PowerShell, Scripting, wmi, WQL
comments 6

WMI Query Language (WQL) – Data Queries: References Of

These posts in the form of an ebook now available [download id=”25″ format=”4″]

Here are the links to all articles in this series of posts on WQL.

1. WMI query language – An introduction
2. WMI query language – Keywords and Operators
3. WMI query language – Data Queries: SELECT, FROM, and WHERE
4. WMI query language – Data Queries: Associators Of
5. WMI query language – Data Queries: References Of (this post)
6. WMI query language – Event Queries: Introduction
7. WMI query language – Event Queries: Syntax
8. WMI query language – Event Queries: Intrinsic Events
9. WMI query language – Event Queries: Extrinsic Events
10. WMI query language – Schema queries

Per MSDN documentation, the REFERENCES OF statement

Retrieves all association instances that refer to a particular source instance. The REFERENCES OF statement is similar to the ASSOCIATORS OF statement in its syntax. However, rather than retrieving endpoint instances, it retrieves the intervening association instances.

That is very cryptic for beginners like you and me. So, let us look at an example to understand this.

Win32_Process
If you look at the above diagram (captured from the associations tab of Win32_Process in CIM Studio) and as I showed you in my earlier post, Win32_SessionProcess, in32_NamedJobObjectProcesses, Win32_SystemProcesses are the associator or association classes. Whereas, Win32_Process, Win32_LogonSession, Win32_NamedObject, and Win32_ComputerSystem are the associated classes.

Now, let us go back to the definition. The REFERENCES OF statement retrieves all association instances that refer to a particular source instance. However, it retrieves only the intervening association instances. Again, I will show you an example to explain this.

References of Win32_ProcessIn the above screen capture, you can see the syntax for using REFERENCES OF is exactly same as that of ASSOCIATORS Of. If you closely observe the output, it is more or less same as the associator classes listed in the CIM Studio output. If you look at the properties of each WMI class listed there, you will find “Antecedent”, “Dependent”, “GroupComponent”, and “PartComponent”. These are called references. They can be identified by type ref.

Note: There is no Win32_NamedJobObjectProcesses in the output here and there is an additional CIM_ProcessExecutable. There is a missing link I am trying to find. I will update this soon.

If we had used “Associators of” instead of “References Of”, we would have seen the endpoint class definitions which are Win32_LogonSession, Win32_ComputerSystem, and Win32_NamedJobObject. You can see that in the output here.

Associators of Win32_Process

Similar to Associators Of keyword, you can use the WHERE clause with “References Of” keyword also. There are predefined keywords that you can use with WHERE clause. They are:

REFERENCES OF {ObjectPath} WHERE
ClassDefsOnly
RequiredQualifier = QualifierName
ResultClass = ClassName
Role = PropertyName

We have already seen an example of using ClassDefsOnly. Also, usage of these keywords is similar to what I mentioned an earlier post. This concludes the WQL “Data or Object” queries part of this series. In the next part, we shall look at how to perform event queries and then proceed on to schema queries to end this series. I will also try to put together some “real” world examples for “Associators Of” and “References Of” keywords. Whatever we discussed around these two keywords has been really generic examples and may not have provided lot of insight in to where exactly you can use these.

I hope you find this useful and I am looking for your feedback on how to improve. Thanks again for reading.

Filed under: PowerShell, Scripting, wmi, WQL

by

Ravikanth is a principal engineer and the lead architect for Microsoft and VMware virtualized and hybrid cloud solutions within the Infrastructure Solutions Group at Dell EMC. He is a multi-year recipient of Microsoft Most Valuable Professional (MVP) award in Windows PowerShell (CDM) and Microsoft Azure. Ravikanth is the author of Windows PowerShell Desired State Configuration Revealed (Apress) and leads Bangalore PowerShell and Bangalore IT Pro user groups. He can be seen speaking regularly at local user group events and conferences in India and abroad.