Get-CIMInstance (PowerShell 3.0+ )

Get the CIM instances of a class from a CIM server. The Common Information Model (CIM) is the DMTF standard [DSP0004] for describing the structure and behavior of managed resources such as storage, network, or software components.

      Get-CimInstance [-ComputerName String[] | -CimSession CimSession[] ] [-ClassName] String [-Filter String]
         [-KeyOnly] [-Namespace String] [-OperationTimeoutSec UInt32]
            [-Property String[]] [-QueryDialect String] [-Shallow] [CommonParameters]
      Get-CimInstance [ -ComputerName String[] | -CimSession CimSession[] ] -ResourceUri Uri [-Filter String]
         [-KeyOnly] [-Namespace String] [-OperationTimeoutSec UInt32]
            [-Property String[]] [-Shallow] [CommonParameters]

      Get-CimInstance [ -ComputerName String[] | -CimSession CimSession[] ] -Query String
         [-Namespace String] [-OperationTimeoutSec UInt32] [-QueryDialect String]
            [-ResourceUri Uri] [-Shallow] [CommonParameters]
      Get-CimInstance [ -ComputerName String[] | -CimSession CimSession[] ] [-InputObject] CimInstance
         [-OperationTimeoutSec UInt32] [-ResourceUri Uri] [CommonParameters]

   -CimSession CimSession[]
        The CIM session to use for this cmdlet. Enter a variable that contains the CIM session or a command 
        that creates or gets the CIM session, such as the New-CimSession or Get-CimSession cmdlets. For more 
        information, see about_CimSessions.
   -ClassName String
        The name of the CIM class for which to retrieve the CIM instances. 
        NOTE: You can use tab completion to browse the list of classes, because wps_2 gets a list of classes from the 
        local WMI server to provide a list of class names.
   -ComputerName String[]
        The computer on which you want to run the CIM operation. You can specify a fully qualified domain name 
        (FQDN), a NetBIOS name, or an IP address.
        If you specify this parameter, the cmdlet creates a temporary session to the specified computer using the 
        WsMan protocol.If you do not specify this parameter, the cmdlet performs the operation on the local computer
        using Component Object Model (COM).

        If multiple operations are being performed on the same computer, using a CIM session gives better performance.
   -Filter String
       Specifies a where clause to use as a filter. Specify the clause in either the WQL or the CQL query language.
       Note: Do not include the where keyword in the value of the parameter.
   -InputObject CimInstance
       Specifies a CIM instance object to use as input.
       If you are already working with a CIM instance object, you can use this parameter to pass the CIM instance 
       object in order to get the latest snapshot from the CIM server. When you pass a CIM instance object as an 
       input, Get-CimInstance returns the object from server using a get CIM operation, instead of an enumerate or 
       query operation. Using a get CIM operation is more efficient than retrieving all instances and then filtering 
       If the CIM class does not implement the get operation, then specifying the InputObject parameter returns an 
       Indicates that only objects with key properties populated are returned. Specifying the KeyOnly parameter 
       reduces the amount of data transferred over the network.
       Use the KeyOnly parameter to return only a small portion of the object, which can be used for other 
       operations, such as the Set-CimInstance or Get-CimAssociatedInstance cmdlets.
   -Namespace String
       Specifies the namespace of CIM class.
       The default namespace is root/cimv2. 
       NOTE: You can use tab completion to browse the list of namespaces, because wps_2 gets a list of namespaces 
       from the local WMI server to provide the list of namespaces.
   -OperationTimeoutSec UInt32
       Specifies the amount of time that the cmdlet waits for a response from the computer.
       By default, the value of this parameter is 0, which means that the cmdlet uses the default timeout value for 
       the server.
       If the OperationTimeoutSec parameter is set to a value less than the robust connection retry timeout of 3 
       minutes, network failures that last more than the value of the OperationTimeoutSec parameter are not 
       recoverable, because the operation on the server times out before the client can reconnect.
   -Property String[]
       Specifies a set of instance properties to retrieve.
       Use this parameter when you need to reduce the size of the object returned, either in memory or over the 
       The object returned always has key properties populated, irrespective of the set of properties listed by the 
       Property parameter. Other properties of the class are present but they are not populated.
   -Query String
       A query to run on the CIM server. For WQL-based queries, you can only use a SELECT query that 
       returns instances.
       If the value specified contains double quotes (“), single quotes (‘), or a backslash (\), you must escape 
       those characters by prefixing them with the backslash (\) character. If the value specified uses the WQL LIKE 
       operator, then you must escape the following characters by enclosing them in square brackets ([]): percent 
       (%), underscore (_), or opening square bracket ([).
       You cannot use a metadata query to retrieve a list of classes or an event query. To retrieve a list of 
       classes, use the Get-CimClass cmdlet. To retrieve an event query, use the Register-CimIndicationEvent cmdlet.
       You can specify the query dialect using the -QueryDialect parameter.
   -QueryDialect String
       Specifies the query language used for the Query parameter.
       psdx_paramvalues WQL or CQL.
       The default value is WQL.
   -ResourceUri Uri
       Specifies the resource uniform resource identifier (URI) of the resource class or instance. The URI is used to 
       identify a specific type of resource, such as disks or processes, on a computer.
       A URI consists of a prefix and a path to a resource. For example: 
       By default, if you do not specify this parameter, the DMTF standard resource URI is used and the class name is appended to it.
       ResourceURI can only be used with CIM sessions created using the WSMan protocol, or when specifying the 
       ComputerName parameter, which creates a CIM session using WSMan. If you specify this parameter without 
       specifying the ComputerName parameter, or if you specify a CIM session created using DCOM protocol, you will 
       get an error, because the DCOM protocol does not support the ResourceURI parameter.
       If both the ResourceUri parameter and the Filter parameter are specified, the Filter parameter is ignored.
       Indicates that the instances of a class are returned without including the instances of any child classes.
       By default, the cmdlet returns the instances of a class and its child classes.
       -Verbose, -Debug, -ErrorAction, -ErrorVariable, -WarningAction, -WarningVariable,
       -OutBuffer, PipelineVariable -OutVariable.

Standard Aliases for Get-CIMInstance: gcim

CIM Classes

The CIM classes available will vary according to your operating system.
List all CIM classes:
PS C:\> Get-cimclass

List all the classes involding discs:
PS C:\> Get-cimclass -List | Where cimClassName -like "*disk*"

Some common CIM classes:

 Win32_Baseboard    (Motherboard)
 Win32_LogicalDisk  (hard disk)
 Win32_OperatingSystem  (Virtual Memory)
 Win32_Processor    (32+64 bit processor info)
 Win32_Product      (avoid this: see Q974524)
 Win32_Share        (File shares)

List all properties of a class:
PS C:\> Get-CIMinstance Win32_BIOS | Get-Member

Find a specific class property:

PS C:\> gcim Win32_bios | Get-Member -MemberType property | Where { $ -match 'install'}
or simply:
PS C:\> gcim Win32_bios | Get-Member -MemberType property | Where name -match 'install'


Display information about all processes on the machine 'Server64':

PS C:\> Get-CimInstance -ClassName Win32_Process -computername Server64

Get a list of namespaces from a WMI server

PS C:\> $NS = Get-CimInstance –Namespace root –ClassName __Namespace
PS C:\> $NS

Get instances of a class filtered by using a query to find those that starts with 'Oracle':

PS C:\> Get-CimInstance -Query "SELECT * from Win32_Process WHERE name LIKE 'Oracle%'"

Display service names on the local machine filtered to those that starts with 'Oracle':

PS C:\> Get-CimInstance -ClassName Win32_Process -filter "name like 'Oracle%'" | select name

Get CIM instances from remote computer:

PS C:\> $comp = Get-CimInstance -ClassName Win32_ComputerSystem -ComputerName Server64, Server65

Get only the key properties, instead of all properties, this reduces the size of the object and network traffic:

PS C:\> Get-CimInstance -Class Win32_Process -KeyOnly

Retrieve items with the -Property parameter and perform other CIM operations, for example Set-CimInstance or Invoke-CimMethod.

PS C:\> $x = Get-CimInstance -Class Win32_Process -Property Name, KernelModeTime
PS C:\> $x | Invoke-CimMethod -MethodName GetOwner

List services that are set to start automatically:

PS C:\> gcim win32_service -filter "startmode='auto'" | select name,startmode

List services that are set to start automatically (same as above but written in WQL):

PS C:\> gcim -query "select * from win32_service where startmode='auto'" | select name,startmode 

Display information about the Geolocation service (lfsvc):

PS C:\> gcim -query "select * from win32_service where name='lfsvc'"

View the Running/Stopped status of the Geolocation service:

PS C:\> (gcim win32_service -filter "name='lfsvc'").State

Stop the Geolocation service (requires elevation):

PS C:\> gwmi win32_process -filter "name='lfsvc'" | invoke-CIMmethod -name StopService

Start the Geolocation service:

PS C:\> gwmi win32_process -filter "name='lfsvc'" | invoke-CIMmethod -name StartService

Get the computer serial number (or Dell service tag) for a remote PC and convert it to a string:

PS C:\> (gcim win32_systemenclosure -computername wkstn64).SerialNumber
PS C:\> gcim win32_bios -computername wkstn64 | fl SerialNumber

Display BIOS and Memory information:

PS C:\> gcim win32_bios | format-list *
PS C:\> gcim Win32_ComputerSystem
PS C:\> gcim Win32_PhysicalMemory

Display the per-computer printers installed on workstation64:

PS C:\> Get-CimInstance -Class Win32_Printer -ComputerName "workstation64"

List the file shares on the remote server: SERVER64 (PowerShell equivalent of the RMTShare utility).

$shares = Get-CimInstance -class Win32_Share -computername SERVER64 -filter "Type=0"
$shares | foreach {

    "Share Name   : $name
     Source Folder: $path 
     Description  : $Description
     Caption : $Caption"
“A good question is like a miniskirt. Long enough to cover the essentials, but short enough to keep everyone interested” ~ Charles Halsey

Related PowerShell Commands:

Example - Remote inventory of OperatingSystem and Service Pack
New-CimInstance - Create a new instance of a class.
Get-Credential - Get a security credential object based on a user name and password.
RUNDLL32 - Run a DLL command (add/remove print connections)

Copyright © 1999-2018
Some rights reserved