Windows XP WMI Hardware Inventory Queries

Windows Management Instrumentation (WMI) served as the primary mechanism for scriptable hardware audits in Windows XP, allowing system administrators to retrieve detailed hardware configurations using WMI Query Language (WQL). By leveraging VBScript or the wmic command-line utility, administrators could query the root\cimv2 namespace to extract low-level component data directly from the system architecture. This article details the essential WMI classes and queries that powered automated hardware inventories across Windows XP environments.

Core System and BIOS Information

To identify the machine make, model, and firmware version, administrators queried the computer system and BIOS abstractions:

  • Win32_ComputerSystem: Provided the machine name, manufacturer, model, and total visible physical memory.
    • Query: SELECT Manufacturer, Model, TotalPhysicalMemory FROM Win32_ComputerSystem
  • Win32_BIOS: Retrieved firmware attributes, serial numbers, and release versions.
    • Query: SELECT Manufacturer, SMBIOSBIOSVersion, SerialNumber FROM Win32_BIOS
  • Win32_BaseBoard: Used to identify motherboard specifications and serial identifiers.
    • Query: SELECT Manufacturer, Product, SerialNumber FROM Win32_BaseBoard

Processors and Physical Memory

Hardware audits in Windows XP relied on dedicated classes to catalog computing power and installed RAM modules:

  • Win32_Processor: Reported CPU architecture, clock speeds, socket specifications, and core details.
    • Query: SELECT Name, Manufacturer, MaxClockSpeed, CurrentClockSpeed FROM Win32_Processor
  • Win32_PhysicalMemory: Provided granular data on individual RAM sticks installed in memory slots, including capacity, speed, and form factor.
    • Query: SELECT Capacity, DeviceLocator, Speed, Manufacturer FROM Win32_PhysicalMemory

Storage Devices and Partitions

Storage inventories differentiated between physical disk controllers and mapped logical drives:

  • Win32_DiskDrive: Extracted physical hard drive data, such as vendor, interface type (e.g., IDE or SCSI), and raw drive capacity.
    • Query: SELECT Model, InterfaceType, Size, Partitions FROM Win32_DiskDrive
  • Win32_LogicalDisk: Identified file systems, partition letters, and available capacity.
    • Query: SELECT DeviceID, FileSystem, FreeSpace, Size FROM Win32_LogicalDisk WHERE DriveType = 3

Network Adapters and Display Hardware

Documenting connectivity and graphics configurations required targeting the network stack and video controllers:

  • Win32_NetworkAdapterConfiguration: The standard class for auditing network interface cards (NICs), IP configurations, and hardware MAC addresses.
    • Query: SELECT Description, MACAddress, IPAddress FROM Win32_NetworkAdapterConfiguration WHERE IPEnabled = True
  • Win32_VideoController: Identified installed graphics cards, resolution capabilities, and video RAM size.
    • Query: SELECT Name, VideoProcessor, AdapterRAM, CurrentHorizontalResolution, CurrentVerticalResolution FROM Win32_VideoController

Execution Methods in Windows XP

These WMI queries were typically executed in two ways on Windows XP:

  1. Command Line (WMIC): Built directly into Windows XP Professional, allowing one-liner exports: 
    wmic cpu get Name,MaxClockSpeed /format:csv
wmic bios get SerialNumber
  2. Windows Script Host (VBScript): Allowed administrators to connect to GetObject("winmgmts:\\.\root\cimv2"), execute queries using ExecQuery, and write the results to a CSV file or network share for centralized auditing.