c# NetworkInterface.GetAllNetworkInterfaces vs WMI Win32_NetworkAdapter - wmi

I get a InterfaceIndex with GetBestInterface (iphlpapi.dll).
The goal : read other interface properties.
This WMI query is slow :
SELECT MACAddress,Name,GUID,NetConnectionID FROM Win32_NetworkAdapter WHERE InterfaceIndex=
In C# there is, faster,
NetworkInterface.GetAllNetworkInterfaces()
but each NetworkInterface hasn't the property InterfaceIndex ( sic ! ).
I don't know how to optimize this :
EnumerationOptions wmi_options = new EnumerationOptions();
wmi_options.Rewindable = false;
wmi_options.ReturnImmediately = true;
string wql = "SELECT MACAddress,Name,GUID,NetConnectionID FROM Win32_NetworkAdapter WHERE InterfaceIndex=" + iface;
ManagementObjectCollection recordset = new ManagementObjectSearcher(#"root\cimv2", wql, wmi_options).Get();
foreach (ManagementObject mo in recordset)
The options don't seem to help.
Can I split the operations and cache any step ?
Or another path : avoid WMI and lookup the interface ( with InterfaceIndex ) from the registry ?
HKLM\SYSTEM\CurrentControlSet\Services\tcpip\Parameters\Interfaces
HKLM\SYSTEM\CurrentControlSet\Control\Network{4D36E972-E325-11CE-BFC1-08002BE10318}

i dont know if this is actually faster but have you tried powershell?
string IfIndex = "15";
string psscript = "get-netadapter | Where-Object interfaceindex -eq " + IfIndex;
PowerShell powershell = PowerShell.Create();
powershell.Runspace = RunspaceFactory.CreateRunspace();
powershell.Runspace.Open();
powershell.AddScript(psscript);
foreach (PSObject result in powershell.Invoke())
{
Console.WriteLine("Name: {0} " + "Status: {1}",result.Members["Name"].Value, result.Members["status"].Value);
}
Console.Read();
run this from your application, using System.Management.Automation &
System.Management.Automation.Runspaces;
i haven't tested the code yet, this is the top of my head.

Related

C++ WMI - Fetch local IP address

I'm trying to fetch the local IP via WMI ManagementObject but I get only empty/null strings.
With a call from PowerShell:
Get-WmiObject -Class Win32_NetworkAdapterConfiguration
I get 13 elements 2 of which with a valid IP address.
But with the following code, passing
"Win32_NetworkAdapterConfiguration" as hardwareClass and
"IPAddress" as propertyName:
void propertyValueLocal(String^ hardwareClass, String^ propertyName)
{
ManagementObjectSearcher^ searcher = gcnew ManagementObjectSearcher("root\\CIMV2", "SELECT * FROM " + hardwareClass);
ManagementObjectCollection^ collection = searcher->Get();
for each (ManagementObject^ object in collection)
{
if (object[propertyName] != nullptr)
Console::WriteLine(object[propertyName]);
}
}
I get:
System.String[]
System.String[]
Any help would be appreciated.

WMI : MSVM_Imagemanagmentservice mount method does not assign drive letter

I m trying to mount a vhd on windows 2012 hyperV core datacenter edition. For mounting the vhd I m using the MSVM_Imagemanagementservice class and mount method inside that. The disk is mounted but the problem is no drive letter is getting assigned. I have tried it on other 2012 datacenter edition and 2012 core as well it works fine. i.e after mount the drive letter gets assigned.
Any thoughts on this will help.
You can query for the drive letters list and then assign the drive letter as per your requirement. Given below is the function to get the drive letters list.
Function GetDriveLetterList(path)
'Where path is path of VHD
Dim mountedImage, diskDevice, diskPartition, diskPartitions, logicalPartition, timeout, query
Dim logicalPartitionList
timeout = 0
driveLetterList = ""
path = Replace(path,"\","\\")
Set wmiServiceCIM = GetObject("winmgmts:\\.\root\cimv2")
Do
WScript.Sleep(3000)
timeout = timeout + 3
Set mountedImage = (wmiService.ExecQuery("SELECT * FROM Msvm_MountedStorageImage WHERE Name='" & path & "'")).ItemIndex(0)
query = "SELECT * From Win32_DiskDrive WHERE Model='Msft Virtual Disk SCSI Disk Device' and SCSITargetId='" & mountedImage.TargetId & "' and SCSILogicalUnit='" & mountedImage.Lun & "' and SCSIPort='" & mountedImage.PortNumber & "'"
Set diskDevice = wmiServiceCIM.ExecQuery(query).ItemIndex(0)
query = "ASSOCIATORS OF {" & diskDevice.Path_.Path & "} where AssocClass=Win32_DiskDriveToDiskPartition"
Set diskPartitions = wmiServiceCIM.ExecQuery(query)
For Each diskPartition In diskPartitions
query = "ASSOCIATORS OF {" & diskPartition.Path_.Path & "} WHERE AssocClass=Win32_LogicalDiskToPartition"
Set logicalPartitionList = wmiServiceCIM.ExecQuery(query)
If logicalPartitionList.count > 0 Then
Set logicalPartition = logicalPartitionList.ItemIndex(0)
'WScript.Echo logicalPartition.DeviceID
driveLetterList = driveLetterList + logicalPartition.DeviceID
End If
Next
End Function
If you want to check for systems drive . Then you can do this ...
folderPath = driveLetter + ":\Windows\System32"
Set fileSys = CreateObject("Scripting.FileSystemObject")
If filesys.FolderExists(folderPath) Then
//doStuff
End If

WMI USB Enable and Disable

Hi I am using WMI to change the remote registry value for USBSTOR. I want to change the value of start attribute to 4 or 3 for enabling and disabling.
But the datatype for Start attribute in registry is DWORD, if i can the datatype to size it does not work .
I need to keep the Datatype to DWORD. Can someone please tell me how to setDWORDValue using WMI, following is the piece of code that i tried, it worked succesfully but still the value of start field is unchanged in registry.
const uint HKEY_LOCAL_MACHINE = 0x80000002;
ManagementBaseObject methodParams = registryTask.GetMethodParameters(typeOfValue);
methodParams["hDefKey"] = HKEY_LOCAL_MACHINE;// BaseKey;
methodParams["sSubKeyName"] = #"SYSTEM\\CurrentControlSet\\Servic\\USBSTOR";
methodParams["sValueName"] = "Start";
try
{
methodParams["sValue"] = "3";
}
catch
{
methodParams["uValue"] = (UInt32)Convert.ToInt32("3");
}
ManagementBaseObject exitValue = registryTask.InvokeMethod(typeOfValue, methodParams, null);
Simple solution using python.
import wmi
import win32api,_winreg
c = wmi.WMI()
# To get the binary value of particular subkey
# Please note that 0x80000002 represents HKEY_LOCAL_MACHINE
ReturnValue, uValue = c.StdRegProv.GetBinaryValue(0x80000002,"AFD","SYSTEM\CurrentControlSet\Services")
# To get the list of all the subkeys available in particular key
ret, subKeys = c.StdRegProv.EnumKey (0x80000002, "SYSTEM\CurrentControlSet\Services")
print ret
for key in subKeys:
print key
ReturnValue=c.StdRegProv.SetDWORDValue(0x80000002,"Type","SYSTEM\CurrentControlSet\Services\USBSTOR",0x4)
#HKEY_CLASSES_ROOT (2147483648 (0x80000000))
#HKEY_CURRENT_USER (2147483649 (0x80000001))
#HKEY_LOCAL_MACHINE (2147483650 (0x80000002))
#HKEY_USERS (2147483651 (0x80000003))
#HKEY_CURRENT_CONFIG (2147483653 (0x80000005))
#HKEY_DYN_DATA (2147483654 (0x80000006))
Yes it can be done. Here's the code, referencing this Microsoft link and this one. Replace 3389 with the new value you want to use, and change the key as needed:
const HKEY_LOCAL_MACHINE = &H80000002
strComputer = "."
'Set StdOut = WScript.StdOut
Set oReg=GetObject( _
"winmgmts:{impersonationLevel=impersonate}!\\" &_
strComputer & "\root\default:StdRegProv")
strKeyPath = "SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp"
strValueName = "PortNumber"
' Display old value
oReg.GetDWORDValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,dwValue
WScript.Echo "Old RDP value=" & dwValue
' Set new value
dwValue= 3389
oReg.SetDWORDValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,dwValue
If Err = 0 Then
oReg.GetDWORDValue _
HKEY_LOCAL_MACHINE,strKeyPath,strValueName,dwValue
WScript.Echo "New RDP Value =" & dwValue
Else
WScript.Echo "Error in creating key" & _
" and DWORD value = " & Err.Number
End If

WMI performance query

I am having an issue with a WMI query.
I use a WMI query to search and resume an instance in BizTalk.
When there are not that many instances (so when the data isn't that much) the query performs pretty good.
But when the data is large (about 3000 instances) the query takes about 6 - 10 seconds to execute, and this isn't tolerable.
Code is as following:
string query = "SELECT * FROM MSBTS_ServiceInstance WHERE InstanceID = \"" + OrchestrationId + "\"";
ManagementObjectSearcher searcher = new ManagementObjectSearcher(new ManagementScope(#"root\MicrosoftBizTalkServer"), new WqlObjectQuery(query), null);
int count = searcher.Get().Count;
if (count > 0)
{
string[] strArray = new string[count];
string[] strArray2 = new string[count];
string[] strArray3 = new string[count];
string str2 = string.Empty;
string str3 = string.Empty;
int index = 0;
foreach (ManagementObject obj2 in searcher.Get())
{
if (str2 == string.Empty)
{
str2 = obj2["HostName"].ToString();
}
strArray2[index] = obj2["ServiceClassId"].ToString();
strArray3[index] = obj2["ServiceTypeId"].ToString();
strArray[index] = obj2["InstanceID"].ToString();
str3 = str3 + string.Format(" {0}\n", obj2["InstanceID"].ToString());
index++;
}
new ManagementObject(string.Format("root\\MicrosoftBizTalkServer:MSBTS_HostQueue.HostName=\"{0}\"", str2)).InvokeMethod("ResumeServiceInstancesByID", new object[] { strArray2, strArray3, strArray, 1 });
It's the first query (Select * from MSBS_ServiceInstance..) that takes to long when te data is getting bigger.
Any ideas how I can improve this?
The platform is Windows Server 2008 Enterprise..
Thx!
It looks like you are getting all service instances for your orchestration, not just the suspended ones.
Try adding the following to your query's where clause, so that only suspended and suspended-not-resumable service instances are returned:
and (ServiceStatus = 4 or ServiceStatus = 16)
Thank you for the replies.
The reason I got that many suspended instances sometimes is by design.
Whenever a message isn't in sequence, the orchestration gets suspended until the previous message went through.
I found another way to resume the instances using the BizTalkOperations class that is installed with BizTalk:
BizTalkOperations operations = new BizTalkOperations(dataSource, initialCatalog);
foreach (Guid id in instanceIds)
{
operations.ResumeInstance(id);
}
This code is much more performant then the WMI code (and less code ^^) :)
Thanks

How can I enumerate/list all installed applications in Windows XP?

When I say "installed application", I basically mean any application visible in [Control Panel]->[Add/Remove Programs].
I would prefer to do it in Python, but C or C++ is also fine.
If you mean the list of installed applications that is shown in Add\Remove Programs in the control panel, you can find it in the registry key:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall
more info about how the registry tree is structured can be found here.
You need to use the winreg API in python to read the values from the registry.
Check out the Win32_Product WMI (Windows Management Instrumentation) class. Here's a tutorial on using WMI in Python.
Control Panel uses Win32 COM api, which is the official method (see Google Groups, Win32)
Never rely on registry.
The Microsoft Script Repository has a script for listing all installed software.
import win32com.client
strComputer = "."
objWMIService = win32com.client.Dispatch("WbemScripting.SWbemLocator")
objSWbemServices = objWMIService.ConnectServer(strComputer,"root\cimv2")
colItems = objSWbemServices.ExecQuery("Select * from Win32_Product")
for objItem in colItems:
print "Caption: ", objItem.Caption
print "Description: ", objItem.Description
print "Identifying Number: ", objItem.IdentifyingNumber
print "Install Date: ", objItem.InstallDate
print "Install Date 2: ", objItem.InstallDate2
print "Install Location: ", objItem.InstallLocation
print "Install State: ", objItem.InstallState
print "Name: ", objItem.Name
print "Package Cache: ", objItem.PackageCache
print "SKU Number: ", objItem.SKUNumber
print "Vendor: ", objItem.Vendor
print "Version: ", objItem.Version
The best registry-based implementation that I have seen is the one written by Chris Wright (chris128) posted at http://www.vbforums.com/showthread.php?t=598355. It uses multiple registry keys and is a lot more complex than any of the answers currently posted here. It seems to produce identical results to the Add/Remove Programs app, and like the ARP app it also provides an option to include updates.
Although it's implemented in VB.NET, it should be easy to convert to other .NET languages like C# or IronPython. I imagine that converting to IronPython first should make it fairly easy to port to regular Python if that's what you want, but I only converted it to C# myself and then cleaned up the code a bit.
Only one small bug to point out: GetUserInstallerKeyPrograms() doesn't add the version for user programs to the list, even though it extracts it. This is easy to fix though.
C#.net code for getting the list of installed software using WMI in xp and win7(wmi is the only way in win7)
WqlObjectQuery wqlQuery =
new WqlObjectQuery("SELECT * FROM Win32_Product");
ManagementObjectSearcher searcher =
new ManagementObjectSearcher(wqlQuery);
foreach (ManagementObject software in searcher.Get()) {
Console.WriteLine(software["Caption"]);
}
The OP mentioned XP and also mentioned Python, C or C++ but I found that a lot of information on the net about this topic is either incomplete or incorrect. An example of the latter is the suggestion to use WMI--specifically, the Win32_Product class; however, as is noted elsewhere, that method is slow, partly because, believe it or not, each MSI found actually runs its repair. I call that solution incorrect because of how painfully slow it is and because of its nasty side-effect. For instance, you have already opted to disable a program's Windows service but calling select * from Win32_Product, as part of ensuring that the MSI repair runs, will apparently re-enable the service.
For what it's worth, below is what I would consider to be the most complete example to date, albeit in C# (I compiled it against Framework 4.6.1 but lower versions may work too.) It lists 32-bit and 64-bit installed programs; it disposes registry keys that it uses and it runs in under a second, at least after caching kicks in. Improvements are welcome.
One thing it is still missing is some updates. For example, when I run it on my Windows 10 system and compare it with Control Panel | Programs and Features | Installed Updates, I notice that it does not show Security Update for Adobe Flash Player for some reason.
I don't have any good reason for the anonymous method, it's just how I was thinking at the time--a sort of method-within-a-method solution.
using System;
using System.Collections.Generic;
using System.Runtime.InteropServices;
using System.Text;
using System.Text.RegularExpressions;
using Microsoft.Win32;
class Program
{
static void Main(string[] args)
{
var result = InstalledProgram.GetAllInstalledPrograms();
result.Sort((a, b) => a.DisplayName.CompareTo(b.DisplayName));
foreach(var program in result)
{
if(!program.IsSystemComponent && !program.IsKB) Console.WriteLine(program.Dump());
}
}
}
public enum PlatformTypes
{
x86,
amd64
}
public class InstalledProgram
{
[DllImport("advapi32.dll")]
extern public static int RegQueryInfoKey(
Microsoft.Win32.SafeHandles.SafeRegistryHandle hkey,
StringBuilder lpClass,
ref uint lpcbClass,
IntPtr lpReserved,
IntPtr lpcSubKeys,
IntPtr lpcbMaxSubKeyLen,
IntPtr lpcbMaxClassLen,
IntPtr lpcValues,
IntPtr lpcbMaxValueNameLen,
IntPtr lpcbMaxValueLen,
IntPtr lpcbSecurityDescriptor,
out long lpftLastWriteTime
);
public string DisplayName { get; private set; }
public string UninstallString { get; private set; }
public string KBNumber { get; private set; }
public string DisplayIcon { get; private set; }
public string Version { get; private set; }
public DateTime InstallDate { get; private set; }
public PlatformTypes Platform { get; private set; }
public bool IsSystemComponent { get; private set; }
public bool IsKB { get { return !string.IsNullOrWhiteSpace(KBNumber); } }
public static List<InstalledProgram> GetAllInstalledPrograms()
{
var result = new List<InstalledProgram>();
Action<PlatformTypes, RegistryKey, string> getRegKeysForRegPath = (platform, regBase, path) =>
{
using(var baseKey = regBase.OpenSubKey(path))
{
if(baseKey != null)
{
string[] subKeyNames = baseKey.GetSubKeyNames();
foreach(string subkeyName in subKeyNames)
{
using(var subKey = baseKey.OpenSubKey(subkeyName))
{
object o;
o = subKey.GetValue("DisplayName");
string displayName = o != null ? o.ToString() : "";
o = subKey.GetValue("UninstallString");
string uninstallString = o != null ? o.ToString() : "";
o = subKey.GetValue("KBNumber");
string kbNumber = o != null ? o.ToString() : "";
o = subKey.GetValue("DisplayIcon");
string displayIcon = o != null ? o.ToString() : "";
o = subKey.GetValue("DisplayVersion");
string version = o != null ? o.ToString() : "";
o = subKey.GetValue("InstallDate");
DateTime installDate = o != null ? parseInstallDate(o.ToString()) : default(DateTime);
o = subKey.GetValue("SystemComponent");
bool isSystemComponent = o != null ? o.ToString() == "1" : false;
// Sometimes, you need to get the KB number another way.
if(kbNumber == "")
{
var match = Regex.Match(displayName, #".*?\((KB\d+?)\).*");
if(match.Success) kbNumber = match.Groups[1].ToString();
}
// Sometimes, the only way you can get install date is from the last write
// time on the registry key.
if(installDate == default(DateTime))
{
string keyFull = baseKey + "\\" + subkeyName + "\\DisplayVersion";
var sb = new StringBuilder(64);
uint sbLen = 65;
RegQueryInfoKey(
subKey.Handle
, sb
, ref sbLen
, IntPtr.Zero
, IntPtr.Zero
, IntPtr.Zero
, IntPtr.Zero
, IntPtr.Zero
, IntPtr.Zero
, IntPtr.Zero
, IntPtr.Zero
, out long lastWriteTime);
installDate = DateTime.FromFileTime(lastWriteTime);
}
if(displayName != "" && uninstallString != "")
{
result.Add(new InstalledProgram
{
DisplayName = displayName,
UninstallString = uninstallString,
KBNumber = kbNumber,
DisplayIcon = displayIcon,
Version = version,
InstallDate = installDate,
Platform = platform,
IsSystemComponent = isSystemComponent
});
}
}
}
}
}
};
getRegKeysForRegPath(PlatformTypes.amd64, Registry.LocalMachine, #"SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall");
getRegKeysForRegPath(PlatformTypes.amd64, Registry.CurrentUser, #"SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall");
if(Environment.Is64BitOperatingSystem)
{
getRegKeysForRegPath(PlatformTypes.x86, Registry.LocalMachine, #"SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall");
getRegKeysForRegPath(PlatformTypes.x86, Registry.CurrentUser, #"SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall");
}
return result;
}
public string Dump()
{
return Platform + "\t" + DisplayName + "\t" + InstallDate + "\t" + DisplayIcon + "\t" + Version + "\t" + KBNumber + "\t" + UninstallString;
}
private static DateTime parseInstallDate(string installDateStr)
{
DateTime.TryParseExact(
installDateStr
, format: "yyyyMMdd"
, provider: new System.Globalization.CultureInfo("en-US")
, style: System.Globalization.DateTimeStyles.None
, result: out DateTime result);
return result;
}
public override string ToString()
{
return DisplayName;
}
}
[Sigh] and then I saw #PolyTekPatrick's answer. How did I miss that?