Forge Home


Manages Windows Management Instrumentation (WMI) objects


1,053 latest version

5.0 quality score

We run a couple of automated
scans to help you access a
module's quality. Each module is
given a score based on how well
the author has formatted their
code and documentation and
modules are also checked for
malware using VirusTotal.

Please note, the information below
is for guidance only and neither of
these methods should be considered
an endorsement by Puppet.

Version information

  • 1.1.0 (latest)
released Dec 15th 2020
This version is compatible with:
  • Puppet Enterprise 2019.8.x, 2019.7.x, 2019.5.x, 2019.4.x, 2019.3.x, 2019.2.x, 2019.1.x, 2019.0.x, 2018.1.x, 2017.3.x, 2017.2.x, 2016.4.x
  • Puppet >= 4.10.0 < 7.0.0

Start using this module

  • r10k or Code Manager
  • Bolt
  • Manual installation
  • Direct download

Add this module to your Puppetfile:

mod 'encore-wmi_obj', '1.1.0'
Learn more about managing modules with a Puppetfile

Add this module to your Bolt project:

bolt module add encore-wmi_obj
Learn more about using this module with an existing project

Manually install this module globally with Puppet module tool:

puppet module install encore-wmi_obj --version 1.1.0

Direct download is not typically how you would use a Puppet module to manage your infrastructure, but you may want to download the module in order to inspect the code.



encore/wmi_obj — version 1.1.0 Dec 15th 2020


This puppet module can be used to create, delete, and modify WMI objects.


Install from Puppet Forge:

puppet module install encore/wmi_obj

Install from Github (do this in your modulepath):

git clone wmi_obj


This module defines two types: wmi_obj and wmi_class_purge.


This type can be used to create, delete, and change the properties of WMI objects. Uniqueness is determined by namespace, wmiclass, and some combination of props. Since the exact properties that determine uniqueness vary, these parameters are not flagged as namevars; instead the uniqueness keys are determined dynamically based on namespace and class.



Standard ensure.


A name for the resource. This does not set any useful properties, for reasons explained above.


WMI namespace, as would be provided to e.g. powershell's Get-WmiObject -Namespace {namespace}. This will be converted to all lowercase to simplify resource duplication detection.


This is the name of the WMI class, same as you would provide with e.g. powershell's Get-WmiObject -Class {wmiclass}. There are various tools for exploring classes within a namespace (powershell, wbemtest.exe, CIM Studio, etc.). This will be converted to all lowercase to simplify resource duplication detection.


This should be a hash of properties to set on the WMI object. WMI classes can mark a subset of their properties as 'key' properties; these properties must be provided as they are used to uniquely identify the object.

If the WMI object has properties not specified in the hash, they will not be managed, that is, they will be left unchanged for existing objects and will be unset for new objects.

Some WMI objects cannot be created without specifying certain properties even though these properties are not marked as key properties; trying this will give an OLE error on the puppet run.


# This creates an instance of the '__EventFilter' class in the 'root\subscription' namespace. 
# This event will fire whenever a notepad.exe process is launched. 
wmi_obj { 'somename':
  ensure    => present,
  wmiclass  => '__EventFilter',
  namespace => 'root\subscription'
  props     => {
    'name' => '_puppet_guy',
    'eventnamespace' => 'root\cimv2',
    'query' => 'SELECT * FROM __InstanceCreationEvent WHERE TargetInstance ISA "Win32_Process" AND Name="notepad.exe"',
    'querylanguage' => 'WQL'


Using the resources type to purge wmi_obj would be impractical, considering the number of things in WMI. As an alternative, the wmi_class_purge type allows purging of a specific class.


wmiclass (namevar)

This will be set to the title of the resource if not explicitly provided. This parameter is the WMI class name, as in wmi_obj. This will be converted to all lowercase to simplify resource duplication detection.

namespace (namevar)

The namespace, same as in wmi_obj. This will be converted to all lowercase to simplify resource duplication detection.


An optional where clause to filter results. You can, for example, title all puppet managed resources something like _puppet_{somename} and then apply a where filter like Name like "_puppet_%" to purge only puppet created resources. Objects not matching the where filter will be left alone.


This is similar to the where clause filter above. Certain properties, however, cannot be filtered by WQL where clauses and so must be filtered after the query has been performed. This parameter should be a hash, where keys are property names and values are Ruby stringified regular expressions (unfortunately Puppet's regex syntax can be applied only in limited contexts, hence the need for strings). For less than obvious cases (e.g. case insensitivity), craft the regex in a Ruby prompt using /slash/ notation and then call #to_s on the regex to get the string.


# This will remove all instances of '__EventFilter' whose name matches
# '_puppet_%'. 
wmi_class_purge { '__EventFilter':
  namespace => 'root\subscription',
  where     => 'Name like "_puppet_%"',

# This will remove all instances of '__FilterToConsumerBinding' that
# have a Filter property matching The provided regex. This type of
# filter cannot be performed with a 'where' filter (WMI doesn't allow it).
wmi_class_purge { '__FilterToConsumerBinding':
  namespace  => 'root\subscription',
  postfilter => {
    'Filter' => '(?i-mix:\.Name="_puppet_.*"$)'


This module has been tested on 3.2.x and 3.4.x puppet master/agents.