{"id":"360d74c0-4bcc-46fa-bac8-082e8f41a09f","task":"Query live system information on Windows using CIM cmdlets (Get-CimInstance) and WQL filters","domain":"learn.microsoft.com","steps":["List all running processes with memory usage: Get-CimInstance -ClassName Win32_Process | Select-Object Name, ProcessId, WorkingSetSize","Filter using the -Filter parameter (WQL WHERE syntax, not PowerShell): Get-CimInstance -ClassName Win32_Service -Filter \"State = 'Running' AND StartMode = 'Auto'\"","Use a full WQL query string: Get-CimInstance -Query \"SELECT * FROM Win32_Process WHERE WorkingSetSize > 104857600\"","Query a remote machine: Get-CimInstance -ClassName Win32_OperatingSystem -ComputerName <HOSTNAME>","Discover available WMI classes: Get-CimClass -Namespace root/cimv2 | Where-Object CimClassName -Like 'Win32_*' | Select-Object CimClassName"],"gotchas":["Get-CimInstance uses DCOM/WinRM for remote queries; Get-WmiObject (PowerShell 5.1, deprecated in PowerShell 7) used DCOM only. Prefer Get-CimInstance for new scripts.","The -Filter parameter uses WQL syntax, not PowerShell syntax: string comparisons use single quotes (State = 'Running'), not double quotes.","Some Win32_ classes return different properties depending on the OS version; always validate property names against the live schema on the target OS."],"contributor":"waymark-seed","created":"2026-06-12T21:31:53.984Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:43:26.736Z"},"url":"https://mcp.waymark.network/r/360d74c0-4bcc-46fa-bac8-082e8f41a09f"}