PowerShell – Working with CIM – Get information

This is the first part of how to work with CIM cmdlets; here i write about how to gather and sort information.

Gathering information

Gathering information with CIM is pretty straight forward.
Using the class CIM_Process as an example.

Get-CimInstance -ClassName CIM_Process

This should list all running processes on your system.

As with all PS objects you can also store you result in a variable and pipe this to your other commands:

$Processes = Get-CimInstance -ClassName CIM_Process

Keep in mind that this will be a snapshot of the moment you are creating the variable, so the data can become stale.

Sorting and filtering

Now you got some data to work with. But it might be somewhat unordered,  maybe you want to change the ordering of the list, or filter the results?
That is easy to do!

The CIM cmdlets like most other cmdlets returns data objects (instead of raw text), and PowerShell have a few different cmdlets for sorting and filtering the data.

So for a few examples:
Using the Sort-Object cmdlet we can sort the list according to the property we would like.
Here we are sorting according to the “name” property:

Get-CimInstance -ClassName CIM_Process | Sort-Object -Property Name

Using the Where-Object cmdlet, we can filter for objects that has specific properties.
Here we are filtering to only get the objects where the name begins with “A”

Get-CimInstance -ClassName CIM_Process | Where-Object -Property Name -Like "A*"

Side note on using Where-Object:
There are a lot of ways to use this cmdlet, but going into that would be beyond the scope of this post.
In case you would like to read up on this, you can take a look at Microsoft's documentation of it; Where-Object

Selecting properties

By default the output might not contain all the data you want, but just is likely to show some of the most commonly relevant properties.

Piping your command into Get-Member is an easy way to show all properties available to you:

Get-CimInstance -ClassName CIM_Process | Get-Member

Using the list of returned properties you can use the Select-Object cmdlet to get the properties you want:

Get-CimInstance -ClassName CIM_Process | Select-Object -Property Name,ProcessID,CreationDate

This should show you the process name, its ID, and when it started running.

You can also see all properties for each object if you pipe your result to Format-List:

Get-CimInstance -ClassName CIM_Process | Where-Object -Property Name -Like "Notepad.exe" | Format-List *

Note that I am also piping through Where-Object to avoid getting too many results (in this case looking for notepad.exe).

It is important to note the difference between writing “Format-List” and “Format-List *”; adding the * (wildcard) character will ensure you get all properties.
In the odd case you are still not getting everything, appending -Force at the end  might help.

 

Rounding off to keep this somewhat easy to read; this should be a decent beginning in understanding how to use CIM cmdlets.
Any questions, corrections?
Please comment below!

The next article i will write about working with CIM methods.
So till then, have a good one!