WMIC Command Guide - Windows Management Instrumentation for System Administration

The wmic command (Windows Management Instrumentation Command-line) is a powerful Windows utility that queries and manages system information, hardware, software, processes, and services through the Windows Management Instrumentation (WMI) infrastructure. Use wmic to retrieve system details, uninstall software, manage processes, and automate administrative tasks—all from the command line.

Whether you're gathering hardware inventory across enterprise networks, remotely uninstalling software, querying BIOS information for asset management, or automating system audits, wmic provides command-line access to virtually every manageable component in Windows. IT professionals rely on wmic for remote administration, scripting system diagnostics, and extracting detailed hardware and software information that GUI tools cannot easily access.

This comprehensive guide covers wmic syntax, essential aliases (process, product, bios, cpu, diskdrive), practical examples for common administrative tasks, troubleshooting tips, PowerShell alternatives (since wmic is deprecated in modern Windows), and frequently asked questions. By the end, you'll confidently use wmic for system administration, inventory management, and automation scripting.

What Is the WMIC Command?

WMIC (Windows Management Instrumentation Command-line) provides command-line access to WMI, Microsoft's implementation of Web-Based Enterprise Management (WBEM) and the Common Information Model (CIM) standards. WMI is the underlying infrastructure that allows administrators and scripts to query and configure Windows systems locally and remotely.

Introduced in Windows XP and Windows Server 2003, wmic offers over 80 aliases (shortcuts) for common WMI classes, covering:

• Hardware information – CPU, RAM, disk drives, motherboard, BIOS, network adapters
• Operating system details – OS version, installation date, serial number, registered user
• Process management – List running processes, terminate tasks, monitor CPU/memory usage
• Software inventory – Installed applications, hotfixes, patches, version numbers
• Service management – Query service status, start/stop services, configure startup types
• User accounts – Local users, group memberships, profile paths
• Event logs – Query system, application, and security event logs
• Network configuration – IP addresses, MAC addresses, DNS settings, network adapters

Deprecation notice: Microsoft deprecated wmic in Windows 10 21H1 and later, recommending PowerShell's Get-CimInstance and Get-WmiObject cmdlets as replacements. However, wmic remains available in Windows 10, Windows 11, and Windows Server 2019/2022 for backward compatibility. New scripts should use PowerShell for long-term maintainability.

WMIC runs in Command Prompt and supports local and remote operations, making it indispensable for legacy systems, quick queries, and environments where PowerShell scripting isn't feasible.

WMIC Command Syntax

The basic syntax for the wmic command is:

wmic [alias] [verb] [/format:format] [/node:computer] [/user:username] [/password:password]

Core Components

Component	Description
alias	WMI class shortcut (e.g., process, product, bios, cpu, diskdrive)
verb	Action to perform: get, list, call, set, delete
get	Retrieve property values (e.g., wmic process get name,processid)
list	Display comprehensive information (list brief, list full)
call	Execute methods (e.g., call terminate, call uninstall)
set	Modify properties (requires elevated privileges)
delete	Remove WMI objects (use with caution)

Common Parameters

Parameter	Description
/format:format	Output format: list, table, csv, xml, htable (HTML table)
/node:computer	Target remote computer (requires admin credentials and firewall rules)
/user:username	Username for remote authentication
/password:password	Password for remote authentication (avoid storing in scripts—security risk)
/output:filename	Redirect output to file instead of console
/append:filename	Append output to existing file
where condition	Filter results (e.g., where name="notepad.exe")

Essential WMIC Aliases

Alias	Description	Common Use Cases
bios	BIOS/UEFI information	Serial number, version, manufacturer
cpu	Processor details	CPU model, cores, speed, architecture
memorychip	RAM modules	Memory size, type, speed, slots
diskdrive	Physical disk drives	Disk size, model, interface type
logicaldisk	Drive letters and volumes	Free space, disk usage, file system
process	Running processes	Process list, PID, memory usage, termination
product	Installed software	Application list, uninstall commands
os	Operating system info	OS version, build, install date, serial
computersystem	Computer details	Manufacturer, model, domain, workgroup
nic	Network adapters	Network card details, MAC addresses
netuse	Mapped network drives	Network share connections
service	Windows services	Service status, startup type, dependencies
startup	Startup programs	Auto-run applications, registry locations
useraccount	User accounts	Local users, SID, account status
qfe	Quick Fix Engineering	Installed Windows updates and hotfixes

Practical WMIC Command Examples

Display System Information

Get comprehensive system details in one command:

wmic computersystem get manufacturer,model,systemtype,totalphysicalmemory

Output shows computer manufacturer (Dell, HP, Lenovo), model number, system type (x64-based PC), and total RAM in bytes. Convert bytes to GB by dividing by 1073741824.

Use case: Automated inventory scripts for asset management databases.

Get BIOS and Serial Number

Retrieve BIOS version and system serial number for warranty tracking:

wmic bios get serialnumber,smbiosbiosversion

Serial numbers are critical for warranty lookups, asset tracking, and support tickets. Combine with /output:inventory.txt to save results.

List All Running Processes

Display all active processes with process ID and executable path:

wmic process get name,processid,executablepath

Similar to Task Manager's Details tab, but scriptable. Filter specific processes:

wmic process where name="chrome.exe" get processid,workingsetsize

Automation tip: Monitor memory usage for specific applications in scheduled tasks.

Terminate a Process by Name

Kill all instances of a process (similar to taskkill):

wmic process where name="notepad.exe" call terminate

More powerful than taskkill for conditional termination. Example—terminate processes consuming excessive memory:

wmic process where "workingsetsize>1000000000" call terminate

This terminates any process using more than 1GB RAM (1,000,000,000 bytes). Use with extreme caution in production.

List Installed Software

Display all installed applications with installation date:

wmic product get name,version,installdate

Performance warning: wmic product triggers Windows Installer consistency checks, which can take several minutes on systems with many installed applications. Use sparingly on production machines.

Alternative for faster results: Query registry instead:

wmic /output:software.txt product get name,version

Redirecting output allows background execution without blocking the terminal.

Uninstall Software Remotely

Uninstall an application by exact name:

wmic product where "name='Adobe Reader DC'" call uninstall /nointeractive

Critical: Application name must match exactly, including capitalization and spaces. Verify name first:

wmic product where "name like '%Adobe%'" get name

The like operator supports wildcard matching with %. /nointeractive suppresses confirmation prompts for scripted uninstalls.

Enterprise use case: Deploy uninstall scripts via Group Policy or remote management tools to remove outdated software across hundreds of workstations.

Get CPU Information

Retrieve detailed processor specifications:

wmic cpu get name,numberofcores,numberoflogicalprocessors,maxclockspeed

Output includes CPU model (e.g., "Intel Core i7-9700K"), physical cores, logical processors (with hyperthreading), and maximum clock speed in MHz.

Cloud migration use case: Collect CPU details for VM sizing and performance planning.

Check Disk Space

Display free and used disk space for all volumes:

wmic logicaldisk get caption,size,freespace,filesystem

Output shows drive letters, total size, free space (both in bytes), and file system type (NTFS, FAT32, exFAT). Convert bytes to GB in scripts:

wmic logicaldisk get caption,size,freespace /format:csv > diskspace.csv

CSV format simplifies import into Excel or databases for capacity monitoring.

Monitor Disk Space with Threshold Alerts

Create a script to alert when disk space drops below 10%:

wmic logicaldisk where "drivetype=3" get caption,freespace,size /format:csv

drivetype=3 filters only fixed local disks (excludes network drives, USB, CD-ROM). Parse CSV output in batch or PowerShell to calculate percentages and send email alerts.

List Windows Updates and Hotfixes

Display all installed Windows updates with installation date:

wmic qfe get hotfixid,installedon,description

QFE (Quick Fix Engineering) represents Windows updates, security patches, and hotfixes. Output includes KB numbers (e.g., KB5034763), installation date, and update type.

Compliance use case: Verify critical security patches are installed across the organization. Export to CSV for audit reports:

wmic qfe get hotfixid,installedon /format:csv > updates.csv

Get Network Adapter Information

List all network adapters with MAC addresses and connection status:

wmic nic get name,macaddress,netconnectionstatus

netconnectionstatus codes:

• 0 = Disconnected
• 2 = Connected
• 7 = Media disconnected

Useful for inventory management and troubleshooting network connectivity issues.

Common Use Cases for the WMIC Command

1. Hardware inventory for asset management – Collect CPU, RAM, disk, BIOS, and serial numbers across enterprise networks. Export to CSV for import into asset tracking databases or CMDB (Configuration Management Database) systems.

2. Remote software uninstallation – Remove outdated or unauthorized software from remote workstations without physical access. Deploy uninstall scripts via Group Policy, SCCM, or remote management platforms.

3. Automated system health monitoring – Query disk space, memory usage, CPU temperature, and service status in scheduled tasks. Trigger alerts when thresholds are exceeded (e.g., disk space <10%, CPU >90% for 5 minutes).

4. BIOS and firmware auditing – Extract BIOS version, serial numbers, and firmware details for security compliance audits. Identify systems requiring BIOS updates for vulnerability patches.

5. Process management and troubleshooting – Identify resource-hungry processes, terminate hung applications, or kill malware processes that resist normal termination methods.

6. Software license compliance audits – Generate reports of installed software versions, installation dates, and license keys. Cross-reference with procurement records to identify unlicensed or unauthorized installations.

7. Pre-migration system assessment – Collect comprehensive hardware and software inventories before cloud migrations, OS upgrades, or data center consolidations. Assess VM sizing requirements, application compatibility, and hardware refresh needs.

8. Security incident response – Query running processes, network connections, startup programs, and user accounts during malware investigations. Export event logs and process lists for forensic analysis.

9. Remote system diagnostics without RDP – Query system information, running services, disk space, and recent updates on remote servers without requiring Remote Desktop Protocol access or physical console connection.

10. Scheduled task automation – Incorporate wmic into batch scripts or scheduled tasks for nightly backups, weekly inventory reports, monthly compliance audits, and real-time monitoring dashboards.

11. Startup program management – List all programs configured to run at Windows startup. Identify performance bottlenecks, malware persistence mechanisms, or unnecessary auto-start entries.

12. Service dependency mapping – Query Windows services, their dependencies, and startup configurations for troubleshooting service failures or optimizing boot times.

Tips and Best Practices

1. Use list brief for quick summaries – wmic cpu list brief provides concise output. Use list full for comprehensive details including all available properties.

2. Run as Administrator for full functionality – Many wmic operations require elevated privileges, especially modifying settings, terminating system processes, or accessing protected WMI namespaces.

3. Format output for readability – Default output can be unwieldy. Use /format:table for aligned columns, /format:csv for spreadsheet import, or /format:htable for HTML reports.

4. Remote operations require firewall rules – For /node:computer to work, remote computer must allow WMI traffic (TCP 135, dynamic RPC ports) and Windows Management Instrumentation service must be running.

5. Avoid storing passwords in scripts – Never hardcode /password:password in batch files. Use scheduled tasks with stored credentials or PowerShell's -Credential parameter for secure authentication.

6. Test with where clause before bulk operations – Before running call terminate or call uninstall, verify exact matches with get name queries to avoid unintended deletions.

7. Export results for record-keeping – Use /output:filename.txt or /format:csv to save results for audit trails, capacity planning, or trend analysis over time.

8. Understand wmic product performance impact – Querying wmic product triggers Windows Installer validation on every installed application, causing significant CPU usage and delays on heavily-loaded systems. Schedule during maintenance windows.

9. Use aliases instead of full WMI paths – wmic cpu is far simpler than wmic path win32_processor. Learn common aliases (process, product, bios, os) for faster command construction.

10. Combine with findstr for filtering – Pipe wmic output to findstr for pattern matching: wmic process get name | findstr chrome lists only Chrome processes.

11. Document remote authentication requirements – Remote wmic requires admin rights on target systems, firewall exceptions, and matching domain credentials. Document prerequisites for troubleshooting.

12. Transition to PowerShell for new projects – Since wmic is deprecated, invest in learning PowerShell's Get-CimInstance and Get-WmiObject cmdlets for better long-term supportability and richer scripting capabilities.

Troubleshooting Common Issues

"Invalid GET expression" Error

Problem: WMIC returns "Invalid GET expression" when running queries.

Cause: Incorrect property names, missing quotes around string values in where clauses, or typos in alias names.

Solution:

• Verify property names with wmic [alias] get /? to list all available properties
• Enclose string values in single or double quotes: where name='notepad.exe'
• Use list brief first to verify the alias is correct and available
• Check for typos in property names (case-sensitive in some contexts)

Prevention: Use tab completion in PowerShell or verify property names with get /? before constructing complex queries.

"Access Denied" on Remote Systems

Problem: WMIC fails with "Access is denied" when targeting remote computers.

Cause: Insufficient permissions, Windows Firewall blocking WMI traffic, or WMI service not running on remote system.

Solution:

• Ensure you have administrator credentials on the target computer
• Enable WMI firewall rules on remote system: netsh advfirewall firewall set rule group="Windows Management Instrumentation (WMI)" new enable=yes
• Verify WMI service is running: wmic /node:computer service where name='winmgmt' get state
• Check User Account Control (UAC) settings—remote admin shares require specific UAC registry modifications on workgroup computers

Prevention: Use Group Policy to pre-configure firewall rules and WMI service startup type (Automatic) on all managed systems.

WMIC Command Not Found or Deprecated Warning

Problem: Windows 10/11 displays "wmic is deprecated" or command not found.

Cause: Microsoft deprecated wmic in Windows 10 version 21H1 and later, though it remains available for compatibility.

Solution:

• WMIC still works in current Windows versions despite deprecation warning
• Migrate scripts to PowerShell equivalents:
  • wmic cpu get name → Get-CimInstance Win32_Processor | Select Name
  • wmic process get name,processid → Get-CimInstance Win32_Process | Select Name,ProcessId
  • wmic product where name="App" call uninstall → Get-Package "App" | Uninstall-Package

Prevention: Start new automation projects with PowerShell instead of wmic for future-proof scripting.

"Invalid Global Switch" Error

Problem: WMIC fails with "Invalid global switch" for certain commands.

Cause: Incorrect parameter syntax, missing colons, or unsupported switches for the specified alias.

Solution:

• Verify syntax: /format:csv not /format csv (colon required)
• Check parameter spelling and case sensitivity
• Use wmic /? to display global switch syntax and examples
• Some aliases don't support certain verbs (e.g., not all support set or delete)

Prevention: Reference official Microsoft documentation or use wmic [alias] /? to verify supported operations before scripting.

"Code = 0x80041010" or "Invalid class" Error

Problem: WMIC returns error code 0x80041010 with "Invalid class" message.

Cause: Specified WMI class doesn't exist, typo in alias name, or WMI repository corruption.

Solution:

• Verify alias name: wmic /? lists all valid aliases
• Check for typos: diskdrive not disk-drive
• Test WMI repository health: winmgmt /verifyrepository
• Rebuild WMI repository if corrupted: winmgmt /salvagerepository (requires admin rights and may take time)

Prevention: Use validated alias names from documentation and test commands on non-production systems first.

WMIC Hangs on Product Query

Problem: wmic product command hangs or takes extremely long to complete.

Cause: Windows Installer consistency checks run on every installed application, causing significant delays on systems with many MSI-installed programs.

Solution:

• Allow adequate time—can take 5-15 minutes on heavily-loaded systems
• Redirect output to file and let it run in background: start /B wmic product get name /format:csv > products.csv
• Use alternative methods: Query registry directly with reg query or PowerShell's Get-ItemProperty
• Schedule during maintenance windows to avoid impacting production users

Prevention: Avoid wmic product in real-time scripts or interactive sessions. Use faster registry queries for software inventory.

Related Commands

PowerShell Get-CimInstance – Modern WMI Replacement

Get-CimInstance is the PowerShell cmdlet replacing wmic for WMI queries. Uses industry-standard WS-Man protocol instead of legacy DCOM, offering better security, firewall friendliness, and richer object manipulation.

When to use Get-CimInstance: All new scripts, remote administration over WS-Man, systems where wmic is unavailable, or when you need PowerShell's object pipeline for complex filtering and formatting.

When to use wmic: Legacy systems, quick one-liners, environments without PowerShell Remoting, or maintaining existing batch scripts.

Example comparison:

wmic bios get serialnumber
Get-CimInstance Win32_BIOS | Select SerialNumber

Migration tip: Most wmic aliases map to Win32_* WMI classes: wmic cpu → Get-CimInstance Win32_Processor, wmic process → Get-CimInstance Win32_Process.

PowerShell Get-WmiObject – Legacy WMI Cmdlet

Get-WmiObject is the older PowerShell cmdlet for WMI (introduced in PowerShell 1.0). Still works but deprecated in favor of Get-CimInstance in PowerShell 3.0+.

Difference: Get-WmiObject uses DCOM protocol (same as wmic), while Get-CimInstance uses WS-Man. Get-CimInstance is faster, more secure, and supports better error handling.

Example: Get-WmiObject Win32_OperatingSystem | Select Caption,Version

Recommendation: Use Get-CimInstance for new scripts; Get-WmiObject is maintained for backward compatibility only.

tasklist / taskkill – Process Management

tasklist displays running processes (simpler alternative to wmic process). taskkill terminates processes by PID or name. Both are faster than wmic for basic process management.

Example: tasklist /FI "MEMUSAGE gt 500000" lists processes using >500MB RAM.

When to use tasklist/taskkill: Quick process queries, simple termination tasks, batch scripts where wmic overhead isn't justified.

When to use wmic process: Detailed process properties (executable path, command line, parent process), remote process management, conditional termination based on multiple criteria.

systeminfo – System Information Summary

systeminfo displays comprehensive system information in readable format: OS version, build number, BIOS, CPU, RAM, network adapters, hotfixes, and boot time.

Example: systeminfo /s remote-pc /u domain\admin

Advantage: Single command provides formatted summary without complex wmic queries. Ideal for quick troubleshooting or support documentation.

Integration: Use systeminfo for human-readable reports; use wmic for machine-parseable data (CSV, XML) in automation scripts.

net commands – User and Service Management

net user manages user accounts (create, modify, delete). net localgroup manages group memberships. net start/stop controls Windows services.

Examples:

net user john * /add
net localgroup administrators john /add
net start wuauserv

When to use net commands: Simple user management, service control, legacy compatibility, environments with restricted PowerShell execution.

When to use wmic: Querying detailed user properties, remote service management, exporting service configurations for documentation.

Frequently Asked Questions

What is the wmic command used for?

The wmic command queries and manages Windows systems through WMI (Windows Management Instrumentation). It retrieves hardware information (CPU, RAM, disk, BIOS), manages processes and services, lists installed software, and performs administrative tasks like remote uninstallation and system monitoring. IT professionals use wmic for inventory management, troubleshooting, and automation scripts.

Is wmic deprecated in Windows 10 and 11?

Yes, Microsoft deprecated wmic in Windows 10 version 21H1 (May 2021) and recommends using PowerShell cmdlets like Get-CimInstance and Get-WmiObject instead. However, wmic remains available in Windows 10, Windows 11, and Windows Server 2019/2022 for backward compatibility. Existing scripts continue to work, but new projects should use PowerShell.

How do I uninstall software with wmic?

Use wmic product where "name='ApplicationName'" call uninstall /nointeractive to remove software. The application name must match exactly, including capitalization and spaces. Verify the exact name first: wmic product where "name like '%App%'" get name. Warning: wmic product triggers Windows Installer consistency checks, which can take several minutes.

What is the PowerShell equivalent of wmic?

PowerShell's Get-CimInstance cmdlet replaces wmic for WMI queries. Examples: wmic cpu get name becomes Get-CimInstance Win32_Processor | Select Name, and wmic process get name,processid becomes Get-CimInstance Win32_Process | Select Name,ProcessId. Get-CimInstance offers better security, performance, and object manipulation than wmic.

How do I get system serial number with wmic?

Use wmic bios get serialnumber to retrieve the system serial number. This command queries the BIOS/UEFI firmware for the manufacturer-assigned serial number, essential for warranty lookups, asset tracking, and support tickets. Combine with /output:file.txt to save results or /node:remote-pc for remote queries.

Can wmic work on remote computers?

Yes, use /node:computername /user:username /password:password to target remote systems. Example: wmic /node:server01 /user:domain\admin /password:pass123 cpu get name. Remote computer must allow WMI traffic through the firewall (TCP 135 + dynamic RPC ports), and you need administrator credentials on the target system. Security: Avoid storing passwords in scripts.

How do I list all running processes with wmic?

Use wmic process get name,processid,executablepath to display all running processes with their process IDs and executable paths. Filter specific processes: wmic process where name="chrome.exe" get processid,workingsetsize. Terminate processes: wmic process where name="notepad.exe" call terminate. Requires administrator rights for system processes.

What does "wmic product" do and why is it slow?

wmic product lists all installed applications managed by Windows Installer (MSI packages). It's slow because it triggers Windows Installer consistency checks on every installed application, recalculating file hashes and verifying installation integrity. This can take 5-15 minutes on systems with many programs. Use sparingly; consider registry queries for faster software inventory.

How do I export wmic output to CSV?

Use /format:csv to export results to CSV format: wmic cpu get name,numberofcores /format:csv > cpu.csv. Combine with /output:filename.csv to save directly to file without console output. CSV format simplifies import into Excel, databases, or monitoring systems for trend analysis and reporting.

Why does wmic fail with "Access Denied" error?

"Access denied" occurs due to insufficient permissions, WMI service not running, or firewall blocking WMI traffic. Solutions: Run Command Prompt as Administrator, enable WMI firewall rules (netsh advfirewall firewall set rule group="Windows Management Instrumentation (WMI)" new enable=yes), verify WMI service is running (sc query winmgmt), and ensure you have admin credentials on target systems.

How do I get disk space information with wmic?

Use wmic logicaldisk get caption,size,freespace,filesystem to display drive letters, total size, free space (in bytes), and file system type. Convert bytes to GB: divide by 1073741824. Filter fixed disks only: wmic logicaldisk where "drivetype=3" get caption,freespace,size. Export to CSV for capacity monitoring: /format:csv > diskspace.csv.

Can I terminate processes remotely with wmic?

Yes, use /node:computername with process termination: wmic /node:remote-pc /user:admin /password:pass process where name="notepad.exe" call terminate. Requires administrator credentials on remote system, WMI firewall rules enabled, and appropriate user rights. Ideal for remote administration without RDP access.

Quick Reference Card

Command	Purpose	Example Use Case
wmic bios get serialnumber	Get system serial number	Asset tracking, warranty lookup
wmic cpu get name,numberofcores	Get CPU details	Hardware inventory
wmic logicaldisk get caption,freespace	Check disk space	Capacity monitoring
wmic process get name,processid	List all processes	Troubleshooting, monitoring
wmic process where name="app.exe" call terminate	Kill specific process	Hung application recovery
wmic product get name,version	List installed software	License compliance audit
wmic product where name="App" call uninstall	Uninstall software	Remote software removal
wmic qfe get hotfixid,installedon	List Windows updates	Patch compliance verification
wmic os get caption,version,installdate	Get OS information	System documentation
wmic /format:csv > output.csv	Export to CSV	Reporting, database import

Try the WMIC Command in Our Simulator

Practice the wmic command safely in our Windows Command Simulator. Run wmic bios get serialnumber, wmic process get name, and other examples in your browser without affecting your actual system. Perfect for learning WMI queries, testing commands before production deployment, or demonstrating system administration techniques in training environments.

Visit the Commands Reference for a full list of supported Windows CMD commands, including system information, process management, and network diagnostics.

Summary

The wmic command provides powerful command-line access to Windows Management Instrumentation for querying and managing hardware, software, processes, and services. Use wmic aliases like bios, cpu, process, product, and logicaldisk to retrieve system information, manage processes, uninstall software, and automate administrative tasks.

Despite being deprecated in Windows 10 21H1+, wmic remains available and functional for backward compatibility. However, new scripts should transition to PowerShell's Get-CimInstance cmdlet for better long-term support, improved security, and richer object manipulation.

Master wmic for hardware inventory collection, remote system diagnostics, software compliance audits, and troubleshooting. Combine /format:csv for database imports, /node:computer for remote administration, and where clauses for precise filtering. Always run as Administrator for full functionality and enable WMI firewall rules on remote systems.

For modern Windows environments, invest in PowerShell WMI cmdlets while maintaining wmic knowledge for legacy system support. The combination of command-line WMI tools—whether wmic or PowerShell—provides unmatched visibility and control over Windows infrastructure at enterprise scale.