Site Navigation
Some of you may have encountered and interacted with the Windows Management Instrumentation [WMI] system, even though there has been scant documentation about its internal workings.
After a promising start, WMIC, like so many MS products has been deprecated. Initially [on the server side] in Server 2012. And some years later [on the workstation side] in W11 23H2. And yet it lives on [!!??].
If you are a SysAdmin or programmer and your domain has a Windows domain
controller, you can use WMIC to gather information about user accounts and the
OS from the domain controller [or exchange MTA if you are only using MS for
email]. Individual workstations in the domain can gather information with the
"net" command. For example if you wish to gather information regarding a user
account you could use this command to query the user account FOO on the domain
controller:
net user /domain foo
Assuming, of course that you use simple login names like "foo". If you have access to the domain controller, rather than using the "net" command, you could use WMIC to access the account information at a lower level and in much greater detail. For example, these are the data columns for the useraccount WMI table:
AccountType Caption Description Disabled Domain FullName InstallDate LocalAccount Lockout Name PasswordChangeable PasswordExpires PasswordRequired SID SIDType Status :: Example commands wmic useraccount get * /format:list wmic useraccount get Disabled, FullName, Name, SID
If you are planning to export this data to a non-Microsoft host, you may discover that the data is UTF-16. A simple way to remedy this is to use the "type" command on the Server before exporting the data.
So in the example above, you could use this
wmic useraccount get Disabled, FullName, Name, SID > useraccount.rpt type useraccount.rpt > useraccount.txt
The file useraccount.txt will contain 7-bit ASCII data, delimited with CR-LF pairs.
Even though WMIC has been officially deprecated it is still possible to obtain it as an "optional feature". However in the long term it looks as if it will be removed. The WMI system still remains, but Microsoft recommend querying the sub-system with Powershell. However, even though there are replacement powershell queries, these are not exactly identical, bolt-in replacements for any WMIC queries you may have crafted.
If you were trying to get a replacement for the above query, the recommended replacement uses the Get-LocalUser cmdlet. However there is no "Disabled" column. Instead there is an "Enabled" column which is the exact boolean reverse of its WMIC counterpart. Also it can be tricky getting the cmdlet to behave in a consistent manner. It takes a different approach to formatting and line wrapping the output. This seems to depend on the nature of the data stored on the DC. I found that I had to use the the -Autosize and -width options to prevent this:
So the power shell replacement ended up as follows:
Get-LocalUser | Select-Object Enabled, Name, FullName, SID | Format-Table -AutoSize | Out-String -Width 100
Don't forget to reverse the logic that interprets the "Enabled" data on the Linux host.
If power shell had been invented first, WMIC would seemed like a marvellous, simple and useful little utility.
For more information about the [now deprecated] WMIC utility and hints about CMD scripting and powershell, visit the https://ss64.com website [or google SS64]