In the last few articles we’ve been exploring using WBEMTest for testing WMI connectivity and queries. This is often helpful as you can verify WMI works as expected before attempting to use it in something like PowerShell. In this article I want to demonstrate a few other tips and tricks with WBEMTest. To follow along, fire up WBEMTest and connect to your local computer.
Contents of this article

List namespaces ^

The namespace that most IS Pros use is root\cimv2. But there are others. We can use WBEMTest to list them. A WMI namespace is just another type of class and we can enumerate them. Click the Enum Instances button that I’ve highlighted in the screenshot.

WBEMTest - Enum Instances

Enum Instances

In the dialog box enter the class name __Namespace as I’ve done in the next screenshot.

WBEMTest - Class name __Namespace

Class name __Namespace

Even though there is an option to search recursively, that doesn’t seem to really work in WBEMTest. Clicking OK gives me a result like like in the screenshot below.

WBEMTest - Class name __Namespace - Query result

Class name __Namespace - Query result

Let’s be clear here: these are only the namspaces under root\cimv2. Depending on your operating system, installed applications or services, there may be many more. To discover them we need to move “up” to the root.

You might think you could go back to the main window and use the Open Namespace button. But this only opens namespaces from the current location. To change to the root click on Connect and in the Namespace field enter Root. Or \\<computername>\root if you want to connect to a remote computer. Now I can repeat the previous step and list all namespaces as you see in the screenshot below.

WBEMTest - Class name __Namespace - Query result root

Class name __Namespace - Query result root

I can double-click any result to examine it further. Although there’s not much to see except the complete path. But that is helpful because I may want to know what classes are in the namespace.

List classes ^

Because I’m already in the root, I should be able to change to a different child namespace by clicking Open Namespace and entering one of the Namespace names.

WBEMTest - Open Namespace

Open Namespace

The main window should reflect the new focus. Now I’ll click on the Enum Classes button which gives me Figure 6.

WBEMTest - Enter Superclass name

Enter Superclass name

I don’t have a particular class in mind so I’ll leave it blank and click OK. WBEMTest should go ahead and list all the classes.

WBEMTest - Top-level classes

Top-level classes

You should be able to ignore any of the system classes that start with a double underscore. Here’s the fun part: double click on one of them. The object editor will display the properties for that class.

WBEMTest - Object Editor

Object Editor

Now I know the properties names I could use in a WMI query. But wait, there’s more. See that Instances button? Let’s have WMI find all instances of this particular class.

WBEMTest - Instances of the AntiSpywareProduct

Instances of the AntiSpywareProduct

The screenshot above shows all instances of the AntiSpywareProduct from the root\securitycenter2 namespace. As before, I can double-click on one of the entries to see actual properties and values as in the next screenshot.

WBEMTest - Instances of the AntiSpywareProduct - Properties

Instances of the AntiSpywareProduct - Properties

Now that I know what to look for and where, I can test a query in WBEMTest.

Test a query in WBEMTest

Test a query in WBEMTest

If it works, I can translate it into PowerShell or whatever.

PS Scripts:\> Get-WmiObject -Namespace root\securitycenter2 AntivirusProduct -filter "displayname='Windows Defender'"

WBEMTest - Translate into PowerShell

Translate into PowerShell

Don’t forget to specify the correct namespace.

If you know the class name you can click Open Class and enter in the class name like AntiVirusProduct or Win32_LogicalDisk to get the class description (see the “Object Editor” screenshot above). Or if you don’t want to query, you can simply ask for all instances of a class by clicking Enum Instances and enter a class name. This will list all the instances just as if you had run a query. If you just want a quick look, this is a fast way to get to the good stuff.

Summary ^

WBEMTest might appear a bit daunting at first. There are many things that you could click and configure, but for the most part you can accept the defaults. This utility cracks opens the hidden world of WMI. I find it the best tool for verifying connectivity and credentials. It is a decent tool for poking around, although it takes a little work and pre-existing knowledge to retrieve information. If you find yourself in WMI a lot, you will want to find some other type of WMI explorer or navigator tool.

Articles in series

WBEMTest

6 Comments
  1. RMe 7 years ago

    While running WMI query for win32 class I get class not registered error. Please provide your views

  2. Author
    jeff hicks 7 years ago

    Not every WMI class or even every property is available on every version of Windows. Classes change over time. Search for the class name on MSDN and see what minimum OS is required.

  3. RMe 7 years ago

    Thanks Jeff,
    I have checked the OS i.e. Intel64 Family 6 Model 69 Stepping 1 GenuineIntel,6.1,7601,Service Pack 1,Windows 7. I have verified on a similar machine having Windows7 SP1 and dont seems to have any issue.
    Apart from that, in WbemTest log i get following errors:
    eg. WMI GET operation errors reported: 30 errors
    Root/CIMV2, Win32_PerfRawData_Counters_IPsecAuthIPv4, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.....so on
    15188 13:27:57 (0) ** MOF Registration: ''.
    Please guide further.

  4. Author

    I get the same error on Windows 8.1. I suspect there is something that needs to be enabled in order for that class to begin capturing data, but I don't know off hand what it is. This is a performance counter issue I think and not a PowerShell or WMI problem. You might try using Get-Counter to retrieve what should be the same information.

  5. RMe 7 years ago

    Hi Jeff, Can you please provide your views on the following:-
    All queries e.g. 'Select * from win32_computersystem' run both on wbemtest and WMIExplorer.
    wbemtest runs the query well and shows result but WMIexplorer shows "The object invoked has disconnected" error while selecting in classes tab and while executing the query shows "Error Class not registered"

  6. Author

    If there is something different about the WMI Explorer, you'd have to ask the vendor.

Leave a reply

Please enclose code in pre tags

Your email address will not be published. Required fields are marked *

*

© 4sysops 2006 - 2021

CONTACT US

Please ask IT administration questions in the forums. Any other messages are welcome.

Sending

Log in with your credentials

or    

Forgot your details?

Create Account