Querying with WQL
The WMI Query Language (WQL) is a subset of standard American National Standards Institute Structured Query Language (ANSI SQL) with minor semantic changes to support WMI.
For a complete list of supported WQL keywords, see WQL (SQL for WMI). Using SQL keywords for object or property names may restrict a query from being parsed. The following SQL keywords are restricted: NULL, TRUE, and FALSE.
Queries can use the WHERE clause for extension and customization, although it is not required. The WHERE clause is made up of a property or keyword, an operator, and a constant. All WHERE clauses must specify one of the predefined operators that are included in WQL. For more information about syntax, see WHERE Clause. For more information about valid WQL operators, see WQL Operators.
As with other SQL query strings, you can escape your queries.
WQL supports the following types of queries:
Data queries are used to retrieve class instances and data associations. They are the most commonly used type of query in WMI scripts and applications. For more information about the syntax of data queries, see Requesting Class Instance Data. For more information about associations, see Declaring an Association Class.Note WQL does not support queries of array datatypes.
The following data query example requests the event log file named "Application" from all instances of Win32_NTLogEvent.
Consumers use event queries to register to receive notification of events. Event providers use event queries to register to support one or more events. For more information about event queries, see Receiving Event Notifications.
The following example event query by a temporary event consumer requests notification when a new instance of a class derived from Win32_NTLogEvent is created.
strComputer = "." Set objWMIService = GetObject("winmgmts:\\" _ & strComputer & "\root\CIMV2") Set objEvents = objWMIService.ExecNotificationQuery _ ("SELECT * FROM __InstanceModificationEvent WITHIN 10 WHERE " & _ "TargetInstance ISA 'Win32_Service'" & _ " AND TargetInstance._Class = 'win32_TerminalService'") i = TRUE Do While i = TRUE Set strReceivedEvent = objEvents.NextEvent 'report an event Wscript.Echo "An event has occurred." Loop
Schema queries are used to retrieve class definitions (rather than class instances) and schema associations. Class providers use schema queries to specify the classes that they support when they register. For more information about schema queries, see Retrieving Class Definitions.
The following example schema query shows the special syntax.