So let's look at how we use the Get‑CimInstance and Invoke‑CimMethod commands
to kind of enhance the process that we're going through.
Well the Get‑CimInstance command retrieves the CIM
instances of the class that we've chosen.
So in the previous example, we looked at,
we were saying Win32_ something, so OperatingSystem,
ComputerSystem, etc.
This supports either the class name, or you can actually query if you wanted to.
So in the previous examples, we wrote the class name itself.
This will return one or more CIM instance objects,
and it will use the Windows Management Instrumentation,
or WMI, using a component object model locally to retrieve that information.
It will then use what's called the CIM server if it's a
remote connection using a session.
So let's just clear this again.
Let's say we wanted to view the operating system information.
So we can use our same command, but this time,
instead of it being Get‑CimClass, I want to get an instance of that class name.
So the CIM class object allows me to retrieve details about the class; the CIM
instance gives me everything around the specific class name,
which is connected to the instance or the machine that we're talking to.
So I can say Win32, and I'll say OperatingSystem here and then press Enter.
And you'll see, it's given me the instance of the class name,
but specifically to the build of the machine that I'm actually running it on.
So this is a Windows 10 device.
If I was to run this from a Windows Server 2016,
2019, 2022, etc., I would get different values back for those machines.
Now of course,
I can also just get information from specific computers
too by passing the ComputerName object.
So I'm going to say WIN10, I can press Enter,
and it will give me the values back for the same machine that I'm on.
If I say 2022 and enter it,
you'll notice that it gives me a bit of an error here,
which is all to do with the WinRM client.
So what we can do is just clear this a second.
I can go back and take that same command.
And I'm just going to do the IP address, and I'll explain why in a second.
So we'll do 128, press Enter, and it goes and gets me the values.
It's all because I can't resolve the names because they're separate machines,
and it's all to do with trusted host, but we'll talk about remoting another time.
But this allows me to retrieve the values from those machines.
So that's how we get the instances of the classes using CIM class,
and then we get the values associated to the instance of the class that
we've chosen for the machine that we're calling into.
Now, we can get more than just the operating system or the computer system, etc.
If I do Get‑CimInstance, I'm going to take away the ComputerName here,
we can change this to just be ComputerSystem like so,
and you'll see I get different information than the operating system.
If I also want to see a list of services that may be running on the machine,
I can say Win32_Service, and it gives me the same information,
albeit it looks slightly different to using Get‑Service,
which is the regular PowerShell command.
Now we also have the ability, so let me just clear this here.
We also have the ability to start filtering that information out as well.
So let's say I wanted to identify services that are running on a machine,
so I've got my class Win32.
But I also want ones that are not set to run as the local system account.
So I'm looking for services effectively that have been set to specific accounts.
Maybe it's domain/user or something else like that.
So I can come into here and use a Filter parameter,
and then I can use kind of standard syntax.
In this one, I'm going to say startname,
and I'm going to say LocalSystem here,
and then I can enter that and close the quotes.
So this is basically saying if it's local system‑‑‑ Well,
if it's not the local system, then go ahead and find it.
So I can do a check, and it will go and check all of the services that are there.
And if the start name isn't LocalSystem, then it will not display those values.
Now, that's all good and well,
especially if you're doing an investigation into specific machines,
you want to retrieve information,
then we can use this kind of CIM instance command.
Now the Invoke‑CimMethod invokes a method of a CIM class or a CIM instance.
Once again, it uses the Windows Management Instrumentation,
WMI, or the Component Object Model locally.
And then it can use a CIM server if it's a remote or you're using a session.
Now what's even more powerful is when you combine the
idea of these CIM classes and instances,
and then you use what's called Invoke‑CimMethod.
So Invoke‑CimMethod allows me to execute something.
Now remember, let's go back to my CIM class command,
so I'm going to say Get‑CimClass, and I'll just use the Win32_Computer one again.
So I'll press Enter.
Remember we talked about the CIM class methods.
So let me say system, and I'm going to say Select‑Object CimClassMethods.
Now in the CimClassMethods for this specific one,
you'll see that there are things that we can do.
We can set the power state, we can rename,
we can join it to a domain or workgroup or unjoin it.
That's exactly the same when we start to look at other things too.
So let's take this same command.
I'm going to go back here, change it from Computer,
and imagine that we're working with services.
Now see what we can do.
We can start, stop, pause, and resume services by using PowerShell.
If I was to do one more here and change that from the Service to Process,
so I'm looking for processes now,
you'll see I can now create instances of processes,
terminate them, and then get values from that as well.
So how does that work?
Well let's go ahead and try invoking the CIM method.
So we call this first.
We need to tell it the class that we like to use.
So in this instance, I'm going to say the process one, so Win32_Process.
And then, I get to say the name,
and the name is actually the method that we want to execute.
It's not just a random name of a process.
So I'm going to say I would like to create a new process.
Then we have what's called arguments,
and the arguments is effectively this type of value.
So it's just a set of values, like a key value pair.
So I'm going to say CommandLine =, and then to be nice and simple,
I'm going to say notepad.exe.
So in reality,
what this should do is create a new instance of the process called Notepad,
so let's execute that.
And sure enough, you can see right at the bottom, I have a new Notepad instance.
And that's great.
So think how we can do this.
It means that we can now either locally or remotely invoke a CIM
method and launch something on somewhere else.
We also have the ability, if we were to think differently,
we could also close specific things down.
So let's say Invoke‑CimMethod like so.
And this time, I'm not going to specify the class name.
I'm just going to query.
I'm going to say go and find me this specific process.
And look how wonderful this is.
We can say SELECT * FROM. Anybody recognize this type of syntax?
It's almost like SQL code itself.
So I'm going to say Win32_Process WHERE Name Like,
and then I can say Notepad with an ampersand sign,
which is exactly the same as you would do in SQL.
And then,
then I get to say, well, the method that I would like to use at this point,
let me put that in quotes, sorry, is Terminate.
There we go, Terminate.
I'm going to press Enter.
Now notice what happens.
My Notepad disappeared,
and it's been removed because it's queried the list of
processes based on a SQL type statement,
and then we said execute this specific method.
So this is a great way using the CIM classes to be able to first
get information that's stored on the machine,
then get instances for the local machine or a remote machine,
and then run through the same process of well maybe I want to retrieve
information or maybe I want to invoke specific types of methods that are
associated to those CIM instances and classes.