Trouble with WMI filter

Question

I've got a notepad.exe started in my session :

gwmi -Query "Select CommandLine from Win32_Process where CommandLine='C:\Windows\system32\notepad.exe'"

gives

Get-WmiObject : Demande non valide
Au niveau de ligne : 1 Caractère : 5
+ gwmi <<<<  -Query "Select CommandLine from Win32_Process where CommandLine='C:\Windows\system32\notepad.exe'"
    + CategoryInfo          : InvalidOperation: (:) [Get-WmiObject], ManagementException
    + FullyQualifiedErrorId : GetWMIManagementException,Microsoft.PowerShell.Commands.GetWmiObjectCommand

I test :

gwmi -Query "Select CommandLine from Win32_Process where CommandLine='C:\\Windows\\system32\\notepad.exe'"

It gives nothing

gwmi -Query "Select CommandLine from Win32_Process where CommandLine LIKE '%C:\\Windows\\system32\\notepad.exe%'"

Works perfectly

__GENUS          : 2
__CLASS          : Win32_Process
__SUPERCLASS     :
__DYNASTY        :
__RELPATH        :
__PROPERTY_COUNT : 1
__DERIVATION     : {}
__SERVER         :
__NAMESPACE      :
__PATH           :
CommandLine      : "C:\Windows\system32\notepad.exe"

Perhaps it's a trouble with wildcards caracters between PowerShell and WMI, but anyone can help me make filter CommandLine='C:\Windows\system32\notepad.exe' working

What's the value of CommandLine on the found (when found) Win32_Process instance? Eg. here the CommandLine value includes double quotes. — Richard
– Richard, Commented Oct 6, 2011 at 10:38
I Edit the question to show the value if th propertie when it works. If you look at WMBEMTEST.EXE CommandLine is one ofthe properties of WIN32_Process. — JPBlanc
– JPBlanc, Commented Oct 6, 2011 at 11:38
the issue is that CommandLine is surrounded by ". how escape " in gwmi query? — CB.
– CB., Commented Oct 6, 2011 at 11:43

craika · Accepted Answer · 2011-10-06 11:44:50Z

1

The value of the CommandLine property contains quotes, so they need to be escaped as well.

A working, but horrible string is:

gwmi -Query "Select * from Win32_Process where CommandLine = '`"c:\\windows\\system32\\notepad.exe`"'"

answered Oct 6, 2011 at 11:44

craika

1,1829 silver badges9 bronze badges

Sign up to request clarification or add additional context in comments.

11 Comments

CB. Over a year ago

have you tested it? return nothing!

JPBlanc Over a year ago

I turn arroud it, thanks that just what I was looking for. Ijust don't see that there were "" in WBEMTEST.EXE.

CB. Over a year ago

@craika: sure! but for me return nothing! why now?

JPBlanc Over a year ago

@Christian It works for me too, don't you forgot to start a notepad before running test ? ;o) I just copy past.

CB. Over a year ago

INCREDIBLE! in my box commandLine have an extra space after last quote: '(backtricks)"c:\\windows\\system32\\notepad.exe(backtricks)" '".

|

Richard · Accepted Answer · 2011-10-06 11:59:41Z

0

You need to include the quotes, but as I can't recall how to escape them in WQL, I would do it in PSH:

gwmi -class Win32_Process -filter "CommandLine like '`"C:\\Windows\\system32\\notepad.exe`"'"

Filter expression is in double quotes, with the string argument to LIKE in single quotes. The double quotes that are part of that argument need to be quoted from PowerShell.

answered Oct 6, 2011 at 11:59

Richard

110k21 gold badges214 silver badges279 bronze badges

Comments

funny · Accepted Answer · 2011-10-12 10:21:08Z

0

Get-Process | ? {$_.Path -eq 'C:\Windows\system32\notepad.exe'}

Get-Process | ? {$_.processname -eq 'notepad'}

answered Oct 12, 2011 at 10:21

funny

1

Collectives™ on Stack Overflow

Trouble with WMI filter

3 Answers 3

11 Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

11 Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related