Using WMI in relevance

(imported topic written by BenKus)

Sometimes you need to use WMI in relevance (more info about WMI from Microsoft is available at http://www.microsoft.com/whdc/system/pnppwr/wmi/default.mspx). The WMI is especially useful when you want to lookup hardware attributes of a computer. You can use relevance to directly query the WMI (if the computer has WMI enabled).

One of the most useful references for WMI that we have found is:

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/wmisdk/wmi/win32_classes.asp

This will list the WMI classes that are available and these can be easily translated into relevance queries. For instance, if I wanted to know about my computer monitor, I look through the “Computer system hardware” class and notice there is “Win32_DesktopMonitor” class with a property called “Description”. When I put this into QnA (available at http://support.bigfix.com/fixlet/) in relevance form, it looks like:

Q: string value of select “Description from Win32_DesktopMonitor” of wmi

A: Default Monitor

Couple notes on WMI usage:

  • WMI is not supported on all Windows platforms by default (only Win2000+).

  • Be careful with WMI because you can sometimes make very long running relevance queries, which are not good for the computer or the BES Client. Also, it is possible to create WMI queries that will generate network requests (for instance, querying the AD servers through WMI) and you must be very cautious with these types of queries to avoid network/server load issues.

  • We have had reports that some computers had WMI problems unrelated to BigFix, but when you add a WMI property to the BES Client, it can trigger problems with the computer due to the underlying WMI issues.

  • If you are making a BES property and do not expect the results to change often, you should change the report interval to “1 day” instead of “Every Report” to avoid querying the WMI unnecessarily.

  • WMI queries through the BES Client can be disabled on specific computers by adding a client setting “_BESClient_Inspector_DisableWMI”=“1” (more info at http://support.bigfix.com/bes/misc/besconfigsettings.html). This setting was designed to allow you to disable WMI if you think that the WMI might have problems on specific computers.

Ben

(imported comment written by rharmer91)

I think I plan to make an Analysis out of this, but I need a little help with the syntax.

I’m trying to find all the servers that I have which are Windows 2003 R2. Microsoft didn’t update the build number that I’m aware of, and I don’t see a way from the columns using OS to do this… so…

From Microsoft’s site, they say query WMI for this…

Select * from Win32_OperatingSystem

If I type

Q: string value of select “Win32_OperatingSystem” of wmi

E: The expression could not be evaluated: unknown error 0x80041017

So if you could give me a little push, that would be great.

Rich

(imported comment written by rharmer91)

I think I figured it out…

Q: string value of select “Name from Win32_OperatingSystem” of wmi

Just used WMIexplorer to find the right column which had the R2 in it. So now I just need to do the rest of the relevance statement of string and contains etc…

Rich