🧬 WMI
Windows Management Instrumentation reference queries and WQL-focused scripts.
Win32_StartupCommand: Filtering Startup Programs (WQL WHERE)
Shows the WQL WHERE clause syntax against Win32_StartupCommand, starting from a LIKE '%' wildcard you customize with a …
Win32_CDROMDrive: CD/DVD Drives (WQL)
A minimal WQL reference query against Win32_CDROMDrive — the raw SELECT statement plus a one-line runner, useful for le…
Win32_PointingDevice: Pointing Devices (WQL)
A minimal WQL reference query against Win32_PointingDevice — the raw SELECT statement plus a one-line runner, useful fo…
Win32_StartupCommand: Event-Driven Monitoring (WQL __InstanceCreationEvent)
Subscribes to WMI's __InstanceCreationEvent for Win32_StartupCommand via Register-CimIndicationEvent — real WQL event q…
Win32_PhysicalMemory: Event-Driven Monitoring (WQL __InstanceCreationEvent)
Subscribes to WMI's __InstanceCreationEvent for Win32_PhysicalMemory via Register-CimIndicationEvent — real WQL event q…
Win32_NetworkAdapterConfiguration: Sorting Network Adapter Configuration (WQL has no ORDER BY)
WQL has no ORDER BY clause — this shows the standard workaround of piping Get-CimInstance results through Sort-Object o…
Win32_QuickFixEngineering: Event-Driven Monitoring (WQL __InstanceCreationEvent)
Subscribes to WMI's __InstanceCreationEvent for Win32_QuickFixEngineering via Register-CimIndicationEvent — real WQL ev…
Win32_PhysicalMemory: Sorting Physical Memory Modules (WQL has no ORDER BY)
WQL has no ORDER BY clause — this shows the standard workaround of piping Get-CimInstance results through Sort-Object o…
Win32_CDROMDrive: Querying CD/DVD Drives Remotely (CIM Session)
Runs the same Win32_CDROMDrive WQL query against a remote computer over a CIM session — the modern, WinRM-based replace…
Win32_OperatingSystem: Discovering Available Properties (Get-CimClass)
Uses Get-CimClass to list every real property and method Win32_OperatingSystem exposes on the current system, instead o…