CIM/WMI is most commonly used to query information or configuration on a device. Thof a class that represents a configuration, process, user etc. In PowerShell there are multiple ways to access these classes and instances, but the most common ways are by using the Get-CimInstance (CIM) or Get-WmiObject (WMI) cmdlets.
You can list all instances of a class.
CIM:
> Get-CimInstance -ClassName Win32_Process
ProcessId Name HandleCount WorkingSetSize VirtualSize
--------- ---- ----------- -------------- -----------
0 System Idle Process 0 4096 65536
4 System 1459 32768 3563520
480 Secure System 0 3731456 0
484 smss.exe 52 372736 2199029891072
....
....
WMI:
Get-WmiObject -Class Win32_Process
You can apply a filter to only get specific instances of a CIM/WMI-class. Filters are written using WQL (default) or CQL (add -QueryDialect CQL). -Filter uses the WHERE-part of a full WQL/CQL-query.
CIM:
Get-CimInstance -ClassName Win32_Process -Filter "Name = 'powershell.exe'"
ProcessId Name HandleCount WorkingSetSize VirtualSize
--------- ---- ----------- -------------- -----------
4800 powershell.exe 676 88305664 2199697199104
WMI:
Get-WmiObject -Class Win32_Process -Filter "Name = 'powershell.exe'"
...
Caption : powershell.exe
CommandLine : "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe"
CreationClassName : Win32_Process
CreationDate : 20160913184324.393887+120
CSCreationClassName : Win32_ComputerSystem
CSName : STACKOVERFLOW-PC
Description : powershell.exe
ExecutablePath : C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe
ExecutionState :
Handle : 4800
HandleCount : 673
....
You can also use a WQL/CQL-query to query and filter instances.
CIM:
Get-CimInstance -Query "SELECT * FROM Win32_Process WHERE Name = 'powershell.exe'"
ProcessId Name HandleCount WorkingSetSize VirtualSize
--------- ---- ----------- -------------- -----------
4800 powershell.exe 673 88387584 2199696674816
Querying objects in a different namespace:
CIM:
> Get-CimInstance -Namespace "root/SecurityCenter2" -ClassName AntiVirusProduct
displayName : Windows Defender
instanceGuid : {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
pathToSignedProductExe : %ProgramFiles%\\Windows Defender\\MSASCui.exe
pathToSignedReportingExe : %ProgramFiles%\\Windows Defender\\MsMpeng.exe
productState : 397568
timestamp : Fri, 09 Sep 2016 21:26:41 GMT
PSComputerName :