Gallery

Managing with WMI

Posted on 12 Jul 2007 at 17:52

Thomas Lee rounds off the basics of .NET by examining how Windows Management Instrumentation can be used in effective systems management.

Using WMI

If you've been following this column from the start then you'll find WMI classes simple to use, once you know how to access them (and that's simple enough, too). Within PowerShell, you use the Get-WMIObject command to retrieve instances of a given WMI class from a given computer. For example, to get and view basic information about your computer, you could use the Win32_ComputerSystem class like this:

PSH [D:\foo]: Get-WMIObject Win32_ComputerSystem

Domain : cookham.com

Manufacturer : Dell Inc.

Model : Latitude D820

Name : TFL1

PrimaryOwnerName : Thomas Lee

TotalPhysicalMemory : 2145435648

The Get-WMIObject command, similar to the New-Object cmdlet, creates an instance of a WMI class - in this case, the Win32_computer class. Of course, like all PowerShell objects, you can assign the output of the Get-WMIObject and manipulate it, and see what it contains using Get-Member:

PSH [D:\foo]: $comp=get-wmiobject win32_computersystem

PSH [D:\foo]: $comp.infraredsupported

False

PSH [D:\foo]: $comp.systemtype

X86-based PC

PSH [D:\foo]: $comp.status

OK

PSH [D:\foo]:

There are several WMI exploration tools, including the WMI Management Console (WMIC), which is built into all versions of Windows, but one of the more interesting ones I've found is the WMI Explorer written by Mark Van Orsow (www.thepowershellguy.com), which you can see above. What's particularly impressive about this tool is that it's written using PowerShell. For more information on the WMI Explorer, see the three blog articles at www.pcpro.co.uk/links/155dotnet2, and look at the first of these three articles for a free download of the tool.

To use the WMI Explorer, download and run the script, then select the computer to view and expand the namespaces. When you select a namespace, you can see all the classes it contains, and selecting a class brings up information about that class, including the ability to view any instances of it that have been created. In the screenshot above, I show the Security Center namespace's Antivirus class, which I'll discuss later.

WMI objects, as shown above, contain a number of properties you can retrieve and, in many cases, set. They also include a number of methods you can call to do useful things: for example, the Win32_computersystem object we looked at above also has a number of methods you can call. For example, you can change the name of your computer using the rename method, as follows:

PSH [D:\foo]: $comp.rename("foobar")

Naturally, you'll need to be logged in as admin in order to have the necessary level of privilege to carry out this operation.

WMI events

WMI also provides a rich event system, and you can monitor for the occurrence of events such as a service stopping unexpectedly; a server becoming unavailable; a disk drive filling to 95% of its capacity; or a security event being reported to an NT Event Log. WMI can detect that an event has occurred and inform an event consumer of that event.

A WMI event consumer is an application or script that requests to be notified whenever this event occurs, and once informed of an event it can carry out appropriate tasks to handle it, such as restarting a service or alerting you that the event has occurred. At present, PowerShell doesn't provide a mechanism for receiving these events, so you'll have to use other less friendly tools to process events - you could write a C++ program that receives the event and spawns a PowerShell script to handle it. For more details on event providers and consumers, take a look at Monitoring and Responding to Events with Standard Consumers, which you'll find at www.pcpro.co.uk/links/155dotnet3.