The problem with extra “stuff” in a WMI query<\/h2>\n
The problem of getting “extra stuff” back when you do a WMI data query has been around since Windows PowerShell 1.0 (even longer if you count the beta period). But to be honest, it is not that you get extra stuff back when you perform a WMI query, it is that certain WMI classes have a default output that is configured via the types.ps1xml<\/b> file. For example, the image that follows illustrates the portion that shows the format XML information for the Win32_BIOS<\/b> WMI class.<\/p>\n
When you perform a basic WMI query, the default display formats the output. This is because the basic query (no specifically requested properties) matches the System.Management.ManagementObject#root\\cimv2\\Win32_BIOS type that is specified in the format XML file. This information is shown here:<\/p>\n PS C:\\> gwmi win32_bios | gm | select typename -Unique<\/p>\n <\/p>\n TypeName<\/p>\n ——–<\/p>\n System.Management.ManagementObject#root\\cimv2\\Win32_BIOS<\/p>\n When I use the Property <\/i>parameter or I perform a custom WQL query, the returned type changes; and therefore, it does not match the type that is defined in the types.ps1xml file, as shown here.<\/p>\n PS C:\\> gwmi win32_bios -property name | gm | select typename -Unique<\/p>\n <\/p>\n TypeName<\/p>\n ——–<\/p>\n System.Management.ManagementObject#\\Win32_BIOS<\/p>\n <\/p>\n PS C:\\> gwmi -q “select name from win32_bios” | gm | select typename -u<\/p>\n <\/p>\n TypeName<\/p>\n ——–<\/p>\n System.Management.ManagementObject#\\Win32_BIOS<\/p>\n So what is the “extra stuff” that comes back when a custom WMI query runs? They are system properties. One of the nice things about WMI is that all of the system properties begin with a double underscore ( __<\/b> ). In addition, all system WMI classes begin with a double underscore. When you run a WMI query that selects only the name property, a whole bunch of system properties also return. This is shown here:<\/p>\n PS C:\\> gwmi -q “select name from win32_bios”<\/p>\n <\/p>\n __GENUS : 2<\/p>\n __CLASS : Win32_BIOS<\/p>\n __SUPERCLASS :<\/p>\n __DYNASTY :<\/p>\n __RELPATH :<\/p>\n __PROPERTY_COUNT : 1<\/p>\n __DERIVATION : {}<\/p>\n __SERVER :<\/p>\n __NAMESPACE :<\/p>\n __PATH :<\/p>\n Name : Default System BIOS<\/p>\n One way to clean up the output is to filter these properties by using a range in either Format-Table<\/b> or Format-List<\/b> as shown here:<\/p>\n PS C:\\> gwmi -q “select name from win32_bios” | fl [a-zA-Z]*<\/p>\n <\/p>\n Name : Default System BIOS<\/p>\n Scope : System.Management.ManagementScope<\/p>\n Path :<\/p>\n Options : System.Management.ObjectGetOptions<\/p>\n ClassPath : Win32_BIOS<\/p>\n Properties : {Name}<\/p>\n SystemProperties : {__GENUS, __CLASS, __SUPERCLASS, __DYNASTY…}<\/p>\n Qualifiers : {dynamic, Locale, provider, UUID}<\/p>\n Site :<\/p>\n Container :<\/p>\n <\/p>\n PS C:\\> gwmi -q “select name from win32_bios” | ft [a-zA-Z]*<\/p>\n <\/p>\n Name Scope Path Options ClassPat Propert SystemP Qualifi Site Contain<\/p>\n h ies roperti ers er<\/p>\n es<\/p>\n —- —– —- ——- ——– ——- ——- ——- —- ——-<\/p>\n Defau… Syste… Syste… Win32… {Name} {__G… {dyn…<\/p>\n Unfortunately, in Windows PowerShell 2.0, that filter trick quit working because no sooner do you get rid of one group of system properties, than another group of system properties appears. It does not matter, whether you use the Format-Table<\/b> cmdlet or if you use the Format-List<\/b> cmdlet—the extra system properties appear to be here to stay.<\/p>\n If you specifically choose the properties in your WMI query, you also need to specifically choose them in the Format-Table<\/b> or Format-List<\/b> query. This technique is shown here:<\/p>\n PS C:\\> gwmi -Property name -Class win32_bios | ft name<\/p>\n <\/p>\n name<\/p>\n —-<\/p>\n Default System BIOS<\/p>\n <\/p>\n PS C:\\> gwmi -Property name -Class win32_bios | fl name<\/p>\n <\/p>\n name : Default System BIOS<\/p>\n There are at least two things “wrong” with this approach. The first is that once you use a Format-Table<\/b>, Format-List<\/b>, or Format-Wide<\/b> cmdlet, you cannot do anything else with your pipeline because the object is now gone. In other words, the format* cmdlets destroy the pipeline. What is the difference? Well, it can be seen by examining the object in the pipeline.<\/p>\n In the first example, we see that we have a win32_bios<\/b> management object.<\/p>\n PS C:\\> gwmi -Property name -Class win32_bios | gm | select typename -u<\/p>\n <\/p>\n TypeName<\/p>\n ——–<\/p>\n System.Management.ManagementObject#\\Win32_BIOS<\/p>\n But following the pipeline to the Format-List<\/b> cmdlet, we no longer have a management object at all. Instead they are all format-related objects as shown here.<\/p>\n PS C:\\> gwmi -Property name -Class win32_bios | fl name | gm | select typename –<\/p>\n <\/p>\n TypeName<\/p>\n ——–<\/p>\n Microsoft.PowerShell.Commands.Internal.Format.FormatStartData<\/p>\n Microsoft.PowerShell.Commands.Internal.Format.GroupStartData<\/p>\n Microsoft.PowerShell.Commands.Internal.Format.FormatEntryData<\/p>\n Microsoft.PowerShell.Commands.Internal.Format.GroupEndData<\/p>\n Microsoft.PowerShell.Commands.Internal.Format.FormatEndData<\/p>\n The best way to remove the “extra stuff” is to use the Select-Object<\/b> cmdlet. This cmdlet removes the “stuff” and retains the object-oriented nature of the data. This means that you can do other things with it. In the command that follows, the Name<\/b> and the ProcessID<\/b> properties from the Win32_Service<\/b> WMI class are chosen from the WMI data. Next, the Select-Object<\/b> cmdlet chooses the same properties. Now they are sent to Get-Member<\/b>, and the typename<\/b> is displayed. This is shown here:<\/p>\n PS C:\\> gwmi -Property name, processID -Class win32_Service | Select name, processID<\/p>\n | gm | select typename -u<\/p>\n <\/p>\n TypeName<\/p>\n ——–<\/p>\n Selected.System.Management.ManagementObject<\/p>\n Now, what does this look like when it is displayed to the Windows PowerShell console? The following is a partial output (note that there are no system properties).<\/p>\n PS C:\\> gwmi -Property name, processID -Class win32_Service | Select name, processID<\/p>\n <\/p>\n name processID<\/p>\n —- ———<\/p>\n AdobeActiveFileMonitor6.0 2036<\/p>\n AdobeARMservice 1776<\/p>\n AeLookupSvc 0<\/p>\n ALG 0<\/p>\n AppIDSvc 0<\/p>\n Appinfo 504<\/p>\n AppMgmt 0<\/p>\n aspnet_state 0<\/p>\n AudioEndpointBuilder 456<\/p>\n AudioSrv 336<\/p>\n AxInstSV 0<\/p>\n BDESVC 0<\/p>\n BFE 1920<\/p>\n BITS 504<\/p>\n Browser 0<\/p>\n bthserv 2796<\/p>\n But what about the object itself? Look at what Get-Member<\/b> displays. We have created a custom management object with two properties: Name<\/b> and ProcessID<\/b>.<\/p>\n PS C:\\> gwmi -Property name, processID -Class win32_Service | Select name, processId<\/p>\n | gm<\/p>\n <\/p>\n TypeName: Selected.System.Management.ManagementObject<\/p>\n <\/p>\n Name MemberType Definition<\/p>\n —- ———- ———-<\/p>\n Equals Method bool Equals(System.Object obj)<\/p>\n GetHashCode Method int GetHashCode()<\/p>\n GetType Method type GetType()<\/p>\n ToString Method string ToString()<\/p>\n name NoteProperty System.String name=AdobeActiveFileMonitor6.0<\/p>\n processId NoteProperty System.UInt32 processId=2036<\/p>\n Because this is still a management object, we can continue to use Windows PowerShell to massage the data. As shown here, we can use the Sort-Object<\/b> cmdlet to sort the data, and we can use the –Last<\/i> parameter to choose the last two services.<\/p>\n PS C:\\> gwmi -Property name, processID -Class win32_Service | sort name | Select name<\/p>\n , processId -Last 2<\/p>\n <\/p>\n name processId<\/p>\n —- ———<\/p>\n wudfsvc 456<\/p>\n WwanSvc 0<\/p>\n One thing that can simplify things is to list the properties that you are interested in obtaining in an array, and then use them directly in your Get-WmiObject<\/b> and your Select-Object<\/b> queries. In this way, you only need to type them once. Because I do not like typing quotation marks, I create a single string with the CSV list of property names. Then I use the Split<\/b> <\/i>operator to create my array. The thing to keep in mind is to not put spaces between the property names. This code is shown here:<\/p>\n $property = “Name,started,StartName” -split “,”<\/p>\n gwmi -p $property -cl win32_service | select $property<\/p>\n When you have the properties in an array, you can use them as often as you want without the need to retype them. In the example that follows, the Format-Table<\/b> cmdlet is used to display a table of service information.<\/p>\n $property = “Name,started,StartName” -split “,”<\/p>\n gwmi -p $property -cl win32_service | select $property | ft $property –AutoSize<\/p>\n The use of the commands and their associated output is shown here:<\/p>\n Well, that is about it for right now. The Scripting Wife will be back soon (I imagine), and then she was talking about going to do something. No idea what—just something. But hey, we are at the beach, so there is bound to be something going on. Maybe we can found the Myrtle Beach Windows PowerShell Users Group while we are down here.<\/p>\n I invite you to follow me on Twitter<\/a> and Facebook<\/a>. If you have any questions, send email to me at scripter@microsoft.com<\/a>, or post your questions on the Official Scripting Guys Forum<\/a>. See you tomorrow. Until then, peace.<\/p>\n Ed Wilson, Microsoft Scripting Guy<\/b> <\/p>\n","protected":false},"excerpt":{"rendered":" Summary: Microsoft Scripting Guy, Ed Wilson, shows you how to use Windows PowerShell to clean up your WMI data output. Microsoft Scripting Guy, Ed Wilson, is here. So far the Scripting Wife has been scarce. She got up before sunrise (I believe) and headed out to points unknown. Actually, I believe she had scheduled a […]<\/p>\n","protected":false},"author":596,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[3,4,61,45,6],"class_list":["post-8721","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting","tag-scripting-guy","tag-scripting-techniques","tag-weekend-scripter","tag-windows-powershell","tag-wmi"],"acf":[],"blog_post_summary":" Summary: Microsoft Scripting Guy, Ed Wilson, shows you how to use Windows PowerShell to clean up your WMI data output. Microsoft Scripting Guy, Ed Wilson, is here. So far the Scripting Wife has been scarce. She got up before sunrise (I believe) and headed out to points unknown. Actually, I believe she had scheduled a […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/8721","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/596"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=8721"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/8721\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=8721"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=8721"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=8721"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}![\"Image](\"https:\/\/devblogs.microsoft.com\/wp-content\/uploads\/sites\/29\/2019\/02\/3823.HSG-7-14-12-01.png\" "\\"Image")
<\/a><\/p>\nFiltering out the system properties<\/h2>\n
Using Format-Table or Format-List<\/h2>\n
Remove the “extra stuff” and retain the object<\/h2>\n
![\"Image](\"https:\/\/devblogs.microsoft.com\/wp-content\/uploads\/sites\/29\/2019\/02\/6378.HSG-7-14-12-02.png\" "\\"Image")
<\/a><\/p>\n