WMI client (WMIC) for Linux

, by
Simon Krenger

One excellent tool for Systems Management on Windows is the Windows Management Instrumentation (WMI), which allows you to remotely execute commands and query parameters on a Windows Host. Of course, all modern Windows systems have the WMI Client installed, but what about the Linux clients?

To get the same functionality on a Linux system (I am using Debian in this example), we need to get the following two packages from this website:

  • libwmiclient1_1.3.14-3_amd64.deb
  • wmi-client_1.3.14-3_amd64.deb

Make sure you get the correct packages for your architecture and Linux distribution. Then install these two packages like so:

root@qcore:~# dpkg -i libwmiclient1_1.3.14-3_amd64.deb
root@qcore:~# dpkg -i wmi-client_1.3.14-3_amd64.deb

Now we are ready to go. The following example shows how to get the size of the WorkingSet of the process “java.exe” running on the remote host 192.168.20.20:

wmic -U Administrator%mysecret //192.168.20.20 "Select WorkingSetSize from Win32_Process Where CommandLine like '%java.exe%'"

Update: I added a set of examples here.

I really like the SQL-like syntax (they call it WQL) and the fact that you can query virtually any parameter of a Windows host. In the future, I might create another post with my Nagios scripts that use WMI for monitoring. For other examples and the documentation of WMI, refer to the corresponding Microsoft TechNet site.

[…] on Linux examples June 18 2012, by Simon Krenger In a previous post I showed how to install the Windows Management Instrumentation (WMI) client for Linux. In this […]

Roshan (July 26, 2012):

Can we use wmic command to fetch logs from devices with IPv6 addresses ??

Simon Krenger (July 26, 2012):

I think that is possible, however I have never tried that. As an alternative, try to use the FQDN of the host.

[…] need to create one, from a Windows command prompt (or if you’ve installed wmic for Linux via ​http://www.krenger.ch/blog/wmi-commands-from-linux/ ) – this _IS_ an interactive command so this won’t work very nicely in a Meterpreter […]

[…] to create one, from a Windows command prompt (or if you’ve installed wmic for Linux via http://www.krenger.ch/blog/wmi-commands-from-linux/ ) – this _IS_ an interactive command so this won’t work very nicely in a […]

[…] need to create one, from a Windows command prompt (or if you’ve installed wmic for Linux via http://www.krenger.ch/blog/wmi-commands-from-linux/ ) – this _IS_ an interactive command so this won’t work very nicely in a Meterpreter […]

vijay (January 4, 2014):

Sir,

I am using Ubuntu 13.10 x64…When i tried to install these packages ..i got the following error…..

dpkg -i wmi-client_1.3.14-3_amd64.deb
(Reading database ... 249402 files and directories currently installed.)
Unpacking wmi-client (from wmi-client_1.3.14-3_amd64.deb) ...
dpkg-deb (subprocess): cannot copy archive member from 'wmi-client_1.3.14-3_amd64.deb' to decompressor pipe: unexpected end of file or stream
dpkg-deb: error: subprocess paste returned error exit status 2
dpkg: error processing wmi-client_1.3.14-3_amd64.deb (--install):
 cannot copy extracted data for './usr/share/pyshared/libasync_wmi_lib.so.0.0.1' to '/usr/share/pyshared/libasync_wmi_lib.so.0.0.1.dpkg-new': unexpected end of file or stream
Errors were encountered while processing:
 wmi-client_1.3.14-3_amd64.deb

…Please Help how can i install WMI on ubuntu 13.10….

Simon Krenger (January 4, 2014):

Hello Vijay,
It seems that your .deb file is damaged. Retry by downloading the package again and check if the file size is correct!

Mike Spinzer (May 1, 2014):

Hello Simon,

I tried wmic to query a Windows 2k3 and it works just fine, thanks for the post!
I’m actually using it to remotely retrieve the Windows events and have couple of questions about that:
– is there any way to limit the number of events returned by a query? It seems the tool doesn’t have such option and I couldn’t find any equivalent of “LIMIT [num]” in the WMI syntax
– does wmic work in synchronous or semi-synchronous mode? Is there any way to force the semi-synchronous mode if it’s not the default behavior? Indeed retrieving a huge amount of events might consume a lot of memory if everything has to be mapped in memory.
– I read that wmic does not work to query a Windows 2k8 server. I unfortunately don’t have a license to test that. Do you by any chance know if that’s the case? Have a look on the post of “Davileh” on the following page: http://aliensanti.blogspot.com/

Thanks a lot for the help!

Mike

Simon Krenger (May 7, 2014):

Hello Mike,

* The WQL syntax does not have a LIMIT clause, so you’ll have to work with the WHERE clause to limit the result set.
* As far as I know, I believe WMIC only works in synchronous mode.
* I think WMIC should work even with Windows 2008 Server. Maybe you have to enable the WMIC service on the server!

All the best, Simon

Post a comment

Please enter a name, an e-mail address and your comment (all fields are required).
Your e-mail address will never be published or made available to any third party, I promise.