WMI 学习

On Error Resume Next
strComputer = "."
Set objWMIService = GetObject("winmgmts://" & strComputer & "/root/cimv2")
Set colItems = objWMIService.ExecQuery("Select * from Win32_ServerConnection WHERE SHareName='电影' and ComputerName='192.168.0.131'",,48)
For Each objItem in colItems
    Wscript.Echo "ActiveTime: " & objItem.ActiveTime
    Wscript.Echo "Caption: " & objItem.Caption
    Wscript.Echo "ComputerName: " & objItem.ComputerName
    Wscript.Echo "ConnectionID: " & objItem.ConnectionID
    Wscript.Echo "Description: " & objItem.Description
    Wscript.Echo "InstallDate: " & objItem.InstallDate
    Wscript.Echo "Name: " & objItem.Name
    Wscript.Echo "NumberOfFiles: " & objItem.NumberOfFiles
    Wscript.Echo "NumberOfUsers: " & objItem.NumberOfUsers
    Wscript.Echo "ShareName: " & objItem.ShareName
    Wscript.Echo "Status: " & objItem.Status
    Wscript.Echo "UserName: " & objItem.UserName
Next

 

关于WQL语句中WHERE用法，当为字符串比较时，需要加"", 当被包含在ExecQuery方法中时，把""变换成''即可

 

WMI编程实用工具：http://www.microsoft.com/downloads/details.aspx?displaylang=en&familyid=9ef05cbd-c1c5-41e7-9da8-212c414a7ab0

 

以下为WQL相关知识

 

The WMI Query Language (WQL)

The WMI Query Language, or WQL, is a subset of the industry-standard Structured Query Language (SQL) defined by the American National Standards Institute (ANSI). Although there are other ways to retrieve information from WMI, writing a WQL query is probably the easiest, because WQL closely resembles normal English syntax and grammar.

In the previous chapter, you saw examples of some basic WQL queries.

• SELECT * FROM Win32_NetworkAdapterConfiguration WHERE DHCPEnabled= TRUE

• SELECT Description FROM Win32_Account WHERE Name= 'Administrator'

• SELECT Freespace,DeviceID FROM Win32_LogicalDisk

Queries like these will likely be the ones you use most; however, it's useful to understand what else you can do with WQL, especially when working with complex information.

Regular SQL has literally hundreds of keywords and clauses; WQL, on the other hand, has 19. That's a much more manageable number, and it means you'll be able to master WQL without rivaling your company's database administrators in SQL prowess. Of course, if you already know SQL, WQL is going to be a snap.

Complex WMI Information

I've used the phrase complex information a couple of times in this and the previous chapter; the next chapter, in fact, has complex information right in the title. What does it mean?

I divide WMI information into two categories: simple and complex. Simple information is the kind that typically only has one instance on a computer. For example, if I want to query a computer's serial number, there's only going to be one of those. More complex information, like TCP/IP addresses, require more effort as a programmer, because each computer can have multiple network adapters, and each network adapter can have multiple addresses.

Security information can be even more complex. For example, WMI provides a way to access NTFS file permissions. Each file on the hard drive is an instance of a WMI class, and each user or group in the computer or domain is represented by a different class. In between those two classes are access control entries, or ACEs, which grant a specific permission on a specific file to a specific user or group. So, to access NTFS file permissions, you're dealing with at least three interrelated classes. Complex enough for you?

Properly written WQL queries can reduce this complexity by allowing you to query for specific sets of data, rather than having to wade through all the interrelated classes.

NOTE

I'm not going to cover all 19 keywords. Several of them are intended for querying WMI events, which are special notifications generated by WMI when specific things occur, as a file being modified. Dealing with WMI events is a bit beyond the scope of this book, and better suited to traditional programming than scripting.

The Basics

You've already met the primary players in a WQL query.

• SELECT, which must start each WQL query.

• The properties you want to query. You can either provide a comma-separated list of property names, or if you want to retrieve all of a class' properties, specify *.

• FROM, which must follow the list of properties that you want to query.

• The name of the class you're querying.

• Optionally, you can include WHERE and a conditional statement. A WHERE clause limits the instances returned by your query. For example, if I include WHERE DHCPEnabled=TRUE in my earlier query, I receive fewer instances in the results, because only those instances of Win32_NetworkAdapterConfiguration that have DHCPEnabled set to TRUE would be returned by the query.

SELECT, a property list (or *), FROM, and a class name are the minimum required elements for any WQL query. Everything else is optional and is used to restrict the amount of information returned by WMI. For example, SELECT * FROM Win32_ComputerSystem WHERE Name = "Server1" returns all instances of the Win32_ComputerSystem class with the appropriate server name.

NOTE

It might seem odd to specify the computer name in a query, when you have to connect to that computer—in this example, Server1—to begin with. What other computer systems could exist on Server1, after all? However, consider so-called blade systems, where a single chassis might contain multiple independent computers. WMI is designed so that a WMI-compliant chassis could be queried for information about any of the computers it contains, although in practice I'm not aware of any chassis that can yet do so.

Boolean Operators

Whenever you specify a WHERE clause in a WQL query, you have to provide some sort of logical expression. WMI returns all instances that meet your logical condition. For example, WHERE Name = "Server1" is a logical condition, because it includes the logical = operator.

You can specify more than one logical condition and combine them with Boolean operators. For example, WHERE Name = "Server1" AND Domain = "MYCOMPANY" provides two conditions that must both be matched. AND serves in this case as a Boolean operator.

WQL supports two primary Boolean operators.

1. AND. Combines two conditions, both of which must evaluate to True in order for an instance to be returned in the query results. For example, WHERE Name = "Server1" AND Domain = "MYCOMPANY".

2. OR. Combines two conditions, either of which may evaluate to True in order for an instance to be returned in the query results. For example, WHERE Name = "Server1" OR Domain = "MYCOMPANY".

Logical expressions can be grouped in parentheses. For example, suppose you're querying the Win32_LogicalDisk class. You might write an expression like the following.

SELECT * FROM Win32_LogicalDisk   WHERE (DriveType = 2) OR (DriveType = 3 AND FreeSpace < 1000000)

This query would return all instances of Win32_LogicalDisk that are either removable drives (DriveType = 2) or fixed drives (DriveType = 3) with less than one megabyte free.

Comparison Operators

Sometimes, you may need to query for instances that have a particular property set to NULL. For example, if you query Win32_NetworkAdapterConfiguration for a configuration that isn't set to use DHCP, the DHC-PLeaseExpires property will be NULL. NULL is a special value, and you cannot use a query like SELECT * FROM Win32_NetworkAdapterConfiguration WHERE DHCPLeaseExpires = NULL. Instead, you have to use the special IS operator, as in SELECT * FROM Win32_NetworkAdapterConfig-uration WHERE DHCPLeaseExpires IS NULL. To query for the opposite condition, you could use SELECT * FROM Win32_NetworkAdapterConfiguration WHERE DHCPLeaseExpires IS NOT NULL. Here they are again.

• SELECT * FROM Win32_NetworkAdapterConfiguration WHERE DHC-PLeaseExpires = NULL. This doesn't work, because you cannot use normal comparison operators like = or <> in combination with NULL.

• SELECT * FROM Win32_NetworkAdapterConfiguration WHERE DHC-PLeaseExpires IS NULL. This selects all instances where the property is set to a null value.

• SELECT * FROM Win32_NetworkAdapterConfiguration WHERE DHC-PLeaseExpires IS NOT NULL. This selects all instances where the property is not set to a null value.

You cannot use IS or IS NOT in place of the normal comparison operators; IS and IS NOT are designed to be used only in conjunction with NULL. The normal comparison operators are

• =. Equal to

• >. Greater than

• <. Less than

• <=. Less than or equal to

• >=. Greater than or equal to

• <> or !=. Not equal to

There's one more comparison operator, LIKE, which is worth looking at. LIKE is sort of a "soft" equality operator, and allows you to use wildcards to match string data. Suppose, for example, that you want to query all network connections that have the word "Office" in their caption, such as "Office Dial-Up" or "Office VPN." You could use the following query.

SELECT * FROM Win32_NetworkConnection WHERE Caption LIKE '%Office%'

The LIKE operator supports several wildcard characters.

• Use % to represent zero or more characters that you don't care about. For example, %Office% returns "My Offices," "Office VPN," and "Office." On the other hand, Office% returns "Offices" and "Office VPN," but it does not return "My Offices," because there's no percent sign preceding "Office."

• Use square brackets ([ ]) to return a specific range of characters. For example, [A-Z]ars returns "Mars," "Wars," and "Tars," but not "Stars."

• Use a caret (^) to negate a character range. For example, [^A-M]ars returns "Wars" and "Tars," but does not return "Mars" because "M" is in the excluded range.

• Use an underscore (_) to return any single character. M_rs returns "Mars," "M3rs," or any other string beginning with "M," ending in "rs," and having one character in between.

Finally, you'll notice that many WMI class properties can be set to either True or False, such as the DHCPEnabled property of the Win32_NetworkAdapterConfiguration class. WQL allows you to use the keywords TRUE and FALSE to query these properties, such as:

SELECT * FROM Win32_NetworkAdapterConfiguration WHERE DHCPEnabled = TRUE

Don't be tempted to write the query with DHCPEnabled IS TRUE, because it won't work; remember that IS and IS NOT only work in conjunction with NULL.