Quantcast
Channel: Sysinternals Forums
Viewing all articles
Browse latest Browse all 10386

Utilities Suggestions : Tools to trace WMI requests

$
0
0
Author: Loic
Subject: Tools to trace WMI requests
Posted: 09 February 2018 at 6:18am

FYI this is what I'm using to get the number of wmi queries that have ran in the last 4 hours
$wmilog=Get-WinEvent -ListLog "*wmi*" |select -expand logname
Get-WinEvent -FilterHashtable @{logname=$wmilog ;id=5858;starttime=((get-date).AddHours(-4))}  |
 ?{$_.message -match "execquery"} |select @{name="request";expression={($_.message.split(';')[5]).split('-')[1] }} |Grou
p-Object request |select count,name |sort count -desc | ft -AutoSize -Wrap
this give me this result
Count Name
----- ----
    6  ROOT\CIMV2 : SELECT ChassisTypes FROM Win32_SystemEnclosure 
    4  root\ccm\policy\machine : select Sign, Encrypt from InventoryClientAuthenticationConfig where
      InventoryActionID="{00000000
    2  root\cimv2 : select MaxClockSpeed from Win32_Processor 
    2  ROOT\CIMV2 : SELECT * FROM Win32_PCMCIAControllerDevice 
    1  root\CIMV2 : SELECT SMBIOSAssetTag FROM Win32_SystemEnclosure  
    1  root\CIMV2 : SELECT uuid FROM win32_computersystemproduct  
    1  ROOT\CIMV2 : SELECT ID FROM Win32_ServerFeature 
    1  ROOT\CIMV2 : SELECT SerialNumber FROM Win32_OperatingSystem 
    1  root\Microsoft\Windows\DeviceGuard : SELECT AvailableSecurityProperties FROM Win32_DeviceGuard  
    1  root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesRunning FROM Win32_DeviceGuard  


Viewing all articles
Browse latest Browse all 10386

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>