Contents

NativeServices.RunWmiQuery

Method

RunWmiQuery

ModuleNativeServices
LibraryCore
Action

Execure a WMI query.

Parameters

Namespace (string; optional, default "root\cimv2"): The WMI namespace to use.

Query (string): The query expression.

AsUser (string; optional; default 1E.Client service user) Windows only: The "domain\user" (down-level logon) account name that the Agent will attempt to impersonate on the local machine.

If this parameter is absent the command will be executed in the Tachyon Agent process's user context.

It is not an error if the specified user is not currently logged on (and this includes accounts that are not even defined). In this case execution is deemed successful but the method does nothing and returns no data.

The specified user must be currently logged on and running explorer.exe (Windows Explorer).

For AsUser to work with TIMS/TAIL/Loadgen there must either be a 1E.Client.exe in the same directory as the TIMS/TAIL/Loadgen executable or an installed 1E Client.

Available from v5.3.

ResultsAsText (boolean; optional, default false):

  • false - return a column for each property returned by the WMI query. Null values are reported as empty string.
  • true - return a single column named " Data " containing a comma-delimited list of all PropertyName:Value returned by the WMI query. Null values are reported as null.

true allows execution of WMI queries and interpretation (or at least display) of the results without the instruction having to know the table schema (WMI property names) up-front.

Return values

A row for each instance returned by the WMI query. The number of columns depends on ResultsAsText:

  • false (default) - return a column for each property returned by the WMI query. Null values are reported as empty string.
  • true - return a single column named "Data" containing a comma-delimited list of all PropertyName:Value returned by the WMI query. Null values are reported as null.
Example
// return multiple columns
@query = "SELECT AdapterType, Name, Index, InterfaceIndex, MACAddress FROM Win32_NetworkAdapter WHERE PhysicalAdapter=true";
NativeServices.RunWmiQuery(Namespace:"root\\cimv2", Query:@query);
//return one column 'Data'
@query = "SELECT AdapterType, Name, Index, InterfaceIndex, MACAddress FROM Win32_NetworkAdapter WHERE PhysicalAdapter=true";
NativeServices.RunWmiQuery(Namespace:"root\\cimv2", Query:@query, ResultsAsText:true);
Platforms
  • Windows
Notes

Avoid using " SELECT * FROM... " in your WMI query for instructions, especially when used as the last statement in an instruction. Instead, you should SELECT specific columns, which you would use in the instruction schema.

This is because:

  • WMI queries may return a different number of columns depending on circumstances, which may cause a conflict with the instruction output schema
  • WMI structure may change in future
  • Returning specific columns is more efficient as the Agent will need to process less data
  • Specifying column names is easier to understand.