Windows Management Instrumentation Command-line

Windows Management Instrumentation command-line (WMIC) provides you with a simple command-line interface to Windows Management Instrumentation (WMI), so you can take advantage of WMI to manage computers running the Windows Server 2003 family of operating systems. WMIC interoperates with existing shells and utility commands, and can be easily extended by scripts or other administration-oriented applications.

  • For tips about using WMIC, see Best Practices.
  • For help with specific tasks, see How to.
  • For general background information , see Concepts.
  • For problem-solving instructions, see Troubleshooting.


Best practices

Use the WHERE () clause for specific instances to be returned for an alias.

  • The WHERE() clause must include the WHERE clause for a valid WQL query. The parentheses are only required for complex criteria. See the WMI SDK for WQL syntax. The WHERE() clause must immediately follows the alias name. For example: process where (processID>300) list brief
  • When the WHERE clause is WHERE NAME='<value>', it is sufficient to give only the value. For example: SERVICE CLIPSRV

    Instead of:

    SERVICE WHERE NAME='CLIPSRV'

    • For more information, see Managing systems with WMI Command-line.

Use /OUTPUT, /APPEND, and /RECORD commands to redirect output.

  • Commands that output in HTML format (such as CLASS) typically have their output directed to a file. You can then view that file for results of the command. You can redirect the output can by using the /OUTPUT, /APPEND, and /RECORD commands.

    • For more information, see Managing systems with WMI Command-line.

Enclose values in quotation marks if the values contain special characters such as dashes, slashes, or spaces.

For more information, see Managing systems with WMI Command-line.

Use these methods of query for large domains or databases

  • ALIAS
    WMIC ALIAS PROCESS LIST BRIEF
  • USERACCOUNT
    WMIC USERACCOUNT WHERE "Name='PutUserNameHere' and Domain='PutDomainNameHere'"
  • FSDIR
    WMIC FSDIR WHERE Name='c:\\WINDOWS'
  • DATAFILE
    WMIC DATAFILE WHERE Name="c:\\boot.ini"
WMIC DATAFILE WHERE "PATH='\\windows\\' and Extension='exe' and FileSize>'108032'" GET LastAccessed, LastModified, Name, FileSize
  • NTEVENT
    WMIC NTEVENT WHERE "LogFile='system' and Type>'0'" GET Message, TimeGenerated
WMIC NTEVENT WHERE "LogFile='system' and Type>'0'" GET Message, TimeGenerated /FORMAT:htable >c:\MySystemEvents.htm
  • Querying:

    Use quotes "" to separate WHERE expressions instead of parentheses () :

    WMIC NTEVENT WHERE "LogFile='system' and Type>'4'"
    [ Compare to:
    WMIC NTEVENT WHERE (LogFile='system' and TYPE>4)
    In this case, Command Shell will misinterpret
    ">4)"
    and will try to redirect output to file named
    "4)"
    ]

    • For more information, see Managing systems with WMI Command-line.

For information about validation of users in WMI, see Managing WMI Security.

For information about WMIC security, authentication, and authorization, see Security with WMIC.

For more information, see Windows Management Instrumentation Command-line.


How to...

  • Run WMIC in interactive mode
  • Run WMIC in non-interactive mode
  • To create an alias for WMIC
  • To create an alias for WMIC off-line
  • To customize an alias in WMIC
  • To create a translation table in WMIC
  • To edit a translation table in WMIC
  • To create a format in WMIC
  • To edit a format in WMIC


Run WMIC in interactive mode

Microsoft Windows graphic

To run WMIC in interactive mode

  1. Click Start, Run.
  2. Type:

    WMIC, and then press ENTER.

  3. Type the alias, command, or global switch you want WMIC to perform.

Notes

  • XOX
  • When you finish using WMIC in interactive mode, you can use the Exit or Quit command to exit WMIC.
  • For more information about the WMIC commands, type /? at the command prompt.

Related Topics


Run WMIC in non-interactive mode

Microsoft Windows graphic

To run WMIC in non-interactive mode

  1. Open Command prompt.
  2. At the command prompt, type:

    WMIC

    and the command, aliases, or global switches, you want WMIC to perform.
  3. Press ENTER.

Notes

  • XOX
  • XOX
  • In non-interactive mode, WMIC returns you to the command prompt after executing the command.
  • For more information about the WMIC commands, type WMIC /? at the command prompt.

Related Topics


Create an alias for WMIC

Microsoft Windows graphic

To create an alias for WMIC

  1. From a WMIC prompt type:
    wmic:root\cli>alias create
  2. Specify the following properties from the command prompt:

    Connection, Description, Formats, FriendlyName, PWhere, Qualifiers, Target, and Verbs.

Notes

  • XOX
  • To open a WMIC prompt, click Start, click Run, and then type WMIC.
  • Formats, Qualifiers, Verbs (methods) can have more than one property name separated by commas. Each property name should be followed by '=' and its value.
  • It may not be practical to create a new alias with more than a few properties and methods.
  • Aliases created in such way will not support localization.
  • To see all the properties you need to create, access the Help by typing:
    wmic:root\cli>alias create /?
  • Save the file, using UNICODE encoding.

Related Topics


Create an alias for WMIC off-line

Microsoft Windows graphic

To create an alias for WMIC off-line

  1. Locate the Managed Object Format (MOF) file, CliEgAlias.mof, located in the %WINDIR%\system32\wbem directory.
  2. Open the MOF file in Notepad.
  3. Add an instance of MSFT_CliAlias by defining:

    Connection, Description, Formats, FriendlyName, PWhere, Qualifiers, Targets, and Verbs

  4. Add an instance of MSFT_LocalizablePropertyValue by defining:

    RelPath, PropertyName and Text properties.

  5. Save the file, using UNICODE encoding.
  6. Open the CliEgAliases.mfl file, located in the %WINDIR%\system32\wbem directory, in Notepad.
  7. Add the instance of MSFT_LocalizablePropertyValue (identical to the one created in step 4).
  8. Save the file, using UNICODE encoding.
  9. From the command prompt, type:
    Mofcomp CliEgAliases.mof
  10. From the command prompt, type:
    Mofcomp CliEgAliases.mfl

Notes

  • XOX
  • You may use schema definitions from the related class specified in your target.

Related Topics


Edit an alias in WMIC

Microsoft Windows graphic

To edit an alias in WMIC

  1. Locate the Managed Object Format (MOF) file, CliEgAliases.mof, located in the %WINDIR%\system32\wbem directory.
  2. Open the MOF file in Notepad.
  3. Locate the appropriate instance of MSFT_CliAlias which defines the alias you want to edit.
  4. Modify the values of the Alias properties (usually, the Descriptions and FriendlyName).
  5. Edit the corresponding values of RelPath, PropertyName and Text properties of the Alias's instance of MSFT_LocalizablePropertyValue if these were changed.
  6. Save the file, specifying UNICODE encoding.
  7. Open CliEgAliases.mfl, located in the %WINDIR%\system32\wbem directory, in Notepad.
  8. Make the same changes (if any) you made in step 5 to the alias's instance of MSFT_LocalizablePropertyValue.
  9. Save the file, specifying UNICODE encoding.
  10. From the command prompt, type:
    Mofcomp CliEgAliases.mof
  11. From the command prompt, type:
    Mofcomp CliEgAliases.mfl

Note

  • XOX

Related Topics


Create a translation table in WMIC

Microsoft Windows graphic

To create a translation table in WMIC

  1. Locate the Managed Object Format (MOF) file, CliEgAliases.mof, located in the %WINDIR%\system32\wbem directory.
  2. Open the MOF file in Notepad.
  3. Create a new translation table as an instance of MSFT_CliTranslateTable.
  4. Define the Name property of the translation table being created.
  5. Define the FromValue and ToValue properties of Instance of MSFT_CliTranslateTableEntry.
  6. Save the file, using UNICODE encoding.
  7. From the command prompt, type:
    Mofcomp CliEgAliases.mof

Note

  • XOX

Related Topics


Edit a translation table in WMIC

Microsoft Windows graphic

To edit a translation table in WMIC

  1. Locate the Managed Object Format (MOF) file, CliEgAliases.mof, located in the %WINDIR%\system32\wbem directory.
  2. Open the MOF file in Notepad.
  3. Locate a translation table to be modified as an Instance of MSFT_CliTranslateTable.
  4. Modify the Name property of the translation table.
  5. Modify FromValue and ToValue properties of Instance of MSFT_CliTranslateTableEntry.
  6. Save the file, using UNICODE encoding.
  7. From a command prompt, type:
    Mofcomp CliEgAliases.mof

Note

  • XOX

Related Topics


Create a format in WMIC

Microsoft Windows graphic

To create a format in WMIC

  1. Create an XSLT-formatted file using the XSL language (for example, MyNewFormat.xsl).
  2. Copy the file into the %WINDIR%\system32\wbem directory.
  3. Locate the xsl-mappings.xml file in the %WINDIR%\system32\wbem directory.
  4. Add an entry in the xsl-mappings.xml file which will map the format to Keyword:
    <XSLFORMAT KEYWORD="MyNewKeyword">MyNewFormat.xsl</XSLFORMAT>

Note

  • XOX

Related Topics


Edit a format in WMIC

Microsoft Windows graphic

To edit a format in WMIC

  1. Locate an existing XSLT format (an .xsl file) in the %WINDIR%\system32\wbem directory.
  2. Make the required changes and save.
  3. Locate the xsl-mappings.xml file in the %WINDIR%\system32\wbem directory.
  4. Modify the related entry in the xsl-mappings.xml file:
    <XSLFORMAT KEYWORD="MyModifiedKeyword">MyModifiedFormat.xsl</XSLFORMAT>

Note

  • XOX

Related Topics


Concepts

This section provides general background information about the Windows Management Intrumentation Command-line (WMIC).

  • Windows Management Instrumentation overview
  • Understanding Windows Management Instrumentation Command-line
  • Deploying Windows Management Instrumentation Command-line
  • Using Windows Management Instrumentation Command-line


Windows Management Instrumentation overview

Windows Management Instrumentation (WMI) is the Microsoft implementation of Web-Based Enterprise Management Initiative (WBEM), an industry initiative to establish standards for accessing and sharing management information over an enterprise network. For more information about WBEM, see WBEM. XOX. WMI provides integrated support for the Common Information Model (CIM)—the data model that describes the objects that exist in a management environment.

WMI includes an object repository, which is the database of object definitions, and the WMI Object Manager, which handles the collection and manipulation of objects in the repository and gathers information from WMI providers. WMI providers act as intermediaries between WMI and components of the operating system, applications, and other systems. For example, the registry provider draws information from the registry, while the SNMP provider provides data and events from SNMP devices. Providers provide information about their components and might provide methods to manipulate the components, properties that can be set or events that can alert you to changes in the components.

WMI can be used by computer management tools, such as Microsoft Systems Management Server, to help you manage your computers. WMI is also used by other Microsoft technologies and tools, such as Microsoft Health Monitor and Microsoft Operations Manager, and by other vendors of computer management systems. You can use WMI with programming or scripting systems (such as Windows Script Host) to retrieve configuration details about most aspects of your computer systems, including server applications, or to affect changes to your systems. For more details, see the WMI SDK.

Several management tools are WMI-enabled, including System Properties, System Information, and the Dependencies component of Services. Brief descriptions of these components follow:

  • System Properties lets you view and change system properties on a local or remote computer. You can restart a remote computer to apply settings changes or to detect new hardware, view the computer name and domain information for other computers on your network, or change the settings for the virtual memory paging file on a computer that might run programs requiring a lot of memory. For more information about System Properties, see Using System Properties.
  • System Information collects and displays configuration information about your system. This is is especially useful when a support technician troubleshoots your system. For more information, see Using System Information.
  • Services helps you manage the services on your computer. Services dependencies identify the services on which the current service depends on and the services that depend on it. For more information about Services, see Using Services.

For technical information about developing the WMI system, see the Windows Management Instrumentation documentation at the Microsoft Platform Software Development Kit (SDK) Web site (http://www.microsoft.com/).

For information about using the WMI Tester to view and modify WMI objects, see Windows Management Instrumentation Tester overview.

For information about using the command-line interface to WMI, see Windows Management Instrumentation Command-line.

For information about using the WMI Control to configure WMI settings and security on a remote or local computer, see WMI Control overview.


Understanding Windows Management Instrumentation Command-line

This section covers:

  • Windows Management Instrumentation Command-line and WMI
  • Understanding WMI Command-line architecture


Windows Management Instrumentation Command-line overview

The Window Management Instrumentation command-line (WMIC) provides you with a simple command-line interface to Windows Management Instrumentation (WMI), so you can take advantage of WMI to manage computers running Microsoft Windows. WMIC interoperates with existing shells and utility commands, and can be easily extended by scripts or other administration-oriented applications.

WMI Providers enable you to use WMI to manage a wide variety of hardware components, operating system subsystems, and application systems. WMIC can be used with all the schemas implemented by those WMI Providers.

WMIC can be used to remotely manage any computer with WMI that is a Windows domain member. WMIC does not have to be available on the remotely managed computer in order for WMIC to manage it.

You can use WMIC to accomplish tasks in the following typical scenarios:

  • Local management of a computer—you are at the computer and use the WMIC command to manage it.
  • Remote management of a computer—you are at one computer and use WMIC to manage another computer.
  • Remote management of multiple computers—you are at on one computer and use WMIC to manage multiple computers with a single command.
  • Remote management of a computer (using a remote session)—you use a remote session technology (such as Telnet or Terminal Services) to connect to a remote computer and manage it with WMIC.
  • Automated management using administrative scripting—you use WMIC to write a simple management script (batch file) to automate the management of a computer (local, remote, or multiple computers—serially or simultaneously).

Notes

  • For general background information on WMI, see WMI overview.
  • For examples on using WMIC, see Managing systems with WMIC.
  • For information about how WMI validates users, see Managing WMI Security.


Understanding WMIC architecture

This topic discusses the relationship of WMIC to WMI, to other computers, and to scripting languages. It also discusses the relationship between aliases, formats, translation tables, and other WMIC elements.

WMIC has an engine to parse, interpret, and execute alias operations called from the command line. The engine is an executable file, called WMIC.exe, which is run on the computer that the user is connected to. Any extension to the WMI command-line interpreter must be done through the addition of alias file definitions or registrations.

Aliases, or friendly names, are defined in Management Object Format (MOF), a language for defining classes and instances in the CIM, and are related to classes in WMI schema.

The WMIC.exe engine receives a command from its stdin interface. The command is parsed by the tool and if it involves an alias, the alias definition is obtained from the current WMI operational namespace (by default, root\cli). The tool interprets the original command with the alias command and current environmental settings, such as the current target namespace. The command is executed as a series of WMI API calls against the target namespace. Any namespace might be used as a target if the namespace is consistent with the alias being processed.

The information returned for the API calls is retrieved in an XML format. The retrieved data is modified by the XSL style sheet, which is associated with the alias. It is applied to the data primarily for presentation formatting. The resulting text is presented back to the user using the stdout interface. The target system and management system need not be on the same computer. However, the original computer must have sufficient credentials to access the target computer.

The style sheet applied to the output defaults is the standard FULL style sheet if no other is specified.

For more information about using WMIC, see Using Windows Management Instrumentation Command-line.

For information about WMI security, see Managing WMI Security.

For information about WMIC security, see Security with WMIC.

For more information, see Windows Management Instrumentation Command-line.


Security with WMIC

General information on the security model

Only users in the local Administrators group can start WMIC. The WMI security access model is enforced on any call from WMIC to WMI. The operating system enforces operating system-level security for any operations executed through WMI. For example, you cannot access files through WMI that you cannot access from Windows Explorer.

WMIC is a client for WMI, so all security checks are performed within WMI components. Before connecting to a remote computer, the component uses PING functionality to verify validity of the input (remote computer status).

When WMIC is used in a Telnet, Terminal Services, or similar session, all commands are carried out in the context of the user issuing the command.

WMIC allows extension of Aliases and XSLs. Security is addressed by NTFS which enforces administrator-only credential requirements for accessing WMIC's files.

Except for method parameters, WMIC allows input data only through the /NODE switch. A list of computer nodes can be provided as a text file using the @FileList option. The file and its location should be secured by the Administrator, and the input file should preferably be read from the WBEM directory.

User permissions

No special user permissions are required to run WMIC. Implicitly, to be able to use WMIC, a user needs to have full write access to both the WMIC namespaces and two registry keys (HKLM\Software\Microsoft\WBEM and HKLM\Software\Microsoft\WBEM\WMIC).

Authentication and authorization

Authentication and authorization are provided by the system when these resources are opened. They are stored in a secured location and the Discretionary Access Control List (DACL) is used to verify that client has access to them. They are wholly dependent on Distributed Component Object Model (DCOM) security as well as Windows Management (WINMGMT) for remote access in providing it with user name, password, and requested levels. The /AUTHLEVEL switch is used for securing WMIC network traffic. In the Windows Server 2003 family operating systems, the default level is set to PKTPRIVACY providing packet privacy encryption level. You can modify the authentication level using the /AUTHLEVEL switch.

Example:

WMIC /AUTHLEVEL:Pktprivacy /NODE:"testcomputer.microsoft.com" BIOS

Configuration data

The configuration information is stored in the registry and in the WMI repository. The registry configuration holds timestamps and validity of Managed Object Format(MOF)-compiled status for schemas. At the start of each session of WMIC, this is evaluated and WMIC will update the WMI repository when schemas are not valid or were updated by a user.

Miscellaneous

WMIC is a powerful command-line tool that allows you to quickly do any task for which you have permissions. If you are not familiar with the WMI environment, you can use the /INTERACTIVE switch to set a warning for delete operations. For example:

WMI /INTERACTIVE:ON

For information about how WMI validates users, see Managing WMI Security.

For more information, see Windows Management Instrumentation Command-line.


Using Windows Management Instrumentation Command-line

This section covers:

  • Running Windows Management Instrumentation command-line
  • Command-line help
  • WMIC aliases
  • WMIC verbs
  • WMIC switches
  • WMIC commands
  • Example text for common queries
  • Using WMI schemas directly
  • Security with WMIC
  • Managing systems with WMI Command-line
  • Creating and customizing WMIC components


Running Windows Management Instrumentation Command-line

When you run Windows Management Instrumentation Command-line (WMIC) for the first time, it compiles Alias definitions, or Managed Object Format (MOF) files. Whenever MOF files are changed, WMIC recompiles the files and updates the repository.

You can choose to use WMIC in interactive mode or non-interactive mode. The following gives you some information about the characteristics and functions of the two modes:

Interactive mode

WMIC in interactive mode returns you to the WMIC command prompt after executing a command. Root\cli is the default WMIC role, and is there when you starts WMIC in interactive mode. The Exit or Quit command is used to exit WMIC.

Interactive mode is useful if you are entering a series of WMIC commands.

To start WMIC in interactive mode see To run WMIC in interactive mode.

The following examples include aliases, commands, and global switches that you can enter at the WMIC prompt when in interactive WMIC mode:

  • CONTEXT - lists all environment variables (Global switches).
  • OS - displays data about operating system in a default TABLE format.
  • OS list full - displays OS alias data in LIST format.
  • /? - lists descriptions of available environment variables and alias.
    • OS /? - lists options available for operating systems.
    • OS list /? - specifies formats for "list" operations.
    • OS list full /? - lists switches available.
    • OS list full /format /? - lists keywords for available formats.
    • OS call /? - lists methods (verbs) available.
    • OS get /? - lists properties available.

Non-Interactive mode

WMIC in non-interactive mode exits WMIC after performing the command you entered. You are returned to the WMIC command prompt when the command is completed. WMIC aliases, global switches, or commands can also be used in non-interactive mode.

Non-interactive mode is useful if you use WMIC for a batch procedure, or if you only need to execute one WMIC command.

To start WMIC in non-interactive mode see To run WMIC in non-interactive mode.

The following examples show how you can run commands in non-interactive mode:

  • <PROMPT>wmic os get /format:hform>MyOS.htm

    The output is directed to a html file, and you are returned to the command prompt where you started.

  • <PROMPT>wmic /?

    The Help is listed, and you are returned to the command prompt where you started

For more information, see Windows Management Instrumentation Command-line.


Using WMIC help

WMIC includes on-line Help at the command line. At any level, you can type /? for additional details. By itself, /? gives you the global switches and the aliases available in the current role. When used after an alias, /? gives you the verbs and switches available for that alias. Following a verb, /? gives you the details for that verb.

For example:

For a list of alias and syntax, at the command prompt, type:

wmic:root\cli> /?

To display options available for the Process alias, type:

wmic:root\cli> process /?

/?:FULL gives all available details. This can be especially useful for the GET and CALL verbs.

Note

  • You can also use a hyphen (-?) instead of a forward slash (/?).
  • For the PATH and CLASS command, progressive help is available for a singular NODE only (on both local and remote computers).

For more information, see Windows Management Instrumentation Command-line.


WMIC aliases

Aliases are intermediary facilitators that help you access the WMI infrastructure when you are running WMIC. Aliases are friendly names used to capture the features of a WMI class that are relevant to some specific task such as disk or network administration.

Aliases can be used to provide:

  • Clearer names for WMI classes, properties, and method.
  • Useful output formats of arranged properties.

    • The output formats can include specific property values or can be formatted in a manner appropriate to some specific presentation strategy or function. For example, an alias might have a "BRIEF" format that will list only property values essential for the identification of the objects visible through the alias. Management data is retrieved in XML format and processed by built-in or custom XSL output formats. For more information, see Creating and editing formats in WMIC .

WMIC provides aliases for the most commonly used classes of management information. You can add aliases for other classes. Thus, aliases in WMIC may be of the following types:

  • Default aliases in the root\cli namespace.
    • For a list of aliases included with WMIC, type /? at the WMIC command prompt.
    • For more information about a specific alias, type: alias_name /?
    • For more information about alias schema, type: Alias alias_name list brief
  • Aliases added by you in the root\cli namespace.
  • Aliases defined by you in other namespaces. If you define aliases in other namespaces, you must use the /ROLE switch to specify the namespace when using it with WMIC. For more information, see Creating and editing aliases.

For information about WMI security, see Managing WMI Security.

For information about WMIC security, see Security with WMIC.

For more information, see Windows Management Instrumentation Command-line.


WMIC Verbs

Most aliases support the following verbs. Aliases might also support other verbs. To use verbs in WMIC, enter the alias name followed by the verb. For more information about <alias> /?, see "Aliases" in Help. If an alias does not support a verb, you receive the message "provider is not capable of the attempted operation."
Verb | Action | Parameters or Verb-specific switches | Example
ASSOC | Returns the result of the query: Associators of {<wmi object>} Where <wmi object> is the path of objects returned by the PATH or CLASS commands. The results are instances associated with the object. When ASSOC is used with an alias, the classes associated with the class underlying the alias are returned. By default, the output for class is in TABLE format. See the following table of switches for /ASSOC. | Optionally, an output file format, such as LIST, MOF, or other. | OS ASSOC
CALL | Executes methods. | Method and parameter list if appropriate. Parameter lists are comma delimited. Use SERVICE CALL /? to get a list of available methods and their parameters for the current alias. | SERVICE WHERE CAPTION='TELNET' CALL STARTSERVICE
CREATE | Creates a new instance and sets the property values for the new instance. This cannot be used to create a new class. | Properties equated to values, delimited with commas. Use CREATE /? for a list of property names for the alias. | ENVIRONMENT CREATE Name="WMIC_test",VariableValue="WMIC_test_value",UserName="SYSTEM"
DELETE | Deletes the current instance or set of instances. This can be used to delete a class. | /INTERACTIVE (prompt to confirm) or /NOINTERACTIVE (do not prompt to confirm). | PROCESS WHERE NAME="CALC.EXE" DELETE
GET | Get specific properties. | Property name or switch. See the table of switches for /GET below. Also use GET /? for a list of property names and switches for the alias. | PROCESS GET NAME
LIST | Show data. LIST is the default verb. | See the following tables of adverbs and switches for LIST. | PROCESS LIST BRIEF
SET | Property set operations. | Properties equated to values, delimited with commas. Use SET /? for a list of property names for the alias. | ENVIRONMENT WHERE Name="WMIC_test" SET VariableValue="WMIC_test_value1"
The List verb has the following adverbs. To use adverbs in WMIC, enter the alias name followed by a verb and adverb. For more information about <alias> /?, see "Aliases" in Help.
Adverb | Results
BRIEF | A core set of the properties.
FULL | The full set of properties. This is the default set of LIST properties.
INSTANCE | The instance paths only.
STATUS | The status and related properties of the object.
SYSTEM | System properties.
Alias-specific or user format | Alias-specific or user defined formats might be defined by providing distinct lists of properties and a format to be used in displaying them.
WRITEABLE | The writeable properties of the objects.
The List verb has the following switches. To use verb-specific switches in WMIC, enter the alias name followed by a switch (verbs and adverbs might also be used). For more information about <alias> /?, see "Aliases" in Help.
Switch | Effect
/TRANSLATE:<translation table> | Translate the output using the translation table named by the command. BasicXml and NoComma are translation tables included with WMIC.
/EVERY:<interval> | Repeat the command every X seconds; X is determined by the interval.
/FORMAT:<format specifier> | Specify a keyword or XSL file name to format the data, as explained in the following note.
The Get verb has the following switches.
Switch | Effect
/VALUE | The output is formatted with each value listed on a separate line and with the name of the property.
/ALL | The output is formatted as a table. The default output format is /ALL.
/TRANSLATE:<translation table> | Translate the output using the translation table named by the command. BasicXml and NoComma are translation tables included with WMIC.
/EVERY:<interval> | Return values every X seconds, X is the interval.
/FORMAT:<format specifier> | Specify a keyword or an XSL file name to format the data, as explained in the following note.
The Assoc verb has the following switches.
Switch | Effect
/RESULTCLASS:<classname> | The returned endpoints associated with the source object must belong to or be derived from the specified class.
/RESULTROLE:<rolename> | The returned endpoints must play a particular role in their association with the source object.
/ASSOCCLASS:<assocclass> | The returned endpoints must be associated with the source through the specified class or one of its derived classes.

Notes

  • For both the LIST and GET verbs, the format specifier is used to designate either the name of an XSL file or the standard formats TABLE or LIST. /FORMAT:TABLE is equivalent to /ALL, which is the default output format.
  • MOF-formatted output can be captured to a file (using the /RECORD switch) and the file can be compiled using Mofcomp.exe on another computer to import it into WMI on the other system. However, make sure that computer-specific properties are edited as appropriate for the other computer.
  • The order of the /FORMAT and /TRANSLATE switches is important. If /TRANSLATE follows /FORMAT, the output is formatted and then translated. If /FORMAT follows /TRANSLATE, the output is translated and then formatted.

Examples

The following examples demonstrate the effective use of the verbs and their adverbs and switches.
  • PROCESS GET NAME /FORMAT:XML.XSL /TRANSLATE:BASICXML

    The process names are output in XML format. Without the /TRANSLATE switch, the characters around the values are displayed as their HTML equivalents.

  • PROCESS WHERE Handle="0" ASSOC

    The instances associated with a specific object (unlike the classes associated with an alias) are returned.

For information about WMI security, see Managing WMI Security.

For information about WMIC security, authentication, and authorization, see Security with WMIC.

For more information, see Windows Management Instrumentation Command-line.


WMIC switches

Global switches are used to set defaults for the WMIC environment. You can view the current value of the conditions that the global switches set by entering the CONTEXT command.

Switch | Condition | Possible values | Default
/NAMESPACE | The namespace that the aliases typically use | Any namespace | root\cimv2
/ROLE | The namespace that WMIC typically looks in for aliases and other WMIC information. When the role changes, the WMIC interactive command prompt changes to match the role. WMIC only has one role by default (\\root\cli), so you only have switch roles if you have a management product that has defined other roles, or if other roles have been created at your organization. | Any namespace that contains aliases. | root\cli
/NODE | Computer names, comma delimited. All commands are synchronously executed against all computers listed in this value. File names must be prefixed with '@'. Computer names within a file must be comma-delimited, or put on separate lines, or both. | Any computer name, a list of computer names, or a file with computer names in it. | Local computer name
/IMPLEVEL | Impersonation level | Anonymous, Identify, Impersonate, Delegate | Impersonate
/AUTHLEVEL | Authentication level | Default, None, Connect, Call, Pkt, Pktintegrity, Pktprivacy | Pktprivacy
/LOCALE | Locale | MS_409 (English), MS_411 (Japanese), MS_40B (Finnish), and so on. | The default language on the computer when WMIC is installed.
/PRIVILEGES | Enable all privileges. | ENABLE or DISABLE | Enabled
/TRACE | The success or failure of all functions used to execute WMIC commands is displayed. | ON or OFF | Off
/RECORD | Records all output to an XML file. Output is also displayed at the command prompt. | File name | Not set and no default file name exists.
/INTERACTIVE | Typically, delete commands are confirmed. | ON or OFF | OFF in NON-INTERACTIVE mode; ON in INTERACTIVE mode
/FAILFAST | Whether or not the /NODE computers are checked before trying to execute the WMIC commands against them. When FAILFAST is ON, WMIC pings the computers in the /NODE switch before sending WMIC commands to them. If they do not respond to the ping, the WMIC commands are not executed for them. | ON or OFF | OFF
/USER | A user name to be used by WMIC when accessing the /NODE computers or computers specified in aliases. You are prompted for the password. A user name cannot be used with a local computer. | Any user name. | Not set
/PASSWORD | A password to be used by WMIC when accessing the /NODE computers (possibly including the local computer). The password is visible at the command line. | Any password | Not set
/OUTPUT | Specifies a mode for output redirection. All output is directed to the destination given only. Output does not appear at the command line. The destination is cleared before the output begins. | STDOUT, CLIPBOARD, or a file name. STDOUT is the command line. Clipboard is the Windows clipboard. The output can then be pasted to any program that accepts data in the format produced. For more details, see the following note. | STDOUT
/APPEND | Specifies a mode for output redirection. All output is directed to the destination given only. Output does not appear at the command line. The destination is not cleared before the output begins. The new output is appended to the current contents of the destination. | STDOUT, CLIPBOARD, or a file name. STDOUT is the command line. Clipboard is the Windows clipboard. The output can then be pasted to any program that accepts data in the format produced. See the following note for more details. | STDOUT
/AGGREGATE | Used with the LIST and GET /EVERY switch. If AGGREGATE is ON, LIST and GET display their results when all computers in the NODE property have either responded or timed out. If AGGREGATE is OFF, LIST and GET display their results as soon as they are received. | ON or OFF | ON
/AUTHORITY | Specifies the authority type for the connection. | Needed if the value assigned to the IMPLEVEL switch is Delegate (for example, /IMPELEVEL:Delegate). It contains the authority definition string: "kerberos:TargetDomainName\TargetComputerName". For this setting to succeed, computers need to have trust for delegation enabled on the Domain Controller. | Not set
Switch | Example
/NAMESPACE | /NAMESPACE:\\root or /NAMESPACE:SMS
/ROLE | /ROLE:\\root
/NODE | /NODE:"TESTSERVER1","TESTSERVER2",@"C:\COMPUTERLIST.TXT"
/IMPLEVEL | /IMPLEVEL:Impersonate
/AUTHLEVEL | /AUTHLEVEL:default
/LOCALE | /LOCALE:MS_411
/PRIVILEGES | /PRIVILEGES:ENABLE
/TRACE | /TRACE:ON
/RECORD | /RECORD:output.xml
/INTERACTIVE | /INTERACTIVE:ON
/FAILFAST | /FAILFAST:ON
/USER | /USER:JSMITH or /USER:"" (to reset the user name and password to nothing).
/PASSWORD | /PASSWORD:PASSWORD
/OUTPUT | /OUTPUT:CLIPBOARD
/APPEND | /APPEND:CLIPBOARD
/AGGREGATE | /AGGREGATE:OFF
/AUTHORITY | /AUTHORITY:"kerberos:TargetDomainName\TargetComputerName"

Notes

  • To browse for possible ROLE and NAMESPACE namespaces, use the command WMIC PATH __NAMESPACE. To see available namespaces in other namespaces, use the /NAMESPACE switch to change a target namespace. For example, use /NAMESPACE:\\root to change the ROOT namespace.
  • The GET, LIST, and ASSOC verbs have verb-specific switches.
  • The /APPEND and /OUTPUT switches can contradict each other (indicating that the results should be sent to different places). When they do contradict each other, /OUTPUT predominates in all cases except where /APPEND is directing the results to a file. In that case, the results go to both the /OUTPUT and /APPEND destinations.
  • Switches can be used on the same line as commands. For example, you can use /NODE:"SERVER1" SERVICE to get a list of all services on SERVER1. The /NODE switch works as described above, and all subsequent commands are also applied to SERVER1. However, if /OUTPUT and /APPEND are used on the same line as a command, the results redirection specified by /OUTPUT and /APPEND only apply to that command. The results of subsequent commands are directed to the previous value of the OUTPUT and APPEND switches.
  • To reset a switch, set its value to "". For example: /NODE:"" sets NODE back to the current computer name.

For more information, see Windows Management Instrumentation Command-line.


WMIC commands

The following commands are available at all times:

Command | Purpose
CLASS | Escape from the default alias mode of WMIC to access classes in the WMI schema directly.
PATH | Escape from the default alias mode of WMIC to access instances in the WMI schema directly.
CONTEXT | Display the current values of all global switches.
QUIT | Exit from WMIC.
EXIT | Exit from WMIC.

For more information about using CLASS or PATH, see Using the WMI schema.

For more information about the global switches displayed by CONTEXT, see WMIC switches.

For information about how WMI validates users, see Managing WMI Security.

For information about WMIC security, authentication, and authorization, see Security with WMIC.


Example text for common queries

The following table contains example text of common queries using WMIC Aliases. To run one of the queries, cut the entire contents of a cell in the Example text column, paste at the WMIC command prompt, edit the variables as appropriate, and then press the ENTER key.

Alias | Example text (includes variables)
ALIAS | ALIAS GET FriendlyName,PWhere,Target
BASEBOARD | BASEBOARD GET Product,Manufacturer
BIOS | BIOS GET Manufacturer,Name,ReleaseDate,SMBIOSBIOSVersion
BOOTCONFIG | BOOTCONFIG GET BootDirectory,Description
CDROM | CDROM GET Drive,MediaLoaded,Name,Size,SystemName,VolumeName,VolumeSerialNumber
COMPUTERSYSTEM | COMPUTERSYSTEM GET Domain,Manufacturer,Model,Name,PrimaryOwnerName,TotalPhysicalMemory,UserName
CPU | CPU GET CurrentClockSpeed,DeviceID,ExtClock,MaxClockSpeed,L2CacheSize,L2CacheSpeed,LoadPercentage,Name,ProcessorId
CSPRODUCT | CSPRODUCT GET Name,Vendor
DATAFILE | DATAFILE WHERE "Extension='ini' and path='\\'" GET Caption,CSName
DATAFILE | DATAFILE WHERE "Path='\\windows\\system32\\wbem\\' AND Extension='xml'" CALL "Compress"
DCOMAPP | DCOMAPP GET AppID,Name
DESKTOP | DESKTOP WHERE "Name!='.DEFAULT' AND Name!='NT AUTHORITY\\SYSTEM' AND Name!='NT AUTHORITY\\LOCAL SERVICE' AND Name!='NT AUTHORITY\\NETWORK SERVICE'" GET Name,ScreenSaverExecutable,ScreenSaverSecure,ScreenSaverTimeout,Wallpaper
DESKTOPMONITOR | DESKTOPMONITOR WHERE Availability='3' GET ScreenHeight,ScreenWidth,SystemName,Name
DEVICEMEMORYADDRESS | DEVICEMEMORYADDRESS GET CSName,Name,StartingAddress,EndingAddress
DISKDRIVE | DISKDRIVE GET InterfaceType,Model,Partitions,Size,SystemName,MediaType
DISKQUOTA | DISKQUOTA WHERE "Limit>'100000'"
DMACHANNEL | DMACHANNEL LIST
ENVIRONMENT | ENVIRONMENT WHERE "Username='<SYSTEM>'" GET Name,VariableValue
FSDIR | FSDIR WHERE "Path='\\Windows\\'" GET CSName,Compressed,EightDotThreeFileName,Encrypted,Hidden,Writeable
GROUP | GROUP WHERE "Name='Domain Users'"
IDECONTROLLER | IDECONTROLLER GET Manufacturer,Name,Status,SystemName
IRQ | IRQ GET CSName,Name,Status,IRQNumber
JOB | JOB GET Command,RunRepeatedly,StartTime
LOADORDER | LOADORDER GET Name,GroupOrder /format:csv:"sortby=GroupOrder"
LOGICALDISK | LOGICALDISK WHERE "DriveType='3'OR DriveType='4'" GET Caption,FreeSpace,ProviderName,Size,SystemName,FileSystem
LOGON | LOGON GET AuthenticationPackage,LogonId,LogonType,StartTime
MEMCACHE | MEMCACHE GET InstalledSize,CacheType,SystemName
MEMLOGICAL | MEMLOGICAL GET TotalPageFileSpace,TotalPhysicalMemory /FORMAT:CSV
MEMORYCHIP | MEMORYCHIP GET Capacity,DeviceLocator,MemoryType /FORMAT:CSV
MEMPHYSICAL | MEMPHYSICAL GET MaxCapacity,MemoryDevices /FORMAT:CSV
NETCLIENT | NETCLIENT GET Name,Status
NETLOGIN | NETLOGIN GET PasswordExpires,Name,NumberOfLogons,ScriptPath,LastLogon,LogonServer
NETPROTOCOL | NETPROTOCOL GET Name,Status,SupportsBroadcasting
NETUSE | NETUSE GET Name,Status,UserName
NIC | NIC GET AdapterType,Caption,MACAddress,NetConnectionStatus,ServiceName
NICCONFIG | NICCONFIG WHERE MACAddress!=NULL GET Caption,DefaultIPGateway,DHCPServer,DNSHostName,DNSServerSearchOrder,MACAddress,IPAddress,IPSubnet
NICCONFIG | NICCONFIG WHERE Index=1 CALL EnableDHCP
NTDOMAIN | NTDOMAIN GET Description,DnsForestname,DomainControllerAddress,DomainControllerName,Status
NTEVENT | /OUTPUT:"c:\event.htm" NTEVENT WHERE "Logfile='Application' and TimeGenerated>'2002.04.01' and EventType<'2'" GET Message,SourceName,TimeGenerated /FORMAT:HTABLE:"sortby=TimeGenerated"
NTEVENTLOG | NTEVENTLOG get FileSize,MaxFileSize,LogFileName,OverWritePolicy,NumberOfRecords /FORMAT:CSV
ONBOARDDEVICE | ONBOARDDEVICE GET Description,Enabled
OS | OS GET CSName,CSDVersion,OSType,Version,NumberOfUsers,Caption,CurrentTimeZone,Locale,NumberOfLicensedUsers,WindowsDirectory,NumberOfUsers
PAGEFILE | PAGEFILE GET AllocatedBaseSize,CurrentUsage,Name,PeakUsage
PAGEFILESET | PAGEFILESET WHERE Name="C:\\pagefile.sys" SET InitialSize=500,MaximumSize=600
PARTITION | PARTITION GET DeviceId,BootPartition,Size,StartingOffset,SystemName
PORT | PORT GET CSName,Description,EndingAddress,StartingAddress
PORTCONNECTOR | PORTCONNECTOR GET PortType,InternalReferenceDesignator /FORMAT:CSV
PRINTER | PRINTER GET DeviceID,Location,ShareName,Status,SystemName,Comment,Default,DriverName
PRINTERCONFIG | PRINTERCONFIG GET Color,Name,PaperSize,PrintQuality,XResolution,YResolution /FORMAT:CSV
PRINTJOB | PRINTJOB GET Document,Name,Owner,PagesPrinted,Status,TimeSubmitted,TotalPages,Size,JobStatus,JobId
PROCESS | PROCESS WHERE NAME="calc.exe" CALL Terminate
PROCESS | PROCESS WHERE "WorkingSetSize>'1000000'" GET Caption,CSName,ExecutablePath,ParentProcessId,ProcessId,WorkingSetSize
PRODUCT | PRODUCT GET Name,Version,InstallDate
QFE | QFE GET CSName,Description,HotFixID,InstallDate,InstalledBy
QUOTASETTING | QUOTASETTING LIST
RDACCOUNT | RDACCOUNT GET AccountName,PermissionsAllowed,PermissionsDenied
RDNIC | RDNIC GET NetworkAdapterName,TerminalName
RDPERMISSIONS | RDPERMISSIONS LIST
RDTOGGLE | /NODE:"computer1" RDTOGGLE WHERE "AllowTSConnections='1'" CALL SetAllowTSConnections 0
RECOVEROS | RECOVEROS GET AutoReboot,DebugFilePath,KernelDumpOnly
REGISTRY | REGISTRY GET CurrentSize,MaximumSize,Status /FORMAT:CSV
SCSICONTROLLER | SCSICONTROLLER GET DriverName,Manufacturer,Name,Status,Systemname
SERVER | SERVER
SERVICE | SERVICE WHERE Caption="Telephony" CALL ChangeStartMode "Manual"
SERVICE | SERVICE GET Name,DisplayName,ProcessId,Started,StartMode,SystemName
SHARE | SHARE GET Description,Name,Path /FORMAT:CSV
SOFTWAREELEMENT | SOFTWAREELEMENT GET Description,InstallDate,Version
SOFTWAREFEATURE | SOFTWAREFEATURE GET Caption,Description,LastUse,Name
SOUNDDEV | SOUNDDEV GET Manufacturer,Name,Status,SystemName
STARTUP | STARTUP GET Command,Description,Location,User
SYSACCOUNT | SYSACCOUNT GET Domain,Name,SID
SYSDRIVER | SYSDRIVER WHERE StartMode!='Disabled' GET DisplayName,PathName,Name,State,SystemName
SYSTEMENCLOSURE | SYSTEMENCLOSURE GET ChassisTypes,LockPresent,Manufacturer,SerialNumber,SMBIOSAssetTag
SYSTEMSLOT | SYSTEMSLOT GET ConnectorType,Shared,SlotDesignation,Status /FORMAT:CSV
TAPEDRIVE | TAPEDRIVE GET Compression,Description,Name,Status
TEMPERATURE | TEMPERATURE GET CurrentReading,Description,MaxReadable,MinReadable,Resolution
TIMEZONE | TIMEZONE GET Bias,DaylightBias,StandardName
UPS | UPS GET FirstMessageDelay,LowBatterySignal,MessageInterval,RemainingCapacityStatus,UPSPort
USERACCOUNT | USERACCOUNT WHERE "Name='username' AND Domain='domainname'"
VOLTAGE | VOLTAGE GET Accuracy,CurrentReading,Description,MaxReadable,Resolution
VOLUMEQUOTASETTING | VOLUMEQUOTASETTING LIST
WMISET | WMISET GET BuildVersion,LoggingDirectory,LoggingLevel,MaxLogFileSize


Using WMI schemas directly

To escape from the default alias mode of WMIC and access class information in the WMI schema directly, use the CLASS command. To escape from the default alias mode of WMIC and access instances or classes in the WMI schema directly, use the PATH command.

The CLASS and PATH commands must be followed by valid paths to a WMI class or instance, respectively. The CLASS and PATH commands can then be used with the standard verbs and their verb switches, except for the LIST switch.

Paths in WMIC are always relative to the Namespace global variable. Use \\root to indicate the root namespace.

The PATH command can be used to return specific instances by including .<propertyname> = <value> or where <propertyname> = <value>.

Examples

CLASS Win32_Environment

Lists all the environment variables

CLASS Win32_Environment CREATE Name="TEST",Username="DOMAIN\Username",VariableName="testvalue"

Creates a new environment variable

WMIC PATH  "Win32_Environment.Name='PROCESSOR_IDENTIFIER',Username='<SYSTEM>'"

Gets all the properties for a particular environment variable

WMIC PATH  "Win32_Environment.Name='PROCESSOR_IDENTIFIER',Username='<SYSTEM>'" GET VariableValue

Gets a particular property for a particular environment variable

WMIC PATH Win32_Process CALL CREATE calc.exe
WMIC PATH Win32_Process WHERE name="calc.exe" CALL TERMINATE

Uses a method to create or terminate a process.

For information about WMIC security, authentication, and authorization, see Security with WMIC.

For more information, see Windows Management Instrumentation Command-line.


Managing systems with WMIC

The following examples help you to use Windows Management Instrumentation Command-line (WMIC) more effectively.

Examples of Simple Tasks

  • process where "processID>300" list brief

    Lists processes on specified computers where the ProcessID is greater than 300, but limits the output to core information on those processes.

  • /node:"computer1","computer2",@"c:\computerlist.txt"

    Specifies the computers from which you want to retrieve information.

  • cpu get MaxClockSpeed
    Lists only useful properties.
  • PRODUCT

    Makes quick queries on the current computer for troubleshooting information, such as the existence of installed software.

  • Process Where Description="WinLogon.exe" Get VirtualSize /EVERY:5

    Uses the /Every switch to monitor changes on the computer, such as virtual memory consumption.

  • PROCESS WHERE PROCESSID=0 LIST BRIEF

    Requests a single instance.

  • SERVICE WHERE CAPTION='TELNET' CALL STARTSERVICE

    Starts a service.

  • SERVICE WHERE CAPTION='TELNET' CALL /?

    Uses the /? switch to get help on methods for specific aliases. There are startservice and stopservice methods for the services.

  •  PROCESS WHERE ProcessID="0" ASSOC

    Follows a WMI association.

Examples of Complex Tasks

  • WMIC NTEVENT WHERE "eventtype<3 AND logfile='Application'" GET Logfile, SourceName, Eventtype, Message, TimeGenerated/FORMAT:htable:"sortby=EventType"> c:\applicationlogs.htm

    You can use WMIC to do a query to retrieve the data you want for a report, put the formatted output in an HTML file, and serve the resulting page to users like any other Web page. This can be automated in a batch procedure.

  • WMIC /NODE:@"c:\MyServerList.txt" OS WHERE (Primary="TRUE" and Locale!="0411" and Organization!="Organization12") CALL Win32ShutDown 6

    You can restart multiple computers listed in the MyServerList.txt but exclude all computers in "Organization12" and all computers using the Japanese locale.

  • WMIC /NODE:"webserver1","webserver2","webserver3" OS WHERE Organization="Organization12" CALL Win32ShutDown 12

    Powering off computers, for example, "webserver","webserver2", and "webserver3" in the "organization12".

  • WMIC /NODE:@"c:\MyServerList.txt" /FAILFAST:ON OS WHERE Locale="0409" CALL Win32ShutDown 0

    Skipping computers that are not responding to a PING command (/FAILFAST:ON)so that the WMIC query could proceed quickly.

  • WMIC /NODE:"testcomputer1.testdomain.microsoft.com" /USER:"testdomainadministrator@testdomain.microsoft.com" RDTOGGLE WHERE ServerName="testcomputer1" CALL SetAllowTSConnections 1

    Enabling remote desktop.

  • WMIC /NAMESPACE:\\root\directory\ldap PATH ds_user GET ds_displayname, ds_userprincipalname, ds_cn, ds_name, ds_whencreated /VALUE

    Using WMI schema to query Domain Active Directory data.

Examples for using Terminal Server aliases

The following aliases are supported by the Terminal Server (TS) Configuration WMI provider.

RDTOGGLE

  • To enable TS connections:

    WMIC /NODE:"ServerName" /USER:"DomainName\Administrator" /PASSWORD:"Password" RDTOGGLE WHERE ServerName="ServerName" CALL SetAllowTSConnections 1

  • To disable TS connections for computers where you have administrative privileges:

    WMIC /NODE:@"C:\MyDomainServersList.txt" /FAILFAST:ON RDTOGGLE WHERE AllowTSConnections=1 CALL SetAllowTSConnections 0

  • To view the RDTOGGLE properties

    WMIC /NODE:"ServerName" /USER:"DomainName\Administrator" /PASSWORD:"password" RDTOGGLE WHERE ServerName="ServerName"

RDACCOUNT

  • To view the RDACCOUNT properties:

    WMIC /NODE:"ServerName" /USER:"DomainName\Administrator" /PASSWORD:"Password" RDACCOUNT WHERE TerminalName="TerminalName"

  • To modify permissions on an existing account where the value of PermissionPreSet is 0 (WINSTATION_QUERY) / 1 (WINSTATION_SET) / 2 (WINSTATION_LOGOFF) / 3 (WINSTATION_VIRTUAL | STANDARD_RIGHTS_REQUIRED) / 4 (WINSTATION_SHADOW) / 5 (WINSTATION_LOGON) / 7 (WINSTATION_MSG) / 8 (WINSTATION_CONNECT) / 9 (WINSTATION_DISCONNECT):

    WMIC /NODE:"ServerName" /USER:"DomainName\Administrator" /PASSWORD:"Password" RDACCOUNT WHERE TerminalName="TerminalName" AND AccountName="DomainName\\UserName" CALL ModifyPermissions FLAG, PermissionPreSet

  • To modify audit permissions on an existing account where the value of PermissionPreSet is 0 (WINSTATION_QUERY) / 1 (WINSTATION_SET) / 2 (WINSTATION_LOGOFF) / 3 (WINSTATION_VIRTUAL | STANDARD_RIGHTS_REQUIRED) / 4 (WINSTATION_SHADOW) / 5 (WINSTATION_LOGON) / 7 (WINSTATION_MSG) / 8 (WINSTATION_CONNECT) / 9 (WINSTATION_DISCONNECT):

    WMIC /NODE:"ServerName" /USER:"DomainName\Administrator" /PASSWORD:"Password" RDACCOUNT WHERE TerminalName="TerminalName" AND AccountName="DomainName\\UserName" CALL ModifyAuditPermissions PermissionPreSet, FLAG

  • To delete an account from a terminal:

    WMIC /NODE:" /USER:"DomainName\Administrator" /PASSWORD:"Password" RDACCOUNT WHERE TerminalName="TerminalName" AND AccountName="DomainName\\UserName" CALL Delete

RDNIC

  • To view the RDNIC properties:

    WMIC /NODE:"ServerName" /USER:"DomainName\Administrator" /PASSWORD:"Password" RDNIC WHERE TerminalName="TerminalName"

  • To assign all network adapters to a terminal (RDP-Tcp / ICA-Tcp):

    WMIC /NODE:ServerName /USER:"DomainName\Administrator" /PASSWORD:"Password" RDNIC WHERE TerminalName="TerminalName" CALL SelectAllNetworkAdapters

  • To select a particular Network adapter for a terminal, specify the following IP address:

    WMIC /NODE:"ServerName" /USER:"DomainName\Administrator" /PASSWORD"Password" RDNIC WHERE TerminalName="TerminalName" CALL SelectNetworkAdapterIP

RDPERMISSIONS

  • To view RDPERMISSIONS properties:

    WMIC /NODE:"ServerName" /USER:"DomainName\Administrator" /PASSWORD:"Password" RDPERMISSIONS WHERE TerminalName="TerminalName"

  • To add an account to a terminal, where the value of PermissionPreSet is 0 (Guest) / 1 (User) / (Full Control):

    WMIC /NODE:"ServerName" /USER:"DomainName\Administrator" /PASSWORD:"Password" RDPERMISSIONS WHERE TerminalName="TerminalName" CALL AddAccount DomainName\\UserName,PermissionPreSet

  • To restore default permissions on a terminal:

    WMIC /NODE:"ServerName" /USER:"DomainName\Administrator" /PASSWORD:"Password" RDPERMISSIONS WHERE TerminalName="TerminalName" CALL RestoreDefaults

For more information, see Windows Management Instrumentation Command-line.


Creating and customizing WMIC components

This section covers:

  • Alias namespaces and classes.
  • Creating and editing aliases.
  • Creating and editing formats.
  • Creating and editing translation tables.


Alias namespaces and classes

Examples of WMI alias classes are listed in the following table:

Alias class | Description
MSFT_CliTranslateTable | Verb-specific switches. WMIC includes translation tables called BasicXml and NoComma.
MSFT_CliTranslateTableEntry | Used in the translation table.
MSFT_CliSeeAlso | The MSFT_CliSeeAlso association provides a relationship between an alias and any aliases with some kind of functional relationship to the alias. You can extend the alias schema to allow aliases to be categorized and navigated in various ways. Use the SeeAlso verb of the Alias alias to see this information.
MSFT_CliAlias | MSFT_CliAlias class is the principal class in the alias schema. Instances of this class are aliases.

An MSFT_CliAlias instance has the following properties:

Property | Description
FriendlyName | The name of the alias. It must be unique.
Description | A description of the alias. This is the descriptive text when /? is entered at the WMIC command line.
Formats | A list, each of which has a name and a list of properties (objects of the class MSFT_CliProperty) to be displayed for that format. All formats are objects of the class MSFT_CliFormat.
Verbs Verbs: A list, each of which are the various behaviors available through this alias. The behaviors come in two forms:
  • Standard verbs, which are directly supported by the utility.
  • User-defined verbs, which must map to some method defined for the target of the alias.
All verbs are objects of the class MSFT_CliVerb.
Qualifiers | A list, similar to WMI qualifiers. All qualifiers are objects of the class MSFT_Qualifier.
Target | A list, similar to WMI qualifiers. All qualifiers are objects of the class MSFT_Qualifier.
PWhere clause | Optional WHERE clause that limits the Target. It have substitution values which are the parameters of the alias. The substitution values are marked with #. If multiple parameters are needed, they are matched with the # markers in sequence.
Connection | Details on which computers to connect to, the security details to be used, and so on. If a connection is not specified, the computers to be accessed is the value of /NODE, and the namespace is the value of /NAMESPACE. If a user name and password are not provided, then the value of /USER and /PASSWORD, if available, is used (otherwise the current account is used). Connection is an object of the class MSFT_CliConnection.
View an alias schema | Use a metaalias Alias to view an alias schema; example: ALIAS OS

MSFT_CliAlias properties contain the following classes to define objects that are used in the properties:

Class | Used in | Description
MSFT_CliFormat | aliases | The MSFT_CliFormat class defines a named format that determines the set of properties to be displayed by the utility on a LIST command. Each MSFT_CliFormat instance has a name, a list of properties and a Format property that contains the name of a style sheet (XSL file) that must be used to format the property display.
MSFT_CliProperty | formats | Each MSFT_CliFormat instance contains a list of MSFT_CliProperty instances. Instances of the MSFT_CliProperty class define the set of properties to be displayed for a given format. Each MSFT_CliProperty instance has a derivation that might be either a constant, the name of a property or a WMI command line GET command. Each MSFT_CliProperty also has a localized description. Formats are related to a specific XSL by the NAME property of the format object. FULL, BRIEF, and INSTANCE correspond to particular XSLs, and the NAME can specify the name of a custom XSL file.
MSFT_CliVerb | aliases | Instances of the MSFT_CliVerb class represent verbs defined for the alias. Verbs are either standard verbs (GET, LIST, CALL and SET ) or user defined. Standard verbs have descriptions and usages but no parameters.
MSFT_CliParam | verbs |
MSFT_CliQualifier | aliases and verbs | WMIC qualifiers serve the same purpose as WMI qualifiers.
MSFT_CliConnection | aliases | Instances of this class provides connection details.

Notes

  • When viewing the role namespaces using WMI browsing tools (such as CIM Studio), only the MSFT_CliAlias and MSFT_CliTranslateTable classes have instances. Their properties might include objects of the other classes, but the other classes will not have instances of their own.
  • For this reason, when creating aliases (see Creating and editing alias), you create instances primarily in the MSFT_CliAlias class. You create instances of the other classes as properties of the MSFT_CliAlias class or as properties of its properties.

For more information, see Windows Management Instrumentation Command-line.


Creating and editing aliases

You can use the WMI tools to create aliases as Managed Object Format (MOF) files. You can use WMI Common Information Model (CIM) Studio to generate a MOF file for a selected class. This file should be edited to create an instance of MSFT_CliAlias. The MOF files can then be used to register the alias. Aliases are registered with WMI by compiling the MOF form of the alias. For step-by-step instructions, see To customize Aliases in WMIC, and To create an alias for WMIC off-line.

When viewing the role namespaces using WMI browsing tools (such as WMI CIM Studio), only the MSFT_CliAlias and MSFT_CliTranslateTable classes have instances. Their properties might include objects of the other classes, but the other classes do not have instances of their own. For this reason, when creating aliases, you primarily create instances in the MSFT_CliAlias class. You create instances of the other classes as properties of the MSFT_CliAlias class or as properties of its properties.

Localization is supported by using localized text arrays defined in the schema. Localization of aliases descriptions is done through the MFL file (CliEgAliases.mfl).

Adding roles to any WMI namespace can be done, for example, by copying WMIC's CliEgAliases.mof file, and then changing the namespace reference to the namespace that is to be used as a role. The new file can then be compiled with MOFCOMP.exe. Aliases can then be added as described above.

Any WMI namespace can serve as a role; but without the additional steps above, such a role would not have WMIC's interactive help or the base classes required for aliases.

For more information, see Windows Management Instrumentation Command-line.


Creating and editing formats in WMIC

Windows Management Instrumentation Command-line (WMIC) uses two types of formats to display properties: LIST format and OUTPUT format.

LIST formats allow displaying and recording of the properties of an alias in a specific way, such as:

List Format | Properties
Process list brief | displays a short list of properties.
Process list full | displays a full list of properties (this is similar to process get /all).
Process list memory | lists properties related to a process memory.

To see what LIST formats are available for an alias, type:

<alias name> list /?.

For example:

os list /?

Each LIST format has a default output format name specified as part of alias definition. For example, FULL is usually associated with TABLE, while BRIEF, with LIST (value list).

As an optional step, add the LIST formats group to the alias class. This makes the formats discoverable and easier to use. You can also specify the default stylesheet to be used for the format output.

OUTPUT formats are provided by WMIC using the /FORMAT switch to display and record output in a desired way. WMIC uses Extensible Style sheet Language (XSL) to transform and format the Extensible Markup Language (XML) output. The provided formats are stored in the WBEM directory as XSL files. Formats are used with GET, or LIST. Specific formats can be specified using GET /FORMAT:, LIST /FORMAT:, GET /ALL, or GET /VALUE.

Use an XSL editor. You might want to first capture some XML data to use for experimenting while using the XSL editor.

Custom formats may be created to display WMIC queries. If you create custom formats, you should also define them in the Formats property of the MSFT_CliAlias class. Each format must have a name that is unique within the alias.

Other Output formats are included in WMIC. These formats can be set as defaults or as specified using keywords:

Keywords | Output Formats
mof.xsl | Converts XML data to Managed Object Format (MOF) format. If aliases or other WMI objects are defined in XML format, this XSL can be used to convert them to MOFs so that they can be MOFCOMPed. - /FORMAT:MOF format.
texttable.xsl | /ALL or /FORMAT:TABLE.
texttable.xsl | /VALUE format—one line per value.

For more information on mapping, see XSL-MAPPINGS.XML in %windir%\system32\wbem.

Additional XSL files that are included in WMI and can be useful when you use WMIC are:

XSL Files |
xml.xsl | Similar to rawxml.xsl, except that the output is in HTML format.
hform.xsl | Html output—the data is displayed in a vertical table (one row per property or instance name). The table can be very long.
htable.xsl | Html output—the data is displayed in a horizontal HTML table (one row per instance). The table can be very wide. you can specify the column that the data is typically sorted by. Enclose this file name in quotation marks. The column and its datatype are specified by using the following syntax: /FORMAT:"htable.xsl":"datatype=<datatype>":"sortby=<property>". For example, PROCESS GET /FORMAT:"htable.xsl":"datatype=number":"sortby=ProcessId".
rawxml.xsl | To output XML data in XML format. All WMIC data is extracted in XML format, so this format gives you data the way that WMIC sees it. This can be useful for creating your own XSL files. Outputting data in XML format is also useful if you want to provide the data to systems that accept XML data.
csv.xsl | Comma-delimited—the data is displayed with commas between each value. This format is suitable for importing the data into Microsoft Excel or a similar program.

Caution

  • When editing default views, be sure to save your changes to a format outside WMI. If you update WMI or the operating system, the new version of WMIC might return the aliases or output formats to the defaults, overwriting your changes.

For step-by-step procedures on how to create and edit formats, see To create a format in WMIC and To edit a format in WMIC.

For more information, see Windows Management Instrumentation Command-line.


Creating and editing translation tables

Like formats, translation tables allow you to change the output of WMIC commands to suit your needs. Translation tables are not as flexible or powerful as formats, but they are much simpler to create and edit.

Translation tables are used when you specify /TRANSLATE on the LIST or GET verbs. WMIC includes translation tables called BasicXML and NoComma. BasicXML converts the HTML symbols for greater-than and less-than characters into the actual characters.

Translation tables are defined in the MSFT_CliTranslateTable WMI class.

For more information, see Windows Management Instrumentation Command-line.


Troubleshooting

What problem are you having?

Parameter not valid

Cause: A parameter name is misspelled or does not apply to the object in question. A required parameter might also be missing, which can include key values or writeable values.

Solution: You must specify the name, user name, and variable value when you create an environment variable.

See also: Managing systems with WMI Command-line

Value map does not contain the input value for this property

Cause: Could be that the needed parameter is not used in the query.

Solution:You can interpret the value for an input parameter by referring to the schema information, the method's description qualifier in the corresponding Managed Object Format (MOF) file, or to the MSDN description of the method.

Some schema information can be retrieved using WMIC, for example:

  • wmic:root\cli>alias OS list full /format:table
  • wmic:root\cli>process call /?:full

RPC error on the unsuccessful connection to a computer or node.

Cause: The computer or node has a firewall set to block incoming calls.

Solution:

  • Ping computer's IP for the availability of the computer.
  • Disable firewall on computer.

Cause: The computer has UNIX, Linux, Windows 95, Windows 98, Windows Millennium Edition, or Windows NT 4 operating system that has no network-enabled WMI or WBEM support.

Solution:

  • Enable WMI or WBEM support in the operating system.
  • Deploy operating systems with network-enabled WMI or WBEM support.

See also: Managing systems with WMI Command-line

Query fails or is slow

Cause: The query does not have enough parameters.

Solution:Narrow down query using Named parameters or WHERE clause. For example:

  • wmic:root\cli>Alias OS list brief
  • wmic:root\cli>nteventlog application get /format:list
  • wmic:root\cli>UserAccount where "Domain='DomainName' and Name='UserName'" get /all

See also: Managing systems with WMI Command-line

Output is not properly aligned in rows and columns.

Cause: Display space is too small.

Solution:

  • Increase Screen Buffer Size for Command (CMD) window.
  • Use WordPad.exe instead of Notepad to open large text files.
  • Use more criteria on query to display only necessary information.
  • Use a custom XSL file to display custom formatting.

See also: Managing systems with WMI Command-line

Localized version of WMIC is not available (in some Multilingual User Interface (MUI) or Language Interface Packs)

Cause: Installed localized version of operating system.

Solution: Use the /LOCALE:ms_409 switch to set up English Locale as the default.

See also: Managing systems with WMI Command-line

XSL files on XOX are not supporting arrays.

Cause: Operating system does not support XSL file arrays.

Solution: Use XSL from the Windows Server 2003 family to query other computers, including XOX

See also: Managing systems with WMI Command-line

Input parameter is of OBJECT type

Cause: Support is not fully implemented yet for input parameters which are of the OBJECT type. The default value (an empty string: "") is the only value currently supported.

Solution: Use the following command to set sharing of the c:\test directory for three users:

WMIC SHARE CALL Create "","test","3","TestShareName","","c:\test",0

See also: Managing systems with WMI Command-line


WMIC Terminology

Adverb
A parameter to a verb clarifying what should be done.
Alias
A WMIC-specific definition of WMI classes. Aliases have simplified names and property names, to make them easier to understand. Aliases also have verbs and formats which make it easier to use the classes. Aliases might contain details for using the classes on remote or multiple computers.
Associator
A relationship between instances.
Class
A definition of WMI objects.
Endpoint
The last object in an association.
Global Switch
A switch that applies to the operation of WMIC and all aliases.
Instance
A specific piece of data.
Interactive
Actions must be confirmed.
Interactive Mode
When WMIC is used from its own command prompt.
Method
An action that a WMI class or instance is capable of executing.
MOF
Management Object Format — the format of files containing WMI data.
Namespace
A virtual location within which WMI classes and instances can be located.
Non-Interactive Mode
When WMIC is used from another command prompt, such as the operating system command prompt.
Object
The implementation of an instance.
Object Path
The WMI path that can be used to locate an instance or class.
Path
The location of a WMI instance or class.
Properties
Details.
Role
A namespace containing WMIC information.
Schema
An abstract definition of a namespace.
Switch
A qualifier indicating how things should be used.
Translation table
A means to translate WMIC output.
Verb
A parameter to an alias indicating what to do with the alias.
XML
eXtended Markup Language—a standard for describing data.
XSL
eXtended Style Language—a standard for describing how to display XML data.

For more information, see Windows Management Instrumentation Command-line.


Deploying WMIC

This section covers:

  • Security with WMIC