Get-WMIQualifierValue

When you create WQL queries for Get-WMIObject you sometimes need to know some property values in advance. A good example is when you want to query the event logs for a specific EventType, you cant do:

PS > Get-WmiObject -class Win32_NTLogEvent -filter "EventType='error'"
Get-WmiObject : Invalid query

It yields an error because EventType expects a numeric value:

So, how do you know which values to use? One way is to find them on MSDN. That was my main method, but not anymore. With Get-WMIQualifierValue you will get the value names and their corresponding numeric values for all class properties that support the 'Values' and 'ValueMap' qualifiers.

In a nutshell, a value map is an array linked to a property with the Value and ValueMap qualifiers, kind of a hash table key/value pair if you will. Get-WMIQualifierValue is also compatible with all versions of PowerShell.

function Get-WMIQualifierValue($Class){
	
	if($PSVersionTable)
	{	#PowerShell v2 detected
		$wmi = gwmi meta_class -filter "__Class = '$class'" -amended
	} 
	else
	{	#PowerShell v1 detected
		$wmi=[wmiclass]$class
		$wmi.psbase.options.useAmendedQualifiers=$true		
	}	
	

	foreach ($p in $wmi.psbase.properties)
	{
		$names = $p.qualifiers | foreach {$_.name}

		if($names -contains "values" -AND $names -contains "valuemap")
		{
			$pLen = "-"* ($p.name.length)
			write-host ("`n$pLen`n"+$p.name+"`n$pLen") -fore yellow
			$value=$p.qualifiers["Values"].value
			$meaning=$p.qualifiers["ValueMap"].value

			$map = $value | select Value,@{n="Meaning";e={$_}}
			1..$map.length | foreach { $map[$_-1].value=$meaning[$_-1] }	
			$map | ft -a
		}
	}
}
 

Here is a sample output for the Win32_NTLogEvent WMI class:

PS > Get-WMIQualifierValue -class Win32_NTLogEvent

---------
EventType
---------

Value Meaning
----- -------
1     error
2     warning
3     information
4     security audit success
5     security audit failure



----
Type
----

Value Meaning
----- -------
1     error
2     warning
4     information
8     audit success
16    audit failure
 

Another example would be to ping a computer, from the (truncated) output you can see that a value of 0 for StatusCode means success (the remote computer is online)

PS > Get-WMIQualifierValue -class Win32_PingStatus 

----------
StatusCode
---------- 

Value Meaning
----- -------
0     Success
11001 Buffer Too Small
11002 Destination Net Unreachable
11003 Destination Host Unreachable
11004 Destination Protocol Unreachable
11005 Destination Port Unreachable
11006 No Resources
11007 Bad Option
11008 Hardware Error
11009 Packet Too Big
11010 Request Timed Out
11011 Bad Request
11012 Bad Route
11013 TimeToLive Expired Transit
11014 TimeToLive Expired Reassembly
11015 Parameter Problem
11016 Source Quench
11017 Option Too Big
11018 Bad Destination
11032 Negotiating IPSEC
11050 General Failure 

Armed with this knowledge you can construct the following WMI ping check:

$ping = gwmi win32_pingstatus -filter "address='comp1'"

if($ping.StatusCode -eq 0)
{
    write-host "comp1 is online"
}
else
{
    write-host "comp1 is not available"
}