wmic - example

wmic - windows management interface

wmic.exe is the command line interface to the WMI APP's.

wmic.exe is available on Windows XP Pro. It is not available on Windows 2000 or XP Home.

Here are two good examples of usage:

C:\>wmic process get workingsetsize,commandline /format:csv

This lists the program and the memory usage

C:\>wmic process | sort

alg.exe              C:\WINDOWS\System32\alg.exe
ccApp.exe            "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
ccEvtMgr.exe         "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
ccSetMgr.exe         "C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"
cmd.exe              "C:\WINDOWS\system32\cmd.exe"
csrss.exe            C:\WINDOWS\system32\csrss.exe \
DefWatch.exe         "C:\Program Files\Symantec AntiVirus\DefWatch.exe"
explorer.exe         C:\WINDOWS\Explorer.EXE
lsass.exe            C:\WINDOWS\system32\lsass.exe
mozilla.exe          "C:\PROGRA~1\MOZILLA.ORG\MOZILLA\MOZILLA.EXE" -turbo
nvsvc32.exe          C:\WINDOWS\system32\nvsvc32.exe
pine.exe             "D:\Program Files\pine\pine.exe"
Rtvscan.exe          "C:\Program Files\Symantec AntiVirus\Rtvscan.exe"
rundll32.exe         "C:\WINDOWS\system32\RUNDLL32.EXE" \
services.exe         C:\WINDOWS\system32\services.exe
smss.exe             \SystemRoot\System32\smss.exe
sort.exe             sort
spoolsv.exe          C:\WINDOWS\system32\spoolsv.exe
svchost.exe          C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe          C:\WINDOWS\system32\svchost -k rpcss
svchost.exe          C:\WINDOWS\System32\svchost.exe -k LocalService
svchost.exe          C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe          C:\WINDOWS\System32\svchost.exe -k NetworkService
VPTray.exe           "C:\PROGRA~1\SYMANT~1\VPTray.exe"
wdfmgr.exe           C:\WINDOWS\system32\wdfmgr.exe
winlogon.exe         winlogon.exe
wmic.exe             wmic process
wmiprvse.exe         C:\WINDOWS\System32\wbem\wmiprvse.exe



C:\>wmic

wmic:root\cli>partition get name,bootable,size,type
Bootable  Name                   Size         Type
TRUE      Disk #0, Partition #0  4194860544   Installable File System
          Disk #0, Partition #1  9475522560   Extended Partition
TRUE      Disk #1, Partition #0  8389753344   Unknown
          Disk #1, Partition #1  11630545920  Unknown

More Examples

• wmic diskdrive get name,size,model

  Model                    Name                Size
  Hitachi HTS721080G9AT00  \\.\PHYSICALDRIVE0  80023749120
  
  

• wmic partition get name,size,type

  Name                   Size         Type
  Disk #0, Partition #0  65769984     Unknown
  Disk #0, Partition #1  79957946880  Installable File System
  
  

• wmic bios get name,serialnumber,version

  Name                                    SerialNumber  Version
  Phoenix ROM BIOS PLUS Version 1.10 A06  99L9891       DELL   - 27d50a02
  
  

  SerialNumber is the Dell Service Tag

• wmic csproduct get name,vendor,identifyingNumber

  IdentifyingNumber  Name           Vendor
  99L9891            Latitude D610  Dell Inc.
  
  

  yet another service tag report

• wmic qfe get description,installedOn /format:csv

  This produces a long list of Windows Patches and when they were installed

  PCPC3-D610,Security Update for Windows XP (KB929969),3/14/2007
  PCPC3-D610,Security Update for Windows XP (KB930178),4/11/2007
  PCPC3-D610,Update for Windows XP (KB930916),5/10/2007
  PCPC3-D610,Security Update for Windows XP (KB931261),4/11/2007
  PCPC3-D610,Security Update for Windows XP (KB931768),5/10/2007
  PCPC3-D610,Security Update for Windows XP (KB931784),4/11/2007
  PCPC3-D610,Update for Windows XP (KB931836),3/14/2007
  PCPC3-D610,Security Update for Windows XP (KB932168),4/11/2007
  PCPC3-D610,Update for Windows XP (KB933360),8/29/2007
  PCPC3-D610,Security Update for Windows XP (KB933566),6/18/2007
  PCPC3-D610,Security Update for Windows XP (KB935839),6/18/2007
  PCPC3-D610,Security Update for Windows XP (KB935840),6/18/2007
  PCPC3-D610,Security Update for Windows XP (KB936021),8/15/2007
  PCPC3-D610,Update for Windows XP (KB936357),7/12/2007
  PCPC3-D610,Security Update for Windows XP (KB937143),8/15/2007
  PCPC3-D610,Security Update for Windows XP (KB938127),8/15/2007
  PCPC3-D610,Update for Windows XP (KB938828),8/15/2007
  PCPC3-D610,Security Update for Windows XP (KB938829),8/15/2007
  PCPC3-D610,XML Paper Specification Shared Components Pack 1.0,
  
  

• wmic COMPUTERSYSTEM get TotalPhysicalMemory,caption

  Caption        TotalPhysicalMemory
  PCPC3-D610     1073074176
  
  

• wmic nic get macaddress,description

  Description                                       MACAddress
  Infrared Port
  Bluetooth Device (Personal Area Network)          00:xxxxxxxxxxx:19
  RAS Async Adapter
  WAN Miniport (L2TP)
  WAN Miniport (PPTP)                               50:xxxxxxxxxxx:30
  WAN Miniport (PPPOE)                              33:xxxxxxxxxxx:30
  Direct Parallel
  WAN Miniport (IP)
  Packet Scheduler Miniport                         8C:xxxxxxxxxxx:53
  Intel(R) PRO/Wireless 215ABG Network Connection
  Packet Scheduler Miniport
  Broadcom NetXtreme 57xx Gigabit Controller        00:xxxxxxxxxxx:C4
  Packet Scheduler Miniport                         00:xxxxxxxxxxx:C4