WMIC Best practices
Updated: January 21, 2005
Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2
Use the WHERE () clause for specific instances to be returned for an alias.
The WHERE() clause must include the WHERE clause for a valid WQL query. The parentheses are only required for complex criteria. See the WMI SDK for WQL syntax. The WHERE() clause must immediately follows the alias name. For example:
process where (processID>300) list brief
When the WHERE clause is WHERE NAME='<value>', it is sufficient to give only the value. For example:
SERVICE WHERE NAME='CLIPSRV'
Use /OUTPUT, /APPEND, and /RECORD commands to redirect output.
Commands that output in HTML format (such as CLASS) typically have their output directed to a file. You can then view that file for results of the command. You can redirect the output can by using the /OUTPUT, /APPEND, and /RECORD commands.
Enclose values in quotation marks if the values contain special characters such as dashes, slashes, or spaces.
Use these methods of query for large domains or databases
WMIC ALIAS PROCESS LIST BRIEF
WMIC USERACCOUNT WHERE "Name='PutUserNameHere' and Domain='PutDomainNameHere'"
WMIC FSDIR WHERE Name='c:\\WINDOWS'
WMIC DATAFILE WHERE Name="c:\\boot.ini" WMIC DATAFILE WHERE "PATH='\\windows\\' and Extension='exe' and FileSize>'108032'" GET LastAccessed, LastModified, Name, FileSize
WMIC NTEVENT WHERE "LogFile='system' and Type>'0'" GET Message, TimeGenerated WMIC NTEVENT WHERE "LogFile='system' and Type>'0'" GET Message, TimeGenerated /FORMAT:htable >c:\MySystemEvents.htm
Use quotes "" to separate WHERE expressions instead of parentheses () :
WMIC NTEVENT WHERE "LogFile='system' and Type>'4'"
WMIC NTEVENT WHERE (LogFile='system' and TYPE>4)
For information about validation of users in WMI, see Managing WMI Security.
For information about WMIC security, authentication, and authorization, see Security with WMIC.
For more information, see Windows Management Instrumentation Command-line.