WMI Query

The WMI Query check runs a WQL query on a Windows device and evaluates the number of rows returned. This lets you check almost any state that Windows exposes through WMI, for example automatic-start services that are currently stopped. The check ships for Windows x64 and Windows Arm64, runs the query through PowerShell (Get-CimInstance), and runs every 15 minutes by default. Linux and macOS are not supported. The check only reads data; it does not change anything on the device.

Steps

1. Go to Devices and open the device.
2. Click the Checks tab → Add Check → WMI Query.
3. Enter the WQL query and adjust the namespace and thresholds if needed.
4. Click Add Check.

To assign the check to several devices, use a config package.

Settings

• With the defaults (both thresholds 1) there is no warning tier: a single returned row makes the check Critical. The same applies with Alert when count is low for 0 or 1 rows.
• If the thresholds are in the wrong order, the check swaps them before evaluation: normally the error value sits above the warning value, and below it with Alert when count is low.
• The query has a fixed 30-second time limit. If it takes longer, the check reports a warning without a row count.

Example

With the example query above and the default values, the check turns Critical as soon as at least one automatic-start service is stopped. To only warn for one stopped service and turn Critical from three, set Warning row count to 1 and Error row count to 3.

Results

Both thresholds also trigger on equality. The Error tier corresponds to the Critical status.

The result view shows the number of rows returned.

See also: Set up alerts for a check