local query

Overview

Execute a given WQL (WMI Query Language) query on the local system. This command provides direct access to WMI data through custom queries, offering maximum flexibility for data extraction and analysis.

ACLs are applied at the object class and instance level, so query results may vary depending on your privileges.

Syntax

SharpSCCM local query <query> [options]

Parameters

query

string

required

The WQL query to execute (must be properly quoted)

wmi-namespace

string

The WMI namespace to query (default: “root\CCM”)

Examples

# Query SMS_Authority class
SharpSCCM local query "SELECT * FROM SMS_Authority"

# Query with WHERE condition
SharpSCCM local query "SELECT Name,Version FROM CCM_InstalledComponent WHERE Name='SmsClient'"

# Query a different namespace
SharpSCCM local query "SELECT * FROM Win32_ComputerSystem" -n "root\cimv2"

# Select only specific properties
SharpSCCM local query "SELECT CurrentManagementPoint,Name FROM SMS_Authority"

WQL Syntax Reference

Basic SELECT Statement

SELECT [properties] FROM [class_name] [WHERE condition]

Use * to select all properties
Specify individual properties separated by commas
Use WHERE clause for filtering

WHERE Conditions

-- String comparison
WHERE Name = 'SmsClient'
WHERE Name LIKE '%Client%'

-- Numeric comparison
WHERE ResourceID > 1000
WHERE Version >= 5

-- Boolean values
WHERE IsNull = TRUE
WHERE IsNull IS NULL

Advanced Operators

LIKE - Pattern matching with wildcards (% and _)
IS NULL / IS NOT NULL - Check for null values
AND / OR - Combine conditions
IN - Match against a list of values

Common SCCM WQL Queries

SELECT CurrentManagementPoint, Name FROM SMS_Authority

SELECT Name, Version FROM CCM_InstalledComponent

SELECT * FROM CCM_Policy_Policy5

SELECT * FROM CCM_NetworkProxy

Output Format

Query results are displayed in a structured format:

[+] Connecting to \\127.0.0.1\root\CCM
[+] Executing WQL query: SELECT * FROM SMS_Authority
-----------------------------------
Capabilities: <Capabilities SchemaVersion="1.0"><Property Name="SSLState" Value="0"/>
CurrentManagementPoint: ATLAS.APERTURE.SCI
Index: 1
Name: SMS:PS1
PolicyOrder: 100
-----------------------------------

Use Cases

Custom Data Extraction

Create targeted queries to extract specific information not available through other SharpSCCM commands.

Advanced Reconnaissance

Combine multiple properties and conditions to build comprehensive intelligence about the SCCM environment.

Troubleshooting and Analysis

Query specific WMI classes to diagnose client issues or understand configuration details.

Error Handling

Common query errors include:

Invalid class names - Verify the class exists using local classes
Permission denied - Some classes require elevated privileges
Syntax errors - Ensure proper WQL syntax and quoting

local classes - List available WMI classes for querying
local class-properties - Get properties for query planning
local class-instances - Simplified class querying with built-in options

Getting Started

Information Gathering

Credential Extraction

Lateral Movement

Local Operations

Infrastructure Management

Advanced Operations

Overview

Syntax

Parameters

Examples

WQL Syntax Reference

Common SCCM WQL Queries

Output Format

Use Cases

Error Handling

​Overview

​Syntax

​Parameters

​Examples

​WQL Syntax Reference

​Common SCCM WQL Queries

​Output Format

​Use Cases

​Error Handling

​Related Commands

Overview

Syntax

Parameters

Examples

WQL Syntax Reference

Common SCCM WQL Queries

Output Format

Use Cases

Error Handling

Related Commands