WMI and CIM¶

Windows Management Instrumentation (WMI) and the Common Information Model (CIM) are two closely related technologies that provide a unified, structured way to query and manage almost every aspect of a Windows system. They expose system information—such as hardware details, operating system configuration, network settings, services, processes, and performance data—through a consistent object model. PowerShell integrates deeply with both technologies, allowing administrators to retrieve system information and perform management tasks in a predictable and scriptable manner.

This section explains the conceptual foundations of WMI and CIM, how PowerShell interacts with them, and how to use them effectively in real administrative scenarios.

1. Understanding WMI and CIM¶

WMI is Microsoft’s implementation of the Common Information Model (CIM), an industry standard for describing system components. CIM defines the structure; WMI provides the Windows‑specific implementation.

Conceptually:

• CIM is the standard model.
• WMI is the Windows provider that implements that model.
• PowerShell provides cmdlets that query and manipulate WMI/CIM classes.

Both WMI and CIM expose system information through classes, such as:

• Win32_OperatingSystem
• Win32_LogicalDisk
• Win32_Service
• Win32_NetworkAdapter

Each class contains properties (data) and methods (actions).

For example, Win32_Service includes:

• Properties: Name, State, StartMode
• Methods: StartService(), StopService()

PowerShell allows you to interact with these classes as if they were native PowerShell objects.

2. WMI vs. CIM in PowerShell¶

PowerShell provides two sets of cmdlets:

WMI cmdlets (older)¶

• Get-WmiObject
• Invoke-WmiMethod
• Set-WmiInstance

These use the older DCOM protocol and are still available for compatibility.

CIM cmdlets (modern)¶

• Get-CimInstance
• Invoke-CimMethod
• New-CimSession

These use WS‑Management (the same protocol as PowerShell Remoting), making them more firewall‑friendly and reliable.

For modern scripts, CIM cmdlets are recommended.

3. Querying System Information with CIM¶

CIM classes allow you to retrieve detailed system information in a structured way.

Example: retrieving operating system information¶

Get-CimInstance -ClassName Win32_OperatingSystem

This returns an object containing:

• OS version
• Build number
• System directory
• Last boot time
• Registered user

Because the result is a PowerShell object, you can access properties directly:

(Get-CimInstance -ClassName Win32_OperatingSystem).LastBootUpTime

4. Querying Hardware Information¶

CIM provides access to hardware details that are not available through standard cmdlets.

Example: retrieving CPU information¶

Get-CimInstance -ClassName Win32_Processor

This reveals:

• CPU name
• Number of cores
• Clock speed
• Virtualization support

Example: retrieving disk information¶

Get-CimInstance -ClassName Win32_LogicalDisk

This returns objects representing each logical disk, including:

• Drive letter
• Free space
• Total size
• File system type

5. Managing System Components with CIM Methods¶

Many CIM classes expose methods that allow you to perform actions, not just retrieve information.

Example: stopping a service using CIM¶

$service = Get-CimInstance -ClassName Win32_Service -Filter "Name='Spooler'"
Invoke-CimMethod -InputObject $service -MethodName StopService

Here:

• The first command retrieves the service object.
• The second command invokes the StopService() method defined by the CIM class.
• The action is performed on the remote system through the CIM infrastructure.

This approach is especially useful when managing systems that do not expose certain actions through standard PowerShell cmdlets.

6. Filtering CIM Queries¶

CIM queries can be filtered at the source, reducing overhead and improving performance.

Example: filtering by class property¶

Get-CimInstance -ClassName Win32_Service -Filter "State='Running'"

This retrieves only running services, without retrieving the entire service list first.

Example: filtering disks by drive type¶

Get-CimInstance -ClassName Win32_LogicalDisk -Filter "DriveType=3"

DriveType 3 corresponds to local disks.

7. CIM Sessions for Remote Management¶

CIM sessions allow you to query remote systems using the same syntax as local queries.

Creating a CIM session¶

$session = New-CimSession -ComputerName "SERVER01"

Querying a remote system¶

Get-CimInstance -ClassName Win32_OperatingSystem -CimSession $session

The command runs on the remote machine, but the results are returned to your local session.

Removing the session¶

Remove-CimSession $session

CIM sessions are more lightweight than PowerShell Remoting sessions and are ideal for large‑scale inventory and monitoring tasks.

8. Practical Administrative Scenarios¶

Checking free disk space across multiple servers¶

$servers = Get-Content "servers.txt"

foreach ($server in $servers) {
    $session = New-CimSession -ComputerName $server
    $disks = Get-CimInstance -ClassName Win32_LogicalDisk -CimSession $session -Filter "DriveType=3"

    foreach ($disk in $disks) {
        [pscustomobject]@{
            ComputerName = $server
            Drive        = $disk.DeviceID
            FreeGB       = [math]::Round($disk.FreeSpace / 1GB, 2)
            TotalGB      = [math]::Round($disk.Size / 1GB, 2)
        }
    }

    Remove-CimSession $session
}

This produces a structured inventory of disk usage across all servers.

Retrieving BIOS information¶

Get-CimInstance -ClassName Win32_BIOS

This is useful for hardware audits and compliance checks.

Restarting a remote service using CIM¶

$session = New-CimSession -ComputerName "SERVER01"
$svc = Get-CimInstance -ClassName Win32_Service -Filter "Name='Spooler'" -CimSession $session

Invoke-CimMethod -InputObject $svc -MethodName StopService
Invoke-CimMethod -InputObject $svc -MethodName StartService

Remove-CimSession $session

This demonstrates how CIM methods can be used to manage services remotely.

9. Summary¶

WMI and CIM provide a powerful, structured, and extensible framework for querying and managing Windows systems. PowerShell integrates deeply with this framework, enabling administrators to:

• Retrieve detailed system and hardware information
• Manage services, processes, and configuration through CIM methods
• Filter queries efficiently at the source
• Perform remote management through CIM sessions
• Build scalable inventory and monitoring solutions

By mastering WMI and CIM, you gain access to the deepest layers of Windows system management, far beyond what standard cmdlets expose. This capability is essential for advanced automation, diagnostics, and enterprise‑level administration.