{"id":52783,"date":"2009-08-06T03:01:00","date_gmt":"2009-08-06T03:01:00","guid":{"rendered":"https:\/\/blogs.technet.microsoft.com\/heyscriptingguy\/2009\/08\/06\/hey-scripting-guy-where-can-i-find-a-list-of-all-the-things-i-can-do-with-windows-powershell-and-wmi\/"},"modified":"2009-08-06T03:01:00","modified_gmt":"2009-08-06T03:01:00","slug":"hey-scripting-guy-where-can-i-find-a-list-of-all-the-things-i-can-do-with-windows-powershell-and-wmi","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/scripting\/hey-scripting-guy-where-can-i-find-a-list-of-all-the-things-i-can-do-with-windows-powershell-and-wmi\/","title":{"rendered":"Hey, Scripting Guy! Where Can I Find a List of All the Things I Can Do with Windows PowerShell and WMI?"},"content":{"rendered":"

 <\/p>\n

\"Hey,<\/p>\n

Hey, Scripting Guy! Using the Get-Member<\/b> cmdlet with Windows PowerShell is pretty cool, but the one thing I do not like is the way that Windows PowerShell hides stuff from me. When I look in MSDN for information about a WMI class, I see all of these methods listed. When I use the Get-Member<\/b>  <\/span>cmdlet, some of the methods are not listed. So it seems that the WMI implementation in Windows PowerShell is incomplete. If this is the case, how can I find out where this stuff is documented? I would like to see a list of all the things I can do with Windows PowerShell and WMI. <\/p>\n<\/p>\n

— DF<\/p>\n

\"Hey,<\/span>Hello DF, <\/p>\n

You already have the documentation. It is called (drumroll please) MSDN<\/font><\/a>. All of the information about our products can be found in the reference documentation on MSDN. You may also want to check out some of the various team blogs as well. There are two things you need to know about Windows Management Instrumentation (WMI). The first is that the WMI team does not write all the WMI classes. They develop the core technology, and the various teams at Microsoft create their own WMI providers and write their own WMI classes. When you go to the WMI documentation (the software development kit [SDK] on MSDN<\/font><\/a>), you only find information about the WMI core classes. For example, if you want to find out about the WMI classes for Hyper-V<\/font><\/a>, you will find the documentation under virtualization—<\/span>not under WMI. <\/p>\n

But when you talk about hidden WMI class methods, you are not talking about hidden WMI documentation. You are talking about the way the information is supplied via the Get-Member<\/b> cmdlet. Let’s take a common scenario: the Win32_Process<\/b> cmdlet. This important WMI class has been written about by Microsoft Scripting Guys<\/font><\/a> numerous times, and therefore our loyal informed readers know the things this class can do. It is also documented on MSDN<\/font><\/a> with the WMI core classes. As seen in Table 1, the Win32_Process WMI class exposes 6 methods. <\/p>\n

Table 1 Methods of the Win32_Process class<\/p>\n

<\/strong><\/p>\n\n\n\n\n\n\n\n\n\n
\n

Method <\/p>\n

<\/strong><\/p>\n<\/td>\n

\n

Description <\/p>\n

<\/b><\/p>\n<\/td>\n<\/tr>\n

\n

AttachDebugger<\/p>\n<\/td>\n

\n

Launches the currently registered debugger for a process.<\/p>\n<\/td>\n<\/tr>\n

\n

Create <\/p>\n<\/td>\n

\n

Creates a new process.<\/p>\n<\/td>\n<\/tr>\n

\n

GetOwner<\/p>\n<\/td>\n

\n

Retrieves the user name and domain name under which the process is running.<\/p>\n<\/td>\n<\/tr>\n

\n

GetOwnerSid <\/p>\n<\/td>\n

\n

Retrieves the security identifier (SID) for the owner of a process.<\/p>\n<\/td>\n<\/tr>\n

\n

SetPriority <\/p>\n<\/td>\n

\n

Changes the execution priority of a process.<\/p>\n<\/td>\n<\/tr>\n

\n

Terminate <\/p>\n<\/td>\n

\n

Terminates a process and all of its threads.<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\n

 <\/p>\n<\/p>\n

When you use the Get-Member<\/b> cmdlet to examine the methods of the Win32_Process<\/b> WMI class, you see only five methods that are returned. As seen here, the Create<\/b> method is missing: <\/p>\n

PS C:> Get-WmiObject -Class win32_process | Get-Member -MemberType method<\/p>\n


   <\/span>TypeName: System.Management.ManagementObject#rootcimv2Win32_Process<\/p>\n

Name           <\/span>MemberType Definition
—-           <\/span>———- ———-
AttachDebugger Method     <\/span>System.Management.ManagementBaseObject AttachDebug…
GetOwner       <\/span>Method     <\/span>System.Management.ManagementBaseObject GetOwner()
GetOwnerSid    <\/span>Method     <\/span>System.Management.ManagementBaseObject GetOwnerSid()
SetPriority    <\/span>Method     <\/span>System.Management.ManagementBaseObject SetPriority…
Terminate      <\/span>Method     <\/span>System.Management.ManagementBaseObject Terminate(S…<\/p>\n

<\/font><\/span><\/p>\n

A clue can be obtained by using the Method Editor from the Windows Management Instrumentation Tester (WbemTest). For more information about using WbemTest, refer to yesterday’s Hey, Scripting Guy! article<\/span><\/a>. <\/p>\n

As seen in the following image, the Create<\/b> method has the Static<\/b> qualifier.<\/p>\n

\n

\"Image<\/a><\/p>\n<\/p>\n


Armed with the fact that the Create<\/b> method is a static method from the Win32_Process<\/b> WMI class, you might be tempted to once again return to the Get-Member<\/b> cmdlet, this time to retrieve static methods. To retrieve static methods, you use the MemberType<\/b> parameter and choose methods and the static switch. This is seen here: <\/p>\n

PS C:> Get-WmiObject -Class win32_process | Get-Member -MemberType method -Stat
ic<\/p>\n


   <\/span>TypeName: System.Management.ManagementObject<\/p>\n

Name            <\/span>MemberType Definition
—-            <\/span>———- ———-
Equals          <\/span>Method     <\/span>static bool Equals(System.Object objA, System.Obj…
ReferenceEquals Method     <\/span>static bool ReferenceEquals(System.Object objA, S…<\/span><\/p>\n

<\/span><\/font><\/p>\n

Unfortunately, the two static methods that are returned by the Get-Member<\/b> cmdlet do not solve our problem. In fact the two static methods that are returned by Get-Member<\/b> do not even appear in the MSDN documentation for the Win32_Process<\/b> WMI class (this is because they are inherited from the System.Object<\/b> .NET Framework class). <\/p>\n

What have we discovered so far? We have seen that the WbemTest utility states that the Create<\/b> method from the Win32_Process<\/b> WMI class is a static method. We have also seen that the Get-Member<\/b> cmdlet did not appear to find the Create<\/b> method. The reason that the Get-Member<\/b> cmdlet did not find the Create<\/b> method is that the Get-WmiObject<\/b> cmdlet returns instances of Win32_Processes<\/b>. This is seen here: <\/p>\n

PS C:> Get-WmiObject -Class win32_process | Select-Object -Property name<\/p>\n

name
—-
System Idle Process
System
smss.exe
csrss.exe
wininit.exe
csrss.exe
winlogon.exe
services.exe
lsass.exe
lsm.exe
svchost.exe
svchost.exe
svchost.exe
svchost.exe
svchost.exe
SLsvc.exe
svchost.exe
svchost.exe
svchost.exe
spoolsv.exe
svchost.exe
vmsrvc.exe
inetinfo.exe
svchost.exe
vpcmap.exe
taskeng.exe
SearchIndexer.exe
taskeng.exe
dwm.exe
explorer.exe
vmusrvc.exe
SnagIt32.exe
TscHelp.exe
SnagPriv.exe
SnagItEditor.exe
powershell.exe
WmiPrvSE.exe<\/span><\/p>\n

<\/span><\/font><\/p>\n

Each of the objects that are returned by the Get-WmiObject<\/b> cmdlet is an instance of a Win32_Process<\/b> WMI class. It makes sense that an instance of a WMI class cannot be used to create an instance of a class. We need to move up one step in the WMI hierarchy. We need to move to the class itself, not to an instance of the class. This process is true, whether you are using the Get-WmiObject<\/b> cmdlet from Windows PowerShell, or whether you are using the GetObject method from VBScript<\/font><\/a>. To try to keep things in perspective, you can think of using the Get-WmiObject<\/b> cmdlet in a similar fashion to the way you used the ExecQuery<\/b> method from within VBScript. You can certainly use the ExecQuery<\/b> method from VBScript to return a collection of processes that match the name “Notepad” and you can certainly call the terminate method to stop such a process<\/font><\/a>. This process makes sense because you are working with an instance of the Win32_Process<\/b> class. You want to terminate an instance of the class. Terminating a process named “Notepad” can be as easy as using a WMI query that retrieves a single instance of the class and calling the terminate<\/b> method. If the query returns more than one instance of the Win32_Process<\/b> class, you will need to use the Foreach-Object<\/b> cmdlet to walk through the collection. This is seen here: <\/p>\n

PS C:> (Get-WmiObject -Class win32_process -Filter “name = ‘notepad.exe'”).Term
inate()<\/p>\n


__GENUS          <\/span>: 2
__CLASS          <\/span>: __PARAMETERS
__SUPERCLASS     <\/span>:
__DYNASTY        <\/span>: __PARAMETERS
__RELPATH        <\/span>:
__PROPERTY_COUNT : 1
__DERIVATION     <\/span>: {}
__SERVER         <\/span>:
__NAMESPACE      <\/span>:
__PATH           <\/span>:
ReturnValue      <\/span>: 0<\/span><\/p>\n

<\/span><\/font><\/p>\n

All this might make you wonder where the hidden WMI methods are. The key to finding the hidden WMI methods is understanding if the method is an instance method or if it is a static WMI method. If the method is an instance method, it is available directly from within using the Get-WmiObject<\/b>, in the same way the methods were available from VBScript using the ExecQuery<\/b> method. The method operates on an instance of the WMI class. If the method is a static WMI method, you will need to use the [wmiclass]<\/b> type accelerator. This is similar to the way you had to use a different syntax in VBScript to call the class methods. In Windows PowerShell, you use the [wmiclass]<\/b> type accelerator to retrieve the WMI class—not an instance of the class. To retrieve the class, you use [wmiclass]<\/b> and the WMI class name. This is seen here: <\/p>\n

PS C:> [wmiclass]”Win32_process”<\/p>\n


   <\/span>NameSpace: ROOTcimv2<\/p>\n

Name                                <\/span>Methods              <\/span>Properties
—-                                <\/span>——-      <\/span>        <\/span>———-
Win32_Process                       <\/span>{Create, Terminat… {Caption, CommandLi…<\/p>\n

<\/font><\/span><\/p>\n

You can think of it as casting a string into a WMI class, or you can think of it as a type accelerator because it makes it easy to get access to the WMI class. After you have the WMI class, you can send it to Get-Member<\/b> as seen here: <\/p>\n

PS C:> [wmiclass]”Win32_process” | Get-Member<\/p>\n


   <\/span>TypeName: System.Management.ManagementClass#ROOTcimv2Win32_Process<\/p>\n

Name                <\/span>MemberType    <\/span>Definition
—-        <\/span>        <\/span>———-    <\/span>———-
Name                <\/span>AliasProperty Name = __Class
Create              <\/span>Method        <\/span>System.Management.ManagementBaseObject Cre…
__CLASS             <\/span>Property      <\/span>System.String __CLASS {get;set;}
__DERIVATION        <\/span>Property      <\/span>System.String[] __DERIVATION {get;set;}
__DYNASTY           <\/span>Property      <\/span>System.String __DYNASTY {get;set;}
__GENUS             <\/span>Property      <\/span>System.Int32 __GENUS {get;set;}
__NAMESPACE         <\/span>Property      <\/span>System.String __NAMESPACE {get;set;}
__PATH              <\/span>Property      <\/span>System.String __PATH {get;set;}
__PROPERTY_COUNT    <\/span>Property      <\/span>System.Int32 __PROPERTY_COUNT {get;set;}
__RELPATH           <\/span>Property      <\/span>System.String __RELPATH {get;set;}
__SERVER            <\/span>Property      <\/span>System.String __SERVER {get;set;}
__SUPERCLASS        <\/span>Property      <\/span>System.String __SUPERCLASS {get;set;}
ConvertFromDateTime ScriptMethod  <\/span>System.Object ConvertFromDateTime();
ConvertToDateTime   <\/span>ScriptMethod  <\/span>System.Object ConvertToDateTime();<\/font><\/span><\/p>\n

<\/span><\/p>\n

The only WMI method that is seen is the Create<\/b> method. The remaining properties are all system properties. There are two scriptMethods<\/b> that were added by Windows PowerShell team to the object. To use the create<\/b> method, you can call the method directly from the class as seen here: <\/p>\n

PS C:> ([wmiclass]”Win32_process”).Create(“notepad”)<\/p>\n


__GENUS          <\/span>: 2
__CLASS       <\/span><\/span><\/font><\/p>\n","protected":false},"excerpt":{"rendered":"

  Hey, Scripting Guy! Using the Get-Member cmdlet with Windows PowerShell is pretty cool, but the one thing I do not like is the way that Windows PowerShell hides stuff from me. When I look in MSDN for information about a WMI class, I see all of these methods listed. When I use the Get-Member  […]<\/p>\n","protected":false},"author":595,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[3,4,45,6],"class_list":["post-52783","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting","tag-scripting-guy","tag-scripting-techniques","tag-windows-powershell","tag-wmi"],"acf":[],"blog_post_summary":"

  Hey, Scripting Guy! Using the Get-Member cmdlet with Windows PowerShell is pretty cool, but the one thing I do not like is the way that Windows PowerShell hides stuff from me. When I look in MSDN for information about a WMI class, I see all of these methods listed. When I use the Get-Member  […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/52783","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/595"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=52783"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/52783\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=52783"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=52783"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=52783"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}