How to Inventory Remote Computers Using PowerShell

Windows Management Instrumentation (WMI) is a management infrastructure built-in to Windows for querying management and operations data. It can be used to query local and remote computers for information like running processes, installed software, BIOS information, and much more using tools like Get-CimInstance.

WMI vs CIM

WMI is based on the Common Information Model (CIM), which is an open-source standard used to access and display information about IT systems.

PowerShell’s Get-WMIObject cmdlet lets you query local and remote computers. But Get-WMIObject is being deprecated. That’s because Microsoft introduced CIM based cmdlets in PowerShell v3.0. There are several different CIM cmdlets available in PowerShell:

• Get-CimSession
• New-CimSession
• Remove-CimSession
• Get-CimInstance
• New-CimInstance
• Remove-CimInstance
• Set-CimInstance

When using the CIM cmdlets to query remote devices, PowerShell uses WinRM, otherwise known as PowerShell remoting. WinRM uses a secure connection and Active Directory and Kerberos for authentication. So, in this article, I’m going to show you how to use Get-CimInstance to query remote devices so that you can gather inventory information.

Query a remote device using CIM

Before we start, it’s important to understand that Get-CimInstance relies on PowerShell remoting. PowerShell remoting is enabled by default in Windows Server. But if you want to query remote client versions of Windows, like Windows 10, you will need to enable PowerShell remoting on those devices before you can use Get-CimInstance.

A typical Get-CimInstance command in PowerShell looks something like this:

Get-CimInstance -Class Win32_Bios -ComputerName DC1

Image #1 Expand

Exploring CIM classes

The -ComputerName parameter specifies the name of the remote computer. In this case, I’m querying a computer named DC1. If you want to query the local device, just omit the -ComputerName parameter. The -Class parameter specifies the class that you want to query.

There are many classes that cover most aspects of the operating system and hardware. The easiest way to determine which class and property you need to query, to get the information you want, is using WMI Explorer. WMI Explorer is a free application that you can download from GitHub here.

Once downloaded, run WmiExplorer.exe. To the right of the Computer field below the File menu, click Connect. This will connect WMI Explorer to the local computer. If you want to explore the available classes on a remote device, enter the computer name in the Computer field and click Connect.

Image #2 Expand

Under Namespaces, double click ROOTCIMV2. This will display a list of available classes in the Classes tab to the right. In the Quick Filter field, you can search for a class. For example, you could look for BIOS information, as shown in #IMAGE2. Then double click each available class to display instances. Switching to the Properties tab will show all the available properties.

The information provided by WMI Explorer allows us to fine tune our PowerShell command to get more precise information. For example, the following command displays each running process name along with its kernel time from largest to smallest:

Get-CimInstance -Class Win32_Process -ComputerName DC1 | Select-Object -Property Name,KernelModeTime | Sort-Object KernelModeTime -Descending

Image #3 Expand

You can also query more than one remote device simultaneously by specifying additional devices, separated by commas, in the -ComputerName property:

Get-CimInstance -Class Win32_Process -ComputerName DC1,DC2,DC3

Networking configuration

Here are some more examples of information you might want to collect during an inventory. The following commands gather information, like IP address, from all network adapters on a device:

$properties = 'IPAddress', 'IPSubnet', 'DefaultIPGateway', 'MACAddress', 'DHCPEnabled', 'DHCPServer', 'DHCPLeaseObtained', 'DHCPLeaseExpires', 'Description'

Get-CimInstance -Class Win32_NetworkAdapterConfiguration -ComputerName DC1 | Select-Object -Property $properties

Windows Update

In the code below, we use the QuickFixEngineering class to get the Windows Update patches installed on a device. Adding the -Property parameter to Get-CimInstance runs the command more efficiently by pulling only the required properties across the network.

$properties = 'HotFixID', 'Description', 'InstalledOn'

Get-CimInstance -ClassName Win32_QuickFixEngineering -ComputerName DC1 -Property $properties | Select-Object -Property $properties | Sort-Object InstalledOn -Descending

Software

CIM only queries software on a device that was install using Windows Installer. So, that’s quite a big limitation. But nevertheless, here’s how to do it:

$properties = 'Name', 'Version', 'InstallDate'

Get-CimInstance -ClassName Win32_Product -ComputerName DC1 -Property $properties | Select-Object -Property $properties | Sort-Object Name

Image # Expand

WMI Explorer and PowerShell CIM cmdlets are a powerful combination

WMI Explorer and PowerShell CIM cmdlets together provide a powerful tool for organizations looking to query servers for information or perform hardware and configuration inventories. Inventories of client devices might be best served by another solution, like Microsoft Intune, if the devices aren’t connected to the same network as your management servers and PCs. That is because PowerShell remoting isn’t enabled by default in client SKUs and it works best when remote devices connect to the corporate network with a VPN that’s configured for ‘manage out’ scenarios.

FAQs

How do I troubleshoot authentication errors when using Get-Ciminstance remote computer commands?

To resolve authentication issues when using Get-Ciminstance remote computer, ensure proper credentials are configured, verify the remote computer’s firewall settings allow WinRM traffic, check if the account has necessary permissions, and confirm the remote computer’s network connectivity.

Can I use Get-Ciminstance remote computer to collect performance metrics in real-time?

Yes, Get-Ciminstance remote computer can monitor real-time performance metrics by querying specific performance counter classes and setting up continuous monitoring scripts with refresh intervals.

What’s the maximum number of simultaneous Get-Ciminstance remote computer connections supported?

The default limit for concurrent Get-Ciminstance remote computer connections is 100, but this can be modified through WinRM configuration settings to accommodate larger deployments.

Is it possible to schedule automated Get-Ciminstance remote computer inventory tasks?

Yes, Get-Ciminstance remote computer commands can be incorporated into scheduled tasks using Windows Task Scheduler or PowerShell jobs to automate regular inventory collection and reporting.

How do I optimize Get-Ciminstance remote computer queries for large networks?

To optimize Get-Ciminstance remote computer operations across large networks, use CIM sessions instead of individual queries, implement parallel processing, filter required properties at the source, and manage timeout settings appropriately.