(For more resources related to this topic, see here.)
Inventorying hardware with PowerShell
Often times, a system administrator needs to identify what hardware is installed in their environment. This could be for an asset tracking project, finding available resources, or even identifying older equipment that needs to be retired. Most hardware information on a system is stored in WMI and can be accessed via in-built PowerShell functions or via WMI queries. In this recipe, we will review the various methods for gathering inventory information from our local system. In addition to collecting from the local system, these methods can be expanded to include remote systems.
How to do it…
We can review the various methods for gathering inventory information as follows:
-
Gather disk information from the local system.
$TargetSystem="." $myCim = New-CimSession -ComputerName $TargetSystem Get-Disk -CimSession $myCim
When executed, the results will be displayed similar to the following screenshot:
-
Review the contents of the Get-Disk function.
Get-Content Function:Get-Disk
When executed, the contents of the function will be displayed as shown in the following screenshot:
-
Retrieve results using WMI.
Get-WmiObject -Class MSFT_DISK ` -Namespace ROOTMicrosoftWindowsStorage
When executed, the results will be displayed similar to the following screenshot:
How it works…
We start by gathering the disk information from the local system. First, we call New-CimSession to create a CIM connection to the target system, in this case we are connecting to the local system, so we can use “.” instead of a system name. Next, we call the in-built PowerShell function Get-Disk to return the disk information. By default, PowerShell only returns a subset of information; more can be returned by piping the output through a Select-Object statement and choosing which columns to return.
In the second step, we review the contents of the Get-Disk function to learn how it works. Because this command is a function, we can use Get-Content to view the contents of the function. This will return the full content of the script, but in this case we are only interested in the OutputType. In this line, we see that the function retrieves its content from WMI at the ROOTMicrosoftWindowsStorageMSFT_Disk namespace and class.
Finally, we query WMI directly using the namespace and class previously identified. To perform this we use Get-WmiObject to search WMI directly. We use the –Namespace switch to connect to the ROOTMicrosoftWindowsStorage namespace. We use the –Class switch to return all objects in the MSFT_Disk class. This information is the same as previously returned, confirming the location is the same.
There’s more…
In addition to the disk values shown here, there are several additional PowerShell commands and WMI locations to report hardware inventory. Only a few of these inventory types have been converted to in-built PowerShell functions, the remainder needs to be queried directly against WMI. Examples of additional counters are as follows:
-
Logical disk
Get-Disk -CimSession $myCim
-
Physical disk
Get-PhysicalDisk -CimSession $myCim
-
Network adapters
Get-NetAdapter -CimSession $myCim
-
System enclosure
Get-WmiObject -ComputerName $TargetSystem ` -Class Win32_SystemEnclosure
-
Computer system
Get-WmiObject -ComputerName $TargetSystem ` -Class Win32_ComputerSystemProduct
-
Processor
Get-WmiObject -ComputerName $TargetSystem -Class Win32_Processor
-
Physical Memory
Get-WmiObject -ComputerName $TargetSystem -Class Win32_ PhysicalMemory
-
CD-Rom
Get-WmiObject -ComputerName $TargetSystem -Class Win32_CDromDrive
-
Sound card
Get-WmiObject -ComputerName $TargetSystem -Class Win32_SoundDevice
-
Video card
Get-WmiObject -ComputerName $TargetSystem ` -Class Win32_VideoController
-
BIOS
Get-WmiObject -ComputerName $TargetSystem -Class Win32_BIOS
Inventorying the installed software
In addition to inventorying a system’s hardware, it is often necessary to inventory the installed software. There are two primary methods to query the installed software: using the Microsoft Installer, and the Uninstall registry key. These two locations generally return the same information, however as we will see there are different uses for each.
How to do it…
Complete the following to review the installed software:
-
Get installed features.
Get-WindowsFeature | Where-Object Install`State -EQ "Installed"
-
Return software inventory via MSI.
Get-WmiObject -Class Win32_Product
-
Open event viewer and review the system event logs. Note the multiple Event ID 1035 messages as shown in the following screenshot:
-
Return inventory via a registry.
$HKLM = 2147483650 (([wmiclass]"rootdefault:stdregprov").EnumKey($HKLM, ` "SoftwareMicrosoftWindowsCurrentVersionUninstall")).sNames
-
Return installed patches.
Get-WmiObject -Class Win32_QuickFixEngineering
How it works…
We start by using Get-WindowsFeature to list the features installed in our Windows 2012 Server. This command returns all of the installed features and roles on the current server. If you are unfamiliar with a system, this is a great method to know what Windows services include.
In the second step, we use WMI to query the Win32_Product class. This class interacts with the MSI packages on your system and returns a list of all packages currently installed. However, this command should be used with caution as it also causes the MSI packages to be reconfigured, or reset to their default configurations. If we open Event Viewer and review the Application, log on your system after executing this task, we will notice a large number of Event ID 1035.
In the fourth step, we use WMI to query the registry and return a list of applications. We start by defining the variable $HKLM and assigning the value 2147483650 which is used by WMI to reference the HKey_Local_Machine registry hive. We then query the results from the SoftwareMicrosoftWindowsCurrentVersionUninstall key. This returns information used by the Programs control panel icon. Often times this list will be different from the previous list because not all applications are installed as MSI packages, and because not all MSI packages appear in the Programs list.
Lastly, we return the installed hotfixes. Most Microsoft hotfixes add an entry to the Win32_QuickFixEngineering WMI namespace when they are installed. This provides a quick and simple method to identify which updates are installed on a system.
