CIM/WMI cmdlets in PowerShell - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the purpose of CIM/WMI cmdlets in PowerShell?

CIM/WMI cmdlets let you get information about your computer and manage it by talking to Windows Management Instrumentation (WMI) or Common Information Model (CIM). They help automate tasks like checking system info or managing services.

beginner

What cmdlet would you use to get information about running processes using CIM?

You use Get-CimInstance -ClassName Win32_Process to get details about running processes on your computer.

intermediate

How does Get-CimInstance differ from Get-WmiObject?

Get-CimInstance uses newer protocols and is faster and more reliable. Get-WmiObject is older and less efficient. Microsoft recommends using Get-CimInstance for new scripts.

beginner

How can you filter CIM queries to get only specific data?

You can use the -Filter parameter with a simple query string, like -Filter "Name = 'notepad.exe'" to get info only about Notepad processes.

intermediate

What cmdlet would you use to start a service using CIM?

Use <code>Invoke-CimMethod</code> with the service class and the method <code>StartService</code> to start a service. For example, to start the Print Spooler service, you would first get the service instance and then invoke the method.

Which cmdlet is recommended for new scripts to query system info in PowerShell?

A Get-CimInstance

B Get-WmiObject

C Get-Process

D Invoke-Command

Get-CimInstance is the modern and recommended cmdlet for querying system info using CIM/WMI.

How do you filter CIM queries to get only processes named 'notepad.exe'?

A -Where {Name -eq 'notepad.exe'}

B -Filter "Name = 'notepad.exe'"

C -Name 'notepad.exe'

D -ProcessName 'notepad.exe'

The -Filter parameter accepts a query string like Name = 'notepad.exe' to filter results.

Which cmdlet lets you run a method on a CIM object, like starting a service?

A Invoke-CimMethod

B Start-Service

C Get-CimInstance

D Set-Service

Invoke-CimMethod runs methods on CIM objects, such as starting or stopping services.

What does CIM stand for in PowerShell cmdlets?

A Central Information Module

B Computer Internal Management

C Common Information Model

D Common Internet Model

CIM stands for Common Information Model, a standard for managing devices and systems.

Which protocol does Get-CimInstance use by default to communicate with remote computers?

A SSH

B DCOM

C HTTP

D WS-Management

Get-CimInstance uses WS-Management protocol by default, which is more firewall-friendly than DCOM.

Explain how you would use CIM cmdlets to find and start a service on a remote computer.

Think about querying the service first, then running the start method.

Describe the difference between Get-CimInstance and Get-WmiObject and why you should prefer one over the other.

Focus on protocol and performance differences.

Practice

1. What does the PowerShell cmdlet Get-CimInstance do?

easy

A. Starts a new PowerShell session.

B. Retrieves management information from local or remote computers using CIM.

C. Deletes files from the system.

D. Installs software packages.

Solution

1. Step 1: Understand the purpose of Get-CimInstance

   Get-CimInstance is used to get management data from computers, like hardware or software info.

2. Step 2: Compare options with cmdlet purpose

   Only Retrieves management information from local or remote computers using CIM. describes retrieving management info, matching the cmdlet's function.

3. Final Answer:

   Retrieves management information from local or remote computers using CIM. -> Option B

4. Quick Check:

   Get-CimInstance = Retrieves info [OK]

Hint: Get-CimInstance fetches system info, not file or session tasks [OK]

Common Mistakes:

• Confusing Get-CimInstance with file or session commands
• Thinking it installs software
• Assuming it deletes files

2. Which of the following is the correct syntax to get the list of running processes using CIM cmdlets?

easy

A. Get-CimInstance -ClassName Win32_Process

B. Get-CimInstance Win32_Process

C. Get-WmiObject -Class Win32_Process

D. Get-Process -ClassName Win32_Process

Solution

1. Step 1: Identify correct syntax for Get-CimInstance

   The correct parameter to specify the class is -ClassName, so Get-CimInstance -ClassName Win32_Process is valid.

2. Step 2: Check other options for syntax errors

   Get-CimInstance Win32_Process misses the parameter name, Get-WmiObject -Class Win32_Process uses Get-WmiObject (older cmdlet), and Get-Process -ClassName Win32_Process uses Get-Process incorrectly with a class parameter.

3. Final Answer:

   Get-CimInstance -ClassName Win32_Process -> Option A

4. Quick Check:

   Correct syntax uses -ClassName parameter [OK]

Hint: Use -ClassName to specify CIM class in Get-CimInstance [OK]

Common Mistakes:

• Omitting -ClassName parameter
• Mixing Get-CimInstance with Get-WmiObject syntax
• Using Get-Process with CIM class names

3. What will be the output of this command?

Get-CimInstance -ClassName Win32_OperatingSystem | Select-Object -Property Caption

medium

A. A list of running processes.

B. The computer's network adapter details.

C. An error about invalid property.

D. The name of the operating system installed on the computer.

Solution

1. Step 1: Understand the CIM class and property

   The class Win32_OperatingSystem contains OS info; the property Caption holds the OS name.

2. Step 2: Analyze the command output

   Selecting Caption will output the OS name, not processes or network info, and no error occurs.

3. Final Answer:

   The name of the operating system installed on the computer. -> Option D

4. Quick Check:

   Win32_OperatingSystem Caption = OS name [OK]

Hint: Win32_OperatingSystem class holds OS info; Caption is OS name [OK]

Common Mistakes:

• Confusing OS info with process or network info
• Expecting full object instead of selected property
• Assuming property Caption does not exist

4. You run this command but get an error:

Get-CimInstance -Class Win32_Processor

What is the likely cause?

medium

A. The parameter name should be -ClassName, not -Class.

B. Win32_Processor is not a valid CIM class.

C. Get-CimInstance cannot query processor info.

D. You need administrator rights to run this command.

Solution

1. Step 1: Check the parameter name used

   The correct parameter for specifying the class in Get-CimInstance is -ClassName, not -Class.

2. Step 2: Verify class validity and permissions

   Win32_Processor is a valid class and Get-CimInstance can query it; admin rights are usually not required for this query.

3. Final Answer:

   The parameter name should be -ClassName, not -Class. -> Option A

4. Quick Check:

   Use -ClassName parameter with Get-CimInstance [OK]

Hint: Use -ClassName, not -Class, with Get-CimInstance [OK]

Common Mistakes:

• Using -Class instead of -ClassName
• Assuming class is invalid
• Thinking admin rights are needed

5. You want to list all services that are currently running on a remote computer named 'Server01' using CIM cmdlets. Which command is correct?

hard

A. Get-CimInstance -ClassName Win32_Service -ComputerName Server01 | Where-Object { $_.Status -eq 'Running' }

B. Get-WmiObject -Class Win32_Service -ComputerName Server01 | Where-Object { $_.Status -eq 'Running' }

C. Get-CimInstance -ClassName Win32_Service -ComputerName Server01 | Where-Object { $_.State -eq 'Running' }

D. Get-CimInstance -ClassName Win32_Service -ComputerName Server01 | Where-Object { $_.State -eq 'Stopped' }

Solution

1. Step 1: Identify the correct property for running services

   The property State with value 'Running' correctly filters running services in Win32_Service.

2. Step 2: Choose the correct cmdlet and filter

   Using Get-CimInstance with -ComputerName is modern and correct. Filtering with Where-Object { $_.State -eq 'Running' } matches running services.

3. Final Answer:

   Get-CimInstance -ClassName Win32_Service -ComputerName Server01 | Where-Object { $_.State -eq 'Running' } -> Option C

4. Quick Check:

   Filter by State='Running' with Get-CimInstance [OK]

Hint: Filter services by State='Running' using Get-CimInstance [OK]

Common Mistakes:

• Using Status instead of State property
• Filtering for 'Stopped' instead of 'Running'
• Mixing Get-WmiObject with CIM cmdlets