WMI

Execute a WMI query

Actions4

Overview

This node executes Windows Management Instrumentation (WMI) queries or commands on remote or local Windows hosts. It supports multiple execution engines, including native Node.js libraries, Windows command-line tools, and Python scripts, allowing flexible integration with different environments.

Common scenarios include:

Retrieving system information such as OS details, running processes, or installed services.
Managing Windows services by starting or stopping them remotely.
Querying hardware or software inventory data for monitoring or auditing.
Automating administrative tasks on Windows machines from n8n workflows.

For example, you can use this node to get the list of running processes on a remote Windows server or call an action to start a service using WMIC aliases.

Properties

Name	Meaning
Engine	Execution engine to run WMI queries: - Node WMI (Node-Wmi): Uses the `node-wmi` library, works even outside Windows. - WMIC (Wmi-Query): Uses local `wmic` command, only on Windows hosts. - Impacket (Python DCOM): Runs Python script using Impacket for DCOM queries (requires Python 3 + Impacket). - WMIC CLI (Linux Samba): Uses Samba's `wmic` binary on Linux for remote WQL queries (only query operation).
Preflight Check	For Impacket engine: verifies before execution that Python interpreter is available and Impacket module importable to fail fast if missing.
Alias	WMIC alias name (e.g., `os`, `process`, `service`). Required for "Get" and "Call" operations.
Fields	Comma-separated list of fields to retrieve for the alias in "Get" operation (e.g., `Name,Version`).
Format	Output format. Only JSON is implemented.
Timeout (Ms)	Maximum wait time in milliseconds for each item before aborting. Minimum 1000 ms. Default is 60000 ms.
Verbose Logging	Enables detailed debug logging (does not print passwords).

Output

The node outputs an array of items where each item's json property contains a data field holding the results of the WMI query or command. The structure of data depends on the executed operation and engine but generally consists of an array of objects representing queried WMI classes or alias properties.

If an error occurs per item and "Continue On Fail" is enabled, the output will contain an error field describing the issue instead of data.

Binary data output is not supported by this node.

Example output snippet:

{
  "json": {
    "data": [
      {
        "Name": "svchost.exe",
        "ProcessId": 1234,
        "Status": "Running"
      },
      {
        "Name": "explorer.exe",
        "ProcessId": 5678,
        "Status": "Running"
      }
    ]
  }
}

Dependencies

Requires valid credentials with host, username, password, and optionally domain and namespace for WMI access.
Depending on the selected engine:
- Node WMI: requires the node-wmi npm package.
- WMIC: requires the wmic command available locally on Windows hosts.
- Impacket: requires Python 3 and the Impacket Python module installed on the host running n8n.
- WMIC CLI: requires the Samba wmic binary installed on Linux hosts.
Environment variable PYTHON_BIN can be set to specify the Python interpreter path for Impacket engine.
The node expects the WMI namespace to default to root\CIMV2 if not specified.

Troubleshooting

Engine availability: Using the WMIC engine on non-Windows hosts or without wmic installed will cause errors.
Python/Impacket issues: If Python or the Impacket module is missing or not importable, the node will throw errors. Use the preflight check to detect these early.
Timeouts: Queries taking longer than the configured timeout will abort with a timeout error.
Credential errors: Missing or incomplete credentials (host, user, password) will cause failures.
Invalid queries or aliases: Malformed WQL queries or invalid WMIC aliases may result in internal errors or empty results.
Error message example: "WMI internal error (possible invalid credentials or query). Original: Cannot convert undefined or null to object" indicates likely credential or query issues.
Enable verbose logging to get detailed debug information without exposing sensitive data like passwords.

WMI