Skip to content

WMI

Get computer model of remote computer

wmic /node:"laptop.company.com" computersystem get model

Get computer serial number

wmic bios get serialnumber

Test WMI query (GUI)

wbemtest.exe

Check WMI repository consistency

winmgmt  /salvagerepository

Get system disk

Get-WmiObject -query "Select * from Win32_DiskPartition WHERE Index = 0" -ComputerName $computernames

WMI query for file modification

  • Run wbemtest.exe.
  • Connect to root\cimv2.
  • Push notification query.
  • Enter your WMI query and press Apply.
  • Change file and check for TargetObject -> View Embedded.
    • Note the use of single quotes to specify strings and double backslashes in place of each backslash.
SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'CIM_DataFile' AND TargetInstance.Name = 'C:\\Program Files (x86)\\nxlog\\conf\\nxlog.conf'

https://docs.microsoft.com/en-us/previous-versions/technet-magazine/cc160917(v=msdn.10)