One of my colleague provided the following screenshot
and asked where he could have found that “ChangeStartMode” method.
Get-CimInstance -Class CIM_Service -Filter "Name='w32time'"| Get-Member -MemberType Methods
Notice that he asked for instances from the CIM_Service class and got an Win32_Service instance back.
You may wonder why.
- What’s the difference between CIM_Service and Win32_Service class ?
Win32_service is actually a subclass of the CIM_Service class.
CIM_ based classes are “schema” classes in WMI while Win32_ classes inherit from them (source)
- How could you find that information using PowerShell?
([wmiclass]"CIM_Service").GetSubclasses() | Select Name,Methods | ft -AutoSize
There’s a child class named Win32_BaseService that inherits from the CIM_Service schema class.
If I get the subclasses from it, I can finally see the Win32_Service class.
([wmiclass]"Win32_BaseService").GetSubclasses() | Select Name,Methods | ft -AutoSize
If I want to see the methods, I should simply get them from the Win32_Service class.
In this case, you use Get-CIMClass cmdlet instead of the Get-CIMInstance cmdlet.
Get-CimClass -ClassName Win32_Service | Select -Expand CimClassMethods | ft
Bonus: If you want to see the MOF defintion of a WMI class, you can do:
([wmiclass]'Win32_Service').gettext('mof') -replace '\;',"`r"
>_ 