I am enumerating installed applications using WMI, and this block is taking a relatively long time to complete no matter how I structure it. It takes 13 seconds in my environment every time. Is there a better (faster) way to check if a program is installed? (I'm using iTunes as an example program to check for)
private static string Timestamp
{
get { return DateTime.Now.ToString("HH:mm:ss.ffff"); }
}
private static void LoadInstalledPrograms()
{
List<string> installedPrograms = new List<string>();
Console.WriteLine("0 - {0}", Timestamp);
ManagementObjectSearcher mos = new ManagementObjectSearcher("SELECT * FROM Win32_Product");
Console.WriteLine("1 - {0}", Timestamp);
ManagementObjectCollection managementObjectCollection = mos.Get();
Console.WriteLine("2 - {0}", Timestamp);
foreach (ManagementObject mo in managementObjectCollection)
{
installedPrograms.Add(mo["Name"].ToString());
}
Console.WriteLine("3 - {0}", Timestamp);
Console.WriteLine("Length - {0}", installedPrograms.Count);
}
SELECT * FROM Win32_Product
0 - 08:08:51.3762
1 - 08:08:51.3942
2 - 08:08:51.4012
3 - 08:09:04.8326
Length - 300
SELECT * FROM Win32_Product WHERE name = 'iTunes'
0 - 08:14:17.6529
1 - 08:14:17.6709
2 - 08:14:17.6779
3 - 08:14:31.0332
Length - 1
SELECT * FROM Win32_Product WHERE name LIKE 'iTunes'
0 - 08:16:38.2719
1 - 08:16:38.2899
2 - 08:16:38.2999
3 - 08:16:51.5113
Length - 1
SELECT name FROM Win32_Product WHERE name LIKE 'iTunes'
0 - 08:19:53.9144
1 - 08:19:53.9324
2 - 08:19:53.9394
3 - 08:20:07.2794
Length - 1
If you query "Win32_product" the msi-installer checks and validates every product.
The KB article http://support.microsoft.com/kb/974524 shows:
Win32_product Class is not query optimized. Queries such as “select * from Win32_Product where (name like 'Sniffer%')” require WMI to use the MSI provider to enumerate all of the installed products and then parse the full list sequentially to handle the “where” clause. This process also initiates a consistency check of packages installed, verifying and repairing the install. With an account with only user privileges, as the user account may not have access to quite a few locations, may cause delay in application launch and an event 11708 stating an installation failure.
Win32reg_AddRemovePrograms is a much lighter and effective way to do this, which avoids the calls to do a resiliency check, especially in a locked down environment. So when using Win32reg_AddRemovePrograms we will not be calling on msiprov.dll and will not be initiating a resiliency check.
So be careful with "Win32_product".
Update: nice article https://sdmsoftware.com/group-policy-blog/wmi/why-win32_product-is-bad-news/
WMI is taking it's time as you already noticed. Iterating through the registry might do the trick for you.
You might have a look at Get installed applications in a system here on stackoverflow, where both methods are mentioned.
As Bernhard points out, WMI use of Win32_Product initiates an integrity check of the package estate, and will hence be quite slow to use - and in special cases it can trigger an MSI self-repair (I have never seen this happen on my machines).
Instead of WMI, you can use the MSI automation interface directly to enumerate the applications installed via Windows Installer packages (MSI files) on the machine. This is very quick and doesn't touch WMI at all.
See this example: how to find out which products are installed - newer product are already installed MSI windows (full blown, but basic and easy to understand VBScript example - do check it out). There are many properties you can retrieve for each product, please consult the MSDN documentation for the MSI automation interface. The linked sample VBScript code and the MSDN documentation taken together should help you get going quickly I hope.
P.S: I know this is an old question, but this issue keeps coming up (specifically the slowness of WMI) - just for future reference.
As mentioned here Registry is not reliable and WMI is slow. Thus for me the best option was using Windows Installer API. Add msi.dll to your references and then adapt the following code to your needs:
public static string GetVersionOfInstalledApplication(string queryName)
{
string name;
string version;
Type type = Type.GetTypeFromProgID("WindowsInstaller.Installer");
Installer installer = Activator.CreateInstance(type) as Installer;
StringList products = installer.Products;
foreach (string productGuid in products)
{
string currName = installer.ProductInfo[productGuid, "ProductName"];
string currVersion = installer.ProductInfo[productGuid, "VersionString"];
if (currName == queryName)
{
name = currName;
version = currVersion;
return version;
}
}
return null;
}
You Should use SELECT Name FROM Win32_Product in WMI Query, it works for me
SELECT * make Load all Data Members, so using it are taking much time
Powershell 5.1 has "get-package" instead.
get-package *chrome*
Name Version Source ProviderName
---- ------- ------ ------------
Google Chrome 109.0.5414.75 msi
Related
since some time now I try to figure out how to correctly setup this new UWF (Unified Write Filter). Unfortunately it seems there is only documentation for Win 8.1 industry (here), not for Win 10. I hope there were no relevant changes since.
I also asked this on the WindowsDevCenter but got no response so far.
Here is my problem:
With the WMI providers I got UWF enabled by now (UWF_Filter.Enable()), but I cannot protect any volume.
Also the volume list looks very strange: There are 4 entrys, everyone is with CurrentSession=True.
The first is for an volume with no drive letter, only a volume id.
The second is for C:
and then there are 2 identical for D: .
Should'nt there normally be 2 entrys per volume, one where CurrentSession is true and one where its false, meaning its the setting applied after reboot?
If I try to execute Protect on the ManagementObject with DriveLetter=C: I get an Access denied exception, I assume because its the object for the current session.
Also if I try uwfmgr.exe Volume Protect C: on the console it simply hangs: no reaction, no error, only a forever blinking cursor. EDIT: it turned out this was a problem caused by another installed software. See also below.
Do I have to enable or disable or do anything else before I can protect volumes?
Thanks in advance,
Sebastian
My system:
Windows 10 IOT Enterprise 2016 LTSB x64
1 SSD 250GB with Boot, C: and D:
Edit:
Here I asked a follow up question with some other details and a workaround. If I use uwfmgr.exe volume protect c: for example, it works and UWF_Volume now suddenly has (the correct) 2 entries for C:, one for the current and one for the next session.
However I want to avoid this, because IMHO it should be solveable by WMI only.
Edit 2: #sommmen
The partition layout is as following: One disk with 4 partitions.
Boot, 500MB
C:/ , 45GB
unknown, 500MB (Boot-Backup I think)
D:/ , ~200GB
PS:
Please could anyone create the tags uwf and uwfmgr? Would be nice :-)
Missing UWF_Volume instances often appeared after reboot in my tests. But if not, you can create them directly using ManagementClass.CreateInstance().
The problem here is that the official docs are not exactly correct. The description of the UWF_Volume.VolumeName property is:
The unique identifier of the volume on the current system. The
VolumeName is the same as the DeviceID property of the Win32_Volume
class for the volume.
from: https://learn.microsoft.com/en-us/windows-hardware/customize/enterprise/uwf-volume#properties
In fact, the DeviceID needs a slight modification, before using it as value for UWF_Volume.VolumeName:
DeviceID.Substring(4).TrimEnd('\\')
So, after removing prefix \\?\ and removing any trailing slashes you can create instances with CurrentSession=false for the specified device.
This also works in Windows 10 Pro without any uwfmgr.exe. Though, officially not recommended/supported.
Also, I was not able to delete instances, yet. So be sure to add only correct values.
Full Example:
// example value
var DeviceId_From_Win32_Volume = #"\\?\Volume{c2eac053-27e3-4f94-b28c-c2c53d5f4fe1}\";
// example value
var myDriveLetter = "C:";
var myDeviceId = DeviceId_From_Win32_Volume.Substring(4).TrimEnd('\\');
var wmiNamespace = "root\\standardcimv2\\embedded";
var className = "UWF_Volume";
var mgmtScope = new ManagementScope {Path = {NamespacePath = wmiNamespace}};
var mgmtPath = new ManagementPath(className);
var mgmtClass = new ManagementClass(mgmtScope, mgmtPath, null);
// prepare the new object
var newObj = mgmtClass.CreateInstance();
newObj.SetPropertyValue("DriveLetter", myDriveLetter);
newObj.SetPropertyValue("VolumeName", myDeviceId);
newObj.SetPropertyValue("CurrentSession", false);
newObj.SetPropertyValue("CommitPending", false);
newObj.SetPropertyValue("BindByDriveLetter", false);
// create the WMI instance
newObj.Put(new PutOptions {Type = PutType.CreateOnly});
I experience the similar issue in that I could not query the UWF_Volume with CurrentSession=False. However, there's one thing I did that seems to "generate" the UWF_Volume management object with CurrentSession=False. I ran "uwfmgr volume protect c:". Unfortunately, in your case running this causes it to hang.
Could you try running uwfmgr in cmd in admin? Also, if you run "uwfmgr get-config", would you be able to get the current setting of the write filter?
Another thing from your description: you said there are two identical volumes for D:, but if you looks closely at the properties, one would be CurrentSession=True, and the other one is CurrentSession=False. According to the documentation, if you want to make change, you must select the management object (UWF_Volume) with CurrentSession=False.
https://learn.microsoft.com/en-us/windows-hardware/customize/enterprise/uwf-volume
(scroll down to powershell script code sample section)
First of all a volume may have several partitions. They will show up as having the same drive label.
e.g.
C:/ //?/{some guid here}
C:/ //?/{some other guid here}
Now this is common for the %systemDrive% because this has the boot partition.
You can use the commands
mountvol
and
Diskpart
List volume
To figure out the right guid for your need (or you can protect both the boot partition and the system partition). Also using wmi you can look at Win32_volume under namespace cimv2 to get some more insight.
The command line util UWFmgr seems to create an UWF_VOLUME wmi instance once you run the protect command. The docs also hint that you need to create an object yourself.
function Set-ProtectVolume($driveLetter, [bool] $enabled) {
# Each volume has two entries in UWF_Volume, one for the current session and one for the next session after a restart
# You can only change the protection status of a drive for the next session
$nextConfig = Get-WMIObject -class UWF_Volume #CommonParams |
where {
$_.DriveLetter -eq "$driveLetter" -and $_.CurrentSession -eq $false
};
# If a volume entry is found for the drive letter, enable or disable protection based on the $enabled parameter
if ($nextConfig) {
Write-Host "Setting drive protection on $driveLetter to $enabled"
if ($Enabled -eq $true) {
$nextConfig.Protect() | Out-Null;
} else {
$nextConfig.Unprotect() | Out-Null;
}
}
=======> (!) im talking about this comment
# If the drive letter does not match a volume, create a new UWF_volume instance
else {
Write-Host "Error: Could not find $driveLetter. Protection is not enabled."
}
}
The docs however do not provide a method of doing this. For now it seems we need to use the command line util till someone has an example using the WMI provider.
To answer my own question: So far I have only a workaround but no real solution.
It is to check if there is an entry with CurrentSession=False and if not invoke the command directly:
ManagementObjectSearcher ms = new ManagementObjectSearcher(_Scope, new ObjectQuery("select * from UWF_Volume where VolumeName = \"" + volId + "\" AND CurrentSession=\"False\""));
ManagementObjectCollection c = ms.Get();
UInt32 res = 1;
foreach (ManagementObject mo in c)
{
// entry found: do it with WMI
res = (UInt32)mo.InvokeMethod(newState ? "Protect" : "Unprotect", new object[] { });
}
if (c.Count == 1 && res == 0)
// message: success
if (c.Count == 0)
{
// no entry found: invoke cmd
ProcessStartInfo info = new ProcessStartInfo("uwfmgr.exe", "volume " + (newState ? "Protect" : "Unprotect") + #" \\?\" + volId);
Process process = new Process();
info.Verb = "runas"; //needs admin
process.StartInfo = info;
process.Start();
process.WaitForExit();
}
This has the side effect that for a split second a command line window will pop up, but nevertheless it works well.
I searched a lot but did not find any working codes getting SPD tables information via C#. Out there there are lots of softwares which get this info but HOW?
as shown in the image, for RAM devices, you can see Manufacture's name which can not be retrieve at all by WMI etc
If there is a DLL for using in C# will be perfect also
After some Research found this:
https://github.com/sapozhnikovay/SMBIOS
but it can not read table 17 to get memory device information.
Once I was researching about this, you need to get this information through SMBUS (not SMBIOS). But you need to create a driver (WDM in C/C++) to access this information.
Make sure you have added System.Management as a reference.
Here is a string that will return almost any information you want from the component :
private string getComponent(string hwClass, string syntax)
{
ManagementObjectSearcher mos = new ManagementObjectSearcher("root\\CIMV2", "SELECT * FROM " + hwClass);
foreach (ManagementObject mj in mos.Get())
{
return Convert.ToString(mj[syntax]);
}
return null;
}
Using the string would look like this, say on a button click :
label1.Text = getComponent("Win32_PhysicalMemory", "SerialNumber");
I tested it and it returned a serial number, you can also look at the list of things you can put in like manufacturer, name, capacity etc.
I got all of this information from this YouTube video.
You can find all of the devices and their properties here (CPU, GPU, etc.)
I'm writing a WMI Provider and I've managed to retrieve all info on the Computer System and Hardware Classes but cannot get data I want from the Performance Counter Classes. (Win32 Classes)
Looking through the MSDN documentation and using examples they provide, I've come up with a shell script that should return all properties of the Win32_PerfFormattedData abstract base class.
Script:
$osClass = New-Object System.Management.ManagementClass Win32_PerfFormattedData
$osClass.Options.UseAmendedQualifiers = $true
# Get the Properties in the class
$properties = $osClass.Properties
"This class has {0} properties as follows:" -f $properties.count
# display the Property name, description, type, qualifiers and instance values
foreach ($property in $properties) {
"Property Name: {0}" -f $property.Name
"Description: {0}" -f $($property.Qualifiers["Description"].Value)
"Type: {0}" -f $property.Type
"-------"
}
(referenced from here)
The problem is that I'm only retrieving the properties from it's base class Win32_Perf
EDIT
After doing more research, I found this on MSDN:
The WMI formatted class name for a counter object is of the form "Win32_PerfFormattedData_service_name_object_name"
I am trying to get the service_name's that are in the Win32_PerfFormattedData and the object_name's within those services.
I'm unsure whether getting the properties is how I want to go about this now but I cannot find any documentation to get the services. Are they the same thing? And, if not, how can I get the info I require? (service_name's & object_name's)
I've also tried this in some C# code and get the same result:
ManagementClass processClass = new ManagementClass();
processClass.Path = new ManagementPath("Win32_PerfFormattedData");
PropertyDataCollection properties = processClass.Properties;
Console.WriteLine("\nProperties:");
foreach (PropertyData property in properties)
{
Console.WriteLine(property.Name);
}
And I tried retrieving the methods to check if that is what I wanted but nothing is returned:
Console.WriteLine("Methods: ");
foreach (MethodData method in methods)
{
Console.WriteLine(method.Name);
}
EDIT 2
Is there another way to retrieve this data? I've looked all through the MSDN documentation on the WMI and I think to get the information I want, I have to access that class (Win32_PerfFormattedData). Sorts of values I want to retrieve:
CPU
RAM
Drives (SSD/HDD)
Processes
OS
GPU
I've retrieved a few classes that will give basic information about some of these but will not provide up to date data on, for example, the temperature of each logical processor. I've managed to get 1 service from the class Win32_PerfFormattedData_PerfOS_Processor which provides the load % of each logical processor but that class must holds other services which I need.
Win32_PerfFormattedData_* classes are located under the "root\cimv2" namespace. To enumerate these classes (and get the service names) you run the following WQL query against that namespace:
SELECT * FROM meta_class WHERE __Class LIKE "Win32_PerfFormattedData%"
Actually you can omit the namespace (at least with ManagementObjectSearcher) in which case the search occurs everywhere. Here is how to search through WMI with C#:
void SearchWmi()
{
ManagementObjectSearcher searcher = new ManagementObjectSearcher("SELECT * FROM meta_class WHERE __Class LIKE \"Win32_PerfFormattedData%\"");
foreach (ManagementClass wmiClass in searcher.Get())
{
Console.WriteLine(wmiClass["__CLASS"].ToString());
}
}
You need to add referece to System.Management as well as the corresponding using directive.
You could find performance data about the:
CPU: Win32_PerfFormattedData_Processor
RAM: Win32_PerfFormattedData_Memory
OS: Win32_PerfFormattedData_System
Drives: Win32_PerfFormattedData_PerfDisk_*
Processes: Win32_PerfFormattedData_PerfProc_*
I have no idea about the GPU. Most likely it is driver dependent.
There are numerous WMI explorer tools out there with a UI and all the good stuff. Have you tried some? I use the "WMI Explorer 2.0"
You can download it from here
I need to check if the power of a display/monitor (is it ON or OFF ?).
I've tried with WMI, using the Win32_DesktopMonitor and check the "Availability", but the value returned is always 3 (powered on), even when the monitor is physically turned off.
Now, looking at a few threads here on StackOverflow, there's one direction I'd like to follow and it's the use of IMSVidDevice Interface, but I have no clue how to use it.
I have this link http://msdn.microsoft.com/en-us/library/windows/desktop/dd694527(v=vs.85).aspx to start.
It talks about using segment.h and segment.idl. There's also the mention of msvidctl.h.
I found an MS Video Control 1.0 Type Library which seems to be what I'm looking for (it has an IMSVidDevice interface defined) but I can't figure out how to use this library.
var devices = new MSVidCtlLib.MSVidOutputDevices();
Console.WriteLine("Found {0} devices", devices.Count);
foreach (MSVidCtlLib.IMSVidOutputDevice dev in devices)
{
Console.WriteLine("{0}: {1} - {2}", dev.Name, dev.Status, dev.Power);
}
But the devices.count is always zero. I have two monitors on my dev box.
What am I missing ?
How to check current machine type? laptop or desktop ?
I got this from http://blog.csdn.net/antimatterworld/archive/2007/11/11/1878710.aspx ,it works well on my home machine(Win2003 on laptop), it returns "Portable", but failed on my work machine(Vista on laptop), it returns "Other".
here is the code:
public enum ChassisTypes
{
Other = 1,
Unknown,
Desktop,
LowProfileDesktop,
PizzaBox,
MiniTower,
Tower,
Portable,
Laptop,
Notebook,
Handheld,
DockingStation,
AllInOne,
SubNotebook,
SpaceSaving,
LunchBox,
MainSystemChassis,
ExpansionChassis,
SubChassis,
BusExpansionChassis,
PeripheralChassis,
StorageChassis,
RackMountChassis,
SealedCasePC
}
public static ChassisTypes GetCurrentChassisType()
{
ManagementClass systemEnclosures = new ManagementClass("Win32_SystemEnclosure");
foreach (ManagementObject obj in systemEnclosures.GetInstances())
{
foreach (int i in (UInt16[ ])(obj["ChassisTypes"]))
{
if (i > 0 && i < 25)
{
return (ChassisTypes)i;
}
}
}
return ChassisTypes.Unknown;
}
Here's a good Microsoft article that suggests looking at a few other WMI classes to get a better idea of whether the computer is a laptop or desktop:
http://technet.microsoft.com/en-us/library/cc180825.aspx
Win32_SystemEnclosure, ChassisTypes(1)=10
Win32_Battery or Win32_PortableBattery
Win32_PCMCIAController
Win32_DriverVXD.Name = "pccard"
Win32_ComputerSystem.Manufacturer
Win32_ComputerSystem.Model
And it also suggests to look in the registry for the Power scheme.
Well, I may be attempting to raise the dead here, but I would suggest that the most reliable method of determining a laptop would be the present of a lid status switch.
See GetPwrCapabilities and System_power_Capabilities
There is no need for both Other and Unknown check.
Change the condition to i > 1 && i < 25 and remember ChassisTypes is an array where OS returns what ever he thinks your system is.
It is possible to match more than single type. Your code only returns the first match.
See http://www.microsoft.com/technet/scriptcenter/resources/qanda/sept04/hey0921.mspx and http://msdn.microsoft.com/en-us/library/aa387204(VS.85).aspx which states that:
This documentation is derived from the CIM class descriptions published by the DMTF.
Presumably, that means the manufacturer had to provide some information for Windows to be able to discover it.
I don't think there is a definitive right answer for this and I've found WMI unreliable for it but I have been using the Win32 function GetSystemPowerStatus() to determine if there is a system battery, obviously system battery == portable computer.
I've never tried this on a desktop with a UPS though?!
I am pretty sure that this will depend on whether the manufacturer has bothered to provide that data on the current chipset. If they have not, then "Other" is the best you can do.
Check out this somewhat related article, which also suggests querying the BIOS directly.
In order to check if machine is laptop or desktop you can try to check battery status, using SystemPowerCapabilites.LidPresent or both of them.
Battery:
if(SystemInformation.PowerStatus.BatteryChargeStatus ==BatteryChargeStatus.NoSystemBattery){
//desktop
}
else{
//laptop
}
SystemPowerCapabilites.LidPresent:
public SYSTEM_POWER_CAPABILITIES getSystemPowerCapabilites(){
{
SYSTEM_POWER_CAPABILITIES systemPowerCapabilites;
GetPwrCapabilities(out systemPowerCapabilites);
return systemPowerCapabilites;
}
getSystemPowerCapabilites().LidPresent;
GetPwrCapabilities definition: http://www.pinvoke.net/default.aspx/powrprof/GetPwrCapabilities.html
read registry key from HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pcmcia, the ‘Start’ value, it's laptop if start =0, otherwise it's desktop machine if start doesn't exist or start != 0.