WMI

Execute a WMI query

Actions4

Overview

This node executes Windows Management Instrumentation (WMI) queries and operations on Windows hosts or compatible environments. It supports multiple execution engines to perform WMI queries, retrieve alias information, and invoke actions on WMI aliases.

Common scenarios include:

Querying system information such as processes, services, or operating system details.
Retrieving or listing WMIC aliases available on a Windows host.
Executing specific actions on WMI aliases, like starting or stopping services.
Integrating WMI data retrieval into automation workflows for monitoring or management.

Practical examples:

Listing all running processes on a remote Windows machine.
Getting detailed information about installed software via WMI.
Enumerating available WMIC aliases to discover manageable components.
Calling an action to restart a service remotely using WMIC.

Properties

Name	Meaning
Engine	Execution engine to use for WMI operations. Options: • Node WMI (node-wmi library, works also outside Windows) • WMIC (local wmic command, Windows only) • Impacket (Python DCOM script, requires Python3 + impacket) • WMIC CLI (Linux Samba binary, Linux only, query operation only)
Preflight Check	(Only for Impacket engine) Whether to verify before execution that the Python interpreter is available and the impacket module can be imported (fail-fast check).
Format	Output format. Only JSON is implemented.
Timeout (Ms)	Maximum wait time in milliseconds for each item before aborting the operation. Minimum 1000 ms.
Verbose Logging	Enable detailed debug logging (does not print passwords).

Additional properties relevant to the "List Alias" operation (and others):

Name	Meaning
Operation	The type of WMI/WMIC operation to execute. For this summary, fixed to "List Alias".

Output

The node outputs an array of items where each item's json field contains a data property. This data property holds the result of the executed WMI operation.

For the "List Alias" operation, the output json.data is an array listing the available WMIC aliases on the target host. Each element represents one alias with its associated metadata as returned by the underlying WMIC query.

No binary data output is produced by this node.

Example output structure snippet:

{
  "json": {
    "data": [
      { "AliasName": "os", "Description": "Operating System" },
      { "AliasName": "process", "Description": "Processes" },
      ...
    ]
  }
}

Dependencies

Requires valid credentials with host, user, password, and optionally domain and namespace for WMI access.
Supports multiple execution engines:
- Node WMI: Uses the node-wmi npm package.
- WMIC: Uses the local wmic command-line tool; only available on Windows hosts where n8n runs.
- Impacket: Requires Python 3 and the impacket Python module installed on the n8n host.
- WMIC CLI: Uses the wmic binary from the Samba package on Linux; only supports query operations.
For Impacket engine, environment variable PYTHON_BIN can be set to specify the Python interpreter path.
The node expects a credential object containing connection details to the target Windows host.

Troubleshooting

Engine availability: Using the WMIC engine on non-Windows platforms will throw an error because the local wmic command is unavailable.
Missing dependencies: If the node-wmi library or the vendor wmi-query.js cannot be loaded, the node will fail with a descriptive error.
Impacket preflight failure: If the Python interpreter or the impacket module is missing or not importable, the node will error out during preflight checks.
Timeouts: Queries exceeding the configured timeout will abort with a timeout error.
Credential issues: Missing or incomplete credentials (host, user, password) cause errors indicating required fields are empty.
Invalid queries or aliases: Errors may occur if the WMI query is malformed or the alias does not exist.
Error message example: "WMI internal error (possible invalid credentials or query). Original: Cannot convert undefined or null to object" indicates likely invalid credentials or query syntax.
Verbose logging can be enabled to get detailed debug information without exposing sensitive data like passwords.

Links and References

Windows Management Instrumentation (WMI) Documentation
WMIC Command-Line Utility
Impacket Python Library
node-wmi npm package (third-party library used internally)

This node is a powerful tool for integrating Windows system management and querying capabilities into n8n workflows, especially useful for administrators automating Windows environment monitoring and control.

WMI