Associations

A common and popular example is of the classes which deal with network adapter:

PS C:\Windows\system32> Get-WmiObject -Class *win32_networkadapter* -List

We can use associators of to extract information from all the above classes:

The __RELPATH property in an instance can be used as a key to list relationship:

PS C:\Windows\system32> Get-WmiObject -Class win32_networkadapter | f1 *

Now associators can be used to get all instances from all the associated class:

PS C:\Windows\system32> Get-WmiObject -Query “Associators of {win32_networkadapter.DeviceID=11}”

PS C:\Windows\system32> Get-CimAssociatedInstance -InputObject (Get-CimInstance -ClassName win32_networkadapter -filter ‘deviceid=11’)

Make sure to use a property inside the curly braces above (with get-wmiobject).without specifying a property we will not get instances of associated classes.

PS C:\Windows\system32> Get-WmiObject -class win32_networkadapter -filter ‘DeviceId=11’

To have a look only at the class definitions of the associated classes and not instances:

PS C:\Windows\system32> Get-WmiObject -query “associators of {win32_networkadapter.deviceid=11} where classdefsonly”

PS C:\Windows\system32> Get-WmiObject -Class win32_computersystem

PS C:\Windows\system32> Get-WmiObject -class win32_networkadapterconfiguration

To retrieve instance of a single associated class:

PS C:\Windows\system32> Get-WmiObject -query “associators of {win32_networkadapter.deviceid=11} where assocclass=win32_protocolbinding”

PS C:\Windows\system32> Get-CimAssociatedInstance -InputObject (Get-CimInstance -ClassName win32_networkadapter -filter ‘deviceid=11’) -association win32_protocolbinding

To restrict instances of a particular associated class:

PS C:\Windows\system32> Get-WmiObject -query “associators of {win32_networkadapter.deviceid=11} where resultclass=win32_networkadapterconfiguration”

PS C:\Windows\system32> Get-CimAssociatedInstance -InputObject (Get-CimInstance -ClassName Win32_NetworkAdapter -filter ‘deviceid=11’) -ResultClassName Win32_NetworkAdapterConfiguration

PS C:\Windows\system32> Get-WmiObject -query “references of {win32_networkadapter.deviceid=11} where classdefsonly”

PS C:\Windows\system32> Get-WmiObject -query “associators of {win32_networkadapter.deviceid=11} where classdefsonly”

PS C:\Windows\system32> Get-WmiObject -query “associators of {win32_networkadapter.deviceid=11}”

PS C:\Windows\system32> Get-WmiObject -query “references of {win32_networkadapter.deviceid=11}”

PS C:\Windows\system32> Get-WmiObject -query “associators of {win32_networkadapter.deviceid=11} where classdefsonly”

For interactive wmic session:

Wmic

To list help from an interactive session:

wmic:root\cli>/?

To list help about a particular namespace:

wmic:root\cli>process /?

For non-interactive use:

wmic:root\cli>process get

wmic:root\cli>process group where name=’administrators’ assoc

wmic:root\cli>process where name=’cmd.exe’ call getowner wmic:root\cli>process where name=’explorer.exe’ call getowner

wmic:root\cli>process get name

wmic:root\cli>process list

WMIC Saving output:

To save output to html:

C:\Windows\System32\wbem\en-US>wmic /output:c:\WMI\proc.htm process list /format:hform.xsl

https://jdhitsolutions.com/blog/powershell/2848/wmi-explorer-from-the-powershell-guy/

C:\Users\victim6\Downloads>wbemtest.exe

Click on open class

Win32_process -> click ok

@Saksham Dixit