WMI

Execute a WMI query

Actions4

Overview

This node executes WMI (Windows Management Instrumentation) queries or commands on remote or local Windows hosts. It supports multiple execution engines, including a Node.js library, native Windows WMIC command, a Python-based Impacket script, and a Linux Samba WMIC CLI tool. The node is useful for system administrators and IT professionals who want to automate querying system information, managing services, processes, or other Windows components remotely or locally.

Common scenarios include:

Retrieving system or process information using WQL (WMI Query Language).
Executing WMIC alias "get" commands to fetch specific fields.
Calling WMIC alias actions such as starting or stopping services.
Listing available WMIC aliases on a host.

Practical examples:

Querying all running processes on a remote Windows machine.
Getting the status of a particular service via WMIC alias.
Starting or stopping a Windows service remotely.
Listing all WMIC aliases to discover manageable components.

Properties

Name	Meaning
Engine	Execution engine to use: - Node WMI (Node-Wmi): Uses the node-wmi library, works even outside Windows. - WMIC (Wmi-Query): Uses local WMIC command, only on Windows hosts. - Impacket (Python DCOM): Uses Python impacket script, requires Python3 + impacket. - WMIC CLI (Linux Samba): Uses wmic binary from samba package on Linux, only supports query operation.
Preflight Check	(Only for Impacket engine) Whether to verify before execution that Python interpreter is available and the impacket module can be imported. This enables fail-fast behavior if dependencies are missing.
Timeout (Ms)	Maximum wait time in milliseconds for each item before aborting the operation. Minimum allowed is 1000 ms.
Verbose Logging	Enable detailed debug logging (does not print passwords). Useful for troubleshooting.

Output

The node outputs an array of items where each item contains a json field with a data property holding the results of the WMI operation. The structure of data depends on the operation and engine used but generally consists of an array of objects representing queried WMI data or command results.

If an error occurs and the node is configured to continue on failure, the output item will contain a json.error field with the error message.

No binary data output is produced by this node.

Example output JSON snippet:

{
  "data": [
    {
      "Name": "svchost.exe",
      "ProcessId": 1234,
      "Status": "Running"
    },
    {
      "Name": "explorer.exe",
      "ProcessId": 5678,
      "Status": "Running"
    }
  ]
}

Dependencies

Requires credentials containing host, user, password, and optionally domain and namespace for WMI connection.
For the "Impacket" engine, requires Python 3 installed on the host running n8n, along with the Python impacket module.
For the "WMIC" engine, requires n8n to run on Windows with the wmic command available.
For the "WMIC CLI" engine, requires the wmic binary from the Samba package installed on Linux.
The "Node WMI" engine requires the node-wmi npm package (loaded dynamically).

Troubleshooting

Missing Credentials: The node throws an error if required credential fields (host, user, password) are missing or empty.
Unsupported Platform: Using the "WMIC" engine on non-Windows platforms or "WMIC CLI" on Windows will cause errors.
Timeouts: Queries or commands exceeding the specified timeout will abort with a timeout error.
Python/Impacket Issues: If using the Impacket engine, ensure Python 3 and the impacket module are installed. Use the preflight check option to detect missing dependencies early.
Invalid Query or Class: If neither a full WQL query nor a class name is provided for the query operation, the node throws an error.
Parsing Errors: The node attempts to parse JSON output from Impacket or WMIC CLI; malformed output may cause errors.
Verbose Logging: Enable verbose logging to get detailed debug information without exposing sensitive data like passwords.

WMI