{"id":765,"date":"2013-10-09T17:50:33","date_gmt":"2013-10-09T13:50:33","guid":{"rendered":"http:\/\/prgmr.io\/?p=765"},"modified":"2013-10-09T17:57:38","modified_gmt":"2013-10-09T13:57:38","slug":"wmi-queries","status":"publish","type":"post","link":"https:\/\/rakhesh.com\/powershell\/wmi-queries\/","title":{"rendered":"WMI queries"},"content":{"rendered":"<p>A useful link to refer to later: <a href=\"http:\/\/www.codeproject.com\/Articles\/46390\/WMI-Query-Language-by-Example#object\" target=\"_blank\">WMI Query language examples<\/a>. <\/p>\n<p>PowerShell can access WMI via <code>Get-WMIObject<\/code>. And while it&#8217;s easier to just pull all WMI objects and then filter, it&#8217;s faster if you do the filtering while pulling itself. <\/p>\n<p>Case in hand: getting a list of installed drivers. The <code>Win32_PnpSignedDriver<\/code> WMI class is what you need to tap into for this. Like thus:<\/p>\n<pre class=\"lang:ps decode:true \" >Get-WMIObject -Class Win32_PnPSignedDriver<\/pre>\n<p>This gives a bucket-load of output. If you want to filter out just a particular driver, the easy way is this:<\/p>\n<pre class=\"lang:ps decode:true \" >Get-WMIObject -Class Win32_PnPSignedDriver | ?{ $_.DeviceName -like \"*PCI*\" }<\/pre>\n<p>The better way, though, is to use WMI queries and filter while running WMI itself. Like this:<\/p>\n<pre class=\"lang:ps decode:true \" >Get-WMIObject -Class Win32_PnPSignedDriver -Filter \"DeviceName like '%PCI%'\"<\/pre>\n<p>Both return the same number of results: <\/p>\n<pre class=\"lang:ps decode:true \" >PS&gt; (Get-WMIObject -Class Win32_PnPSignedDriver | ?{ $_.DeviceName -like \"*PCI*\" }).Count\r\n17\r\nPS&gt; (Get-WMIObject -Class Win32_PnPSignedDriver -Filter \"DeviceName like '%PCI%'\").Count\r\n17\r\n<\/pre>\n<p>But the latter is faster.<\/p>\n<pre class=\"lang:ps decode:true mark:13,28\" >PS&gt; Measure-Command -Expression { Get-WMIObject -Class Win32_PnPSignedDriver | ?{ $_.DeviceName -like \"*PCI*\" } }\r\n\r\n\r\nDays              : 0\r\nHours             : 0\r\nMinutes           : 0\r\nSeconds           : 1\r\nMilliseconds      : 637\r\nTicks             : 16374688\r\nTotalDays         : 1.89521851851852E-05\r\nTotalHours        : 0.000454852444444444\r\nTotalMinutes      : 0.0272911466666667\r\nTotalSeconds      : 1.6374688\r\nTotalMilliseconds : 1637.4688\r\n\r\nPS&gt; Measure-Command -Expression { Get-WMIObject -Class Win32_PnPSignedDriver -Filter \"DeviceName like '%PCI%'\" }\r\n\r\n\r\nDays              : 0\r\nHours             : 0\r\nMinutes           : 0\r\nSeconds           : 1\r\nMilliseconds      : 593\r\nTicks             : 15936620\r\nTotalDays         : 1.8445162037037E-05\r\nTotalHours        : 0.000442683888888889\r\nTotalMinutes      : 0.0265610333333333\r\nTotalSeconds      : 1.593662\r\nTotalMilliseconds : 1593.662<\/pre>\n<p>The difference isn&#8217;t much in the example above, but when you run this across the network for multiple computers it adds up quickly. <\/p>\n<p>So when in doubt filter at the WMI level. And to make filter queries like the above, the link at the start of this post helps. It gives you the keywords you can use. Like, for instance, to do wildcard matches use the <code>like<\/code> keyword as above. And like <code>*<\/code> is the wildcard symbol usually, for WMI queries <code>%<\/code> is the wildcard symbol. Similarly, to do exact matches use the <code>=<\/code> keyword; to do relational matches (greater than, less than) use the <code>&lt;<\/code> and <code>&gt;<\/code> keywords; and so on. <\/p>\n<p>Special shout-out to <a href=\"https:\/\/codeslammer.wordpress.com\/2009\/02\/21\/wmic-wildcard-search-using-like-and\/\" target=\"_blank\">this blog post<\/a> where I first came across the <code>like<\/code> keyword. <\/p>\n","protected":false},"excerpt":{"rendered":"<p>A useful link to refer to later: WMI Query language examples. PowerShell can access WMI via Get-WMIObject. And while it&#8217;s easier to just pull all WMI objects and then filter, it&#8217;s faster if you do the filtering while pulling itself. Case in hand: getting a list of installed drivers. The Win32_PnpSignedDriver WMI class is what &hellip; <a href=\"https:\/\/rakhesh.com\/powershell\/wmi-queries\/\" class=\"more-link\">Continue reading <span class=\"screen-reader-text\">WMI queries<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false}}},"categories":[2],"tags":[38],"jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/765"}],"collection":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/comments?post=765"}],"version-history":[{"count":0,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/765\/revisions"}],"wp:attachment":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/media?parent=765"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/categories?post=765"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/tags?post=765"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}