Description and usage of WMIC Windows command

[Aacini]

WMIC is a command included in the latest Windows versions and is one of the largest commands because the amount of information it may provide and the number of parameters it uses, but at the same time is one of the worst documented ones. WMIC is a command-line interface to Windows Management Instrumentation, that is Microsoft's implementation of the WBEM and CIM standards; you may review these terms in Wikipedia if you wish. In despite of that, I used the simplest way to explain WMIC usage, so I apologize if a purist does not agree. Although WMIC was designed to work through remote servers, it also may provide useful information in a single computer.

WMIC may display information about a very large number of computer resources, so you always must indicate the type of information you want via a resource name called alias; the simplest one is DataFile, that provide information about files. After the alias you may put a where clause, that select the desired data files, and a verb clause, that indicate the requested information. For example, the following command display all available information of all files in the disk (and take toooo long to complete):

Code: Select all

wmic datafile

Verb clauses are: ASSOC, CALL, CREATE, DELETE, GET and LIST; the most useful one is GET [<property list>] where the most useful properties for DataFile alias are: CreationDate, Drive, FileExtension, FileName, FileType, LastAccessed, LastModified, Name, Path and Size, but there are more than 30 total properties for this alias!

The where clause take this form:where (propertyName=value [and propertyName=value] ...) although not all properties are allowed here. Note that path names in this clause must start and end with \\ and every intermediate \ in the path must be expanded to double \\; also, string values must be enclosed in quotes.

The Batch file below display the properties given in the parameters of the files in current directory, besides Name. Note that properties are always displayed in alphabetic order.

Properties.bat:

Code: Select all

@echo off
set properties=Name
:nextParam
   if "%1" == "" goto endParams
   set properties=%properties%, %1
   shift
   goto nextParam
:endParams
set drive=%CD:~0,2%
set folder=%CD:~2%
wmic datafile where (drive="%drive%" and path="%folder:\=\\%\\") get %properties%

For example:

Code: Select all

properties CreationDate LastAccessed FileType

If /VALUE switch is added after the property list, the data is displayed in separated lines in PropertyName=value format (ready for a SET command!) instead of table format.

Another interesting alias are:

Code: Select all

wmic BaseBoard get Description, InstallDate, Manufacturer, Model, Name, SerialNumber, Version     

wmic ComputerSystem get CurrentTimeZone, Description, InstallDate, Manufacturer, Model, Name, NumberOfProcessors, TotalPhysicalMemory

Other useful alias (for me, at least) are: Bios, CDRom, CPU, DeskTop, DiskDrive, Environment, Job, LogicalDisk, OS, Printer, Process, Service, TimeZone and UserAccount, but there are more than 70 alias total!

Before the alias you may include global switches to modify the scope used by WMIC to retrieve or provide the requested information. The most useful ones are:

Code: Select all

/TRACE:ON
    Specify whether output debug information is to be copied to stderr.

/{OUTPUT|APPEND}:CLIPBOARD|<filename>
    Specifies the mode and destination for output redirection.

I gather most of this information by executing wmic with various options and /? at end; for example: wmic /?:full. I also got some useful information from this site, excepting where clause usage that I got from here: w w w.robvanderwoude.com/wmic.php (besides several interesting examples).

I encourage you to add additional details on wmic usage if you know that for the benefit of all of us!

Antonio

[dbenham]

I agree WMIC is powerful resource. But it is also very finicky, and has a few quirks that can make it awkward to use in a batch file.

The output of WMIC is unicode, so it cannot be processed by FOR /F directly. The output can be redirected to a file, and then TYPE or MORE can convert the file into ANSI. It would seem logical that you should be able to pipe the WMIC output directly to MORE to get valid ANSI output. This is where it gets really weird. As far as I can tell, WMIC detects when the output is piped and does its own conversion. But the WMIC piped conversion is flawed in two ways:

1) An extra blank line is appended to the output.
2) Each line of output is terminated with <CR><CR><LF> instead of <CR><LF>

Both of the above can cause difficulties when trying to parse the output. The odd output is not a function of the pipe operation. It seems to be part of WMIC itself.

Another oddity I've run into is how WMIC handles volume serial numbers. The VOL command reports volume serial numbers as a string of 8 hexadecimal digits. But WMIC treats those digits as a signed 32 bit int. My C: volume serial number displays as a negative decimal number in WMIC. But if I try to use that negative number in a WMIC WHERE clause, it returns "Invalid query". If I interpret the 8 hex digits as an unsigned integer and use that in my WHERE clause, then WMIC finds my C: volume.

Another difficulty is the help documentation. The help shows multi word property names with spaces. But the actual property names never have spaces. Generally you can simply drop the spaces from the property name listed in the help to get the actual property name (case insensitive). For example "Serial Number" is "SerialNumber". But some property names don't work. For example, the help lists "File System Name" as a property of DATAFILE. But an attempt to use the "FileSystemName" property fails. If you do a LIST, (hopefully with a reasonable WHERE clause to limit the results), you will see that the actual property name is "FSName".

Lastly, WMIC uses the backslash \ as an escape character. So if you wanted to include a quote in a string value to be used in a WHERE clause, it would need to be escaped as \". I haven't run into a situation where I needed a quote literal. But I have run into problems with specifying a path. The backslash folder separators must be escaped as in WHERE "PATH=C:\\root\\sub1\\sub2\\"


Dave Benham

[aGerman]

I realy like WMIC. I often used the WMI in VBScripts before.
But you're right that the unicode output makes things more complicated as they should be.

It would seem logical that you should be able to pipe the WMIC output directly to MORE to get valid ANSI output. This is where it gets really weird. As far as I can tell, WMIC detects when the output is piped and does its own conversion. But the WMIC piped conversion is flawed in two ways:

1) An extra blank line is appended to the output.
2) Each line of output is terminated with <CR><CR><LF> instead of <CR><LF>

Not quite sure why, but it seems that the cmd itself causes these problems when a unicode output is piped. I saw the same effect with other unicode tools. If parsed as ASCII the <NULL> character is separating the <CR> and <LF>. It keeps the <CR> in the string and converts the <LF> to a new regular line break <CR><LF>. Only a guess though.

You could remove the excrescent <CR> via string manipulation in a variable.

Code: Select all

del "test.txt" 2>nul
for /f %%i in ('copy /z "%~f0" nul') do (
  for /f "delims=%%i" %%j in ('WMIC OS Get LocalDateTime^|findstr .') do (
    set "var=%%j"
    setlocal EnableDelayedExpansion
    >>"test.txt" echo(!var:%%i=!
    endlocal
  )
)

4C6F63616C44617465540D0A32303132303432383231343635352E3133323030302B31323020200D0A

Regards
aGerman

[dbenham]

I like your method of stripping the <CR> at the end
It removes the bogus empty line at the end as well, yes

Not quite sure why, but it seems that the cmd itself causes these problems when a unicode output is piped. I saw the same effect with other unicode tools.

I think we are saying the same thing

What other unicode tools have shown this behavior

I've done some tests to demonstrate that pipes by themselves do not alter unicode output. My tests make use of the fact that FINDSTR "^" file produces a binary copy of the source, even if it is unicode.

WMIC VOLUME GET NAME >temp.txt --> healthy unicode output

FINDSTR "^" temp.txt | FINDSTR "^" --> healthy unicode output

WMIC VOLUME GET NAME | FINDSTR "^" --> corrupted ANSI output


Dave Benham

[aGerman]

What other unicode tools have shown this behavior

I was virtually certain I have seen it with fsutil on XP, but now on Win7 I can't reproduce it
I'll search my older batch files and come back later ...

Regards
aGerman

[foxidrive]

Ipconfig under XP gives 0d0d0a line ends too. This is a method to convert them to 0d0a

Code: Select all

@echo off
for /f "delims=" %%a in ('ipconfig /all') do (
for /f "delims=" %%b in ('echo.%%a') do echo.%%b>>file.txt
)

This also works.

Code: Select all

@echo off
del file.txt 2>nul
for /f "delims=" %%a in ('ipconfig /all') do cmd /c echo.%%a>>file.txt

[aGerman]

Yeah, that's a quite simple and fast method. Works fine

Code: Select all

for /f "delims=" %%i in ('WMIC OS Get LocalDateTime') do (
  for /f "delims=" %%j in ("%%i") do >>"test.txt" echo %%j
)

BTW It was the fsutil on XP but now it seems they fixed it.

Regards
aGerman

[kevin]

Dave, great post. I learned a lot.

For example, the help lists "File System Name" as a property of DATAFILE. But an attempt to use the "FileSystemName" property fails. If you do a LIST, (hopefully with a reasonable WHERE clause to limit the results), you will see that the actual property name is "FSName".

I did find that when using a property name that contains spaces, you can wrap the property name with double quotes like this:

Code: Select all

wmic datafile where name="c:notepad.exe" get "File System Name"
wmic datafile where name="c:notepad.exe" get "Last Modified"
wmic datafile where name='c:\\windows\\system32\\notepad.exe' get "File System Class Name"

I was wondering if you know where I can find a list of valid clauses for WHERE with DATAFILE? I know of "NAME" (as above), and "PATH", but I am trying to find others. I tried: wmic datafile where /?, but the results are not very helpful:

Code: Select all

C:\Windows\System32>wmic datafile where /?

Escapes to full WMI WQL query capabilities. If an alias is involved, only the
'WHERE' clause for the query should be supplied.
USAGE:

WHERE <where clause> [<verb clause>]