Win32_SystemDriver - powershell.one

The Win32_SystemDriverâWMI class represents the system driver for a base service.

Methods

Win32_SystemDriver has 10 methods:

Method	Description
Change	Class method that modifies a service.
ChangeStartMode	Class method that modifies the start mode of a service.
Create	Class method that creates a new service.
Delete	Class method that deletes an existing service.
InterrogateService	Class method that requests that the service update its state to the service manager.
PauseService	Class method that attempts to place the service in the paused state.
ResumeService	Class method that attempts to place the service in the resumed state.
StartService	Class method that attempts to place the service into its startup state.
StopService	Class method that places the service in the stopped state.
UserControlService	Class method that attempts to send a user-defined control code to a service.

Learn more about Invoke-CimMethod and how to invoke commands. Click any of the methods listed above to learn more about their purpose, parameters, and return value.

Properties

Win32_SystemDriver returns 22 properties:

'AcceptPause','AcceptStop','Caption','CreationClassName','Description',
'DesktopInteract','DisplayName','ErrorControl','ExitCode','InstallDate','Name','PathName',
'ServiceSpecificExitCode','ServiceType','Started','StartMode','StartName','State','Status',
'SystemCreationClassName','SystemName','TagId'

Unless explicitly marked as writeable, all properties are read-only. Read all properties for all instances:

Get-CimInstance -ClassName Win32_SystemDriver -Property *

Most WMI classes return one or more instances.

When Get-CimInstance returns no result, then apparently no instances of class Win32_SystemDriver exist. This is normal behavior.

Either the class is not implemented on your system (may be deprecated or due to missing drivers, i.e. CIM_VideoControllerResolution), or there are simply no physical representations of this class currently available (i.e. Win32_TapeDrive).

AcceptPause

BOOLEAN

Service can be paused.

Get-CimInstance -ClassName Win32_SystemDriver | Select-Object -Property Name, AcceptPause

AcceptStop

BOOLEAN

Service can be stopped.

Get-CimInstance -ClassName Win32_SystemDriver | Select-Object -Property Name, AcceptStop

Caption

STRING MAX 64 CHAR

Short description of the object.

Get-CimInstance -ClassName Win32_SystemDriver | Select-Object -Property Name, Caption

CreationClassName

STRING

Name of the first concrete class to appear in the inheritance chain used in the creation of an instance. When used with the other key properties of the class, this property allows all instances of this class and its subclasses to be uniquely identified.

Get-CimInstance -ClassName Win32_SystemDriver | Select-Object -Property Name, CreationClassName

Description

STRING

Description of the object.

Get-CimInstance -ClassName Win32_SystemDriver | Select-Object -Property Name, Description

DesktopInteract

BOOLEAN

This service can create or communicate with windows on the desktop.

Get-CimInstance -ClassName Win32_SystemDriver | Select-Object -Property Name, DesktopInteract

DisplayName

STRING

Display name of the service. This string has a maximum length of 256 characters. The name is case-preserved in the Service Control Manager. DisplayName comparisons are always case-insensitive.

Constraints: Accepts the same value as the Name property.

Example: “Atdisk”

Get-CimInstance -ClassName Win32_SystemDriver | Select-Object -Property Name, DisplayName

ErrorControl

STRING

Severity of the error if this service fails to start during startup. This value indicates the action taken by the startup program if failure occurs. All errors are logged by the computer system.

User is not notified.

User is notified.

System is restarted with the last-known-good configuration.

System attempts to restart with a good configuration.

Cause of the failure is unknown.

Get-CimInstance -ClassName Win32_SystemDriver | Select-Object -Property Name, ErrorControl

ExitCode

UINT32

Windows error code defining any problems encountered in starting or stopping the service. This property is set to ERROR_SERVICE_SPECIFIC_ERROR (1066) when the error is unique to the service represented by this class, and information about the error is available in the ServiceSpecificExitCode property. The service sets this value to NO_ERROR when running, and again upon normal termination.

Get-CimInstance -ClassName Win32_SystemDriver | Select-Object -Property Name, ExitCode

InstallDate

DATETIME

Object was installed. This property does not need a value to indicate that the object is installed.

Get-CimInstance -ClassName Win32_SystemDriver | Select-Object -Property Name, InstallDate

Name

KEY PROPERTY STRING

Unique identifier for the service which provides an indication of the functionality that is managed. This functionality is described in more detail in the object Description property.

Get-CimInstance -ClassName Win32_SystemDriver | Select-Object -Property Name

PathName

STRING

Fully qualified path to the service binary file that implements the service.

Example: “\SystemRoot\System32\drivers\afd.sys”

Get-CimInstance -ClassName Win32_SystemDriver | Select-Object -Property Name, PathName

ServiceSpecificExitCode

UINT32

Service-specific error code for errors that occur while the service is either starting or stopping. The exit codes are defined by the service represented by this class. This value is only set when the ExitCode property value is ERROR_SERVICE_SPECIFIC_ERROR (1066).

Get-CimInstance -ClassName Win32_SystemDriver | Select-Object -Property Name, ServiceSpecificExitCode

ServiceType

STRING

Type of service provided to calling processes.

The values are:

Kernel Driver (“Kernel Driver”)

File System Driver (“File System Driver”)

Adapter (“Adapter”)

Recognizer Driver (“Recognizer Driver”)

Own Process (“Own Process”)

Share Process (“Share Process”)

Interactive Process (“Interactive Process”)

Get-CimInstance -ClassName Win32_SystemDriver | Select-Object -Property Name, ServiceType

Started

BOOLEAN

Service has been started.

Get-CimInstance -ClassName Win32_SystemDriver | Select-Object -Property Name, Started

StartMode

STRING

Start mode of the system driver.

Device driver started by the operating system loader (valid only for driver services).

Device driver started by the operating system initialization process. This value is valid only for driver services.

Service to be started automatically by the service control manager during system start up.

Service to be started by the service control manager when a process calls the StartService method.

Service that can no longer be started.

Get-CimInstance -ClassName Win32_SystemDriver | Select-Object -Property Name, StartMode

StartName

STRING

Account name under which the service runs. Depending on the service type, the account name may be in the form of DomainName\Username. The service process will be logged using one of these two forms when it runs. If the account belongs to the built-in domain, .\Username can be specified. If NULL is specified, the service will be logged on as the LocalSystem account. For kernel or system-level drivers, StartName contains the driver object name (that is, \FileSystem\Rdr or \Driver\Xns) which the input and output (I/O) system uses to load the device driver. Additionally, if NULL is specified, the driver runs with a default object name created by the I/O system based on the service name.

Example: “DWDOM\Admin”

Get-CimInstance -ClassName Win32_SystemDriver | Select-Object -Property Name, StartName

State

WRITEABLE STRING

Current state of the base service.

The values are:

Stopped (“Stopped”)

Start Pending (“Start Pending”)

Stop Pending (“Stop Pending”)

Running (“Running”)

Continue Pending (“Continue Pending”)

Pause Pending (“Pause Pending”)

Paused (“Paused”)

Unknown (“Unknown”)

Get-CimInstance -ClassName Win32_SystemDriver | Select-Object -Property Name, State

Status

STRING MAX 10 CHAR

Current status of an object. Various operational and nonoperational statuses can be defined. Available values:

$values = 'Degraded','Error','Lost Comm','No Contact','NonRecover','OK','Pred Fail','Service','Starting','Stopping','Stressed','Unknown'

Get-CimInstance -ClassName Win32_SystemDriver | Select-Object -Property Name, Status

SystemCreationClassName

STRING

Type name of the system that hosts this service.

Get-CimInstance -ClassName Win32_SystemDriver | Select-Object -Property Name, SystemCreationClassName

SystemName

STRING

Name of the system that hosts this service.

Get-CimInstance -ClassName Win32_SystemDriver | Select-Object -Property Name, SystemName

TagId

UINT32

Unique tag value for this service in the group. A value of 0 (zero) indicates that the service has not been assigned a tag. A tag can be used for ordering service startup within a load order group by specifying a tag order vector in the registry located at:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\GroupOrderList.

Tags are only evaluated for Kernel Driver and File System Driver start-type services that have Boot or System start modes.

Get-CimInstance -ClassName Win32_SystemDriver | Select-Object -Property Name, TagId

Examples

List all instances of Win32_SystemDriver

Get-CimInstance -ClassName Win32_SystemDriver

Learn more about Get-CimInstance and the deprecated Get-WmiObject.

View all properties

Get-CimInstance -ClassName Win32_SystemDriver -Property *

View key properties only

Get-CimInstance -ClassName Win32_SystemDriver -KeyOnly

Selecting Properties

To select only some properties, pipe the results to Select-Object -Property a,b,c with a comma-separated list of the properties you require. Wildcards are permitted.

Get-CimInstance always returns all properties but only retrieves the ones that you specify. All other properties are empty but still present. That’s why you need to pipe the results into Select-Object if you want to limit the visible properties, i.e. for reporting.

Selecting Properties

The code below lists all available properties. Remove the ones you do not need:

$properties = 'AcceptPause',
              'AcceptStop',
              'Caption',
              'CreationClassName',
              'Description',
              'DesktopInteract',
              'DisplayName',
              'ErrorControl',
              'ExitCode',
              'InstallDate',
              'Name',
              'PathName',
              'ServiceSpecificExitCode',
              'ServiceType',
              'Started',
              'StartMode',
              'StartName',
              'State',
              'Status',
              'SystemCreationClassName',
              'SystemName',
              'TagId'
Get-CimInstance -ClassName Win32_SystemDriver | Select-Object -Property $properties

Limiting Network Bandwidth

If you work remotely, it makes sense to limit network bandwidth by filtering the properties on the server side, too:

Get-CimInstance -Class Win32_SystemDriver -Property $property | 
Select-Object -Property $property

Selecting Instances

To select some instances, use Get-CimInstance and a WMI Query. The wildcard character in WMI Queries is % (and not “*”).

The parameter -Filter runs a simple query.

Listing all instances where the property Caption starts with “A”

Get-CimInstance -Class Win32_SystemDriver -Filter 'Caption LIKE "a%"' 

Using a WQL Query

The parameter -Query uses a query similar to SQL and combines the parameters -Filter and -Property. This returns all instances where the property Caption starts with “A”, and returns the properties specified:

Get-CimInstance -Query "SELECT SystemName, Started, SystemCreationClassName, DisplayName FROM Win32_SystemDriver WHERE Caption LIKE 'a%'"

Any property you did not specify is still present but empty. You might need to use Select-Object to remove all unwanted properties:
Get-CimInstance -Query "SELECT SystemName, Started, SystemCreationClassName, DisplayName FROM Win32_SystemDriver WHERE Caption LIKE 'a%'" | Select-Object -Property SystemName, Started, SystemCreationClassName, DisplayName

Accessing Remote Computers

To access remote systems, you need to have proper permissions. User the parameter -ComputerName to access one or more remote systems.

Authenticating as Current User

# one or more computer names or IP addresses:
$list = 'server1', 'server2'

# authenticate with your current identity:
$result = Get-CimInstance -ClassName Win32_SystemDriver -ComputerName $list 
$result

Authenticating as Different User

Use a CIMSession object to authenticate with a new identity:

# one or more computer names or IP addresses:
$list = 'server1', 'server2'

# authenticate with a different identity:
$cred = Get-Credential -Message 'Authenticate to retrieve WMI information:'
$session = New-CimSession -ComputerName $list -Credential $cred

$result = Get-CimInstance Win32_SystemDriver -CimSession $session

# remove the session after use (if you do not plan to re-use it later)
Remove-CimSession -CimSession $session

$result

Learn more about accessing remote computers.

Requirements

To use Win32_SystemDriver, the following requirements apply:

PowerShell

Get-CimInstance was introduced with PowerShell Version 3.0, which in turn was introduced on clients with Windows 8 and on servers with Windows Server 2012.

If necessary, update Windows PowerShell to Windows PowerShell 5.1, or install PowerShell 7 side-by-side.

Operating System

Win32_SystemDriver was introduced on clients with WindowsÂ Vista and on servers with Windows ServerÂ 2008.

Namespace

Win32_SystemDriver lives in the Namespace Root/CIMV2. This is the default namespace. There is no need to use the -Namespace parameter in Get-CimInstance.

Implementation

Win32_SystemDriver is implemented in CIMWin32.dll and defined in CIMWin32.mof. Both files are located in the folder C:\Windows\system32\wbem:

explorer $env:windir\system32\wbem
notepad $env:windir\system32\wbem\CIMWin32.mof

PREVIOUSArchive