WQL

WQL stands for Windows Query Language. It is a SQL-like query language used by Windows Management Instrumentation (WMI) to retrieve management data from Windows-based systems and devices. WQL queries operate against WMI classes, which represent real-world management objects such as processes, services, and hardware components. The language is designed to be readable and familiar to users with SQL experience but is specialized for WMI data.

Typical queries use the SELECT statement to specify which properties to return from a WMI class, along with the FROM clause naming the class and an optional WHERE clause to filter results. For example, SELECT Name,ProcessId FROM Win32_Process WHERE Name = 'notepad.exe' retrieves the names and process IDs of running Notepad processes. WQL supports basic comparison operators and logical connectors such as AND, OR, and NOT, and may offer the LIKE operator to match string patterns. The results are WMI objects representing instances of the requested class and properties.

WQL is a read-only query language for WMI data and does not support joins across classes, grouping, or aggregation. It is not intended for large-scale relational queries; its primary purpose is to query management data defined in WMI schemas (CIM classes).

WQL is exposed through various Windows management tools and APIs, including the WMIC command-line utility, PowerShell cmdlets such as Get-WmiObject and Get-CimInstance (which can accept a -Query parameter with a WQL statement), and the WMI SDK for programmatic access. See also Windows Management Instrumentation, WMIC, and Get-WmiObject/Get-CimInstance for practical usage.