Richard Siddaway's Blog

The Win32_ComputerOperatingSystem class can provide a good deal of information about the OS installed on your machines. These examples are converted from those presented here: http://msdn.microsoft.com/en-us/library/aa394596%28v=vs.85%29.aspx

# ServicePack version
Get-CimInstance -ClassName Win32_OperatingSystem |
select ServicePackMajorVersion, ServicePackMinorVersion

# install date of OS
Get-CimInstance -ClassName Win32_OperatingSystem |
select Installdate

# Windows version
Get-CimInstance -ClassName Win32_OperatingSystem |
select Caption, Version

# windows folder
Get-CimInstance -ClassName Win32_OperatingSystem |
select WindowsDirectory

# all
Get-CimInstance -ClassName Win32_OperatingSystem |
select Caption, Version, ServicePackMajorVersion,
ServicePackMinorVersion, Installdate, WindowsDirectory

You could create a function:

function get-OS {
[CmdletBinding()]
param(
[string]$computername = $env:COMPUTERNAME
)

Get-CimInstance -ClassName Win32_OperatingSystem  -ComputerName $computername|
select Caption, Version, ServicePackMajorVersion,
ServicePackMinorVersion, Installdate, WindowsDirectory

}

and then choose properties if required:

£> get-OS | Format-Table Caption, Installdate

Caption                                    Installdate                              
-------                                    -----------                              
Microsoft Windows 8.1 Pro                  05/12/2013 10:16:49                      

£> get-OS

Caption                 : Microsoft Windows 8.1 Pro
Version                 : 6.3.9600
ServicePackMajorVersion : 0
ServicePackMinorVersion : 0
Installdate             : 05/12/2013 10:16:49
WindowsDirectory        : C:\windows

£> get-OS | Format-Table Caption, Service* -AutoSize

Caption                   ServicePackMajorVersion ServicePackMinorVersion
-------                   ----------------------- -----------------------
Microsoft Windows 8.1 Pro                       0                       0

£> get-OS | Format-Table Caption, Installdate -AutoSize

Caption                   Installdate       
-------                   -----------       
Microsoft Windows 8.1 Pro 05/12/2013 10:16:49

You can see the running processes on a local or remote machine using Get-Process. Alternatively you can use Win32_Process:

Get-CimInstance -ClassName Win32_Process |
select Name, ProcessID, Threadcount, PageFileUsage, PageFaults, WorkingSetSize |
Format-Table –AutoSize

You can use the –ComputerName or –CimSession properties to access the processes on a remote machine.

Other properties are available:

Get-CimClass -ClassName Win32_Process |
select -ExpandProperty CimClassProperties |
Format-Table -AutoSize

To see the command lines that have been used when processes are started is simple one liner:

Get-CimInstance -ClassName Win32_Process | select Name, CommandLine

If you want to investigate specific processes use the –Filter parameter to restrict the processes

This one is interesting as I’d tried doing this a while back and failed.  Starting a process with Win32_Process is straightforward but controlling the process – such as starting in a hidden window wasn’t working. This is how you do it:

function start-hiddenproc {
[CmdletBinding()]
param (
[string]$processname = 'notepad.exe'
)

$startclass = Get-CimClass -ClassName Win32_ProcessStartup
$startinfo = New-CimInstance -CimClass $startclass -Property @{ShowWindow = 0} -ClientOnly

$class = Get-CimClass -ClassName Win32_Process
Invoke-CimMethod -CimClass $class -MethodName Create -Arguments @{Commandline = $processname; ProcessStartupInformation = [CimInstance]$startinfo}
}

The function takes a path to the process executable as a parameter – would be a good place for a validation script parameter to test the path to the executable.

Get the Win32_ProcessStartup class and use it with New-CimInstance to create the start up information. The New-CimInstance parameter –ClientOnly can be aliased to –Local.  I always prefer to use the master parameter name rather than aliases – makes it easier for people to look things up in the documentation.

Get the Win32_Process class and use it with Invoke-CimMethod to invoke the Create method with the arguments passed as shown