Skip to main content

1E 23.11 (SaaS)

NativeServices.RunWmiQuery

Method

RunWmiQuery

Module

NativeServices

Library

Core

Action

Execure a WMI query.

Parameters

Namespace (string; optional, default "root\cimv2"): The WMI namespace to use.

Query (string): The query expression.

Note

For AsUser to work with TIMS/TAIL/Loadgen there must either be a 1E.Client.exe in the same directory as the TIMS/TAIL/Loadgen executable or an installed 1E Client.

ResultsAsText (boolean; optional, default false):

  • false - return a column for each property returned by the WMI query. Null values are reported as empty string.

  • true - return a single column named "Data" containing a comma-delimited list of all PropertyName:Value returned by the WMI query. Null values are reported asnull.

Note

true allows execution of WMI queries and interpretation (or at least display) of the results without the instruction having to know the table schema (WMI property names) up-front.

Return values

A row for each instance returned by the WMI query. The number of columns depends on ResultsAsText:

  • false (default) - return a column for each property returned by the WMI query. Null values are reported as empty string.

  • true - return a single column named "Data" containing a comma-delimited list of all PropertyName:Value returned by the WMI query. Null values are reported as null.

Example

// return multiple columns
@query = "SELECT AdapterType, Name, Index, InterfaceIndex, MACAddress FROM Win32_NetworkAdapter 
WHERE PhysicalAdapter=true";
NativeServices.RunWmiQuery(Namespace:"root\\cimv2", Query:@query);
//return one column 'Data'
@query = "SELECT AdapterType, Name, Index, InterfaceIndex, MACAddress FROM Win32_NetworkAdapter 
WHERE PhysicalAdapter=true";
NativeServices.RunWmiQuery(Namespace:"root\\cimv2", Query:@query, ResultsAsText:true);

Platforms

  • Windows

Notes

Avoid using "SELECT * FROM..." in your WMI query for instructions, especially when used as the last statement in an instruction. Instead, you should SELECT specific columns, which you would use in the instruction schema.

This is because:

  • WMI queries may return a different number of columns depending on circumstances, which may cause a conflict with the instruction output schema

  • WMI structure may change in future

  • Returning specific columns is more efficient as the Agent will need to process less data

  • Specifying column names is easier to understand.