Powershell

Get-CimInstance: Get WMI Objects with PowerShell

Migrate away from WMIC and embrace the versatility of the Get-CimInstance cmdlet. Learn about the performance benefits and efficient network communication it offers.

In case you haven’t heard, starting on January 29, 2024, Microsoft has deprecated the Windows Management Instrumentation Command-line (WMIC), disabled by default on Windows 11 insider builds. If your application depends on WMIC, Microsoft, in their documentation, recommends that you migrate away from it. Get-CimInstance cmdlet is a modern PowerShell-based tool with tremendous value you can use to interact with WMI classes and the Common Information Model (CIM) with various parameters. 

Get-CimInstance

With the deprecation of WMI and the newer CIM instance object and the Get-CimInstance cmdlet, admins get a more robust, efficient, and versatile tool. Unlike its predecessor, Get-WmiObjectGet-CimInstance uses the CIM server over the more dated Component Object Model (COM) interface. This leads to performance benefits and more efficient network communication when managing remote computers.

Take a look at the output of a Get-Help Get-CimInstance cmd.NAME
Get-CimInstance

SYNTAX
Get-CimInstance [-ClassName] <string> [-ComputerName <string[]>] [-KeyOnly] [-Namespace <string>]
[-OperationTimeoutSec <uint>] [-QueryDialect <string>] [-Shallow] [-Filter <string>] [-Property <string[]>]
[<CommonParameters>]

Get-CimInstance [-InputObject] <ciminstance> -CimSession <CimSession[]> [-ResourceUri <uri>] [-OperationTimeoutSec
<uint>] [<CommonParameters>]

Get-CimInstance -CimSession <CimSession[]> -Query <string> [-ResourceUri <uri>] [-Namespace <string>]
[-OperationTimeoutSec <uint>] [-QueryDialect <string>] [-Shallow] [<CommonParameters>]

Get-CimInstance [-ClassName] <string> -CimSession <CimSession[]> [-KeyOnly] [-Namespace <string>]
[-OperationTimeoutSec <uint>] [-QueryDialect <string>] [-Shallow] [-Filter <string>] [-Property <string[]>]
[<CommonParameters>]

Get-CimInstance -CimSession <CimSession[]> -ResourceUri <uri> [-KeyOnly] [-Namespace <string>]
[-OperationTimeoutSec <uint>] [-Shallow] [-Filter <string>] [-Property <string[]>] [<CommonParameters>]

Get-CimInstance -ResourceUri <uri> [-ComputerName <string[]>] [-KeyOnly] [-Namespace <string>]
[-OperationTimeoutSec <uint>] [-Shallow] [-Filter <string>] [-Property <string[]>] [<CommonParameters>]

Get-CimInstance [-InputObject] <ciminstance> [-ResourceUri <uri>] [-ComputerName <string[]>] [-OperationTimeoutSec
<uint>] [<CommonParameters>]

Get-CimInstance -Query <string> [-ResourceUri <uri>] [-ComputerName <string[]>] [-Namespace <string>]
[-OperationTimeoutSec <uint>] [-QueryDialect <string>] [-Shallow] [<CommonParameters>]

CIM advantages

CIM is a standard that is defined by the Distributed Management Task Force (DMTF). It is a  standardized way of describing management data. With CIM, admins can use a consistent approach across different platforms.

Get-CimInstance Examples for Local and Remote System Queries

The cmdlet allows you to query a wide range of system information, including installed software and services and hardware details.

Querying Local Computer Information

Let’s use Get-CimInstance to query the local computer. The simplest form of a Get-CimInstance command looks like this:

Get-CimInstance -ClassName CIM_OperatingSystem

This command fetches basic operating system details. But Get-CimInstance shines in its ability to filter and refine these queries using the -Property parameter to specify only the key properties you’re interested in.

Getting cim operating system information
Getting cim operating system information

Remote Computer queries

Let’s use Get-CimInstance for remote system management. We need to use the ComputerName parameter. This allows queries across the network on remote systems. For instance, to get the operating system information from a remote machine, you’d use the WMI class “CIM_OperatingSystem”:

Get-CimInstance -ClassName CIM_OperatingSystem -ComputerName "RemoteComputerName"
Getting a remote server operating system using get ciminstance
Getting a remote server operating system using get ciminstance

You can also query multiple remote computers in a single command by passing an array of computer names to the ComputerName parameter.

Querying multiple servers using get ciminstance
Querying multiple servers using get ciminstance

Advanced Get-CimInstance Query techniques

To truly leverage Get-CimInstance, understanding its advanced querying capabilities is key. The -Query parameter allows for WMI Query Language (WQL) statements, offering precise control over the data retrieved.

Filtering with WQL

For example, to retrieve processor information only for processors with a speed greater than 2 GHz, you would use:

Get-CimInstance -Query "SELECT * FROM CIM_Processor WHERE MaxClockSpeed > 2000"
Querying processor capabilities with get ciminstance
Querying processor capabilities with get ciminstance

CIM Sessions

CIM sessions enable persistent connections to remote systems. This has an advantage for executing multiple operations on the same remote computer. It minimizes the management to create connections for each query.

Establishing a CIM Session

Creating a CIM session is straightforward:

$session = New-CimSession -ComputerName "RemoteComputerName" Get-CimInstance -ClassName CIM_OperatingSystem -CimSession $session

Using Get-CimInstance to query the Event log

We can use Get-CimInstance to query the event log.

To monitor system events, you might use:

Get-CimInstance -ClassName Win32_NTLogEvent -Filter "Logfile = 'System' AND EventType = 1"

With this command you can monitor and list critical system events and all the properties of each.

Event log queries using get ciminstance
Event log queries using get ciminstance

Troubleshooting

WMI and WinRM can still be quirky when it comes to domain permissions and workgroup configurations. The command is sensitive to using a computer name or IP address in an operation or connection, as you can see below:

Error connecting via ip address
Error connecting via ip address

In the above, you will need to make sure to use the computer name for the commands instead.

Below, a workgroup computer is attempting to query a server that is joined to a Windows domain.

Kerberos error with get ciminstance
Kerberos error with get ciminstance

Wrapping up

Get-CimInstance is a great PowerShell cmdlet for system management and has many features. It can query multiple WMI classes locally and remotely. You can use a New-CimSession cmdlet to establish a session that can be reused, and you can also use it for real-world examples like querying the event logs. These cmdlets are the future for an administrator querying objects in a script or accessing quick information from the command line.

Subscribe to VirtualizationHowto via Email 🔔

Enter your email address to subscribe to this blog and receive notifications of new posts by email.

Brandon Lee

Brandon Lee is the Senior Writer, Engineer and owner at Virtualizationhowto.com and has over two decades of experience in Information Technology. Having worked for numerous Fortune 500 companies as well as in various industries, Brandon has extensive experience in various IT segments and is a strong advocate for open source technologies. Brandon holds many industry certifications, loves the outdoors and spending time with family.

Related Articles

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.