The backslash character, , is used to escape the meaning of characters in a WMI query. This might be used to escape a wildcard character, quotes, or itself. For example, the following WMI query uses a path; each instance of in the path must be escaped:
Get-CimInstance Win32_Process -Filter "ExecutablePath='C:\Windows\Explorer.exe'"
About Win32_Process and the Path property:
The Path property is added to the output from the Win32_Process class by PowerShell. While it appears in the output, the property cannot be used to define a filter, nor can Path be selected using the Property parameter of either Get-CimInstance or Get-WmiObject.
Get-Member shows that it is a ScriptProperty:
Get-CimInstance Win32_Process -Filter "ProcessId=$pid" | Get-Member -Name Path
Get-WmiObject Win32_Process -Filter "ProcessId=$pid" | Get-Member -Name Path
The Path property is added to the output from the Win32_Process class by PowerShell. While it appears in the output, the property cannot be used to define a filter, nor can Path be selected using the Property parameter of either Get-CimInstance or Get-WmiObject.
Get-Member shows that it is a ScriptProperty:
Get-CimInstance Win32_Process -Filter "ProcessId=$pid" | Get-Member -Name Path
Get-WmiObject Win32_Process -Filter "ProcessId=$pid" | Get-Member -Name Path
WQL defines two wildcard characters that can be used with string queries:
- The % (percentage) character matches any number of characters, and is equivalent to using * in a file system path or with the -like operator
- The _ (underscore) character matches a single character and is equivalent to using ? in a filesystem path or with the -like operator
The following query filters the results of Win32_Service, including services with paths starting with a single drive letter and ending with .exe:
Get-CimInstance Win32_Service -Filter 'PathName LIKE "_:\%.exe"'