get class-instances

Overview

Query instances of specific WMI classes with custom filtering and property selection. This command provides direct access to WMI data through the SMS Provider, enabling detailed analysis of SCCM objects and configurations.

Syntax

SharpSCCM get class-instances <wmi-class> [options]

Parameters

wmi-class

string

required

The WMI class to query (e.g., “SMS_R_System”)

sms-provider

string

The IP address, FQDN, or NetBIOS name of the SMS Provider to connect to

site-code

string

The three-character site code (e.g., “PS1”)

properties

string

Specify properties to retrieve (can be used multiple times)

where-condition

string

Custom WQL WHERE clause for advanced filtering

count

boolean

Return count of results only

verbose

boolean

Display all class properties

dry-run

boolean

Display the WQL query without execution

Examples

# Query specific class
SharpSCCM get class-instances SMS_R_System -sms SCCM01.corp.local -sc PS1

# Count instances
SharpSCCM get class-instances SMS_Admin -c -sms SCCM01.corp.local -sc PS1

# Select specific properties
SharpSCCM get class-instances SMS_R_System -p Name -p LastLogonUserName -sms SCCM01.corp.local -sc PS1

# Query administrative users
SharpSCCM get class-instances SMS_Admin -p LogonName -p RoleNames -sms SCCM01.corp.local -sc PS1

# Filter with WHERE condition
SharpSCCM get class-instances SMS_R_System -w "Client = 1" -sms SCCM01.corp.local -sc PS1

# Complex filtering
SharpSCCM get class-instances SMS_R_System -w "LastLogonUserName LIKE '%admin%' AND Client = 1" -sms SCCM01.corp.local -sc PS1

# Dry run to see query
SharpSCCM get class-instances SMS_Collection -w "CollectionType = 2" -z -sms SCCM01.corp.local -sc PS1

Required Permissions

SMS Admins local group membership on the SMS Provider server. Additional permissions may be required for specific classes.

Common Classes

Device and User Classes

SMS_R_System:

Device information and properties
Hardware and software inventory
User relationships and logon data

SMS_R_User:

User account information
Domain and authentication data
User group memberships

SMS_R_UserGroup:

User group definitions
Group membership information
Security group analysis

Administrative Classes

SMS_Admin:

Administrative user accounts
Security role assignments
Administrative scope and permissions

SMS_Role:

Security role definitions
Permission sets and capabilities
Role-based access control

SMS_SecuredObject:

Object security and permissions
Access control lists
Security scope assignments

Collection Classes

SMS_Collection:

Collection definitions and properties
Collection types and settings
Collection relationships

SMS_FullCollectionMembership:

Complete collection membership
Member details and properties
Collection-device relationships

WQL Query Examples

SELECT Name, LastLogonUserName, IPAddresses FROM SMS_R_System WHERE Client = 1

SELECT LogonName, RoleNames, DisplayName FROM SMS_Admin

SELECT Name, CollectionID, MemberCount FROM SMS_Collection WHERE CollectionType = 2

SELECT Name, LastLogonTimestamp FROM SMS_R_System WHERE LastLogonTimestamp > '2023-01-01'

Intelligence Gathering

System Reconnaissance

Device Analysis:

# Active SCCM clients
SharpSCCM get class-instances SMS_R_System -w "Client = 1" -sms SCCM01.corp.local -sc PS1

# Admin workstations
SharpSCCM get class-instances SMS_R_System -w "LastLogonUserName LIKE '%admin%'" -sms SCCM01.corp.local -sc PS1

User Intelligence:

# Domain users
SharpSCCM get class-instances SMS_R_User -p UniqueUserName -p FullUserName -sms SCCM01.corp.local -sc PS1

# Administrative accounts
SharpSCCM get class-instances SMS_R_User -w "UniqueUserName LIKE '%admin%'" -sms SCCM01.corp.local -sc PS1

Administrative Analysis

SCCM Administrators:

# All administrators
SharpSCCM get class-instances SMS_Admin -v -sms SCCM01.corp.local -sc PS1

# Full administrators
SharpSCCM get class-instances SMS_Admin -w "RoleNames LIKE '%Full Administrator%'" -sms SCCM01.corp.local -sc PS1

Security Roles:

# Available roles
SharpSCCM get class-instances SMS_Role -p RoleName -p RoleDescription -sms SCCM01.corp.local -sc PS1

Advanced Usage

Complex Filtering

Multiple Conditions:

Client = 1 AND LastLogonTimestamp > '2023-01-01' AND LastLogonUserName IS NOT NULL

Pattern Matching:

Name LIKE 'WS-%' OR Name LIKE 'LAPTOP-%'

Numeric Comparisons:

ResourceID > 1000 AND ResourceID < 2000

Property Selection

Essential Properties:

Focus on key identifying and security-relevant properties
Avoid retrieving unnecessary data for performance
Use meaningful property combinations

Security Properties:

User authentication and logon information
Administrative roles and permissions
Network and system configuration data

Use Cases

Target Identification

High-Value Systems:

Administrative workstations and servers
Systems with privileged user access
Critical infrastructure components

User Targeting:

Administrative and service accounts
High-privilege users
Domain administrators

Environment Mapping

Infrastructure Analysis:

Network topology and system distribution
Administrative boundaries and relationships
User-device relationship mapping

Security Assessment:

Permission and role analysis
Administrative access patterns
Security configuration review

get classes - List available WMI classes
get class-properties - Examine class structure
local class-instances - Query local WMI classes
local query - Execute local WQL queries

Getting Started

Information Gathering

Credential Extraction

Lateral Movement

Local Operations

Infrastructure Management

Advanced Operations

Overview

Syntax

Parameters

Examples

Required Permissions

Common Classes

WQL Query Examples

Intelligence Gathering

Advanced Usage

Use Cases

​Overview

​Syntax

​Parameters

​Examples

​Required Permissions

​Common Classes

​WQL Query Examples

​Intelligence Gathering

​Advanced Usage

​Use Cases

​Related Commands

Overview

Syntax

Parameters

Examples

Required Permissions

Common Classes

WQL Query Examples

Intelligence Gathering

Advanced Usage

Use Cases

Related Commands