Scribd
Upload
186 views

TP N°19a - Examples WMI Filters

The document provides examples of WMI filters to retrieve information about computer properties, operating systems, software and settings, Active Directory, and date and time from Windows computers. Over 20 example WMI queries are given covering topics like checking if a computer is a laptop, screen resolution, installed RAM, operating system version, timezone, installed software, and Active Directory properties. The examples can be used or modified for various purposes including filtering or targeting specific systems.

Uploaded by

Me Mon
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
186 views

TP N°19a - Examples WMI Filters

The document provides examples of WMI filters to retrieve information about computer properties, operating systems, software and settings, Active Directory, and date and time from Windows computers. Over 20 example WMI queries are given covering topics like checking if a computer is a laptop, screen resolution, installed RAM, operating system version, timezone, installed software, and Active Directory properties. The examples can be used or modified for various purposes including filtering or targeting specific systems.

Uploaded by

Me Mon
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 4

Example WMI filters

Far more easy than creating a filter is to use someone else's filters. These examples are tested
on Windows 2008 R2 and Windows 7 and should work on earlier Windows versions.

If not mentioned otherwise, the namespace used in the examples is root\CIMv2.

Computer properties

Computer is a laptop (because it has a battery)

SELECT * FROM Win32_Battery

Screen resolution is at least 1280x720

SELECT * FROM Win32_DisplayControllerConfiguration WHERE


HorizontalResolution>1279 AND VerticalResolution>719

System is running on batteries

SELECT * FROM BatteryStatus Where Discharging = True

NOTE: Namespace for this filter: \root\WMI

Computer has at least 2GB RAM memory

SELECT * FROM Win32_ComputerSystem WHERE TotalPhysicalMemory > 2000000000

Drive D: contains at least 100GB free space

SELECT * FROM Win32_LogicalDisk WHERE FreeSpace > 100000000000 AND Caption


= "D:"

Computer contains an Intel Processor

SELECT * FROM Win32_Processor WHERE Manufacturer = "GenuineIntel"

Computer has more than 2 logical processors

SELECT * FROM Win32_ComputerSystem where NumberOfLogicalProcessors > 2

Computer has more than 1 physical processor

SELECT * FROM Win32_ComputerSystem where NumberOfProcessors > 1

Computer contains an IRDA device

SELECT * FROM CIM_InfraredController


Computer contains a floppy drive

SELECT * FROM Win32_FloppyDrive

Computer contains an active Trusted Platform Module (TPM)

SELECT * FROM Win32_Tpm WHERE IsEnabled_InitialValue = True

NOTE: Namespace for this filter: root\CIMV2\Security\MicrosoftTpm

Computer is a Compaq Presario SR5115NL

SELECT * FROM Win32_ComputerSystem WHERE manufacturer = "Compaq-Presario"


and Model = "GN729AA-ABH SR5115NL"

Windows Operating System

64 bits OS installed

SELECT OSArchitecture FROM Win32_OperatingSystem WHERE OSArchitecture = "64-


bit"

OS Windows 7

SELECT * FROM Win32_OperatingSystem WHERE Version = "6.1%" and ProductType =


"1"

OS Windows 7 with service pack 1

SELECT * FROM Win32_OperatingSystem WHERE Version = "6.1%" and ProductType =


"1" and ServicePackMajorVersion = "1"

OS Windows Vista

SELECT * FROM Win32_OperatingSystem WHERE Version = "6.0%" and ProductType =


"1"

OS Windows XP

SELECT * FROM Win32_OperatingSystem WHERE Version = "5.1%" and ProductType =


"1"

OS windows 2000 workstation

SELECT * FROM Win32_OperatingSystem WHERE Version = "5.0%" and ProductType =


"1"

OS Windows 2008 R2 server


SELECT * FROM Win32_OperatingSystem WHERE Version = "6.1%" and ProductType <>
"1"

OS Windows 2008 R2 server with service pack 1

SELECT * FROM Win32_OperatingSystem WHERE Version = "6.1%" and ProductType <>


"1" and ServicePackMajorVersion = "1"

OS Windows 2008 server

SELECT * FROM Win32_OperatingSystem WHERE Version = "6.0%" and ProductType <>


"1"

OS Windows 2003 server

SELECT * FROM Win32_OperatingSystem WHERE Version = "5.2%" and ProductType <>


"1"

OS windows 2000 server

SELECT * FROM Win32_OperatingSystem WHERE Version = "5.0%" and ProductType <>


"1"

Software and settings

Time zone + 1 (bias is the time zone GMT+0 offset in minutes)

SELECT * FROM win32_timezone WHERE bias = 60

Windows feature webserver is installed

SELECT * FROM Win32_ServerFeature WHERE Name="Web Server (IIS)"

Service DHCP Server starts automatically

SELECT * FROM Win32_Service WHERE Caption="DHCP Server" AND


StartMode="Auto"

Share Backup$ is defined on this computer

SELECT * FROM Win32_Share WHERE Caption="Backup$"

File C:\windows\system32\notepad.exe exists

SELECT * FROM CIM_Datafile WHERE Name="C:\\windows\\system32\\notepad.exe"

Local user JDoe exists

SELECT * FROM Win32_UserAccount WHERE Name="JDoe" AND LocalAccount=True


Local group WSUS-administrators exists

SELECT * FROM Win32_Group WHERE LocalAccount=True AND Name="WSUS-


administrators"

Microsoft Office is installed (slow query!!)

SELECT * FROM Win32_Product WHERE Caption LIKE "Microsoft Office%"

Active Directory

Computer is an AD client computer

SELECT ProductType FROM Win32_OperatingSystem WHERE ProductType = "1"

Computer is an AD domain controller

SELECT ProductType FROM Win32_OperatingSystem WHERE ProductType = "2"

Computer is an AD member server

SELECT ProductType FROM Win32_OperatingSystem WHERE ProductType = "3"

AD Site-name is Amsterdam

SELECT * FROM Win32_NTDomain WHERE ClientSiteName = "Amsterdam"

Date and time

It is monday (1=monday, 2=thuesday, etc)

SELECT DayOfWeek FROM Win32_LocalTime WHERE DayOfWeek = 1

It is February (1=Januari, 2=February, etc)

SELECT DayOfWeek FROM Win32_LocalTime WHERE month = 2


Complexifier le filtre WMI
Voici quelques possibilités pour complexifier votre filtre si besoin :
– Cibler les OS – 64 Bits : Ajouter à la fin de la requête :
 AND OSArchitecture = « 64-bit »
– Cibler les OS – 32 Bits : Ajouter à la fin de la requête :
 AND NOT OSArchitecture = « 64-bit »
– Cibler deux OS différents (Exemple Windows 8 ET Windows 8.1):
 select * from Win32_OperatingSystem where (Version like « 6.2% » or
Version like « 6.3% ») and ProductType = « 1 »

You might also like