0

I'm writing a simple WMI query in the powershell ISE. I want to get just two fields, but I get more

Get-WmiObject -Query "select DisplayName, State from Win32_Service"

And what I get is a list of results, each has the next fields,

__GENUS          : 2
__CLASS          : Win32_Service
__SUPERCLASS     : 
__DYNASTY        : 
__RELPATH        : 
__PROPERTY_COUNT : 2
__DERIVATION     : {}
__SERVER         : 
__NAMESPACE      : 
__PATH           : 
DisplayName      : Windows Font Cache Service
State            : Running

I noticed that the fields all start with a double underscore, not sure if it means anything. I know I can get a better result with

Get-WmiObject -Class Win32_Service | Select-Object DisplayName, State

However, I would like to add a where clause to this query, so I'm trying to use the -Query option.

Ansgar Wiechers
  • 193,178
  • 25
  • 254
  • 328
tamir
  • 81
  • 2
  • 9
  • 1
    You can still use a WHERE clause: `get-wmiobject -query "select DisplayName, State from Win32_service WHERE ..." | select-object DisplayName, State` – Tomalak May 02 '19 at 12:20
  • Or you can use where-object, for example `get-wmiobject -class win32_service | where-object -Property State -EQ -Value "Stopped" | select-object DisplayName, State`. – Andrew Morton May 02 '19 at 12:22
  • 1
    This is part of `Get-WmiObject`'s format file that dictates how objects from that cmdlet get printed to the console. You would either have to manually edit that, or the easy way is to just use the `Select-Object` cmdlet. – Maximilian Burszley May 02 '19 at 12:24

2 Answers2

3

These fields are part of the internal WMI metadata. You can't stop the legacy WMI cmdlets from returning them, but you can obviously use Select-Object to create a copy without them, or Format-Table, etc to display only what you want to see.

In any case, the 'CIM' cmdlets are the preferred option now. So in your case, you should use this command instead:

Get-CimInstance -Query "select DisplayName, State from Win32_Service"

Get more information here:

Get-CimInstance

boxdog
  • 7,894
  • 2
  • 18
  • 27
1

I've read that using the linq like .where() method is much faster than using Where-Object. This works for me. Not sure what else you're looking for.

  (Get-WmiObject -Query "select DisplayName, State from Win32_Service").Where( {$_.State -eq 'Stopped'}) | select Displayname, State

Or You will need to use a WMI based query to filter first.

Get-WmiObject -Query "select DisplayName, State from Win32_Service where State ='Stopped'" | select Displayname, State
RoscoeT
  • 87
  • 8
  • `.Where()` isn't a LINQ method (these aren't available as _extension_ methods in PowerShell), it is the [intrinsic `.Where()` method](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_Arrays#where), and it is definitely slower than filtering at the source with `-Query`. However, judging by what answer was accepted, the OP's intent wasn't to filter _what objects_ should be returned, but _what properties_ should be returned from each result object. – mklement0 Jul 24 '23 at 22:09