Skip to main content

​
Overview

List available WMI classes in the SMS Provider namespace. This command is useful for understanding the WMI schema, identifying custom classes, and discovering available data sources for reconnaissance and exploitation.

​
Syntax

SharpSCCM get classes [options]

​
Parameters

​
sms-provider
string
The IP address, FQDN, or NetBIOS name of the SMS Provider to connect to
​
site-code
string
The three-character site code (e.g., “PS1”)
​
wmi-namespace
string
The WMI namespace to query (default: auto-detected SMS namespace)
​
name
string
Filter classes by name pattern (supports partial matching)
​
count
boolean
Return count of results only

​
Examples

# List all SMS classes
SharpSCCM get classes -sms SCCM01.corp.local -sc PS1

# Count total classes
SharpSCCM get classes -c -sms SCCM01.corp.local -sc PS1

​
Required Permissions

SMS Admins local group membership on the SMS Provider server

​
Class Categories

SMS_R_ Classes:*
  • SMS_R_System - Device/computer information
  • SMS_R_User - User account information
  • SMS_R_UserGroup - User group information
Usage: Primary resource discovery and enumeration
Collection Management:
  • SMS_Collection - Collection definitions
  • SMS_CollectionMember - Collection membership
  • SMS_CollectionRule - Collection rules
Usage: Collection analysis and manipulation
Application Management:
  • SMS_Application - Application definitions
  • SMS_ApplicationAssignment - Application deployments
  • SMS_DeploymentType - Deployment configurations
Usage: Application and deployment analysis
Administration:
  • SMS_Admin - Administrative users
  • SMS_Role - Security roles
  • SMS_SecuredObject - Object permissions
Usage: Administrative structure analysis

​
WMI Schema Discovery

SMS_ Classes:*
  • Core SCCM functionality
  • Microsoft-provided classes
  • Standard SCCM operations
Custom Classes:
  • Organization-specific extensions
  • Third-party integrations
  • Custom reporting classes
Resource Classes:
  • Discovery and inventory data
  • Device and user information
  • Hardware and software inventory
Management Classes:
  • Administrative operations
  • Configuration and policy
  • Deployment and enforcement

​
Use Cases

Schema Discovery:
  • Understand available data sources
  • Identify custom extensions
  • Map WMI capabilities
Class Analysis:
  • Find interesting data classes
  • Identify administrative classes
  • Discover custom implementations
Data Source Identification:
  • Locate sensitive information classes
  • Find credential-related classes
  • Identify high-value data sources
Operation Planning:
  • Understand WMI structure for exploitation
  • Plan data extraction strategies
  • Identify manipulation opportunities

​
Common Class Patterns

SMS_R_%

​
Output Analysis

By Category:
  • Resource classes: Discovery and inventory
  • Management classes: Administrative operations
  • Policy classes: Configuration and enforcement
  • Custom classes: Organization-specific extensions
By Prefix:
  • SMS_: Microsoft SCCM classes
  • CCM_: Client-side classes
  • Win32_: Windows management classes
  • Custom: Organization-specific classes
Sensitive Data Classes:
  • User and device information
  • Administrative accounts and roles
  • Credential and secret storage
  • Network and infrastructure data
Operational Classes:
  • Deployment and execution
  • Collection and targeting
  • Policy and configuration
  • Administrative operations