Win32_Service to Get-Member makes a double output?

by sponsen at 2013-03-12 06:00:12

I’m doing the following oneliner, and was wondering why im getting 2 outputs:

Get-CimInstance -Namespace root/CIMV2 -ClassName Win32_Service | gm

TypeName: Microsoft.Management.Infrastructure.CimInstance#root/CIMV2/Win32_Service
TypeName: Microsoft.Management.Infrastructure.CimInstance#root/CIMV2/Win32_TerminalService

This doesn’t happen if i try the same on the Win32_Process.

Anyone have an idea why this is happening?
by MattG at 2013-03-12 15:47:52
Great question!

It’s likely that the only Win32_TerminalService you’re seeing in that list is the TermService service (duh ;D). The following code will show you which objects derive from the Win32_TerminalService class:
$Services = Get-CimInstance -Namespace root/CIMV2 -ClassName Win32_Service
$Services | Where-Object {$.PSObject.TypeNames[0] -eq 'Microsoft.Management.Infrastructure.CimInstance#root/CIMV2/Win32_TerminalService'}
Terminal services should be returned. You can see that this object derives from the Win32_Service class with the following command:
$Services |
Where-Object {$
.PSObject.TypeNames[0] -eq 'Microsoft.Management.Infrastructure.CimInstance#root/CIMV2/Win32_TerminalService'} |
ForEach-Object { $_.PSObject.TypeNames }
You’ll see that Win32_TerminalService is derived from Win32_Service. So what inference can be made about the Get-CimInstance cmdlet? This implies that Get-CimInstance returns all instances of classes and their respective subclasses. To test this, run the following and be prepared to get a ton of output:
Get-CimInstance -Namespace root/CIMV2 -ClassName CIM_ManagedSystemElementCIM_ManagedSystemElement is at the root of every CIM instance so the above command returns every CIM instance available. I hope this helps explain the curious behavior you’re seeing!
by sponsen at 2013-03-15 23:47:27
So, what you are basically saying is that Win32_TerminalService is a childitem of Win32_Service? I had that option in mind when i first saw this, but was put of by the naming convention - because in my head, a child of Win32_Service would be called Win32_Service<subname>, not the other way arround - but hey, when was Wmi obvious in the first place.

But i guess it makes sense in some sort of way, even though PowerShell sure isn’t reveling this the easy way :slight_smile:

by MattG at 2013-03-16 04:57:39
Right. Win32_TerminalService is a subclass of Win32_Service. The MSDN documentation will confirm this for you.

You’re right though. WMI is far from intuitive. :smiley: Thanks for asking the question though. I hadn’t realized that Get-CimInstance returned all classes and subclasses until I started to investigate you question.