WMI client (WMIC) for Linux

, by
Simon Krenger

One excellent tool for Systems Management on Windows is the Windows Management Instrumentation (WMI), which allows you to remotely execute commands and query parameters on a Windows Host. Of course, all modern Windows systems have the WMI Client installed, but what about the Linux clients?

To get the same functionality on a Linux system (I am using Debian in this example), we need to get the following two packages from this website:

  • libwmiclient1_1.3.14-3_amd64.deb
  • wmi-client_1.3.14-3_amd64.deb

Make sure you get the correct packages for your architecture and Linux distribution. Then install these two packages like so:

root@qcore:~# dpkg -i libwmiclient1_1.3.14-3_amd64.deb
root@qcore:~# dpkg -i wmi-client_1.3.14-3_amd64.deb

Now we are ready to go. The following example shows how to get the size of the WorkingSet of the process “java.exe” running on the remote host 192.168.20.20:

wmic -U Administrator%mysecret //192.168.20.20 "Select WorkingSetSize from Win32_Process Where CommandLine like '%java.exe%'"

Update: I added a set of examples here.

I really like the SQL-like syntax (they call it WQL) and the fact that you can query virtually any parameter of a Windows host. In the future, I might create another post with my Nagios scripts that use WMI for monitoring. For other examples and the documentation of WMI, refer to the corresponding Microsoft TechNet site.

[…] on Linux examples June 18 2012, by Simon Krenger In a previous post I showed how to install the Windows Management Instrumentation (WMI) client for Linux. In this […]

Roshan (July 26, 2012):

Can we use wmic command to fetch logs from devices with IPv6 addresses ??

Simon Krenger (July 26, 2012):

I think that is possible, however I have never tried that. As an alternative, try to use the FQDN of the host.

[…] need to create one, from a Windows command prompt (or if you’ve installed wmic for Linux via ​http://www.krenger.ch/blog/wmi-commands-from-linux/ ) – this _IS_ an interactive command so this won’t work very nicely in a Meterpreter […]

[…] to create one, from a Windows command prompt (or if you’ve installed wmic for Linux via http://www.krenger.ch/blog/wmi-commands-from-linux/ ) – this _IS_ an interactive command so this won’t work very nicely in a […]

[…] need to create one, from a Windows command prompt (or if you’ve installed wmic for Linux via http://www.krenger.ch/blog/wmi-commands-from-linux/ ) – this _IS_ an interactive command so this won’t work very nicely in a Meterpreter […]

vijay (January 4, 2014):

Sir,

I am using Ubuntu 13.10 x64…When i tried to install these packages ..i got the following error…..

dpkg -i wmi-client_1.3.14-3_amd64.deb
(Reading database ... 249402 files and directories currently installed.)
Unpacking wmi-client (from wmi-client_1.3.14-3_amd64.deb) ...
dpkg-deb (subprocess): cannot copy archive member from 'wmi-client_1.3.14-3_amd64.deb' to decompressor pipe: unexpected end of file or stream
dpkg-deb: error: subprocess paste returned error exit status 2
dpkg: error processing wmi-client_1.3.14-3_amd64.deb (--install):
 cannot copy extracted data for './usr/share/pyshared/libasync_wmi_lib.so.0.0.1' to '/usr/share/pyshared/libasync_wmi_lib.so.0.0.1.dpkg-new': unexpected end of file or stream
Errors were encountered while processing:
 wmi-client_1.3.14-3_amd64.deb

…Please Help how can i install WMI on ubuntu 13.10….

Simon Krenger (January 4, 2014):

Hello Vijay,
It seems that your .deb file is damaged. Retry by downloading the package again and check if the file size is correct!

Mike Spinzer (May 1, 2014):

Hello Simon,

I tried wmic to query a Windows 2k3 and it works just fine, thanks for the post!
I’m actually using it to remotely retrieve the Windows events and have couple of questions about that:
– is there any way to limit the number of events returned by a query? It seems the tool doesn’t have such option and I couldn’t find any equivalent of “LIMIT [num]” in the WMI syntax
– does wmic work in synchronous or semi-synchronous mode? Is there any way to force the semi-synchronous mode if it’s not the default behavior? Indeed retrieving a huge amount of events might consume a lot of memory if everything has to be mapped in memory.
– I read that wmic does not work to query a Windows 2k8 server. I unfortunately don’t have a license to test that. Do you by any chance know if that’s the case? Have a look on the post of “Davileh” on the following page: http://aliensanti.blogspot.com/

Thanks a lot for the help!

Mike

Simon Krenger (May 7, 2014):

Hello Mike,

* The WQL syntax does not have a LIMIT clause, so you’ll have to work with the WHERE clause to limit the result set.
* As far as I know, I believe WMIC only works in synchronous mode.
* I think WMIC should work even with Windows 2008 Server. Maybe you have to enable the WMIC service on the server!

All the best, Simon

Konstantin (December 25, 2014):

Hello.
What the format of file for credentials (for –authentication-file param)?

Ernesto Cullen (January 12, 2015):

I get errors when using backslashes in WQL, like in
select FileName from CIM_DataFile where Name=’c:\\boot.ini’

I get the generic error NT code 0x80041017

this query works ok in wbemtest (on windows). Have tested several variations and different classes, as soon as a backslash is included in the query it fails.
Any advice on this?

thanks

Ernesto Cullen

Ernesto Cullen (January 13, 2015):

solved! have to double escape backslashes, so the query gets

select FileName from CIM_DataFile where Name=’c:\\\\boot.ini’

Now it works like a charm :)

vaibhav (February 16, 2015):

Hello Everyone,

I want to develop an application on linux system which is based on system hardware.Can you tell me how can interact with system hardware using java.I want to make an application just like WiFi On/Off and etc.Is there any API for interaction.

Thanks

Post a comment

Please enter a name, an e-mail address and your comment (all fields are required).
Your e-mail address will never be published or made available to any third party, I promise.