Windows: Read the IP Address of a BMC Board

Most of the Serversystems have a Baseboard Management Controller (BMC) integrated for maintenace and management tasks.

Typical functions are, indepentend from the running operating system:

  • Shutdown and reboot
  • Switch Power On and Off
  • KVM (Keyboard, Video, Mouse) redirection
  • Hardware monitoring
  • USB redirection, connect the local DVD Drive to the Server over a LAN connection
  • and much more…

Usually, the BMC has its own LAN Interface and therefore an own IP Address.

The IP Address of the BMC can be read by the MICROSOFT_IPMI WMI Class in Namespace root/wmi.  Since Server 2008 the WMI IPMI Provider Class is shipped with the operating system. In Windows Server 2003 R2 you must add this manually:

Go to Control Panel, Add/Remove System Components and install the Hardware Management feature under Management and Monitoring Tools.

The advantage of using the Microsoft WMI class is that this works manufacturer indepentent. Means it doesn’t matters wether the BMC, for example, is a Fujitsu iRMC or a HP iLO board.

The following script reads the IP Address, Subnet mask and MAC Address of the first BMC found in the system.

# Get the Class instance
$oIPMI=Get-WmiObject -Namespace root\WMI -Class MICROSOFT_IPMI
# Some constants
# <a title="Microsoft In Band Management" href="" target="_blank">Source</a>
[byte]$BMCResponderAddress = 0x20
[byte]$GetLANInfoCmd = 0x02
[byte]$GetChannelInfoCmd = 0x42
[byte]$SetSystemInfoCmd = 0x58
[byte]$GetSystemInfoCmd = 0x59
[byte]$DefaultLUN = 0x00
[byte]$IPMBProtocolType = 0x01
[byte]$8023LANMediumType = 0x04
[byte]$MaxChannel = 0x0b
[byte]$EncodingAscii = 0x00
[byte]$MaxSysInfoDataSize = 19

If you have administrator rights this works also on a remote machine. Just add the -ComputerName parameter when you get the WMI Class instance

$oIPMI=Get-WmiObject -Namespace root\WMI -Class MICROSOFT_IPMI -ComputerName RemoteComputer

Finding the first LAN Channel

for(;$iLanChannel -le $MaxChannel;$iLanChannel++){
	$oRet=$oIPMI.PSBase.InvokeMethod("RequestResponse",$oMethodParameter,(New-Object System.Management.InvokeMethodOptions))
	if($oRet.ResponseData[2] -eq $8023LANMediumType){

If a LAN Channel is found get the Network parameters

	$oRet=$oIPMI.PSBase.InvokeMethod("RequestResponse",$oMethodParameter,(New-Object System.Management.InvokeMethodOptions))
	write-host ("IP Address:     "+$oRet.ResponseData[2]+"."+$oRet.ResponseData[3]+"."+$oRet.ResponseData[4]+"."+ $oRet.ResponseData[5] )
	$oRet=$oIPMI.PSBase.InvokeMethod("RequestResponse",$oMethodParameter,(New-Object System.Management.InvokeMethodOptions))
	write-host ("Subnet Mask:    "+$oRet.ResponseData[2]+"."+$oRet.ResponseData[3]+"."+$oRet.ResponseData[4]+"."+ $oRet.ResponseData[5] )
	$oRet=$oIPMI.PSBase.InvokeMethod("RequestResponse",$oMethodParameter,(New-Object System.Management.InvokeMethodOptions))
	# Format
	write-host ("MAC Address:    "+("{0:x2}:{1:x2}:{2:x2}:{3:x2}:{4:x2}:{5:x2}" -f $oRet.ResponseData[2], $oRet.ResponseData[3],$oRet.ResponseData[4], $oRet.ResponseData[5], $oRet.ResponseData[6], $oRet.ResponseData[7]))

Have fun

In-Band Management using IPMI and PowerShell

Advertisment to support

Read BMC network parameters
3.1 KiB

2 thoughts on “Windows: Read the IP Address of a BMC Board”

  1. Hi Michael, just wanted to thank you for this post, it’s fantastic and it helped me a great deal when trying to cleanup and standardize our hardware inventory, with this data I was able to break into make/model and start recovering access to the OOBM management homepages, which in turn saves money as we don’t have to reach out to local hands to help us out as often. I blogged about your script and made some edits to make it into a tool my colleagues can use and anyone else can edit as they see fit.

    Once again, thank you, it’s because of people like you that share this information that others like me can move forward.

Leave a Reply

Your email address will not be published.

Time limit is exhausted. Please reload CAPTCHA.