🧬 WMI
Windows Management Instrumentation reference queries and WQL-focused scripts.
Win32_SoundDevice: Sound Devices (WQL)
A minimal WQL reference query against Win32_SoundDevice — the raw SELECT statement plus a one-line runner, useful for l…
Win32_NetworkAdapter: Sorting Network Adapters (WQL has no ORDER BY)
WQL has no ORDER BY clause — this shows the standard workaround of piping Get-CimInstance results through Sort-Object o…
Win32_StartupCommand: Startup Programs (WQL)
A minimal WQL reference query against Win32_StartupCommand — the raw SELECT statement plus a one-line runner, useful fo…
Win32_DiskDrive: Finding Associated Objects (WQL ASSOCIATORS OF)
Demonstrates Get-CimAssociatedInstance, the modern CIM equivalent of WQL's ASSOCIATORS OF syntax, against a Win32_DiskD…
Win32_Product: Sorting Installed MSI Products (WQL has no ORDER BY)
WQL has no ORDER BY clause — this shows the standard workaround of piping Get-CimInstance results through Sort-Object o…
Win32_OperatingSystem: Filtering Operating System Info (WQL WHERE)
Shows the WQL WHERE clause syntax against Win32_OperatingSystem, starting from a LIKE '%' wildcard you customize with a…
Win32_Group: Filtering Local Groups (WQL WHERE)
Shows the WQL WHERE clause syntax against Win32_Group, starting from a LIKE '%' wildcard you customize with a real sear…
Win32_Keyboard: Event-Driven Monitoring (WQL __InstanceCreationEvent)
Subscribes to WMI's __InstanceCreationEvent for Win32_Keyboard via Register-CimIndicationEvent — real WQL event query s…
Win32_SystemDriver: Discovering Available Properties (Get-CimClass)
Uses Get-CimClass to list every real property and method Win32_SystemDriver exposes on the current system, instead of g…
Win32_PhysicalMemory: Filtering Physical Memory Modules (WQL WHERE)
Shows the WQL WHERE clause syntax against Win32_PhysicalMemory, starting from a LIKE '%' wildcard you customize with a …
Win32_UserAccount: Querying Local User Accounts Remotely (CIM Session)
Runs the same Win32_UserAccount WQL query against a remote computer over a CIM session — the modern, WinRM-based replac…
Win32_SoundDevice: Finding Associated Objects (WQL ASSOCIATORS OF)
Demonstrates Get-CimAssociatedInstance, the modern CIM equivalent of WQL's ASSOCIATORS OF syntax, against a Win32_Sound…