Windows 7 / Getting Started

---

Querying Information on Specific Objects

If you tried to retrieve information on some of the other Win32 classes, you may have been a little overwhelmed by the results, especially if you included the | Format-List cmdlet. For example, if you queried the Win32_Service class (using Get-wmiObject Win32_Service), it would have scrolled through several screens. This is because it's querying every instance of the object on your system.

If you query the Win32_Computersystem class, it retrieves only information on your system. However, the Win32_Service class will query information on every single instance of a service on your system.

Many times, instead of retrieving all of the information about all the objects, you may want only information on a specific object. As an example, here's how you can use the -query switch to retrieve information about a specific service.

Imagine that you only want to see if the Windows Defender (WinDefend) service is running. You can use this query:

Get-WmiObject -query "Select * From Win32_service Where name ='WinDefend'"

The Select statement in the query starts by saying that you want to retrieve all columns (using the * as a wildcard). Next, it identifies the class Win32_Service as the source in the From clause. Last, it uses a Where clause to identify the name of the service. You should be aware of a couple of rules here:

• The entire Select statement must be enclosed in double quotes.
• String data used in comparisons must be enclosed in single quotes (as in 'WinDefend').
• The Select statement uses symbols (such as = for equals) for comparison operators instead of the comparison switches used in PowerShell commands (such as -eq for equals).

You may be wondering how I knew that the Windows Defender service is named WinDefend. A couple of ways to determine the name. If I knew the common name was Windows Defender, I could have used the PowerShell command Get- Service "Windows Defender" to display the status, name, and DisplayName to see this result:

Status 	Name 		DisplayName
------ 	---- 		-----------
Running WinDefend 	Windows Defender

Similarly, you may be interested in knowing if the Windows Defender service is running on a remote computer named WS23. You could use this command:

Get-WmiObject -queryi↵
"select * from Win32_service where name ='WinDefend'" -computername WS23

Tip Even though the previous code is shown on two lines, it would be entered on a single line.

The only extra that is added is the -computername switch and the name of the remote computer. If you don't have another computer to query right now, you can query your own system. Type hostname and press Enter to determine the name of your system, and substitute WS23 with your system's name.

Tip While you can query your local computer without invoking administrator rights, you must have local administrator rights on remote computers that you want to query using WMI If you don't have local admin rights, access will be denied.