Get-CimInstance: Get WMI Objects with PowerShell

In case you haven’t heard, starting on January 29, 2024, Microsoft has deprecated the Windows Management Instrumentation Command-line (WMIC), disabled by default on Windows 11 insider builds. If your application depends on WMIC, Microsoft, in their documentation, recommends that you migrate away from it. Get-CimInstance cmdlet is a modern PowerShell-based tool with tremendous value you can use to interact with WMI classes and the Common Information Model (CIM) with various parameters. 

Get-CimInstance

With the deprecation of WMI and the newer CIM instance object and the Get-CimInstance cmdlet, admins get a more robust, efficient, and versatile tool. Unlike its predecessor, Get-WmiObject, Get-CimInstance uses the CIM server over the more dated Component Object Model (COM) interface. This leads to performance benefits and more efficient network communication when managing remote computers.

Take a look at the output of a Get-Help Get-CimInstance cmd.NAME
Get-CimInstance

SYNTAX
Get-CimInstance [-ClassName] <string> [-ComputerName <string[]>] [-KeyOnly] [-Namespace <string>]
[-OperationTimeoutSec <uint>] [-QueryDialect <string>] [-Shallow] [-Filter <string>] [-Property <string[]>]
[<CommonParameters>]

Get-CimInstance [-InputObject] <ciminstance> -CimSession <CimSession[]> [-ResourceUri <uri>] [-OperationTimeoutSec
<uint>] [<CommonParameters>]

Get-CimInstance -CimSession <CimSession[]> -Query <string> [-ResourceUri <uri>] [-Namespace <string>]
[-OperationTimeoutSec <uint>] [-QueryDialect <string>] [-Shallow] [<CommonParameters>]

Get-CimInstance [-ClassName] <string> -CimSession <CimSession[]> [-KeyOnly] [-Namespace <string>]
[-OperationTimeoutSec <uint>] [-QueryDialect <string>] [-Shallow] [-Filter <string>] [-Property <string[]>]
[<CommonParameters>]

Get-CimInstance -CimSession <CimSession[]> -ResourceUri <uri> [-KeyOnly] [-Namespace <string>]
[-OperationTimeoutSec <uint>] [-Shallow] [-Filter <string>] [-Property <string[]>] [<CommonParameters>]

Get-CimInstance -ResourceUri <uri> [-ComputerName <string[]>] [-KeyOnly] [-Namespace <string>]
[-OperationTimeoutSec <uint>] [-Shallow] [-Filter <string>] [-Property <string[]>] [<CommonParameters>]

Get-CimInstance [-InputObject] <ciminstance> [-ResourceUri <uri>] [-ComputerName <string[]>] [-OperationTimeoutSec
<uint>] [<CommonParameters>]

Get-CimInstance -Query <string> [-ResourceUri <uri>] [-ComputerName <string[]>] [-Namespace <string>]
[-OperationTimeoutSec <uint>] [-QueryDialect <string>] [-Shallow] [<CommonParameters>]

CIM advantages

CIM is a standard that is defined by the Distributed Management Task Force (DMTF). It is a  standardized way of describing management data. With CIM, admins can use a consistent approach across different platforms.

Get-CimInstance Examples for Local and Remote System Queries

The cmdlet allows you to query a wide range of system information, including installed software and services and hardware details.

Querying Local Computer Information

Let’s use Get-CimInstance to query the local computer. The simplest form of a Get-CimInstance command looks like this:

Get-CimInstance -ClassName CIM_OperatingSystem

This command fetches basic operating system details. But Get-CimInstance shines in its ability to filter and refine these queries using the -Property parameter to specify only the key properties you’re interested in.

Remote Computer queries

Let’s use Get-CimInstance for remote system management. We need to use the ComputerName parameter. This allows queries across the network on remote systems. For instance, to get the operating system information from a remote machine, you’d use the WMI class “CIM_OperatingSystem”:

Get-CimInstance -ClassName CIM_OperatingSystem -ComputerName "RemoteComputerName"

You can also query multiple remote computers in a single command by passing an array of computer names to the ComputerName parameter.

Advanced Get-CimInstance Query techniques

To truly leverage Get-CimInstance, understanding its advanced querying capabilities is key. The -Query parameter allows for WMI Query Language (WQL) statements, offering precise control over the data retrieved.

Filtering with WQL

For example, to retrieve processor information only for processors with a speed greater than 2 GHz, you would use:

Get-CimInstance -Query "SELECT * FROM CIM_Processor WHERE MaxClockSpeed > 2000"

CIM Sessions

CIM sessions enable persistent connections to remote systems. This has an advantage for executing multiple operations on the same remote computer. It minimizes the management to create connections for each query.

Establishing a CIM Session

Creating a CIM session is straightforward:

$session = New-CimSession -ComputerName "RemoteComputerName" Get-CimInstance -ClassName CIM_OperatingSystem -CimSession $session

Using Get-CimInstance to query the Event log

We can use Get-CimInstance to query the event log.

To monitor system events, you might use:

Get-CimInstance -ClassName Win32_NTLogEvent -Filter "Logfile = 'System' AND EventType = 1"

With this command you can monitor and list critical system events and all the properties of each.

Troubleshooting

WMI and WinRM can still be quirky when it comes to domain permissions and workgroup configurations. The command is sensitive to using a computer name or IP address in an operation or connection, as you can see below:

In the above, you will need to make sure to use the computer name for the commands instead.

Below, a workgroup computer is attempting to query a server that is joined to a Windows domain.

Wrapping up

Get-CimInstance is a great PowerShell cmdlet for system management and has many features. It can query multiple WMI classes locally and remotely. You can use a New-CimSession cmdlet to establish a session that can be reused, and you can also use it for real-world examples like querying the event logs. These cmdlets are the future for an administrator querying objects in a script or accessing quick information from the command line.