Get-CimInstance is a PowerShell cmdlet that retrieves CIM instances of a class from a CIM server, supporting local and remote queries via DCOM or WinRM.
Get-CimInstance -ClassName Win32_OperatingSystem | Format-ListSyntax
Get-CimInstance
[-ClassName] <String>
[[-ComputerName] <String[]>]
[-Namespace <String>]
[-Filter <String>]
[-KeyOnly]
[-Property <String[]>]
[-OperationTimeoutSec <UInt32>]
[<CommonParameters>]
Get-CimInstance
-CimSession <CimSession[]>
[-ClassName] <String>
[-Namespace <String>]
[-Filter <String>]
[-KeyOnly]
[-Property <String[]>]
[-OperationTimeoutSec <UInt32>]
[<CommonParameters>]
Get-CimInstance
-ResourceUri <Uri>
[[-ComputerName] <String[]>]
[-Namespace <String>]
[-KeyOnly]
[<CommonParameters>]
Get-CimInstance
-Query <String>
[[-ComputerName] <String[]>]
[-Namespace <String>]
[-KeyOnly]
[<CommonParameters>]
Get-CimInstance
-InputObject <CimInstance>
[[-ComputerName] <String[]>]
[-Namespace <String>]
[-KeyOnly]
[<CommonParameters>]Tested on Windows Server 2022 / Windows 11 with PowerShell 7.4 and WMI service running.
Options and Flags
| Flag | Type | Default | Description |
|---|---|---|---|
-ClassName |
String | None | Specifies the name of the CIM class to retrieve instances for (e.g., Win32_Process). |
-ComputerName |
String[] | localhost | Specifies remote computers to query. Uses WMI/CIM protocol over DCOM or WinRM. |
-Namespace |
String | root/cimv2 | Specifies the CIM namespace (e.g., root/SecurityCenter2). |
-Query |
String | None | WQL query string to filter results (e.g., SELECT * FROM Win32_Service WHERE State = 'Running'). |
-Filter |
String | None | Server-side filter expression without full WQL (e.g., Name LIKE '%sql%'). |
-KeyOnly |
Switch | False | Returns only instances with key properties populated; reduces data transfer. |
-CimSession |
CimSession[] | None | One or more CIM session objects created by New-CimSession for persistent connections. |
-ResourceUri |
Uri | None | Specifies a WS-Management resource URI for non-WMI CIM servers. |
-Property |
String[] | All | Limits returned properties to those named; reduces network payload. |
-OperationTimeoutSec |
UInt32 | 0 (no timeout) | Maximum wait time in seconds for a response from the CIM server. |
Usage Examples
Example 1: Get operating system information from the local machine
Get-CimInstance -ClassName Win32_OperatingSystem | Format-ListReturns properties like Version, BuildNumber, SystemDirectory, and RegisteredUser. No authentication is needed for local queries.
Example 2: Query running services from a remote computer
Get-CimInstance -ClassName Win32_Service -ComputerName "SRV-DB01" -Filter "State = 'Running'"Uses DCOM or WinRM to connect to SRV-DB01. The remote system must allow remote WMI access (firewall rules, proper DCOM permissions). Returns only services currently running.
Example 3: Reuse a CIM session for multiple queries
$session = New-CimSession -ComputerName "SRV-APP01"
Get-CimInstance -CimSession $session -ClassName Win32_Process -Property Name, KernelModeTime
$session | Get-CimInstance -ClassName Win32_Service -Filter "StartMode = 'Auto'"
Remove-CimSession $sessionCreates a persistent CIM session, reducing authentication overhead. The -Property flag limits returned data to Name and KernelModeTime. The same session can query multiple classes. Always clean up sessions with Remove-CimSession.
Example 4: Use KeyOnly to retrieve minimal instance data
Get-CimInstance -ClassName Win32_Process -KeyOnlyReturns only the key properties (Handle for processes). Useful when you need to enumerate instances for later operations (e.g., passing to Invoke-CimMethod). Reduces network traffic significantly on remote queries.
Example 5: WQL query with a filter
Get-CimInstance -Query "SELECT * FROM Win32_LogicalDisk WHERE DriveType = 3" -ComputerName "SRV-FS02"Uses WQL to select only local fixed disks (DriveType=3) from a remote file server. The -Query parameter cannot be combined with -ClassName or -Filter.
Troubleshooting & Common Errors
| Error Message / Code | Root Cause | Resolution Command |
|---|---|---|
| “Provider load failure” with category NotSpecified | WMI provider failed to load; often due to missing or corrupted provider DLL | winmgmt /verifyrepository or winmgmt /salvagerepository as Admin; check Application event log |
| “Access denied” (0x80041003) | User lacks DCOM permissions or WMI namespace access | Run wmimgmt.msc → WMI Control → Security → edit namespace permissions; or use -Credential with proper admin account |
| “Invalid class” (0x80041010) | Class name misspelled or not present in namespace | Get-CimClass -Namespace root/cimv2 -ClassName *print* to find correct class |
| “RPC server is unavailable” (0x800706BA) | Remote computer offline, firewall blocking port 135 or 5985/5986 | Test-Connection -ComputerName target; check firewall rules; enable WinRM: Enable-PSRemoting -Force |
| Slow response or timeout | Large result set or slow network | Add -Property with only needed fields; use -KeyOnly; set -OperationTimeoutSec 30 |
Frequently Asked Questions
What is the difference between Get-CimInstance -ClassName and -Query?
Answer: -ClassName retrieves all instances of a single CIM class; -Query executes a WQL query for filtered results.
Both return CIM instances, but -ClassName is simpler for entire class enumeration (e.g., Get-CimInstance -ClassName Win32_Process). -Query allows complex filtering, joins, and property selection via WQL. Example:
Get-CimInstance -Query "SELECT * FROM Win32_Process WHERE Name LIKE 'powershell%'"When should I use the -Filter parameter with Get-CimInstance?
Answer: Use -Filter to apply server-side filtering on CIM properties without writing a full WQL query.
The -Filter parameter accepts a hash table or string with property comparisons. It is faster than client-side Where-Object for large result sets. Syntax:
Get-CimInstance -ClassName Win32_Service -Filter "State = 'Running'"How do I fix “Access denied” (HRESULT 0x80070005) when running Get-CimInstance?
Answer: Run PowerShell as Administrator or configure DCOM/CIM permissions on the target machine.
This error occurs when the user lacks WMI/CIM access. For local machine, use an elevated session. For remote, ensure the account is in the target’s “Distributed COM Users” group. Use proper credentials with -Credential:
Get-CimInstance -ClassName Win32_ComputerSystem -ComputerName SRV01 -Credential (Get-Credential)Does Get-CimInstance work on Linux or only Windows?
Answer: Get-CimInstance is a Windows-only cmdlet.
PowerShell Core includes Get-CimInstance only on Windows. For cross-platform CIM access, use Invoke-WSManAction or install the PSWSMan module on Linux. Example alternative on Linux:
Invoke-WSManAction -ResourceURI wmicimv2/Win32_ComputerSystem -Action Get -ComputerName remote_hostWhat is the fastest way to retrieve all CIM instances of a class with minimal overhead?
Answer: Use Get-CimInstance -ClassName explicitly (no -Query) and pipe directly to Select-Object for needed properties.
Avoid unnecessary WQL parsing and property retrieval. Specify only required properties using -Property to reduce network and memory usage. Example:
Get-CimInstance -ClassName Win32_LogicalDisk -Property DeviceID, Size, FreeSpace
Command Line Expert & Software Engineer
Welcome! I’m Thomas Heinrich, a software engineer and system administrator with a deep passion for the Command Line Interface (CLI). With years of experience navigating the terminal, building backend architectures, and automating server deployments, I created this space to share practical, real-world terminal knowledge.
Whether you are a beginner taking your first steps in a Linux environment or a seasoned DevOps engineer looking to optimize your deployment scripts, you will find actionable solutions here. My goal is to help you ditch the mouse, speed up your workflow, and harness the full power of the command line.