Get-CIMInstance (PowerShell 3.0+ )

Get the CIM instances of a class from a CIM server. Equivalent to the old WMI cmdlet Get-WmiObject , the CIM version uses WSMAN (WinRM) to connect to remote machines and is therefore an order of magnitude faster.

Syntax
      Get-CimInstance [-ClassName] String [-Filter String]
         [ -ComputerName String[] | -CimSession CimSession[] ]
            [-KeyOnly] [-Namespace String] [-Shallow]
               [-Property String[]] [-QueryDialect String]
                  [-OperationTimeoutSec UInt32] [CommonParameters]

      Get-CimInstance  -ResourceUri Uri [-Filter String]
         [ -ComputerName String[] | -CimSession CimSession[] ]
            [-KeyOnly] [-Namespace String] [-Shallow]
               [-Property String[]]
                  [-OperationTimeoutSec UInt32] [CommonParameters]

      Get-CimInstance -Query String
         [ -ComputerName String[] | -CimSession CimSession[] ]
            [-Namespace String] [-Shallow] [-QueryDialect String]
               [-ResourceUri Uri]
                  [-OperationTimeoutSec UInt32] [CommonParameters]

      Get-CimInstance [-InputObject] CimInstance
         [ -ComputerName String[] | -CimSession CimSession[] ]
            [-ResourceUri Uri]
               [-OperationTimeoutSec UInt32] [CommonParameters]

Key
   -CimSession CimSession[]
       The CIM session to use for this cmdlet. Enter a variable that contains the CIM session or a command 
       that creates or gets the CIM session, such as the New-CimSession or Get-CimSession cmdlets. For more 
       information, see about_CimSessions.

   -ClassName String
       The name of the CIM class for which to retrieve the CIM instances. 
       NOTE: You can use tab completion to browse the list of classes, because wps_2 gets a list of classes from the 
       local WMI server to provide a list of class names.

   -ComputerName String[]
       The computer on which you want to run the CIM operation. You can specify a fully qualified domain name 
       (FQDN), a NetBIOS name, or an IP address.

       If you specify this parameter, the cmdlet creates a temporary session to the specified computer using the 
       WsMan protocol.If you do not specify this parameter, the cmdlet performs the operation on the local computer
       using Component Object Model (COM).

       If multiple operations are being performed on the same computer, using a CIM session gives better performance.

   -Filter String
       Specifies a where clause to use as a filter. Specify the clause in either the WQL or the CQL query language.
       Note: Do not include the where keyword in the value of the parameter.

   -InputObject CimInstance
       Specifies a CIM instance object to use as input.

       If you are already working with a CIM instance object, you can use this parameter to pass the CIM instance 
       object in order to get the latest snapshot from the CIM server. When you pass a CIM instance object as an 
       input, Get-CimInstance returns the object from server using a get CIM operation, instead of an enumerate or 
       query operation. Using a get CIM operation is more efficient than retrieving all instances and then filtering 
       them.

       If the CIM class does not implement the get operation, then specifying the InputObject parameter returns an 
       error.

   -KeyOnly
       Indicates that only objects with key properties populated are returned. Specifying the KeyOnly parameter 
       reduces the amount of data transferred over the network.

       Use the KeyOnly parameter to return only a small portion of the object, which can be used for other 
       operations, such as the Set-CimInstance or Get-CimAssociatedInstance cmdlets.

   -Namespace String
       Specifies the namespace of CIM class.

       The default namespace is root/cimv2. 
       NOTE: You can use tab completion to browse the list of namespaces, because wps_2 gets a list of namespaces 
       from the local WMI server to provide the list of namespaces.

   -OperationTimeoutSec UInt32
       Specifies the amount of time that the cmdlet waits for a response from the computer.

       By default, the value of this parameter is 0, which means that the cmdlet uses the default timeout value for 
       the server.

       If the OperationTimeoutSec parameter is set to a value less than the robust connection retry timeout of 3 
       minutes, network failures that last more than the value of the OperationTimeoutSec parameter are not 
       recoverable, because the operation on the server times out before the client can reconnect.

   -Property String[]
       Specifies a set of instance properties to retrieve.

       Use this parameter when you need to reduce the size of the object returned, either in memory or over the 
       network.

       The object returned always has key properties populated, irrespective of the set of properties listed by the 
       Property parameter. Other properties of the class are present but they are not populated.

   -Query String
       A query to run on the CIM server. For WQL-based queries, you can only use a SELECT query that 
       returns instances.

       If the value specified contains double quotes (“), single quotes (‘), or a backslash (\), you must escape 
       those characters by prefixing them with the backslash (\) character. If the value specified uses the WQL LIKE 
       operator, then you must escape the following characters by enclosing them in square brackets ([]): percent 
       (%), underscore (_), or opening square bracket ([).

       You cannot use a metadata query to retrieve a list of classes or an event query. To retrieve a list of 
       classes, use the Get-CimClass cmdlet. To retrieve an event query, use the Register-CimIndicationEvent cmdlet.

       You can specify the query dialect using the -QueryDialect parameter.

   -QueryDialect String
       Specifies the query language used for the Query parameter.

       psdx_paramvalues WQL or CQL.

       The default value is WQL.

   -ResourceUri Uri
       Specifies the resource uniform resource identifier (URI) of the resource class or instance. The URI is used to 
       identify a specific type of resource, such as disks or processes, on a computer.

       A URI consists of a prefix and a path to a resource. For example: 

       http://schemas.microsoft.com/wbem/wsman/1/wmi/root/cimv2/Win32_LogicalDisk
       http://intel.com/wbem/wscim/1/amt-schema/1/AMT_GeneralSettings
       
       By default, if you do not specify this parameter, the DMTF standard resource URI 
       http://schemas.dmtf.org/wbem/wscim/1/cim-schema/2/ is used and the class name is appended to it.
       
       ResourceURI can only be used with CIM sessions created using the WSMan protocol, or when specifying the 
       ComputerName parameter, which creates a CIM session using WSMan. If you specify this parameter without 
       specifying the ComputerName parameter, or if you specify a CIM session created using DCOM protocol, you will 
       get an error, because the DCOM protocol does not support the ResourceURI parameter.

       If both the -ResourceUri parameter and the -Filter parameter are specified, the -Filter parameter is ignored.

   -Shallow
       Indicates that the instances of a class are returned without including the instances of any child classes.

       By default, the cmdlet returns the instances of a class and its child classes.

   CommonParameters:
       -Verbose, -Debug, -ErrorAction, -ErrorVariable, -WarningAction, -WarningVariable,
       -OutBuffer, -PipelineVariable -OutVariable.

The Common Information Model (CIM) is the DMTF standard [DSP0004] for describing the structure and behavior of managed resources such as storage, network, or software components.

Standard Alias for Get-CIMInstance: gcim

CIM Classes

The CIM classes available will vary according to your operating system.
List all CIM classes:
PS C:\> Get-cimclass

List all the classes involding discs:
PS C:\> Get-cimclass -List | Where cimClassName -like "*disk*"

Some common CIM classes:

 Win32_Baseboard    (Motherboard)
 Win32_BIOS
 Win32_ComputerSystem
 Win32_LogicalDisk  (hard disk)
 Win32_OperatingSystem  (Virtual Memory)
 Win32_PingStatus
 Win32_Printer
 Win32_PrinterShare
 Win32_PhysicalMemory
 Win32_Process
 Win32_Processor    (32+64 bit processor info)
 Win32_Product      (avoid this: see Q974524)
 Win32_Share        (File shares)

List all properties of a class:
PS C:\> Get-CIMinstance Win32_BIOS | Get-Member

Find a specific class property:

PS C:\> gcim Win32_bios | Get-Member -MemberType property | Where { $_.name -match 'install'}
or simply:
PS C:\> gcim Win32_bios | Get-Member -MemberType property | Where name -match 'install'

Examples

Display information about all processes on the machine 'Server64':

PS C:\> Get-CimInstance -ClassName Win32_Process -computername Server64

Get the computer install date:

PS> (Get-CimInstance -Class Win32_OperatingSystem).InstallDate
18 May 2018 12:24:16

Get the last boot time of the computer, note this is automatically formatted as a Date:

PS> Get-CimInstance -ClassName Win32_OperatingSystem | select LastBootUpTime
24 Jan 2019 11:09:31

List all the Win32_OperatingSystem properties available:

PS> Get-CimInstance -Class Win32_OperatingSystem | get-member

Ping a computer once with an ICMP timeout of 1000ms:

$ComputerName = 'computer64'
$Filter = 'Address="$ComputerName" and Timeout=1000'
Get-ciminstance Win32_PingStatus -Filter $Filter | Select-Object Address, ProtocolAddress, ResponseTime, Timeout

The -filter can also specify multiple addresses:
'Address="example.com" and Timeout=2000 or Address="example2.com" and Timeout=2000'

Get a list of namespaces from a WMI server

PS C:\> $NS = Get-CimInstance –Namespace root –ClassName __Namespace
PS C:\> $NS

Get instances of a class filtered by using a query to find those that starts with 'Oracle':

PS C:\> Get-CimInstance -Query "SELECT * from Win32_Process WHERE name LIKE 'Oracle%'"

Display service names on the local machine filtered to those that starts with 'Oracle':

PS C:\> Get-CimInstance -ClassName Win32_Process -filter "name like 'Oracle%'" | select name

Get CIM instances from remote computer:

PS C:\> $comp = Get-CimInstance -ClassName Win32_ComputerSystem -ComputerName Server64, Server65

Get only the key properties, instead of all properties, this reduces the size of the object and network traffic:

PS C:\> Get-CimInstance -Class Win32_Process -KeyOnly

Retrieve items with the -Property parameter and perform other CIM operations, for example Set-CimInstance or Invoke-CimMethod.

PS C:\> $x = Get-CimInstance -Class Win32_Process -Property Name, KernelModeTime
PS C:\> $x | Invoke-CimMethod -MethodName GetOwner

List services that are set to start automatically:

PS C:\> gcim win32_service -filter "startmode='auto'" | select name,startmode

List services that are set to start automatically (same as above but written in WQL):

PS C:\> gcim -query "select * from win32_service where startmode='auto'" | select name,startmode 

Display information about the Geolocation service (lfsvc):

PS C:\> gcim -query "select * from win32_service where name='lfsvc'"

View the Running/Stopped status of the Geolocation service:

PS C:\> (gcim win32_service -filter "name='lfsvc'").State

Stop the Geolocation service (requires elevation):

PS C:\> gwmi win32_process -filter "name='lfsvc'" | invoke-CIMmethod -name StopService

Start the Geolocation service:

PS C:\> gwmi win32_process -filter "name='lfsvc'" | invoke-CIMmethod -name StartService

Get the computer serial number (or Dell service tag) for a remote PC and convert it to a string:

PS C:\> (gcim win32_systemenclosure -computername wkstn64).SerialNumber
or
PS C:\> gcim win32_bios -computername wkstn64 | select SerialNumber

Display BIOS and Memory information:

PS C:\> gcim win32_bios | format-list *
PS C:\> gcim Win32_ComputerSystem
PS C:\> gcim Win32_PhysicalMemory

Display the per-computer printers installed on workstation64:

PS C:\> Get-CimInstance -Class Win32_Printer -ComputerName "workstation64"

List the file shares on the remote server: SERVER64 (PowerShell equivalent of the RMTShare utility).

$shares = Get-CimInstance -class Win32_Share -computername SERVER64 -filter "Type=0"
$shares | foreach {
    $path=($_.path)
    $Description=($_.Description)
    $name=($_.name)
    $Caption=($_.Caption)

    "Share Name   : $name
     Source Folder: $path 
     Description  : $Description
     Caption : $Caption"
    }

Related PowerShell Cmdlets:

Example - Remote inventory of OperatingSystem and Service Pack
Get-CimAssociatedInstance - Retrieve CIM instance by an association.
Get-CimClass - Get a list of CIM classes in a specific namespace.
Set-CimInstance - Modify a CIM instance on a CIM server.
Invoke-CimMethod - Invoke a method of a CIM class or CIM instance.
New-CimInstance - Create a new instance of a class.
Remove-CimInstance - Remove a CIM instance from a computer.
Register-CimIndicationEvent
Get-Credential - Get a security credential object based on a user name and password.
RUNDLL32 - Run a DLL command (add/remove print connections)