WMIC

WMIC is a command line interface to WMI (Windows Management Instrumentation). WMI is a powerful management interface that we can access from directly from command line. 

WMIC can be used to manage remote computers. 
If we want to execute WMIC commands on a single computer we prepend command with /node: as shown below:

/node:hostname123 - specifies single server 
(wmic /node:hostname123 qfe where hotfixid="KB974571" list full)

If we want to execute WMIC commands on multiple computers listed in c:\nodes.txt we prepend command with /node:@ as shown below:

/node:@'c:\node.txt' - specifies text file with server names 

 (wmic /node:@'c:\node.txt' qfe where hotfixid="KB974571" list full)

It's worth keeping in mind that not all WMI classes have corresponding classes (called aliases) in WMIC. It is however possible to access WMI classes directly from WMIC:

wmic /namespace:\\root\NAMSPACE path CLASSNAME

To directly access WMI classes in CIMv2 namespace  

wmic /namespace:\\root\cimv2 path win32_useraccount

To see if there are any predictive failures using WMIC: 

wmic /namespace:\\root\wmi PATH MSStorageDriver_FailurePredictStatus get 

We can use Microsoft WMI Studio to explorer WMI classes, properties and methods

http://technet.microsoft.com/en-us/library/cc181062.aspx

We can tell WMIC to repeat a command at specified interval:

/every:5    -  repeats a command every 5 seconds 

WMIC can also output to an HTML file using /output and /format switches 

wmic /output:c:\cpu.htm cpu get name, maxclockspeed /format:hform.xsl

HTML output is no longer available in Windows 2008 or 7, on these platforms we omit /format switch.

qfe - wmic query for hotfixes and patches 

query for a given patch by using a KB ID: 

wmic qfe where hotfixid="KB974571" list full

process - process management 

query for an exe path of a process 

wmic process where caption="Apntex.exe" get executablepath  

query for a process's thread count  

wmic process where caption="Apntex.exe" get threadcount 

to execute a  command on a remote machine  

wmic /node:hostname process call create 'cmd.exe /c net stop iisadmin' 

To kill a process using WMIC: 

wmic process where caption="notepad.exe" call terminate 

service - service management: 

Disable service using WMIC

wmic service where caption='SSDP Discovery Service' call changestartmode disabled 

Enable service using WMIC

wmic service where caption='SSDP Discovery Service'  call changestartmode enabled 

Stop service using WMIC

wmic service where caption='SSDP Discovery Service'  call stopservice 

Startservice using WMIC

wmic service where caption='SSDP Discovery Service' call startservice 

Retrieve service status

wmic service where name='........'  get status 

To retrieve service name: 

wmic service list instance 

product - Software Management 

List installed software: 

wmic product get

wmic product list brief 

  

Only required attributes: 

wmic product get name, vendor, version 

Only products from Adobe: 

wmic product where "vendor like 'adobe%'" get 

  

 Find out a username of a user logged on to a computer: 

wmic /NODE:hostname COMPUTERSYSTEM GET USERNAME 

 Configure a static IP address using WMIC: 

wmic nicconfig where Index=1 call EnableStatic ("10.10.10.10"), ("255.255.255.0") 

To retrieve index ID: 

wmi nicconfig where ipenabled='true' 

  

Enable DHCP using WMIC: 

wmic nicconfig where Index=1 call EnableDHCP

File management using WMIC: 

list details about c:\script\comps.txt file 

wmic datafile where "path='\\scripts\\' and name='c:\\scripts\\comps.txt'" list full   

Backup event log using WMIC:

wmic nteventlog where "logfilename='system'" call backupeventlog "c:\system.evt"

wmic nteventlog where "logfilename='application'" call backupeventlog "c:\application.evt"

Query local groups:

wmic group where (localaccount=true) get name

Local groups with "sql" in the name:

wmic group where (localaccount=true and name like 'sql%') get name