{"id":4513,"date":"2012-12-05T00:01:00","date_gmt":"2012-12-05T00:01:00","guid":{"rendered":"https:\/\/blogs.technet.microsoft.com\/heyscriptingguy\/2012\/12\/05\/use-hidden-wmi-classes-and-powershell-to-discover-hid-info\/"},"modified":"2012-12-05T00:01:00","modified_gmt":"2012-12-05T00:01:00","slug":"use-hidden-wmi-classes-and-powershell-to-discover-hid-info","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/scripting\/use-hidden-wmi-classes-and-powershell-to-discover-hid-info\/","title":{"rendered":"Use Hidden WMI Classes and PowerShell to Discover HID Info"},"content":{"rendered":"

Summary:<\/strong> Microsoft Scripting Guy, Ed Wilson, talks about using two WMI classes from the root\\wmi<\/strong> namespace to reveal additional HID hardware information.<\/p>\n

Microsoft Scripting Guy, Ed Wilson, is here. Well, the Scripting Wife and I returned from Europe yesterday. It is good to be home, but we will miss our friends and all the great food. I fell in love with several new types of food that I have absolutely no hopes of ever finding in Charlotte, North Carolina. While there is a pretty good German restaurant in Charlotte, I have yet to find a Danish, Swedish, Norwegian, Swiss, Polish, Czech, or even Swiss restaurant in Charlotte. Major bummer to be sure. Oh, well. Stay in touch with the Scripting Wife on either Facebook or Twitter because she is already talking about planning a return trip to areas we missed on this trip. We only had three weeks after all.  <\/p>\n

Revisiting WMI mouse & keyboard discovery<\/h2>\n

On the flight from Frankfurt to Charlotte yesterday, I had time (indeed plenty of time) to spend playing around with Windows PowerShell. (I mean one can only watch so many boring movies on a 5-inch screen that bounces every time the person in front of you moves. In my case, the number was exactly 0.) In all fairness, they did have good Jazz music programing, and so I put my headphones, fired up the Windows PowerShell ISE, and began playing.<\/p>\n

Last week, I wrote Use PowerShell and WMI to Find Wireless Keyboard & Mouse<\/a> <\/em>about using WMI to identify a wireless mouse and keyboard attached to my system.<\/p>\n

So, I was playing around with a function called Get-NameSpace<\/strong>, which I wrote for my new Microsoft Press Windows PowerShell 3.0 Step by Step book, and I decided to investigate additional namespaces for mouse and keyboard information.<\/p>\n

Note<\/strong>   The Root\\Cimv2<\/strong> namespace is well documented on MSDN, and the classes there are supported for general use. Classes from other namespaces not documented on MSDN are not supported.<\/p>\n

Just because a WMI class is not supported does not mean that it will not work—it only means that I cannot call up Microsoft support for assistance if the thing breaks, quits working, or behaves erratically. With this caveat in place, I begin my investigation.<\/p>\n

Note<\/strong>   After things settle down, I intend to add the Get-NameSpace<\/strong> to my HSG*WMI*module.<\/p>\n

Get-WMINameSpace Function<\/p>\n

Function Get-WmiNameSpace<\/p>\n

{<\/p>\n

 Param(<\/p>\n

  $nameSpace = “root”,<\/p>\n

  $computer = “localhost”<\/p>\n

 )<\/p>\n

 Get-WmiObject -class __NameSpace -computer $computer `<\/p>\n

 -namespace $namespace -ErrorAction “SilentlyContinue” |<\/p>\n

 Foreach-Object `<\/p>\n

 -Process `<\/p>\n

   {<\/p>\n

     $subns = Join-Path -Path $_.__namespace -ChildPath $_.name<\/p>\n

     if($subns -notmatch ‘directory’) {$subns}<\/p>\n

     $namespaces += $subns + “`r`n”<\/p>\n

     Get-WmiNameSpace -namespace $subNS -computer $computer<\/p>\n

   }<\/p>\n

} #end Get-WmiNameSpace<\/p>\n

 When I run the Get-WmiNameSpace<\/strong> function, I am presented with an extensive listing of new WMI namespaces existing on my computer running Windows 8. The partial listing appears in the following image.<\/p>\n

\"Image<\/a><\/p>\n

As I look over the listing, I find a couple of namespaces that seem like they might be interesting. The first one is Root\\Hardware<\/strong>. I use the following command to see if I can find anything related to a mouse or to a keyboard. As shown here, I found nothing.<\/p>\n

PS C:\\> Get-CimClass *mouse* -Namespace root\\hardware<\/p>\n

PS C:\\> Get-CimClass *keyboard* -Namespace root\\hardware<\/p>\n

PS C:\\> <\/p>\n

I could also have used the Windows PowerShell 2.0 syntax, but the results are the same.<\/p>\n

PS C:\\> Get-WmiObject -List *mouse* -Namespace root\\hardware<\/p>\n

PS C:\\> Get-WmiObject -List *keyboard* -Namespace root\\hardware<\/p>\n

PS C:\\> <\/p>\n

After exploring several other namespaces, I decided to go where I felt I would find success—the Root\\WMI<\/strong> namespace. Once I queried there, I found several classes I could use.<\/p>\n

PS C:\\> “*mouse*”,”*keyboard*” | % {Get-CimClass $_ -Namespace root\\WMI}<\/p>\n

   NameSpace: ROOT\/wmi<\/p>\n

CimClassName                        CimClassMethods      CimClassProperties   <\/p>\n

————                        —————      ——————   <\/p>\n

MSMouse                             {}                   {}                   <\/p>\n

MSMouse_ClassInformation            {}                   {Active, DeviceId, …<\/p>\n

MSMouse_PortInformation             {}                   {Active, Buttons, C…<\/p>\n

MSKeyboard                          {}                   {}                   <\/p>\n

MSKeyboard_ExtendedID               {}                   {Active, InstanceNa…<\/p>\n

MSKeyboard_PortInformation          {}                   {Active, ConnectorT…<\/p>\n

MSKeyboard_ClassInformation         {}                   {Active, DeviceId, …<\/p>\n

Notice that the MSMouse<\/strong> and MSKeyboard<\/strong> classes do not expose any properties in the CimClassProperties<\/strong> column. I verified this by using WbemTest as shown here.<\/p>\n

\"Image<\/a><\/p>\n

Basically, the MSMouse<\/strong> class is an abstract class, but it does not have the abstract <\/em>qualifier. I confirmed this by seeing first there are no instances (I pressed the Instances<\/strong> button). Then I pressed the Derived<\/strong> button, and saw there are two WMI classes derived from the MSMouse<\/strong> class (same thing for MSKeyboard<\/strong>). The derived classes are shown here.<\/p>\n

\"Image<\/a><\/p>\n

Now that I have found the WMI classes that I want to query, I have a couple of choices. If I use the Get-CimInstance<\/strong> cmdlet, I need to supply each class: MSMouse_ClassInformation<\/strong> and MSMouse_PortInformation<\/strong>. But if I use the Get-WmiObject<\/strong> cmdlet, I can take advantage of another unsupported trick. Remember, I said the MSMouse<\/strong> and MSKeyboard<\/strong> classes are abstract? It is not supported to query abstract classes, and the Get-CimInstance<\/strong> cmdlet enforces this ban. However, the Get-WmiObject<\/strong> cmdlet does not. Therefore, when I query an abstract class, the query automatically routes to the two derived classes, and it is from there the answer returns.<\/p>\n

Here is the query—I passed the results to the HasWmivalue<\/strong> function from my HSG*WMI* module to filter out empty and system properties.<\/p>\n

PS C:\\> gwmi msmouse -Namespace root\\wmi | ? instancename -match ‘hid’ | haswmivalue<\/p>\n

\\\\EDLT\\root\\wmi:MSMouse_PortInformation.InstanceName=”HID\\\\{00001124-0000-1000-8000-00805f9b34fb}_VID&0002<\/p>\n

045e_PID&0702&Col02\\\\9&da0cc6e&0&0001_0″<\/p>\n

==========================================================================================================<\/p>\n

========================================<\/p>\n

 <\/p>\n

Name                           Value                                                                     <\/p>\n

—-                           —–                                                                     <\/p>\n

Active                         True                                                                      <\/p>\n

Buttons                        5                                                                         <\/p>\n

ConnectorType                  2                                                                          <\/p>\n

DataQueueSize                  2                                                                         <\/p>\n

InstanceName                   HID\\{00001124-0000-1000-8000-00805f9b34fb}_VID&0002045e_PID&0702&Col02\\9…<\/p>\n

\\\\EDLT\\root\\wmi:MSMouse_ClassInformation.InstanceName=”HID\\\\{00001124-0000-1000-8000-00805f9b34fb}_VID&000<\/p>\n

2045e_PID&0702&Col02\\\\9&da0cc6e&0&0001_0″<\/p>\n

==========================================================================================================<\/p>\n

=========================================<\/p>\n

Active                         True                                                                      <\/p>\n

DeviceId                       18446738026718451632                                                      <\/p>\n

InstanceName                   HID\\{00001124-0000-1000-8000-00805f9b34fb}_VID&0002045e_PID&0702&Col02\\9…<\/p>\n

 I can do the same thing with the MSKeyboard<\/strong> class. The MSKeyboard WMI<\/strong> class does contain the abstract <\/em>qualifier, as shown here.<\/p>\n

\"Image<\/a><\/p>\n

In addition, instead of only two classes derived from the abstract, there are three, as shown in the WbemTest tool.<\/p>\n

\"Image<\/a><\/p>\n

Therefore, when I query the abstract MSKeyboard WMI<\/strong> class, three classes report information instead of just the two that report from the MSMouse<\/strong> class. The output from the command is shown here.<\/p>\n

PS C:\\> gwmi mskeyboard -Namespace root\\wmi | ? instancename -match ‘hid’ | haswmivalue<\/p>\n

\\\\EDLT\\root\\wmi:MSKeyboard_ClassInformation.InstanceName=”HID\\\\{00001124-0000-1000-8000-00805f9b34fb}_VID&00020<\/p>\n

45e_PID&0762&Col01\\\\9&5c4d6fc&0&0000_0″<\/p>\n

===============================================================================================================<\/p>\n

=======================================<\/p>\n

 <\/p>\n

Name                           Value                                                                          <\/p>\n

—-                           —–                                                                           <\/p>\n

Active                         True                                                                           <\/p>\n

DeviceId                       18446738026714008784                                                           <\/p>\n

InstanceName                   HID\\{00001124-0000-1000-8000-00805f9b34fb}_VID&0002045e_PID&0762&Col01\\9&5c4d…<\/p>\n

\\\\EDLT\\root\\wmi:MSKeyboard_ExtendedID.InstanceName=”HID\\\\{00001124-0000-1000-8000-00805f9b34fb}_VID&0002045e_PI<\/p>\n

D&0762&Col01\\\\9&5c4d6fc&0&0000_0″<\/p>\n

===============================================================================================================<\/p>\n

=================================<\/p>\n

Active                         True                                                                            <\/p>\n

InstanceName                   HID\\{00001124-0000-1000-8000-00805f9b34fb}_VID&0002045e_PID&0762&Col01\\9&5c4d…<\/p>\n

Type                           81                                                                             <\/p>\n

\\\\EDLT\\root\\wmi:MSKeyboard_PortInformation.InstanceName=”HID\\\\{00001124-0000-1000-8000-00805f9b34fb}_VID&000204<\/p>\n

5e_PID&0762&Col01\\\\9&5c4d6fc&0&0000_0″<\/p>\n

===============================================================================================================<\/p>\n

======================================<\/p>\n

Active                         True                                                                           <\/p>\n

ConnectorType                  2                                                                               <\/p>\n

DataQueueSize                  1                                                                              <\/p>\n

FunctionKeys                   12                                                                             <\/p>\n

Indicators                     3                                                                              <\/p>\n

InstanceName                   HID\\{00001124-0000-1000-8000-00805f9b34fb}_VID&0002045e_PID&0762&Col01\\9&5c4d…<\/p>\n

Well, that is all for now. Join me tomorrow for more cool Windows PowerShell stuff.<\/p>\n

I invite you to follow me on Twitter<\/a> and Facebook<\/a>. If you have any questions, send email to me at scripter@microsoft.com<\/a>, or post your questions on the Official Scripting Guys Forum<\/a>. See you tomorrow. Until then, peace.<\/p>\n

Ed Wilson, Microsoft Scripting Guy<\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"

Summary: Microsoft Scripting Guy, Ed Wilson, talks about using two WMI classes from the root\\wmi namespace to reveal additional HID hardware information. Microsoft Scripting Guy, Ed Wilson, is here. Well, the Scripting Wife and I returned from Europe yesterday. It is good to be home, but we will miss our friends and all the great […]<\/p>\n","protected":false},"author":596,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[385,34,35,3,4,45,6],"class_list":["post-4513","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting","tag-cim","tag-hardware","tag-peripherals-and-devices","tag-scripting-guy","tag-scripting-techniques","tag-windows-powershell","tag-wmi"],"acf":[],"blog_post_summary":"

Summary: Microsoft Scripting Guy, Ed Wilson, talks about using two WMI classes from the root\\wmi namespace to reveal additional HID hardware information. Microsoft Scripting Guy, Ed Wilson, is here. Well, the Scripting Wife and I returned from Europe yesterday. It is good to be home, but we will miss our friends and all the great […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/4513","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/596"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=4513"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/4513\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=4513"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=4513"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=4513"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}