How to use the command 'wmic' (with examples)

Windows Management Instrumentation Command-line (WMIC) is a powerful utility built into Windows operating systems that provides users with the ability to interact with Windows Management Instrumentation (WMI). This tool is particularly useful for accessing and managing system details through a command-line interface. With WMIC, users can query detailed information about system resources, toggle system services, and manage processes among many other features. It provides a wide scope of commands to help access, modify, and maintain system status information.

Use case 1: Show brief details about the currently running processes

Code:

wmic process list brief

Motivation for using the example:

Being able to quickly check on the running processes on your computer can help you identify rogue or resource-intensive apps. System administrators and power users often need a concise view of the running processes to monitor system health or troubleshoot performance issues. Running a brief list gives you an at-a-glance overview without overwhelming you with information.

Explanation for every argument given in the command:

• wmic: Invokes the Windows Management Instrumentation Command-line utility.
• process: Specifies that we are interested in information related to system processes.
• list: Directs the command to display information in a list format.
• brief: Requests only a minimal amount of information for each process, typically including the process name, process ID (PID), and other basic details.

Example output:

Caption                     HandleCount     Name                    Priority   ProcessId  ThreadCount
System Idle Process         0               System Idle Process     0          0          4
System                      200             System                  8          4          206
wininit.exe                 738             wininit.exe             13         456        3
...

Use case 2: Show full details about the currently running processes

Code:

wmic process list full

Motivation for using the example:

There are times when a granular and comprehensive view of system processes is vital, such as diagnosing detailed behavioral issues of specific software or conducting deep forensic analysis. When an issue arises that can’t be explained through a minimal data set, system administrators need detailed insights covering every aspect of a running process: from its executable path to memory usage and environmental variables it interacts with.

Explanation for every argument given in the command:

• wmic: Initiates the command-line utility to interact with Windows Management Instrumentation.
• process: Targets system processes for information retrieval.
• list: Formats the retrieved process information in a human-readable list.
• full: Instructs WMIC to provide exhaustive details about each process.

Example output:

CreationClassName       : Win32_Process
Caption                 : svchost.exe
CommandLine             : C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
ProcessId               : 3828
ParentProcessId         : 548
PriorityBase            : 8
PrivatePageCount        : 1400832
...

Use case 3: Access specific fields such as process name, process ID, and parent process ID

Code:

wmic process get name,processid,parentprocessid

Motivation for using the example:

When you need specific pieces of information about processes running on a system, extracting only the relevant details is an efficient way to reduce clutter. This is significant during script development or batch tasks where only certain process attributes are necessary for decision-making or logging processes.

Explanation for every argument given in the command:

• wmic: Calls the command-line tool to access Windows Management data.
• process: Specifies that the command targets running system processes.
• get: Instructs the system to retrieve specified fields of information.
• name,processid,parentprocessid: Lists the specific fields the user wants information on — the process name, its unique identifier (Process ID), and its parent process identifier.

Example output:

Name                   ProcessId   ParentProcessId
System                 4           0
smss.exe               408         4
csrss.exe              596         408
wininit.exe            672         408
...

Use case 4: Display information about a specific process

Code:

wmic process where name="example.exe" list full

Motivation for using the example:

Focusing on a single process helps isolate specific software or services for in-depth analysis. This functionality is vital in troubleshooting situations where a particular application behaves anomalously or when optimizing an application’s resource consumption.

Explanation for every argument given in the command:

• wmic: Opens the command-line utility to perform Windows Management operations.
• process: Specifies processes as the object of our inquiry.
• where: Adds a filter condition to the query.
• name="example.exe": States the condition, restricting results to the process named “example.exe”.
• list full: Indicates that a complete set of details should be shown for the filtered data.

Example output:

Name                    : example.exe
ProcessId               : 4567
PageFaults              : 1420
PeakWorkingSetSize      : 258560
HandleCount             : 400
KernelModeTime          : 0:00:00.531
...

Use case 5: Display specific fields for a specific process

Code:

wmic process where processid=1234 get name,commandline

Motivation for using the example:

There are instances where gaining insights into the execution context and origin of a specific process is needed, such as in security audits or when verifying configuration options passed to an application. Limiting the output to essential details reduces noise and helps in precise evaluation.

Explanation for every argument given in the command:

• wmic: Invokes the WMI command utility.
• process: Indicates that the inquiry pertains to system processes.
• where processid=1234: Uses a filter to specify the process using its Process ID.
• get: Commands the tool to retrieve specific pieces of information.
• name,commandline: Specifies what information to retrieve for the targeted process: the process’s name and the command-line string used to launch it.

Example output:

Name               CommandLine
example.exe        "C:\Program Files\Example\example.exe" /quiet

Use case 6: Kill a process

Code:

wmic process where processid=1234 delete

Motivation for using the example:

System administrators often need to terminate processes that are unresponsive, consuming excessive resources, or posing security risks. The power to kill a process programmatically is a vital aspect of managing system stability and security. In environments where immediate action is required to ensure productivity, this command is quite critical.

Explanation for every argument given in the command:

• wmic: Engages the Windows Management Instrumentation Command-line.
• process: Designates processes as the focus of the command.
• where processid=1234: Applies a filter condition to identify the process by its ID.
• delete: Instructs the system to terminate the indicated process.

Example output:

Deleting instance of 'Win32_Process' with ProcessID '1234'
Instance deletion successful.

Conclusion:

WMIC is an exceptionally versatile command-line tool that empowers users to manage and access system processes effectively. These examples demonstrate key operations one can perform using WMIC, from simply listing processes to retrieving detailed information and even managing processes by terminating them. By mastering these commands, users can greatly enhance their abilities to troubleshoot, manage, and secure their Windows systems.