Version: 9
restore

Contents

Method

RunWmiQuery

ModuleNativeServices
LibraryCore
Action


Execure a WMI query.

Parameters

Namespace (string): The WMI namespace to use. From v3.1, this parameter is optional and defaults to "root\cimv2" .

Query (string): The query expression.

ResultsAsText (boolean; optional):

  • false (default) - return a column for each property returned by the WMI query. Null values are reported as empty string.
  • true - return a single column named "Data" containing a comma-delimited list of all PropertyName:Value returned by the WMI query. Null values are reported as null.

true allows execution of WMI queries and interpretation (or at least display) of the results without the instruction having to know the table schema (WMI property names) up-front.

Return values

A row for each instance returned by the WMI query. The number of columns depends on ResultsAsText:

  • false (default) - return a column for each property returned by the WMI query. Null values are reported as empty string.
  • true - return a single column named "Data" containing a comma-delimited list of all PropertyName:Value returned by the WMI query. Null values are reported as null.
Example
// return multiple columns
@query = "SELECT AdapterType, Name, Index, InterfaceIndex, MACAddress FROM Win32_NetworkAdapter WHERE PhysicalAdapter=true";
NativeServices.RunWmiQuery(Namespace:"root\\cimv2", Query:@query);
//return one column 'Data'
@query = "SELECT AdapterType, Name, Index, InterfaceIndex, MACAddress FROM Win32_NetworkAdapter WHERE PhysicalAdapter=true";
NativeServices.RunWmiQuery(Namespace:"root\\cimv2", Query:@query, ResultsAsText:true);
Platforms
  • Windows
Notes

Avoid using " SELECT * FROM... " in your WMI query for instructions, especially when used as the last statement in an instruction. Instead, you should SELECT specific columns, which you would use in the instruction schema.

This is because:

  • WMI queries may return a different number of columns depending on circumstances, which may cause a conflict with the instruction output schema
  • WMI structure may change in future
  • Returning specific columns is more efficient as the Agent will need to process less data
  • Specifying column names is easier to understand.