wmi

WMI “installed” query different from add/remove programs list?

by

I believe your syntax is using the Win32_Product Class in WMI. One cause is that this class only displays products installed using Windows Installer (See Here). The Uninstall Registry Key is your best bet. HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall UPDATE FOR COMMENTS: The Uninstall Registry Key is the standard place to list what is installed and what isn’t … Read more

Getting the Username from the HKEY_USERS values

by

If you look at either of the following keys: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\hivelist You can find a list of the SIDs there with various values, including where their “home paths” which includes their usernames. I’m not sure how dependable this is and I wouldn’t recommend messing about with this unless you’re really sure what you’re doing.

How can I get the CPU temperature?

by

For others who may come by here, maybe take a look at : http://openhardwaremonitor.org/ Follow that link and at first you might think, “Hey, that’s an application, and that is why it was removed. The question was how to do this from C# code, not to find an application that can tell me the temperature…” … Read more

Detecting USB drive insertion and removal using windows service and c#

by

You can use WMI, it is easy and it works a lot better than WndProc solution with services. Here is a simple example: using System.Management; ManagementEventWatcher watcher = new ManagementEventWatcher(); WqlEventQuery query = new WqlEventQuery(“SELECT * FROM Win32_VolumeChangeEvent WHERE EventType = 2”); watcher.EventArrived += new EventArrivedEventHandler(watcher_EventArrived); watcher.Query = query; watcher.Start(); watcher.WaitForNextEvent();

Creating a shadow copy using the “Backup” context in a PowerShell

by

Okay, Technoob1984 here with the scoop. See my attached screen shot. This one is tricky, because you have to use x64 version of Powershell (located under system32 not wow64) The Shadow Copy Context are the .properties of the object. Also I used the static method in my screenshots below. https://learn.microsoft.com/en-us/previous-versions/windows/desktop/vsswmi/create-method-in-class-win32-shadowcopy # get existing shadow copies … Read more

Common WQL Monitoring Queries

by

This is a truly great question, and it’s a shame it has not gotten more love! My basic theory of bottleneck analysis is to treat the system as a box with 4 sorts of finite resources: processor, memory, disk, and network. So I want to get basic numbers for each of these to determine the … Read more

Generating a unique machine id

by

I had the same problem and after a little research I decided the best would be to read MachineGuid in registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography, as @Agnus suggested. It is generated during OS installation and won’t change unless you make another fresh OS install. Depending on the OS version it may contain the network adapter MAC address … Read more

How to list all properties of a PowerShell WMI object

by

Try this: Get-WmiObject -Class “Win32_computersystem” | Format-List * Get-WmiObject -Class “Win32_computersystem” | Format-List -Property * For certain objects, PowerShell provides a set of formatting instructions that can affect either the table or list formats. These are usually meant to limit the display of reams of properties down to just the essential properties. However there are … Read more