a need for Credentials:
$Credential = Get-Credential
Get-WmiObject –List –Namespace root –ComputerName 10.10.10.240 -Credential $CredentialIf you want to know what are sub directories of the root namespace:
Get-WmiObject -Class __NAMESPACE -Namespace root | Select-Object NameCommand Explanations:
-Class __NAMESPACE
Is the class of sub directories of any namespace
-Namespace root
Is the root namespace of the whole WMI repository
| Select-Object Name
The output then Pipelined because we don’t need all the properties of all the subspaces. We need only the names, so we can choose the appropriate one.
The namespace with the regular information about your system is stored in “root/cimv2”, so let’s list all the classes under that namespace:
Get-WmiObject -List -Namespace root/cimv2If you want to find all the classes that somehow connected to disk, you may execute:
Get-WmiObject -List *disk* -Namespace root/cimv2Let’s query for some information class:
Get-WmiObject -Class Win32_ComputerSystem -Namespace root/cimv2Here you will see less details than you would see in wmiexplorer.exe.
To find all the processes:
Get-WmiObject -Class Win32_Process -Namespace root/cimv2To find all the processes with Caption of “iexplore.exe”:
Get-WmiObject -Class Win32_Process -Namespace root/cimv2 | where { $_.Caption -eq 'iexplore.exe' }If you want to find all the processes with Caption of “iexplore.exe” and “wmiprvse.exe”:
Get-WmiObject -Class Win32_Process -Namespace root/cimv2 | where { ( $_.Caption -eq 'iexplore.exe' ) -or ( $_.Caption -eq 'wmiprvse.exe' ) }To find all the processes with Caption of “iexplore.exe” and “wmiprvse.exe”, but output only Cpation and SessionId properties of the objects:
Get-WmiObject -Class Win32_Process -Namespace root/cimv2 | where { ( $_.Caption -eq 'iexplore.exe' ) -or ( $_.Caption -eq 'wmiprvse.exe' ) } | Select-Object Caption, SessionIdTo make it easier, better use the WQL queries for that matter:
Get-WmiObject -Namespace root/cimv2 -Query "SELECT Caption, SessionId FROM Win32_Process WHERE Caption = 'wmiprvse.exe' OR Caption = 'iexplore.exe'"In the example above, the returned properties are not only Caption and SessionId, there are many properties that are returned by the object. So, in Powershell it is better to return all the Properties and filter them with “Select-Object”:
Get-WmiObject -Namespace root/cimv2 -Query "SELECT * FROM Win32_Process WHERE Caption = 'wmiprvse.exe' OR Caption = 'iexplore.exe'" | Select-Object Caption, SessionIdNow we’ll execute full query from a server with credentials:
$Server = "SomeServerName001"
$Credential = Get-Credential
$Namespace = "root/cimv2"
$Query = "SELECT * FROM Win32_Process WHERE Caption = 'wmiprvse.exe' OR Caption = 'iexplore.exe'"
Get-WmiObject -Computername $Server -Credential $Credential -Namespace $Namespace -Query $QueryOrder in Powershell is very important. It is better to use Variables to execute such cmdlets. Also get used to put single quotes for the properties and not double quotes (example: ‘iexplore.exe’ and not “iexplore.exe”). Both of theצ will work, but if you will use “-Query” Method, you will use it with double quotes, so all the properties inside should be with single quotes.
How to query WMI with Command Line (CMD) and Batch File
There is an option querying WMI through Batch file or Command Line. In this WMI query guide we will explain how to do it in CMD.
The equivalent is “WMIC” command. In Command Line with Administrative privileges run:
WMIC /?*** More about WMIC usage can be found in Microsoft Docs.
You will get all the needed information and available aliases for daily usage. Like:
WMIC ComputerSystem GET ModelIs equivalent to WQL Query of:
SELECT Model FROM Win32_ComputerSystem“ComputerSystem” in WMIC is an alias for Class “Win32_ComputerSystem” of WQL and “GET” is a “verb” for “SELECT”. Different WMIC verbs are available in Microsoft Docs.
If you don’t know what the alias is (that you need for a particular namespace and class of WMI), you can use the full syntax:
WMIC /namespace:\root\cimv2 path Win32_ComputerSystem GET ModelIf you want all the Properties of the class and not only the “Model” you can:
WMIC /namespace:\root\cimv2 path Win32_ComputerSystem GET *This is equivalent to WQL of:
SELECT Model FROM Win32_ComputerSystemIn namespace “root\cimv2”.
You can also make it easier to view by formatting the output of WMIC:
WMIC /namespace:\root\cimv2 path Win32_ComputerSystem GET * /format:listIf you get “Access Denied” error and you’re in the domain, you will need to provide Administrator credentials:
WMIC /user:adminjohn /password:P@ssword /namespace:\root\cimv2 path Win32_ComputerSystem GET * /format:listWe wouldn’t recommend this method as the credentials are passed in plaintext, so better run “CMD.exe” as that user and then execute the command without the “/user” and “/password” switches.
If you need to run the command on remote computer:
WMIC /node:YourRemoteComputerName001 /namespace:\root\cimv2 path Win32_ComputerSystem GET * /format:listAnother example is mixing WQL query and WMIC:
WMIC /namespace:\root\cimv2 path win32_Process WHERE "Caption like '%explore%'"Will return you all the instances of the processes that contain “explore” in the Caption Property.
Drilling down the aliases of WMIC in Command Line:
In our WMI query guide we will explain how to get help from WMIC command, by drilling down each step of the command till we reach the desired result.
Run in CMD:
WMIC /?This will give you all the switches and the aliases available.
For example, you found that the alias for the Class “Win32_ComputerSystem” is “computersystem”. Now you want to know what the available verbs for that alias are:
WMIC ComputerSystem /?This will give you different examples of the verbs, but basics are “GET” to fetch the information and “SET” to set a value in the property. So now we want to know what properties of that alias are available:
WMIC ComputerSystem GET /?Off course most of them aren’t self-explanatory so you can run them in order to see their value:
WMIC ComputerSystem GET ResetCapabilityAfter you run the query, you will see that the first line is the name of the Property and if you want to use it in a variable in a Batch file, then you will need to skip this line. We use this in a batch in order to filter it out:
SET WMICCommand="WMIC /node:%ComputerName% os get version"
FOR /F "skip=1 tokens=*" %%X IN ('%WMICCommand%') DO (
echo %%X
goto endMe
)
: endMe
Sometimes the returned value contains a space character or two before the value and after the value, so you will need to filter those too.
Bonus: Here are some WMI query VBScript examples.
The Windows Management Instrumentation Command-line (WMIC) utility is a command-line interface (CLI) for working with Windows Management Instrumentation (WMI), a Web-Based Enterprise Management (WBEM) framework for accessing and managing information about Windows computers in enterprise environments.
What is the purpose of WMIC?
The main purpose of WMIC (Wmic.exe) is to provide a user-friendly CLI that allows Windows local system admins to access WMI. WMIC is fully compatible with existing shells and utility commands. Admins can use many prebuilt commands at the WMIC command prompt to do everything from the following:
- Determine what aliases are available for WMIC.
- List all the processes on specified computers where the ProcessID is greater than a certain number.
- Add to the list of nodes from which information is to be retrieved.
- Retrieve properties or call on a defined method.
- Perform specific actions using verbs like Assoc (to show the associations that the Administrators group has with the system), Create (to add a variable with a specific name and set its value to a folder below the Program Files folder), Delete (to delete an environment variable), List (to show data, such as system properties, object status or instance paths), and Get (to return the boot-partition Boolean description string).
Benefits of WMIC
Without WMIC, do-it-yourself systems management with WMI can be very difficult. One reason is that system admins would need to know a programming language like C++ or a scripting language like VBScript to write scripts. These scripts would be needed to gather information by means of WMI. But with WMIC, admins don’t have to write scripts. Instead, they can use the utility on a local machine regardless of WMI namespace permissions to obtain management data from remote computers with WMI.
The WMIC utility also eliminates the need to use WMI-based applications, the WMI Scripting API or tools to manage WMI-enabled computers. It provides a simple and intuitive way, plus batch scripts to extend WMI for operation from several command-line interfaces.
Admins don’t need to understand the WMI namespace to use WMIC. They can use the utility on local machines regardless of WMI namespace permissions. WMIC makes DIY systems management less complex by using aliases. An alias refers to a simple renaming of a class, property or method. Aliases take simple commands entered at the WMIC command line and then act on the WMI namespace in a predefined manner. By functioning as user-friendly syntax intermediaries between the user (admin) and the WMI namespace, aliases in WMIC make it easier for admins to use and read WMI for accessing management information.
How does WMI work?
WMI is Microsoft’s implementation of WBEM — a set of management specifications for defining how resources in enterprise computing environments can be discovered, accessed and manipulated. WMI is also based on the Common Information Model (CIM), a computer industry standard for representing systems, devices, applications and other managed components. The CIM standard lets system administrators and management programs control devices and applications from multiple manufacturers or sources in the same way.
WMI provides users with information about the status of local or remote computer systems and supports the following actions:
- Establish a connection to a remote computer to obtain data about it, such as its domain or currently logged-on user.
- Control hardware or software.
- Get information about a hardware component, such as its properties, presence or state.
- Get information about the hardware state or logical volume of a disk drive.
- Get information about software or operating system, i.e., its version.
- Get event notifications.
- Add a new printer connection for a remote computer.
- Find all the installed hotfixes on a specific computer.
- Back up or clear log files.
- Get event data from NT Event log files.
- Change file or folder properties.
- Create (or modify) registry keys and values.
- Access (or refresh) data about computer performance.
- Create processes and get information related to a running process, such as the account under which it is running.
- Get information about scheduled tasks and implemented services.
The WMIC utility provides an interface to WMI that makes it easy to access information and perform administrative functions. To obtain any of the data listed above, admins can write a script or application in a language like C++, C# or WMI .NET. The other option is to use the WMIC utility, which makes it easy to access WMI for the above tasks. It provides an interface to WMI that makes it easy to access information and perform administrative functions without having to write a script.
To supply data to WMI, admins need to write a WMI COM provider. They can do this with the WMI ATL Wizard in Visual Studio or by using COM directly in any integrated development environment (IDE). A simpler method is to create a managed code provider by using WMI in the .NET Framework.
WMIC modes of operation
WMIC operates in two modes: interactive and noninteractive.
Interactive mode
Users can use WMIC in interactive mode when they first start WMIC. When WMIC starts in interactive mode, the default WMIC role is Root\cli. Once Windows installs the utility on the computer, the user will see the WMIC command prompt, wmic:root\cli>. Then, they can enter a relevant command on one line. After one command runs, the WMIC command prompt will reappear, and the user can insert new comments (again, on one line).
Once in interactive mode, the user can run WMIC commands without specifying the wmic keyword at the beginning of each command. The user remains in this mode until they specifically exit from it by entering the Quit or Exit commands. The interactive mode is most useful if the user needs to enter a series of WMIC commands.
Here’s how to run WMIC in interactive mode:
- Click Start > Run
- Type WMIC
- Press ENTER
- Type the alias, command or global switch that WMIC is to perform.
Noninteractive mode
WMIC can also be used in noninteractive mode. In this mode, the WMIC command prompt disappears after WMIC performs a previously entered command. This mode is useful for carrying out one-off tasks or when including WMIC commands in a batch file (doing this removes the need to retype command sequences in order to repeat common tasks).
The WMIC interactive mode can be invoked at a Terminal command prompt just like other commands. A user can invoke WMIC noninteractive mode by preceding the WMIC command with the utility’s name. For example, Figure 1 shows a WMIC command at a command prompt in Windows Terminal. This command retrieves information about currently running processes that are named RuntimeBroker.exe.
The command begins with the wmic keyword — the utility’s name — followed by the command body. The body starts with the alias process. Aliases play an integral role in the WMIC utility. They provide friendly names that abstract the more complex underlying logic needed to retrieve WMI information and carry out administrative tasks. In this case, the process alias is used to retrieve a list of specific processes, as qualified by the WHERE option and its name value.
The process alias and its WHERE option are then followed by the verb list, which is one of multiple verbs WMIC supports. A verb carries out some type of action. In this context, the list verb returns information about the specified processes. The verb is also accompanied by the brief option, which tells WMI to return only a subset of the available information about each process.
When a user runs a WMIC command in noninteractive mode, they’re returned to the command prompt after the command has completed. However, if they want to work interactively with WMIC, they should type wmic at the command prompt and press Enter. The command prompt changes to wmic:root\cli, as shown in Figure 2.
Here’s how to run WMIC in noninteractive mode:
- Open Command prompt.
- Here, type WMIC.
- Type the command, aliases or global switches WMIC should perform.
- Press ENTER.
Another option for running WMIC is to invoke the utility directly in the Run dialog box. This method is available locally or through a .NET Server Terminal Services session. After the user opens the dialog box, they can type wmic in the text box and click OK. This launches a Terminal window with the WMIC command prompt active, where they can enter commands, as shown in Figure 3.
WMIC commands list
Admins can choose from numerous WMIC commands to easily access and use WMI and the WMI namespace. Commonly used commands include the following:
- CLASS. To escape from WMIC’s default alias mode to directly access classes in the WMI schema.
- PATH. To escape from WMIC’s default alias mode to directly access instances in the WMI schema.
- CONTEXT. To display the current values of all global switches.
- QUIT. To exit from WMIC.
- EXIT. To exit from WMIC.
In addition to commands, WMIC uses global switches, aliases, verbs and Command-line Help. Global switches are settings that apply to the entire WMIC session, aliases are the syntax intermediaries between users and the WMI namespace, and verbs are the specific actions a user wants WMI to take.
Users can get help on individual WMIC elements by using the Command-line Help. Specific characters must be typed at a WMIC command prompt to find specific information. For example, they can review a complete list of aliases and global switches by entering /? or -? at the command prompt, or get information about a specific alias by entering the alias name, followed by /? Similarly, <command_name> /? will show information about one command while <alias_name> /? will show information about one alias.
Is WMIC still used?
Microsoft deprecated the WMIC utility beginning with versions 21H1 of Windows 10 and the 21H1 semi-annual release of Windows Server. It has been superseded by Windows PowerShell for WMI. For that reason, administrators will want to invest their time in PowerShell for WMI. However, they might need to understand WMIC if working with legacy systems or WMIC scripts, in which case, having some knowledge of the utility could be useful.
It’s important to note that only the WMIC utility has been deprecated. WMI remains unchanged and can still be used to obtain management data about managed components like systems, applications, networks and devices. Enterprise admins can also use Windows Management Infrastructure (MI), the next generation of WMI to remotely manage Windows computer systems.
The Windows Command Prompt and PowerShell can perform similar tasks, but their methods might influence users to prefer one over the other.
This was last updated in April 2025
Continue Reading About What is the Windows Management Instrumentation Command-line (WMIC) utility?
- Basic PowerShell commands for Windows administrators
- Learn how the Windows Server 2025 editions differ
- PowerShell courses to help hone your skills
- How admins can benefit from switching to PowerShell 7.4
- When to use the Windows command prompt vs. PowerShell
Dig Deeper on Windows OS and management
-
How to find and customize your PowerShell profile
By: Anthony Howell
-
Please make ‘please’ a sudo alias on your Linux box
By: Darcy DeClute
-
PowerShell vs. Bash: Key differences explained
By: Brien Posey
-
How and why PowerShell Linux commands differ from Windows
By: Anthony Howell
Table of Contents
In this example I will take you through 20 useful wmic command examples in Windows. wmic utility provides a command-line interface for Windows Management Instrumentation(WMI). Windows command line lovers can use this utility to query WMI entries. We will see some real world examples of wmic command in below section. More on Microsoft docs.
Also Read: 27 Useful net command examples to Manage Windows Resources
Example 1: How to Display the State of all the Global Switches in Windows
If you want to check the state of all global switches in windows then you need to use wmic context command as shown below.
C:\>wmic context
NAMESPACE : root\cimv2
ROLE : root\cli
NODE(S) : DESKTOP-JSK6PD
IMPLEVEL : IMPERSONATE
[AUTHORITY : N/A]
AUTHLEVEL : PKTPRIVACY
LOCALE : ms_409
PRIVILEGES : ENABLE
TRACE : OFF
RECORD : N/A
INTERACTIVE : OFF
FAILFAST : OFF
OUTPUT : STDOUT
APPEND : STDOUT
USER : N/A
AGGREGATE : ON
Example 2: How to Get Your System Serial Number
If you want to check your system serial number then you need to use wmic bios get serialnumber command as shown below.
C:\>wmic bios get serialnumber
SerialNumber
FYNGK07
Example 3: How to Check HotFixID of all the Installed Updates in Windows
If you want to check the HotfixID of all the installed updates in windows then you need to use wmic qfe list command as shown below.
NOTE:
Please note that it is possible that some of the updates will show in "View Installed Updates" section but not on wmic qfe list output.
C:\>wmic qfe list
Caption CSName Description FixComments HotFixID InstallDate InstalledBy InstalledOn Name ServicePackInEffect Status
http://support.microsoft.com/?kbid=5003537 DESKTOP-JSK6PD Update KB5003537 NT AUTHORITY\SYSTEM 7/2/2021
https://support.microsoft.com/help/4562830 DESKTOP-JSK6PD Update KB4562830 NT AUTHORITY\SYSTEM 2/10/2021
http://support.microsoft.com/?kbid=4570334 DESKTOP-JSK6PD Security Update KB4570334 11/18/2020
https://support.microsoft.com/help/4577586 DESKTOP-JSK6PD Update KB4577586 NT AUTHORITY\SYSTEM 2/19/2021
https://support.microsoft.com/help/4580325 DESKTOP-JSK6PD Security Update KB4580325 11/19/2020
https://support.microsoft.com/help/4586864 DESKTOP-JSK6PD Security Update KB4586864 11/19/2020
https://support.microsoft.com/help/4589212 DESKTOP-JSK6PD Update KB4589212 NT AUTHORITY\SYSTEM 3/23/2021
https://support.microsoft.com/help/4598481 DESKTOP-JSK6PD Security Update KB4598481 NT AUTHORITY\SYSTEM 2/10/2021
https://support.microsoft.com/help/5004237 DESKTOP-JSK6PD Security Update KB5004237 NT AUTHORITY\SYSTEM 7/16/2021
DESKTOP-JSK6PD Security Update KB5003742 NT AUTHORITY\SYSTEM 7/9/2021
Example 4: How to Get the List of all Installed Applications in Windows
If you want get the list of all the installed applications in your Windows system then you need to use wmic product get name command as shown below.
C:\>wmic product get name
Name
Windows 7 USB/DVD Download Tool
Office 16 Click-to-Run Extensibility Component
Office 16 Click-to-Run Localization Component
Office 16 Click-to-Run Extensibility Component 64-bit Registration
Office 16 Click-to-Run Licensing Component
Microsoft Update Health Tools
Oracle VM VirtualBox 6.1.18
Adobe Refresh Manager
Adobe Acrobat Reader DC
Kaspersky VPN
Kaspersky Total Security
PuTTY release 0.74 (64-bit)
Kaspersky Password Manager
Example 5: How to Count the number of Installed Updates in Windows
If you want to get the total count of installed updates in windows then you need to use wmic qfe list | find /c /v "" command as shown below.
C:\>wmic qfe list | find /c /v ""
12
Example 6: How to Get the Total Number of CPU Cores in Windows
If you want to check the total number of CPU Cores in your system then you need to use wmic cpu get numberofcores command as shown below. As you can see my system has 4 CPU Cores.
C:\>wmic cpu get numberofcores
NumberOfCores
4
Example 7: How to find the Process Id of a running program in Windows
If you are looking to check the process Id of a running program then you need to use wmic process where ExecutablePath='<process_executable_path>' get ProcessId syntax. In this example we are checking the Process Id of notepad.exe using wmic process where ExecutablePath='C:\\windows\\system32\\notepad.exe' get ProcessId command as shown below.
C:\>wmic process where ExecutablePath='C:\\windows\\system32\\notepad.exe' get ProcessId
ProcessId
9632
5392
Example 8: How to Get the System Bios Version using wmic command
If you want to check the System Bios Version then you need to use wmic bios get version command as shown below.
C:\>wmic bios get version
Version
DELL - 20170001
Example 9: How to Get All the Users logged in to a Remote System
If you are looking to check all the logged in to users in a remote system then you can use below wmic command. In this example we are checking all currently logged in users in 192.168.27.103 system by using wmic /node:192.168.27.103 /user:admin /password:pass123 computersystem get username command as shown below.
NOTE:
Please note that here I am using remote server administrator account admin and password pass123 for querying the number of logged in users.
C:\>wmic /node:192.168.27.103 /user:admin /password:pass123 computersystem get username
Example 10: How to Check all the logs related to Explorer
If you want to check all the logs related to explorer then you need to use wmic ntevent where (message like "%explorer%") list brief command as shown below.
C:\>wmic ntevent where (message like "%explorer%") list brief
EventIdentifier EventType Message RecordNumber SourceName TimeGenerated
1001 3 Fault bucket 1920831938051734614, type 5Event Name: AppHangXProcB1Response: Not availableCab Id: 0Problem signature:P1: SnippingTool.exeP2: 10.0.19041.746P3: eb13aef9P4: 7906P5: 134217744P6: explorer.exeP7: 10.0.19041.964P8: P9: P10: Attached files:\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERB726.tmp.WERInternalMetadata.xml\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERB737.tmp.xml\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERB736.tmp.csv\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERB766.tmp.txt\\?\C:\Users\bholu\AppData\Local\Temp\WERBE2D.tmp.appcompat.txtThese files may be available here:\\?\C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppHang_SnippingTool.exe_8ac07f9eac8f4087f48567a8def0533923dde231_4958eda7_88513af1-b46c-47b0-b41d-0e97480dc92fAnalysis symbol: Rechecking for solution: 0Report Id: 10c89b18-905b-46e5-9f4a-798cc5341758Report Status: 268435456Hashed bucket: 3608dbed5bb45864faa82a787ccc7c56Cab Guid: 0 10604 Windows Error Reporting 20210610160144.722031-000
10002 3 The following application was terminated because it was hung: explorer.exe.
Example 11: How to Get the Product ID of Your System using wmic command
If you want to check the ProductID of your System then you need to use wmic csproduct get name command as shown below.
C:\>wmic csproduct get name
Name
Inspiron 3493
Example 12: How to Get the List of all running Processes using wmic command
If you want to check all the current running processes then you need to use wmic process list command as shown below.
C:\>wmic process list
CommandLine CSName Description ExecutablePath ExecutionState Handle HandleCount InstallDate KernelModeTime MaximumWorkingSetSize MinimumWorkingSetSize Name OSName OtherOperationCount OtherTransferCount PageFaults PageFileUsage ParentProcessId PeakPageFileUsage PeakVirtualSize PeakWorkingSetSize Priority PrivatePageCount ProcessId QuotaNonPagedPoolUsage QuotaPagedPoolUsage QuotaPeakNonPagedPoolUsage QuotaPeakPagedPoolUsage ReadOperationCount ReadTransferCount SessionId Status TerminationDate ThreadCount UserModeTime VirtualSize WindowsVersion WorkingSetSize WriteOperationCount WriteTransferCount
DESKTOP-JSK6PD System Idle Process 0 0 8982450000000 System Idle Process Microsoft Windows 10 Home Single Language|C:\Windows|\Device\Harddisk1\Partition3 0 0 9 60 0 60 8192 12 0 61440 0 1 0 1 0 0 0 0 8 0 8192 10.0.19042 8192 0 0
Example 13: How to Get the Executable path of a running process
If you want to get the full executable path of any specific process then you need to use wmic process where "name=<process_name>" get ProcessID,ExecutablePath syntax. In this example, we are checking the executable path of chrome.exe process using wmic process where "name=chrome.exe" get ProcessID, ExecutablePath command as shown below.
C:\>wmic process where "name='chrome.exe'" get ProcessID, ExecutablePath
ExecutablePath ProcessId
C:\Program Files\Google\Chrome\Application\chrome.exe 2492
C:\Program Files\Google\Chrome\Application\chrome.exe 4252
C:\Program Files\Google\Chrome\Application\chrome.exe 1536
C:\Program Files\Google\Chrome\Application\chrome.exe 4792
C:\Program Files\Google\Chrome\Application\chrome.exe 8960
C:\Program Files\Google\Chrome\Application\chrome.exe 10288
C:\Program Files\Google\Chrome\Application\chrome.exe 10360
C:\Program Files\Google\Chrome\Application\chrome.exe 10464
C:\Program Files\Google\Chrome\Application\chrome.exe 10860
Example 14: How to Get the Executable of all the Process
If you want to get the executable path of all the running process then you need to use wmic process get ProcessID,ExecutablePath command as shown below.
C:\>wmic process get ProcessID,ExecutablePath
ExecutablePath ProcessId
0
4
124
724
812
908
916
Example 15: How to Get all the Information about System CPU
If you want to check all the information about System CPU then you can use wmic CPU Get DeviceID,NumberOfCores,NumberOfLogicalProcessors command as shown below.
C:\>wmic CPU Get DeviceID,NumberOfCores,NumberOfLogicalProcessors
DeviceID NumberOfCores NumberOfLogicalProcessors
CPU0 4 8
Example 16: How to Get the Windows OS version using wmic command
If you want to check the Windows OS version then you need to use wmic os get version command as shown below.
C:\>wmic os get version
Version
10.0.19042
Example 17: How to Get the System Slot Status using wmic command
If you want to check the status about your System slots then you can use wmic systemslot get slotdesignation,currentusage,description,status command as shown below.
C:\>wmic systemslot get slotdesignation,currentusage,description,status
CurrentUsage Description SlotDesignation Status
3 System Slot PCI-Express 0 OK
3 System Slot PCI-Express 1 OK
3 System Slot PCI-Express 2 OK
3 System Slot PCI-Express 3 OK
3 System Slot PCI-Express 4 OK
3 System Slot PCI-Express 5 OK
3 System Slot PCI-Express 6 OK
Example 18: How to Get the System Sensor Status using wmic command
If you want to get the system sensor status then you need to use wmic temperature get deviceid,name,status command as shown below.
C:\>wmic temperature get deviceid,name,status
DeviceID Name Status
root\cimv2 0 Numeric Sensor OK
root\cimv2 1 Numeric Sensor OK
root\cimv2 2 Numeric Sensor OK
Example 19: How to Get the List of all System I/O Ports using wmic command
If you want to check all the System I/O ports then you need to use wmic port get name command as shown below.
C:\>wmic port get name
Name
0x0000002E-0x0000002F
0x0000004E-0x0000004F
0x00000061-0x00000061
0x00000063-0x00000063
0x00000065-0x00000065
0x00000067-0x00000067
0x00000070-0x00000070
0x00000080-0x00000080
0x00000092-0x00000092
0x000000B2-0x000000B3
..................
Example 20: How to Check all the options available with wmic command
If you want to check all the option available with wmic command then you need to use wmic /? command as shown below.
C:\>wmic /?
[global switches] <command>
The following global switches are available:
/NAMESPACE Path for the namespace the alias operate against.
/ROLE Path for the role containing the alias definitions.
/NODE Servers the alias will operate against.
/IMPLEVEL Client impersonation level.
/AUTHLEVEL Client authentication level.
/LOCALE Language id the client should use.
/PRIVILEGES Enable or disable all privileges.
/TRACE Outputs debugging information to stderr.
/RECORD Logs all input commands and output.
/INTERACTIVE Sets or resets the interactive mode.
/FAILFAST Sets or resets the FailFast mode.
/USER User to be used during the session.
/PASSWORD Password to be used for session login.
/OUTPUT Specifies the mode for output redirection.
/APPEND Specifies the mode for output redirection.
/AGGREGATE Sets or resets aggregate mode.
/AUTHORITY Specifies the <authority type> for the connection.
/?[:<BRIEF|FULL>] Usage information.
WMI queries from the command line
With WMIC we can use WMI queries in batch files.
Like WMI itself, WMIC is available as of Windows XP Professional.
And though WMI can be added on Window NT 4 and 2000, WMIC requires Windows XP Professional or later.
Though the C in WMIC seems to stand for Console, I prefer to interpret it as WMI for the Command line.
To start WMIC in interactive console mode, just type:
WMIC
Typing /? in the WMIC console will give you the same on-screen help you would get after typing:
WMIC /?
at the command prompt: a list of switches and aliases.
Since we are dealing with batch files here, I’ll use the commands for Command Line Mode from now on.
If you prefer the Interactive Console Mode, just remove «WMIC» from the start of each command line.
WMIC commands
- The majority of my batch files uses WMIC’s
GETcommand to read properties of the specified WMI class.
To find out which properties are available for a specific WMI class, use a command like:WMIC OS Get /?Feel free to experiment with WMIC’s
GETcommand, it won’t change any setting. - With WMIC’s
SETcommand you can set (change) properties, unless they are read-only.
To find out which properties are writeable for a specific WMI class, use a command like:WMIC OS Set /?Do not use WMIC’s
SETcommand unless you are absolutely sure about the consequences. - With WMIC’s
CALLcommand you can call a WMI method for the specified class.
To find out which methods are available for a specific WMI class use a command like:WMIC OS Call /?Do not use WMIC’s
CALLcommand unless you are absolutely sure about the consequences.
Now let’s try the following commands:
WMIC BIOS WMIC BIOS Get Manufacturer WMIC BIOS Get Manufacturer,Name,Version /Format:csv WMIC BIOS Get Manufacturer,Name,Version /Format:list WMIC BIOS Get /Format:list WMIC BIOS Get Manufacturer,Name,Version /Format:htable
You may want to save the latter to a HTML file to view it in a browser:
WMIC /Output:bios.html BIOS Get Manufacturer,Name,Version /Format:htable
START "" "%CD%.\bios.html"
Need the result pasted in another window?
Use /Output:CLIPBOARD
Need to store the properties in variables? Try this (note the commas now being «escaped» by ˆ, carets):
FOR /F "tokens=*" %%A IN ('WMIC BIOS Get Manufacturerˆ,Nameˆ,Version /Value ˆ| FIND "="') DO (
SET BIOS.%%A
)
SET BIOS
Try to figure out for yourself how that worked.
A hint: try the plain WMIC command, without the FIND filtering and without the FOR loops, and see what the output looks like…
Now prepend each of those lines with SET BIOS.
Narrowing down the returned selection with WHERE
Often WMI queries return far too much information, so we want to narrow down the selection.
For example, the following query against my own computer returns 27 instances, even though it has only one network adapter:
WMIC Path Win32_NetworkAdapter Get
| Note: | If all you want to know is the number of adapters, just list the indexes only:
|
WQL to the rescue!
WQL or WMI Query Language allows us to get only those instances matching the conditions set by a WHERE clause.
The following modified query returns only 2 instances on my computer (it turns out the BlueTooth dongle is also considered a physical network adapter):
WMIC Path Win32_NetworkAdapter Where "PhysicalAdapter=TRUE" Get
This is pretty straightforward.
Now list only adapters manufactured by Realtek.
The following command will not work:
WMIC Path Win32_NetworkAdapter Where "Manufacturer=Realtek" Get
Realtek in this case is a string, so we need to place it in quotes, preferably without confusing them with the quotes for the entire WHERE clause.
The following commands will work:
WMIC Path Win32_NetworkAdapter Where "Manufacturer='Realtek'" Get
WMIC Path Win32_NetworkAdapter Where (Manufacturer='Realtek') Get
WMIC Path Win32_NetworkAdapter Where (Manufacturer="Realtek") Get
WMIC Path Win32_NetworkAdapter Where "Manufacturer = 'Realtek'" Get
etcetera.
Parentheses are required for more complex WHERE clauses:
WMIC Path Win32_NetworkAdapter Where ( Manufacturer = "Realtek" And PhysicalAdapter = TRUE ) Get
However, these parenthesis tend to break your FOR /F loops…
A limitation of the WHERE clause is that it cannot select properties of type array.
Take a good look at WQL if you intend to use WMIC seriously.
A note on aliases
Instead of the BIOS alias, we might just as well have used Path Win32_BIOS, it wouldn’t have made any difference.
The reason I mention this is that my WMI Code Generator does indeed use Path followed by the full class name.
Besides, not every class has its own WMIC alias.
To find the full class name behind an alias, use the following command:
WMIC ALIAS alias_name Get Target [ /Format:list ]
The result will look like this:
Target=Select * from full_class_name
or use:
WMIC alias_name Get CreationClassName [ /Format:list ]
The result will be one or more lines like this:
CreationClassName=full_class_name
To list all available aliases, try this short batch file:
@ECHO OFF
SETLOCAL ENABLEDELAYEDEXPANSION
FOR /F "skip=1 tokens=1,5" %%A IN ('WMIC /NameSpace:\\root\CLI Path MSFT_CliAlias Get FriendlyName^,Target ^| FIND "*"') DO SET Alias.%%A=%%B
FOR /F "tokens=2,3 delims==." %%A IN ('SET Alias') DO (
SET "_Alias=%%A "
SET _Alias=!_Alias:~0,20!
ECHO !_Alias! = %%B
)
ENDLOCAL
Or use WMIAlias.bat, which can either list all aliases and their class names, or return the class for a single specified alias.
I have not yet found a way to make WMIC list all WMI classes available, but the following code comes close:
FOR /F %%A IN ('WMIC /? ˆ| FINDSTR /R /B /C:"[A-Z][A-Z][A-Z ][A-Z ][A-Z ][A-Z ][A-Z ][A-Z ][A-Z ][A-Z ][A-Z ][A-Z ]" ˆ| FINDSTR /R /B /V /C:"For more information"') DO (
FOR /F "tokens=4" %%B IN ('WMIC ALIAS %%A Get Target /Value 2ˆ>NUL ˆ| FIND "="') DO (
ECHO.%%B
)
)
The first line extracts a list of aliases from WMIC’s help screen, and these aliases are «fed» to the second WMIC command line which retrieves the Target class, as discussed above.
Unfortunately, not all WMI classes have an alias, so some (most) will not be included in the list.
The resulting list is not sorted and may contain duplicates.
ListWMIClasses.bat extends the code above to display a sorted list without duplicates.
By far the easiest and most reliable way to find all WMI classes available is to use Microsoft’s ScriptOMatic or my own WMI Code Generator, both with GUI, or ListWMIClasses.vbs.
Other computers & other WMI namespaces
Use WMIC’s /Node:remote_computer switch to query remote computers.
Use WMIC’s /NameSpace:\\root\other_namespace switch to query classes that are not located in the default CIMV2 namespace.
Work with the registry
It is possible to use WMIC to read, write or delete registry keys and values, but I would not recommend it, it is not for the faint of heart.
REG.EXE is a lot easier to use.
The reason I still mention this feature of WMIC is the possibility to check if the current user has permissions to access a registry key or value:
SET KEY_QUERY_VALUE="&H1" SET KEY_SET_VALUE="&H2" SET KEY_CREATE_SUB_KEY="&H4" SET KEY_ENUMERATE_SUB_KEYS="&H8" SET KEY_NOTIFY="&H10" SET KEY_CREATE="&H20" SET DELETE="&H10000" SET READ_CONTROL="&H20000" SET WRITE_DAC="&H40000" SET WRITE_OWNER="&H80000" SET HKEY_CLASSES_ROOT="&H80000000" SET HKEY_CURRENT_USER="&H80000001" SET HKEY_LOCAL_MACHINE="&H80000002" SET HKEY_USERS="&H80000003" SET HKEY_CURRENT_CONFIG="&H80000005" WMIC /NameSpace:\\root\default Class StdRegProv Call CheckAccess hDefKey=%HKEY_LOCAL_MACHINE% sSubKeyName="Software\My Program" uRequired=%KEY_SET_VALUE%
This code will return «errorlevel» 0 («true») if the current user has permission to set values in HKEY_LOCAL_MACHINE\Software\My Program or 2 («false») if not.
To combine permissions, add their associated hexadecimal numbers.
| Note: | You don’t have to use environment variables to store the hexadecimal values:WMIC /NameSpace:\\root\default Class StdRegProv Call CheckAccess hDefKey="&H80000002" sSubKeyName="Software\My Program" uRequired="&H2"will work just fine. |
Samples
There are some WMIC samples available on this site:
- BattStat.bat, which displays the battery status.
- BootDisk.bat, which displays the boot disk, partition and drive letter.
- CheckRegAccess.bat, which checks if the current user has the specified permissions on the specified registry key.
- CPULoad.bat, which displays the CPU load percentage.
- DiskSpc.bat, which displays a disk space summary for every partition on a WMI enabled computer, or a list of computers.
- Hardware.bat, which displays a hardware summary for any WMI enabled computer.
- is6432os.bat, which detects if the OS is 32-bit or 64-bit.
- MdmCmds.bat, which displays the available configuration commands for your modem(s).
- NICSpeed.bat, which displays the active Ethernet network adapters’ link speed.
- PausePrinting.bat and ResumePrinting.bat, two batch files to pause and resume printing on a specified printer.
- Printing.bat, a batch file that combines the functionality of PausePrinting.bat and ResumePrinting.bat, and adds commands to list all printers or to flush all printjobs on the specified printer(s).
- SortDate.bat Version 5, which displays the current date and time in YYYYMMDD and HHmmss format.
- DatePart.cmd, which displays the specified part of the current date or time (like VBScript’s
DatePart( )function). - WMIC commands to reboot or shutdown any WMI enabled computer.
- With the «Create Batch Code» button in the WMI Code Generator you can create your own WMIC samples.
Create some samples, try them, trim and prune them until they meet your requirements.
Except for CheckRegAccess.bat, PausePrinting.bat, ResumePrinting.bat, Printing.bat, and the reboot and shutdown, these samples are all limited to Get (read) property values only.
More samples (be careful, some of these do actually change your system configuration):
- WMIC Samples by John Howard.
More to explore:
A good source for more information is the article WMIC — Take Command-line Control over WMI by Ethan Wilansky.
Examples of WMIC commands for Windows .NET SERVER Family
Using Windows Management Instrumentation Command-line
And Alain Lissoir’s book: Understanding WMI Scripting which devotes an entire chapter to WMIC.
Microsoft Windows 2000 Scripting Guide provides an excellent explanation of WQL use in its chapter Retrieving Managed Resources Using WMI Query Language.
To create more «selective» queries, use the WMI Query Language, or WQL, a subset of SQL.
See this overview of WQL.
page last modified: 2016-09-19; loaded in 0.0041 seconds