8

I was attempting to get disk info of remote machines, including whether or not SMART is enabled on the drive by using the win32_diskdrive class.

This is trickier than I thought. While it's easy enough the read the status property I discovered something interesting in the Capabilities property- namely the value denoting if "SMART Notification" is available. This value will not appear unless the command is run in an elevated security context. So for example if I run (gwmi win32_diskdrive).Capabilities the SMART value (10) does not appear in the array of values yet if I run it in an elevated prompt it does appear. As far as I know you can't run a winrm session in an elevated context (and I'm not interested in cheesy schtasks hacks or psexec).

So then I attempted to map win32_diskdrive to the MSStorageDriver_FailurePredictStatus class. I think I would have to do this anyway because even if SMART appears in the Capabilities property that doesn't necessarily mean its enabled right?

I was mapping the PNPDeviceID property of win32_diskdrive to the InstanceName property of MSStorageDriver_FailurePredictStatus, but now my problem is that I do not think the InstanceName property is unique enough for this to work. For example here is my InstanceName: IDE\DiskST3250312AS_____________________________JC47____\5&350bf0c3&0&0.0.0_0

It shows the interface type (IDE) the model number (ST3250312AS) the firmware version (JC47) what I thought was a unique identifier of some kind (5&350bf0c3&0&0.0.0) then what looks like an index number (_0). When I google 5&350bf0c3&0&0.0.0 it turns up some info on the drive so I don't think this number is unique. That means the the uniqueness is in the index number which is not included in the PNPDeviceID property of the win32_diskdrive class. This is an issue because many of our servers have multiple, identical, disks.

My concern is that MSStorageDriver_FailurePredictStatus would represent multiple disks like this:

IDE\DiskST3250312AS_____________________________JC47____\5&350bf0c3&0&0.0.0_0
IDE\DiskST3250312AS_____________________________JC47____\5&350bf0c3&0&0.0.0_1
IDE\DiskST3250312AS_____________________________JC47____\5&350bf0c3&0&0.0.0_2

And the PNPDeviceID property of win32_diskdrive of all of them would just be IDE\DiskST3250312AS_____________________________JC47____\5&350bf0c3&0&0.0.0

How can I reliably map objects retrieved from win32_diskdrive to MSStorageDriver_FailurePredictStatus or do this another way with powershell via remote sessions?

Edit:

Well it looks like I was over-reacting. When I checked a bunch of servers I found InstanceNames\PNPDeviceIDs like this:

SCSI\Disk&Ven_TOSHIBA&Prod_MBF2600RC\5&354ecb35&0&000200_0
SCSI\Disk&Ven_TOSHIBA&Prod_MBF2600RC\5&354ecb35&0&000300_0

If no one can conclusively confirm this, in a day or so, I will just assume this value actually is unique and mark this as the "answer".

womble
  • 95,029
  • 29
  • 173
  • 228
red888
  • 4,069
  • 16
  • 58
  • 104

2 Answers2

5

"When the road before you splits in two, take a third path..." ~ Telaxian Proverb

Script

This is the script I used to get the SMART data from multiple machines. I've already enabled winrm on the devices used in this example.

$aComputers = Get-Content C:\ComputerSMARTDriveTest.txt

 (Get-WmiObject -ComputerName $aComputers -namespace root\wmi –class MSStorageDriver_FailurePredictStatus -ErrorAction Silentlycontinue |  
    more |
    Select PSComputerName,PredictFailure,Reason,InstanceName |
    Format-Table –Autosize) 

That will get you output like:

PSComputerName PredictFailure Reason InstanceName                                                            
-------------- -------------- ------ ------------                                                            
4CZ1*****              False      0 IDE\DiskHitachi_HTS723225A7A364_________________ECBOA60W\4&35e86db3&0...
2UA0*****              False      0 IDE\DiskST3160318AS_____________________________HP35____\5&5df8cfa&0&...

Script Notes: In the text file I have one hostname listed per line. There are no comma's separating the data. Also, computers which don't have smart enabled drives won't show on the report. You can customize the report with more data options to select, just run a Select * instead of the options I used in the script to see the full dump.

Win32_diskdrive vs MSStorageDriver_FailurePredictStatus

On the question of win32_diskdrive vs MSStorageDriver_FailurePredictStatus properties... The MSStorageDriver_FailurePredictStatus is in the dynasty of MSStorageDriver in the root\wmi namespace (which is separate and distinct from root\cimv2 where the class win32_diskdrve exists) and get's it's non class specific properties from inheritance. The MSStorageDriver gets it's data direct from the hardware (no provider). Where as win32_diskdrive has it's own PNPDeviceID property which uses the provider Win32_DiskDrivePhysicalMedia. Both query the same data from the hardware but do so separately.

That script above where it gets the InstanceName is the same as PNPDeviceID below:

(Get-WmiObject -ComputerName $aComputers -Namespace root\cimv2 -Class win32_diskdrive `
    -ErrorAction Continue |
    more |
    select PNPDeviceID |
    Format-Table -AutoSize)

Conclusion

(gwmi -Namespace root\wmi -Class MSStorageDriver_FailurePredictStatus).InstanceName

Get's the same data as:

(gwmi -Class Win32_DiskDrive).PNPDeviceID

Comment References

This section contains links intended to reference additional information from the comment section of this answer.

Device Tree

Instance IDs

Colyn1337
  • 2,387
  • 2
  • 22
  • 38
  • Just out of curiosity, do you have any idea why "_0" is suffixed on InstanceName property? Initially I thought it was an index number, but as per my edit, I found that appears to not be the case. – red888 Oct 09 '13 at 12:36
  • 1
    That set of data after the hardware ID is the `Device Instance ID` also referred to as *instance-specific-ID*. The PnP manager assigns a unique identifier to each "devnode" in the device tree. Because a devnode can have multiple devices, it indexes them so that they're unique to the PnP manager. This is why you get a *_X* appended to the `Device Instance ID`. I'll edit my original answer with a few links that should help you explore this further, should you choose to do so. – Colyn1337 Oct 09 '13 at 13:28
1

If you connect to the remote WMI namespace using a domain account that is a member of the remote computer's local administrator group, UAC token filtering shouldn't take effect.

When I say connect, I mean by specifying the -computer parameter for Get-WMIObject (sorry, not a fan of aliases - I'm a big fan over readability and maintainability!).

Simon Catlin
  • 5,222
  • 3
  • 16
  • 20
  • Your right I was mistaken. The value does appears with the -computer param, but I also found it unreliable- the SMART value (10) is not present on some machine's disks yet on these same machines MSStorageDriver_FailurePredictStatus reports SMART is active for these same drives. – red888 Oct 09 '13 at 12:50