WMI subclasses

One of my colleague provided the following screenshot

and asked where he could have found that “ChangeStartMode” method.

Get-CimInstance -Class CIM_Service -Filter "Name='w32time'"|
Get-Member -MemberType Methods

Notice that he asked for instances from the CIM_Service class and got an Win32_Service instance back.
You may wonder why.

  • What’s the difference between CIM_Service and Win32_Service class ?

Win32_service is actually a subclass of the CIM_Service class.
CIM_ based classes are “schema” classes in WMI while Win32_ classes inherit from them (source)

  • How could you find that information using PowerShell?
([wmiclass]"CIM_Service").GetSubclasses() | 
Select Name,Methods | 
ft -AutoSize

There’s a child class named Win32_BaseService that inherits from the CIM_Service schema class.

If I get the subclasses from it, I can finally see the Win32_Service class.

([wmiclass]"Win32_BaseService").GetSubclasses() | 
Select Name,Methods | 
ft -AutoSize

If I want to see the methods, I should simply get them from the Win32_Service class.
In this case, you use Get-CIMClass cmdlet instead of the Get-CIMInstance cmdlet.

Get-CimClass -ClassName Win32_Service | 
Select -Expand CimClassMethods | ft

Bonus: If you want to see the MOF defintion of a WMI class, you can do:

([wmiclass]'Win32_Service').gettext('mof') -replace '\;',"`r"

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.